15 #include "capsicum-test.h"
17 // Arguments to use in execve() calls.
18 static char* null_envp[] = {NULL};
20 class Execve : public ::testing::Test {
22 Execve() : exec_fd_(-1) {
23 // We need a program to exec(), but for fexecve() to work in capability
24 // mode that program needs to be statically linked (otherwise ld.so will
25 // attempt to traverse the filesystem to load (e.g.) /lib/libc.so and
27 exec_prog_ = capsicum_test_bindir + "/mini-me";
28 exec_prog_noexec_ = capsicum_test_bindir + "/mini-me.noexec";
29 exec_prog_setuid_ = capsicum_test_bindir + "/mini-me.setuid";
31 exec_fd_ = open(exec_prog_.c_str(), O_RDONLY);
33 fprintf(stderr, "Error! Failed to open %s\n", exec_prog_.c_str());
35 argv_checkroot_[0] = (char*)exec_prog_.c_str();
36 argv_fail_[0] = (char*)exec_prog_.c_str();
37 argv_pass_[0] = (char*)exec_prog_.c_str();
46 char* argv_checkroot_[3] = {nullptr, (char*)"--checkroot", nullptr};
47 char* argv_fail_[3] = {nullptr, (char*)"--fail", nullptr};
48 char* argv_pass_[3] = {nullptr, (char*)"--pass", nullptr};
49 std::string exec_prog_, exec_prog_noexec_, exec_prog_setuid_;
53 class Fexecve : public Execve {
55 Fexecve() : Execve() {}
58 class FexecveWithScript : public Fexecve {
61 Fexecve(), temp_script_filename_(TmpFile("cap_sh_script")) {}
63 void SetUp() override {
64 // First, build an executable shell script
65 int fd = open(temp_script_filename_, O_RDWR|O_CREAT, 0755);
67 const char* contents = "#!/bin/sh\nexit 99\n";
68 EXPECT_OK(write(fd, contents, strlen(contents)));
71 void TearDown() override {
72 (void)::unlink(temp_script_filename_);
75 const char *temp_script_filename_;
78 FORK_TEST_F(Execve, BasicFexecve) {
79 EXPECT_OK(fexecve_(exec_fd_, argv_pass_, null_envp));
80 // Should not reach here, exec() takes over.
81 EXPECT_TRUE(!"fexecve() should never return");
84 FORK_TEST_F(Execve, InCapMode) {
85 EXPECT_OK(cap_enter());
86 EXPECT_OK(fexecve_(exec_fd_, argv_pass_, null_envp));
87 // Should not reach here, exec() takes over.
88 EXPECT_TRUE(!"fexecve() should never return");
91 FORK_TEST_F(Execve, FailWithoutCap) {
92 EXPECT_OK(cap_enter());
93 int cap_fd = dup(exec_fd_);
96 cap_rights_init(&rights, 0);
97 EXPECT_OK(cap_rights_limit(cap_fd, &rights));
98 EXPECT_EQ(-1, fexecve_(cap_fd, argv_fail_, null_envp));
99 EXPECT_EQ(ENOTCAPABLE, errno);
102 FORK_TEST_F(Execve, SucceedWithCap) {
103 EXPECT_OK(cap_enter());
104 int cap_fd = dup(exec_fd_);
107 // TODO(drysdale): would prefer that Linux Capsicum not need all of these
108 // rights -- just CAP_FEXECVE|CAP_READ or CAP_FEXECVE would be preferable.
109 cap_rights_init(&rights, CAP_FEXECVE, CAP_LOOKUP, CAP_READ);
110 EXPECT_OK(cap_rights_limit(cap_fd, &rights));
111 EXPECT_OK(fexecve_(cap_fd, argv_pass_, null_envp));
112 // Should not reach here, exec() takes over.
113 EXPECT_TRUE(!"fexecve() should have succeeded");
116 FORK_TEST_F(Fexecve, ExecutePermissionCheck) {
117 int fd = open(exec_prog_noexec_.c_str(), O_RDONLY);
121 EXPECT_OK(fstat(fd, &data));
122 EXPECT_EQ((mode_t)0, data.st_mode & (S_IXUSR|S_IXGRP|S_IXOTH));
123 EXPECT_EQ(-1, fexecve_(fd, argv_fail_, null_envp));
124 EXPECT_EQ(EACCES, errno);
129 FORK_TEST_F(Fexecve, SetuidIgnored) {
130 if (geteuid() == 0) {
131 TEST_SKIPPED("requires non-root");
134 int fd = open(exec_prog_setuid_.c_str(), O_RDONLY);
136 EXPECT_OK(cap_enter());
139 EXPECT_OK(fstat(fd, &data));
140 EXPECT_EQ((mode_t)S_ISUID, data.st_mode & S_ISUID);
141 EXPECT_OK(fexecve_(fd, argv_checkroot_, null_envp));
142 // Should not reach here, exec() takes over.
143 EXPECT_TRUE(!"fexecve() should have succeeded");
148 FORK_TEST_F(Fexecve, ExecveFailure) {
149 EXPECT_OK(cap_enter());
150 EXPECT_EQ(-1, execve(argv_fail_[0], argv_fail_, null_envp));
151 EXPECT_EQ(ECAPMODE, errno);
154 FORK_TEST_F(FexecveWithScript, CapModeScriptFail) {
157 // Open the script file, with CAP_FEXECVE rights.
158 fd = open(temp_script_filename_, O_RDONLY);
160 cap_rights_init(&rights, CAP_FEXECVE, CAP_READ, CAP_SEEK);
161 EXPECT_OK(cap_rights_limit(fd, &rights));
163 EXPECT_OK(cap_enter()); // Enter capability mode
165 // Attempt fexecve; should fail, because "/bin/sh" is inaccessible.
166 EXPECT_EQ(-1, fexecve_(fd, argv_pass_, null_envp));
170 class Execveat : public Execve {
172 Execveat() : Execve() {}
175 TEST_F(Execveat, NoUpwardTraversal) {
176 char *abspath = realpath(exec_prog_, NULL);
178 getcwd(cwd, sizeof(cwd));
180 int dfd = open(".", O_DIRECTORY|O_RDONLY);
181 pid_t child = fork();
183 EXPECT_OK(cap_enter()); // Enter capability mode.
184 // Can't execveat() an absolute path, even relative to a dfd.
185 EXPECT_SYSCALL_FAIL(ECAPMODE,
186 execveat(AT_FDCWD, abspath, argv_pass_, null_envp, 0));
187 EXPECT_SYSCALL_FAIL(E_NO_TRAVERSE_CAPABILITY,
188 execveat(dfd, abspath, argv_pass_, null_envp, 0));
190 // Can't execveat() a relative path ("../<dir>/./<exe>").
191 char *p = cwd + strlen(cwd);
192 while (*p != '/') p--;
193 char buffer[1024] = "../";
196 strcat(buffer, exec_prog_);
197 EXPECT_SYSCALL_FAIL(E_NO_TRAVERSE_CAPABILITY,
198 execveat(dfd, buffer, argv_pass_, null_envp, 0));
199 exit(HasFailure() ? 99 : 123);
202 EXPECT_EQ(child, waitpid(child, &status, 0));
203 EXPECT_TRUE(WIFEXITED(status)) << "0x" << std::hex << status;
204 EXPECT_EQ(123, WEXITSTATUS(status));