5 uidrange="60000:100000"
6 gidrange="60000:100000"
9 gidinrange="nobody" # We expect $uidinrange in this group
10 gidoutrange="daemon" # We expect $uidinrange in this group
15 if ! sysctl -N security.mac.bsdextended >/dev/null 2>&1; then
16 atf_skip "mac_bsdextended(4) support isn't available"
18 if [ $(sysctl -n security.mac.bsdextended.enabled) = "0" ]; then
19 # The kernel module is loaded but disabled. Enable it for the
20 # duration of the test.
21 touch enabled_bsdextended
22 sysctl security.mac.bsdextended.enabled=1
30 [ -c /dev/mdctl ] || atf_skip "no /dev/mdctl to create md devices"
32 || atf_fail "failed to mount md device"
34 md_device=$(mount -p | grep "$PWD/mnt" | awk '{ gsub(/^\/dev\//, "", $1); print $1 }')
35 if [ -z "$md_device" ]; then
36 atf_fail "md device not properly attached to the system"
38 echo $md_device > md_device
42 cat > mnt/test-script.sh <<'EOF'
47 atf_fail "failed to create test script"
50 file1=mnt/test-$uidinrange
51 file2=mnt/test-$uidoutrange
52 command1="sh mnt/test-script.sh $file1"
53 command2="sh mnt/test-script.sh $file2"
56 atf_check -s exit:0 su -m $uidinrange -c "$command1"
58 chown "$uidinrange":"$gidinrange" $file1
66 chown "$uidoutrange":"$gidoutrange" $file2
75 if [ -f md_device ]; then
76 mdconfig -d -u $( cat md_device )
78 if [ -f enabled_bsdextended ]; then
79 sysctl security.mac.bsdextended.enabled=0
83 atf_test_case no_rules cleanup
86 atf_set "require.user" "root"
92 # no rules $uidinrange
93 atf_check -s exit:0 su -fm $uidinrange -c "$command1"
95 # no rules $uidoutrange
96 atf_check -s exit:0 su -fm $uidoutrange -c "$command1"
103 atf_test_case subject_match_on_uid cleanup
104 subject_match_on_uid_head()
106 atf_set "require.user" "root"
108 subject_match_on_uid_body()
112 atf_check -s exit:0 ugidfw set 1 subject uid $uidrange object mode rasx
113 # subject uid in range
114 atf_check -s not-exit:0 -e match:"Permission denied" \
115 su -fm $uidinrange -c "$command1"
117 # subject uid out range
118 atf_check -s exit:0 su -fm $uidoutrange -c "$command1"
121 subject_match_on_uid_cleanup()
126 atf_test_case subject_match_on_gid cleanup
127 subject_match_on_gid_head()
129 atf_set "require.user" "root"
131 subject_match_on_gid_body()
135 atf_check -s exit:0 ugidfw set 1 subject gid $gidrange object mode rasx
137 # subject gid in range
138 atf_check -s not-exit:0 -e match:"Permission denied" \
139 su -fm $uidinrange -c "$command1"
141 # subject gid out range
142 atf_check -s exit:0 su -fm $uidoutrange -c "$command1"
144 subject_match_on_gid_cleanup()
149 atf_test_case subject_match_on_jail cleanup
150 subject_match_on_jail_head()
152 atf_set "require.progs" "jail"
153 atf_set "require.user" "root"
155 subject_match_on_jail_body()
159 atf_expect_fail "this testcase fails (see bug # 205481)"
160 # subject matching jailid
161 jailid=`jail -i / localhost 127.0.0.1 /usr/sbin/daemon -f /bin/sh -c "(sleep 5; touch mnt/test-jail) &"`
162 atf_check -s exit:0 ugidfw set 1 subject jailid $jailid object mode rasx
165 if [ -f mnt/test-jail ]; then
170 # subject nonmatching jailid
171 jailid=`jail -i / localhost 127.0.0.1 /usr/sbin/daemon -f /bin/sh -c "(sleep 5; touch mnt/test-jail) &"`
173 if ! [ -f mnt/test-jail ]; then
177 subject_match_on_jail_cleanup()
182 atf_test_case object_uid cleanup
185 atf_set "require.user" "root"
191 atf_check -s exit:0 ugidfw set 1 subject object uid $uidrange mode rasx
193 # object uid in range
194 atf_check -s not-exit:0 -e match:"Permission denied" \
195 su -fm $uidinrange -c "$command1"
197 # object uid out range
198 atf_check -s exit:0 su -fm $uidinrange -c "$command2"
199 atf_check -s exit:0 ugidfw set 1 subject object uid $uidrange mode rasx
201 # object uid in range (different subject)
202 atf_check -s not-exit:0 -e match:"Permission denied" \
203 su -fm $uidoutrange -c "$command1"
205 # object uid out range (different subject)
206 atf_check -s exit:0 su -fm $uidoutrange -c "$command2"
214 atf_test_case object_gid cleanup
217 atf_set "require.user" "root"
223 atf_check -s exit:0 ugidfw set 1 subject object gid $uidrange mode rasx
225 # object gid in range
226 atf_check -s not-exit:0 -e match:"Permission denied" \
227 su -fm $uidinrange -c "$command1"
229 # object gid out range
230 atf_check -s exit:0 su -fm $uidinrange -c "$command2"
231 # object gid in range (different subject)
232 atf_check -s not-exit:0 -e match:"Permission denied" \
233 su -fm $uidoutrange -c "$command1"
235 # object gid out range (different subject)
236 atf_check -s exit:0 su -fm $uidoutrange -c "$command2"
243 atf_test_case object_filesys cleanup
244 object_filesys_head()
246 atf_set "require.user" "root"
248 object_filesys_body()
252 atf_check -s exit:0 ugidfw set 1 subject uid $uidrange object filesys / mode rasx
253 # object out of filesys
254 atf_check -s exit:0 su -fm $uidinrange -c "$command1"
256 atf_check -s exit:0 ugidfw set 1 subject uid $uidrange object filesys mnt mode rasx
258 atf_check -s not-exit:0 -e match:"Permission denied" \
259 su -fm $uidinrange -c "$command1"
261 object_filesys_cleanup()
266 atf_test_case object_suid cleanup
269 atf_set "require.user" "root"
275 atf_check -s exit:0 ugidfw set 1 subject uid $uidrange object suid mode rasx
277 atf_check -s exit:0 su -fm $uidinrange -c "$command1"
281 atf_check -s not-exit:0 -e match:"Permission denied" \
282 su -fm $uidinrange -c "$command1"
286 object_suid_cleanup()
291 atf_test_case object_sgid cleanup
294 atf_set "require.user" "root"
300 atf_check -s exit:0 ugidfw set 1 subject uid $uidrange object sgid mode rasx
302 atf_check -s exit:0 su -fm $uidinrange -c "$command1"
306 atf_check -s not-exit:0 -e match:"Permission denied" \
307 su -fm $uidinrange -c "$command1"
310 object_sgid_cleanup()
315 atf_test_case object_uid_matches_subject cleanup
316 object_uid_matches_subject_head()
318 atf_set "require.user" "root"
320 object_uid_matches_subject_body()
324 atf_check -s exit:0 ugidfw set 1 subject uid $uidrange object uid_of_subject mode rasx
326 # object uid notmatches subject
327 atf_check -s exit:0 su -fm $uidinrange -c "$command2"
329 # object uid matches subject
330 atf_check -s not-exit:0 -e match:"Permission denied" \
331 su -fm $uidinrange -c "$command1"
333 object_uid_matches_subject_cleanup()
338 atf_test_case object_gid_matches_subject cleanup
339 object_gid_matches_subject_head()
341 atf_set "require.user" "root"
343 object_gid_matches_subject_body()
347 atf_check -s exit:0 ugidfw set 1 subject uid $uidrange object gid_of_subject mode rasx
349 # object gid notmatches subject
350 atf_check -s exit:0 su -fm $uidinrange -c "$command2"
352 # object gid matches subject
353 atf_check -s not-exit:0 -e match:"Permission denied" \
354 su -fm $uidinrange -c "$command1"
357 object_gid_matches_subject_cleanup()
362 atf_test_case object_type cleanup
365 atf_set "require.user" "root"
372 atf_check -s exit:0 ugidfw set 1 subject uid $uidrange object type dbclsp mode rasx
373 atf_check -s exit:0 su -fm $uidinrange -c "$command1"
376 atf_check -s exit:0 ugidfw set 1 subject uid $uidrange object type r mode rasx
377 atf_check -s not-exit:0 -e match:"Permission denied" \
378 su -fm $uidinrange -c "$command1"
380 object_type_cleanup()
385 atf_init_test_cases()
387 atf_add_test_case no_rules
388 atf_add_test_case subject_match_on_uid
389 atf_add_test_case subject_match_on_gid
390 atf_add_test_case subject_match_on_jail
391 atf_add_test_case object_uid
392 atf_add_test_case object_gid
393 atf_add_test_case object_filesys
394 atf_add_test_case object_suid
395 atf_add_test_case object_sgid
396 atf_add_test_case object_uid_matches_subject
397 atf_add_test_case object_gid_matches_subject
398 atf_add_test_case object_type