| // Copyright 2024 The Fuchsia Authors. All rights reserved. |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| #include <errno.h> |
| #include <fcntl.h> |
| #include <grp.h> |
| #include <lib/fit/defer.h> |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <sys/mount.h> |
| #include <sys/prctl.h> |
| #include <sys/stat.h> |
| #include <sys/syscall.h> |
| #include <sys/xattr.h> |
| |
| #include <filesystem> |
| |
| #include <fbl/unique_fd.h> |
| #include <gtest/gtest-spi.h> |
| #include <gtest/gtest.h> |
| #include <linux/capability.h> |
| #include <linux/prctl.h> |
| #include <linux/securebits.h> |
| |
| #include "src/lib/fxl/strings/string_printf.h" |
| #include "src/starnix/tests/syscalls/cpp/capabilities_helper.h" |
| #include "src/starnix/tests/syscalls/cpp/test_helper.h" |
| |
| namespace { |
| |
| struct capability_t { |
| int cap_num; |
| int effective; |
| int permitted; |
| int inheritable; |
| int bounding; |
| int ambient; |
| }; |
| |
| static char kPrintHelperBinary[] = "print_helper"; |
| |
| constexpr size_t kRootUid = 0; |
| constexpr size_t kRootGid = 0; |
| constexpr size_t kUser1Uid = 65533; |
| constexpr size_t kUser1Gid = 65534; |
| |
| // Runs a program with a single argument in a childe process, wiring stdout to a |
| // given file descriptor. Runs the given prelude code inside the child process |
| // before calling execve. |
| testing::AssertionResult RunSimpleProgram(std::function<void()> prelude, std::string program_path, |
| std::string argv1, int stdout_fd = 1) { |
| ::testing::AssertionResult result = ::testing::AssertionSuccess(); |
| |
| pid_t pid = SAFE_SYSCALL(fork()); |
| if (pid == 0) { |
| prelude(); |
| |
| if (stdout_fd != 1) { |
| SAFE_SYSCALL(dup2(stdout_fd, 1)); |
| } |
| |
| char *const argv[] = {const_cast<char *>(program_path.c_str()), |
| const_cast<char *>(argv1.c_str()), nullptr}; |
| char *const envp[] = {nullptr}; |
| |
| SAFE_SYSCALL(execve(program_path.c_str(), argv, envp)); |
| |
| _exit(EXIT_FAILURE); |
| } |
| |
| int wstatus = 0; |
| SAFE_SYSCALL(waitpid(pid, &wstatus, 0)); |
| if (!WIFEXITED(wstatus) || WEXITSTATUS(wstatus) != 0) { |
| result = ::testing::AssertionFailure() |
| << "wait_status: WIFEXITED(wstatus) = " << WIFEXITED(wstatus) |
| << ", WEXITSTATUS(wstatus) = " << WEXITSTATUS(wstatus) |
| << ", WTERMSIG(wstatus) = " << WTERMSIG(wstatus); |
| } |
| |
| return result; |
| } |
| |
| std::string GetTestResourcePath(const std::string &resource) { |
| std::filesystem::path test_file = std::filesystem::path("data/tests/deps") / resource; |
| |
| std::error_code ec; |
| bool file_exists = std::filesystem::exists(test_file, ec); |
| EXPECT_FALSE(ec) << "failed to check if file exists: " << ec; |
| |
| if (!file_exists) { |
| char self_path[PATH_MAX]; |
| realpath("/proc/self/exe", self_path); |
| std::filesystem::path directory = std::filesystem::path(self_path).parent_path(); |
| return directory / resource; |
| } |
| |
| return test_file; |
| } |
| |
| class CapsExecTest : public ::testing::Test { |
| protected: |
| void SetUp() { |
| if (!test_helper::HasSysAdmin()) { |
| GTEST_SKIP() << "Not running with sysadmin capabilities. skipping."; |
| } |
| |
| // The securebits flag should have no bits set. Individual tests can enable |
| // what they use. |
| ASSERT_EQ(SAFE_SYSCALL(prctl(PR_GET_SECUREBITS)), 0); |
| |
| std::error_code ec; |
| std::filesystem::path root = std::filesystem::temp_directory_path(ec); |
| ASSERT_FALSE(ec) << "failed to get temp dir: " << ec; |
| |
| std::string path_template = root / "capexectest.XXXXXX"; |
| std::vector<char> mut_path_template(path_template.size() + 1, '\0'); |
| strncpy(mut_path_template.data(), path_template.c_str(), mut_path_template.size()); |
| |
| char *tmpdir = mkdtemp(mut_path_template.data()); |
| ASSERT_NE(tmpdir, nullptr) << "mkdtemp failed: " << strerror(errno); |
| |
| path_ = std::string(tmpdir); |
| |
| // The test should be able to control the mount flags. |
| SAFE_SYSCALL(mount(nullptr, path_.c_str(), "tmpfs", 0, nullptr)); |
| |
| constexpr int kDirPerms = S_IRWXU | S_IXGRP | S_IXOTH; |
| SAFE_SYSCALL(chmod(path_.c_str(), kDirPerms)); |
| |
| // Copy out the test binary into the temporary directory. |
| std::filesystem::path print_helper_binary = GetTestResourcePath(kPrintHelperBinary); |
| |
| print_helper_ = path_ / kPrintHelperBinary; |
| std::filesystem::copy_file(print_helper_binary.c_str(), print_helper_.c_str(), ec); |
| ASSERT_FALSE(ec) << "failed to copy file: " << ec; |
| |
| SAFE_SYSCALL(chown(print_helper_.c_str(), kUser1Uid, kUser1Gid)); |
| SAFE_SYSCALL(chmod(print_helper_.c_str(), S_IRWXU | S_IXGRP | S_IXOTH)); |
| |
| // The file has no capabilities. |
| ASSERT_EQ(getxattr(print_helper_.c_str(), "security.capability", nullptr, 0), -1); |
| ASSERT_EQ(errno, ENODATA); |
| |
| FILE *fp = fopen("/proc/sys/kernel/cap_last_cap", "r"); |
| ASSERT_NE(fp, nullptr); |
| int n = fscanf(fp, "%d\n", &cap_last_cap_); |
| ASSERT_EQ(n, 1); |
| fclose(fp); |
| } |
| |
| void TearDown() { |
| if (IsSkipped() && !test_helper::HasSysAdmin()) { |
| // We shouldn't run the cleanup step if we skipped the SetUp step. |
| return; |
| } |
| SAFE_SYSCALL(umount2(path_.c_str(), MNT_DETACH)); |
| |
| std::error_code ec; |
| std::filesystem::remove_all(path_, ec); |
| ASSERT_FALSE(ec) << "failed to remove temp dir at " << path_ << ": " << ec; |
| } |
| |
| testing::AssertionResult RunPrintSecurebits(std::function<void()> prelude, |
| unsigned int *securebits) { |
| fbl::unique_fd stdout_fd(SAFE_SYSCALL(test_helper::MemFdCreate("output", 0))); |
| |
| testing::AssertionResult result = |
| RunSimpleProgram(prelude, print_helper_, "securebits", stdout_fd.get()); |
| |
| if (!result) { |
| return result; |
| } |
| |
| SAFE_SYSCALL(lseek(stdout_fd.get(), 0, SEEK_SET)); |
| FILE *fp = fdopen(stdout_fd.release(), "r"); |
| if (fp == nullptr) { |
| return ::testing::AssertionFailure() << "failed to open output fd\n" << strerror(errno); |
| } |
| auto cleanup = fit::defer([fp]() { SAFE_SYSCALL(fclose(fp)); }); |
| |
| if (fscanf(fp, "%x\n", securebits) != 1) { |
| return ::testing::AssertionFailure() << "failed to read securebits\n"; |
| } |
| return ::testing::AssertionSuccess(); |
| } |
| |
| testing::AssertionResult RunPrintCapabilities(std::function<void()> prelude, |
| std::vector<capability_t> &capabilities) { |
| capabilities.clear(); |
| ::testing::AssertionResult result = ::testing::AssertionSuccess(); |
| fbl::unique_fd stdout_fd(SAFE_SYSCALL(test_helper::MemFdCreate("output", 0))); |
| |
| result = RunSimpleProgram(prelude, print_helper_, "capabilities", stdout_fd.get()); |
| if (!result) { |
| return result; |
| } |
| |
| SAFE_SYSCALL(lseek(stdout_fd.get(), 0, SEEK_SET)); |
| FILE *fp = fdopen(stdout_fd.release(), "r"); |
| if (fp == nullptr) { |
| return ::testing::AssertionFailure() << "failed to open output fd\n" << strerror(errno); |
| } |
| auto cleanup = fit::defer([fp]() { SAFE_SYSCALL(fclose(fp)); }); |
| |
| char buf[100] = {0}; |
| int n = fscanf(fp, "%99s\n", &buf[0]); |
| if (n != 1) { |
| return ::testing::AssertionFailure() << "failed to read result header"; |
| } |
| |
| if (strcmp(buf, "CAP_NUM,EFFECTIVE,PERMITTED,INHERITABLE,BOUNDING,AMBIENT") != 0) { |
| return ::testing::AssertionFailure() << "Header doesn't match expected value. Got: " << buf; |
| } |
| |
| for (int expected_cap = 0; expected_cap <= cap_last_cap_; expected_cap++) { |
| capability_t capability{}; |
| int n = fscanf(fp, "%d,%d,%d,%d,%d,%d\n", &capability.cap_num, &capability.effective, |
| &capability.permitted, &capability.inheritable, &capability.bounding, |
| &capability.ambient); |
| if (n != 6) { |
| return ::testing::AssertionFailure() << "invalid row"; |
| } |
| |
| if (capability.cap_num != expected_cap) { |
| return ::testing::AssertionFailure() << "Unexpected capability number"; |
| } |
| |
| auto is_valid = [](int val) { return (val == 1 || val == 0); }; |
| if (!is_valid(capability.effective) || !is_valid(capability.permitted) || |
| !is_valid(capability.inheritable) || !is_valid(capability.bounding) || |
| !is_valid(capability.ambient)) { |
| return ::testing::AssertionFailure() << "Invalid capability value"; |
| } |
| capabilities.push_back(capability); |
| } |
| |
| return result; |
| } |
| |
| std::filesystem::path path_; |
| std::filesystem::path print_helper_; |
| int cap_last_cap_; |
| }; |
| |
| } // namespace |
| |
| TEST_F(CapsExecTest, SecurebitKeepCapsIsNotPreservedAcrossExecve) { |
| unsigned int securebits; |
| |
| ASSERT_TRUE(RunPrintSecurebits([]() { SAFE_SYSCALL(prctl(PR_SET_SECUREBITS, SECBIT_KEEP_CAPS)); }, |
| &securebits)); |
| |
| EXPECT_NE(securebits & SECBIT_KEEP_CAPS, static_cast<unsigned int>(SECBIT_KEEP_CAPS)); |
| } |
| |
| TEST_F(CapsExecTest, SecurebitFlagsArePreservedAcrossExecve) { |
| unsigned int securebits; |
| |
| constexpr unsigned int kSecurebitInheritableFlags = |
| SECBIT_NO_SETUID_FIXUP | SECBIT_NO_SETUID_FIXUP_LOCKED | SECBIT_NOROOT | |
| SECBIT_NOROOT_LOCKED | SECBIT_NO_CAP_AMBIENT_RAISE | SECBIT_NO_CAP_AMBIENT_RAISE_LOCKED; |
| ASSERT_TRUE(RunPrintSecurebits( |
| []() { SAFE_SYSCALL(prctl(PR_SET_SECUREBITS, kSecurebitInheritableFlags)); }, &securebits)); |
| |
| EXPECT_EQ(securebits & kSecurebitInheritableFlags, kSecurebitInheritableFlags); |
| } |
| |
| TEST_F(CapsExecTest, NonRootExecutingRegularBinaryClearsPermittedAndEffectiveCaps) { |
| // If a non-root user executes a regular binary, without file capabilities, |
| // it should clear its permitted and effective capabilities. |
| std::vector<capability_t> capabilities; |
| |
| ASSERT_TRUE(RunPrintCapabilities( |
| []() { |
| // We want to keep capabilities after switching uids. |
| SAFE_SYSCALL(prctl(PR_SET_SECUREBITS, SECBIT_KEEP_CAPS)); |
| |
| // After switching to a non-root uid, with the secbits |
| // all our effective capabilities are cleaned, but the permitted are |
| // still there. |
| SAFE_SYSCALL(setresuid(kUser1Uid, kUser1Uid, kUser1Gid)); |
| |
| // CAP_AUDIT_READ will be effective and permitted. |
| test_helper::SetCapabilityEffective(CAP_AUDIT_READ); |
| |
| // CAP_AUDIT_WRITE will be effective, permitted, and inheritable. |
| test_helper::SetCapabilityEffective(CAP_AUDIT_WRITE); |
| test_helper::SetCapabilityInheritable(CAP_AUDIT_WRITE); |
| }, |
| capabilities)); |
| |
| for (const auto &capability : capabilities) { |
| EXPECT_EQ(capability.effective, 0); |
| EXPECT_EQ(capability.permitted, 0); |
| } |
| } |
| |
| TEST_F(CapsExecTest, RootExecutingRegularBinaryGetsAllCapabilitiesBack) { |
| // A program with euid root will get all capabilities back when it executes a |
| // regular binary. |
| std::vector<capability_t> capabilities; |
| |
| ASSERT_TRUE(RunPrintCapabilities( |
| [&]() { |
| // This test doesn't care about CAP_SYS_ADMIN, it only cares about |
| // having the root uid. |
| SAFE_SYSCALL(setresuid(kRootUid, kRootUid, kRootUid)); |
| |
| // We expect to have all bounding capabilities set. |
| for (int cap = 0; cap <= cap_last_cap_; cap++) { |
| ASSERT_TRUE(test_helper::HasCapabilityBounding(cap)); |
| } |
| |
| // Disable one: this should not be enabled after execve. |
| test_helper::UnsetCapabilityBounding(CAP_AUDIT_READ); |
| |
| test_helper::DropAllCapabilities(); |
| test_helper::DropAllAmbientCapabilities(); |
| }, |
| capabilities)); |
| |
| for (int cap = 0; cap <= cap_last_cap_; cap++) { |
| if (cap == CAP_AUDIT_READ) { |
| continue; |
| } |
| |
| EXPECT_EQ(capabilities[cap].effective, 1); |
| EXPECT_EQ(capabilities[cap].permitted, 1); |
| EXPECT_EQ(capabilities[cap].inheritable, 0); |
| EXPECT_EQ(capabilities[cap].bounding, 1); |
| EXPECT_EQ(capabilities[cap].ambient, 0); |
| } |
| |
| // The one we removed from the bounding set was not added. |
| EXPECT_EQ(capabilities[CAP_AUDIT_READ].effective, 0); |
| EXPECT_EQ(capabilities[CAP_AUDIT_READ].permitted, 0); |
| EXPECT_EQ(capabilities[CAP_AUDIT_READ].inheritable, 0); |
| EXPECT_EQ(capabilities[CAP_AUDIT_READ].bounding, 0); |
| EXPECT_EQ(capabilities[CAP_AUDIT_READ].ambient, 0); |
| } |
| |
| TEST_F(CapsExecTest, ChangingFromRootUidDropsAllCapabilities) { |
| test_helper::ForkHelper helper; |
| |
| ASSERT_EQ(geteuid(), kRootUid); |
| helper.RunInForkedProcess([&]() { |
| // Changing from a root uid to a non-root uid drops all capabilities. |
| SAFE_SYSCALL(setresuid(kUser1Uid, kUser1Uid, kUser1Uid)); |
| |
| for (int cap = 0; cap <= cap_last_cap_; cap++) { |
| EXPECT_TRUE(test_helper::HasCapabilityBounding(cap)); |
| EXPECT_FALSE(test_helper::HasCapabilityAmbient(cap)); |
| EXPECT_FALSE(test_helper::HasCapabilityEffective(cap)); |
| EXPECT_FALSE(test_helper::HasCapabilityPermitted(cap)); |
| EXPECT_FALSE(test_helper::HasCapabilityInheritable(cap)); |
| } |
| }); |
| } |
| |
| TEST_F(CapsExecTest, ChangingFromRootUidWithKeepCapsDropsAllEffectiveCapabilities) { |
| test_helper::ForkHelper helper; |
| |
| ASSERT_EQ(geteuid(), kRootUid); |
| helper.RunInForkedProcess([&]() { |
| SAFE_SYSCALL(prctl(PR_SET_SECUREBITS, SECBIT_KEEP_CAPS)); |
| // With SECBIT_KEEP_CAPS, changing from a root euid to a non-root euid drops all effective |
| // capabilities. |
| SAFE_SYSCALL(setresuid(kUser1Uid, kUser1Uid, kUser1Uid)); |
| |
| for (int cap = 0; cap <= cap_last_cap_; cap++) { |
| EXPECT_TRUE(test_helper::HasCapabilityBounding(cap)); |
| EXPECT_FALSE(test_helper::HasCapabilityAmbient(cap)); |
| EXPECT_FALSE(test_helper::HasCapabilityEffective(cap)); |
| EXPECT_TRUE(test_helper::HasCapabilityPermitted(cap)); |
| EXPECT_FALSE(test_helper::HasCapabilityInheritable(cap)); |
| } |
| }); |
| } |
| |
| TEST_F(CapsExecTest, ChangingFromRootUidWithNoFixupSetuidKeepsCapabilities) { |
| test_helper::ForkHelper helper; |
| |
| ASSERT_EQ(geteuid(), kRootUid); |
| helper.RunInForkedProcess([&]() { |
| SAFE_SYSCALL(prctl(PR_SET_SECUREBITS, SECBIT_NO_SETUID_FIXUP)); |
| // With SECBIT_NO_SETUID_FIXUP, capabilities don't change when changing uids. |
| SAFE_SYSCALL(setresuid(kUser1Uid, kUser1Uid, kUser1Uid)); |
| |
| for (int cap = 0; cap <= cap_last_cap_; cap++) { |
| EXPECT_TRUE(test_helper::HasCapabilityBounding(cap)); |
| EXPECT_FALSE(test_helper::HasCapabilityAmbient(cap)); |
| EXPECT_TRUE(test_helper::HasCapabilityEffective(cap)); |
| EXPECT_TRUE(test_helper::HasCapabilityPermitted(cap)); |
| EXPECT_FALSE(test_helper::HasCapabilityInheritable(cap)); |
| } |
| }); |
| } |
| |
| TEST_F(CapsExecTest, RegularUserExecutingSUIDRootGetsAllCapabilities) { |
| /* |
| When a process with nonzero UIDs execves a set-user-ID root program |
| that does not have capabilities attached, the calculation of the permitted |
| and effective capabilities is as follows: |
| |
| P'(permitted) = P(inheritable) | P(bounding) |
| P'(effective) = P'(permitted) |
| */ |
| std::vector<capability_t> capabilities; |
| |
| SAFE_SYSCALL(chown(print_helper_.c_str(), kRootUid, kRootGid)); |
| SAFE_SYSCALL(chmod(print_helper_.c_str(), S_ISUID | S_IXOTH | S_IRWXU)); |
| |
| ASSERT_TRUE(RunPrintCapabilities( |
| [&]() { |
| SAFE_SYSCALL(setresgid(kUser1Gid, kUser1Gid, kUser1Gid)); |
| SAFE_SYSCALL(setgroups(0, nullptr)); |
| |
| // Will not drop permitted capabilities. |
| SAFE_SYSCALL(prctl(PR_SET_SECUREBITS, SECBIT_KEEP_CAPS)); |
| SAFE_SYSCALL(setresuid(kUser1Uid, kUser1Uid, kUser1Uid)); |
| |
| test_helper::SetCapabilityEffective(CAP_SETPCAP); |
| |
| // Leave only CAP_SETPCAP in effective capabilities. |
| for (int cap = 0; cap < cap_last_cap_; cap++) { |
| if (cap == CAP_SETPCAP) { |
| continue; |
| } |
| test_helper::UnsetCapabilityEffective(cap); |
| test_helper::UnsetCapabilityPermitted(cap); |
| test_helper::UnsetCapabilityInheritable(cap); |
| test_helper::UnsetCapabilityAmbient(cap); |
| } |
| |
| // CAP_SYSLOG will be in the bounding set but not in inheritable. |
| ASSERT_TRUE(test_helper::HasCapabilityBounding(CAP_SYSLOG)); |
| ASSERT_FALSE(test_helper::HasCapabilityInheritable(CAP_SYSLOG)); |
| |
| // CAP_AUDIT_READ will not be in bounding nor in inheritable. |
| test_helper::UnsetCapabilityBounding(CAP_AUDIT_READ); |
| |
| // CAP_AUDIT_CONTROL will be both inheritable and bounding. |
| test_helper::SetCapabilityInheritable(CAP_AUDIT_CONTROL); |
| |
| // CAP_AUDIT_WRITE will be inheritable but not in bounding. |
| test_helper::SetCapabilityInheritable(CAP_AUDIT_WRITE); |
| test_helper::UnsetCapabilityBounding(CAP_AUDIT_WRITE); |
| |
| test_helper::UnsetCapabilityEffective(CAP_SETPCAP); |
| test_helper::UnsetCapabilityPermitted(CAP_SETPCAP); |
| test_helper::UnsetCapabilityInheritable(CAP_SETPCAP); |
| test_helper::UnsetCapabilityAmbient(CAP_SETPCAP); |
| }, |
| capabilities)); |
| |
| EXPECT_EQ(capabilities[CAP_SYSLOG].effective, 1); |
| EXPECT_EQ(capabilities[CAP_SYSLOG].permitted, 1); |
| EXPECT_EQ(capabilities[CAP_SYSLOG].inheritable, 0); |
| EXPECT_EQ(capabilities[CAP_SYSLOG].bounding, 1); |
| EXPECT_EQ(capabilities[CAP_SYSLOG].ambient, 0); |
| |
| EXPECT_EQ(capabilities[CAP_AUDIT_READ].effective, 0); |
| EXPECT_EQ(capabilities[CAP_AUDIT_READ].permitted, 0); |
| EXPECT_EQ(capabilities[CAP_AUDIT_READ].inheritable, 0); |
| EXPECT_EQ(capabilities[CAP_AUDIT_READ].bounding, 0); |
| EXPECT_EQ(capabilities[CAP_AUDIT_READ].ambient, 0); |
| |
| EXPECT_EQ(capabilities[CAP_AUDIT_WRITE].effective, 1); |
| EXPECT_EQ(capabilities[CAP_AUDIT_WRITE].permitted, 1); |
| EXPECT_EQ(capabilities[CAP_AUDIT_WRITE].inheritable, 1); |
| EXPECT_EQ(capabilities[CAP_AUDIT_WRITE].bounding, 0); |
| EXPECT_EQ(capabilities[CAP_AUDIT_WRITE].ambient, 0); |
| |
| EXPECT_EQ(capabilities[CAP_AUDIT_CONTROL].effective, 1); |
| EXPECT_EQ(capabilities[CAP_AUDIT_CONTROL].permitted, 1); |
| EXPECT_EQ(capabilities[CAP_AUDIT_CONTROL].inheritable, 1); |
| EXPECT_EQ(capabilities[CAP_AUDIT_CONTROL].bounding, 1); |
| EXPECT_EQ(capabilities[CAP_AUDIT_CONTROL].ambient, 0); |
| } |
| |
| void SetUpCapabilities(capability_t cap) { |
| test_helper::SetCapabilityEffective(CAP_SETPCAP); |
| int cap_num = cap.cap_num; |
| |
| test_helper::SetCapabilityEffective(cap_num); |
| test_helper::SetCapabilityPermitted(cap_num); |
| test_helper::SetCapabilityInheritable(cap_num); |
| test_helper::SetCapabilityAmbient(cap_num); |
| |
| if (cap.effective == 0) { |
| test_helper::UnsetCapabilityEffective(cap_num); |
| } |
| if (cap.permitted == 0) { |
| test_helper::UnsetCapabilityPermitted(cap_num); |
| } |
| if (cap.inheritable == 0) { |
| test_helper::UnsetCapabilityInheritable(cap_num); |
| } |
| if (cap.ambient == 0) { |
| test_helper::UnsetCapabilityAmbient(cap_num); |
| } |
| if (cap.bounding == 0) { |
| test_helper::UnsetCapabilityBounding(cap_num); |
| } |
| |
| EXPECT_EQ(test_helper::HasCapabilityEffective(cap_num), cap.effective); |
| EXPECT_EQ(test_helper::HasCapabilityPermitted(cap_num), cap.permitted); |
| EXPECT_EQ(test_helper::HasCapabilityInheritable(cap_num), cap.inheritable); |
| EXPECT_EQ(test_helper::HasCapabilityAmbient(cap_num), cap.ambient); |
| EXPECT_EQ(test_helper::HasCapabilityBounding(cap_num), cap.bounding); |
| } |
| |
| TEST(CapsTest, PermittedCapabilitiesCannotBeRegained) { |
| if (!test_helper::HasSysAdmin()) { |
| GTEST_SKIP() << "Not running with sysadmin capabilities. skipping."; |
| } |
| |
| std::vector<capability_t> caps; |
| |
| // Capabilities combinations that don't have the permitted bit. |
| caps.push_back({CAP_AUDIT_READ, 0, 0, 0, 0, 0}); |
| caps.push_back({CAP_AUDIT_READ, 0, 0, 0, 1, 0}); |
| caps.push_back({CAP_AUDIT_READ, 0, 0, 1, 0, 0}); |
| caps.push_back({CAP_AUDIT_READ, 0, 0, 1, 1, 0}); |
| |
| test_helper::ForkHelper helper; |
| for (const auto &cap : caps) { |
| helper.RunInForkedProcess([cap]() { |
| SetUpCapabilities(cap); |
| EXPECT_NONFATAL_FAILURE(test_helper::SetCapabilityPermitted(cap.cap_num), |
| "Operation not permitted"); |
| }); |
| EXPECT_TRUE(helper.WaitForChildren()); |
| } |
| } |
| |
| TEST(CapsTest, PermittedCapabilitiesCannotBeDroppedIfTheyAreEffective) { |
| if (!test_helper::HasSysAdmin()) { |
| GTEST_SKIP() << "Not running with sysadmin capabilities. skipping."; |
| } |
| |
| std::vector<capability_t> caps; |
| |
| // Capabilities combinations that have effective and permitted bits. |
| caps.push_back({CAP_AUDIT_READ, 1, 1, 0, 0, 0}); |
| caps.push_back({CAP_AUDIT_READ, 1, 1, 1, 0, 0}); |
| caps.push_back({CAP_AUDIT_READ, 1, 1, 0, 1, 0}); |
| caps.push_back({CAP_AUDIT_READ, 1, 1, 1, 1, 0}); |
| caps.push_back({CAP_AUDIT_READ, 1, 1, 1, 1, 1}); |
| |
| test_helper::ForkHelper helper; |
| for (const auto &cap : caps) { |
| helper.RunInForkedProcess([cap]() { |
| SetUpCapabilities(cap); |
| EXPECT_NONFATAL_FAILURE(test_helper::UnsetCapabilityPermitted(cap.cap_num), |
| "Operation not permitted"); |
| }); |
| EXPECT_TRUE(helper.WaitForChildren()); |
| } |
| } |
| |
| TEST(CapsTest, CannotSetEffectiveCapsIfNotPermitted) { |
| // Tests that you cannot set a capability as effective if it's not permitted. |
| if (!test_helper::HasSysAdmin()) { |
| GTEST_SKIP() << "Not running with sysadmin capabilities. skipping."; |
| } |
| |
| std::vector<capability_t> test_cases; |
| |
| test_cases.push_back({CAP_AUDIT_READ, 0, 0, 0, 0, 0}); |
| test_cases.push_back({CAP_AUDIT_READ, 0, 0, 0, 1, 0}); |
| test_cases.push_back({CAP_AUDIT_READ, 0, 0, 1, 0, 0}); |
| test_cases.push_back({CAP_AUDIT_READ, 0, 0, 1, 1, 0}); |
| |
| test_helper::ForkHelper helper; |
| |
| for (const auto &test_case : test_cases) { |
| helper.RunInForkedProcess([test_case]() { |
| SetUpCapabilities(test_case); |
| EXPECT_NONFATAL_FAILURE(test_helper::SetCapabilityEffective(CAP_AUDIT_READ), "SYS_capset"); |
| EXPECT_FALSE(test_helper::HasCapabilityEffective(CAP_AUDIT_READ)); |
| }); |
| EXPECT_TRUE(helper.WaitForChildren()); |
| } |
| } |
| |
| TEST(CapsTest, AmbientCapabilitiesRequirePermittedAndInheritable) { |
| // Tests that ambient capabilities will be unset if inheritable or permitted |
| // are unset. |
| if (!test_helper::HasSysAdmin()) { |
| GTEST_SKIP() << "Not running with sysadmin capabilities. skipping."; |
| } |
| |
| struct test_case_t { |
| capability_t caps; |
| const char *failure; |
| }; |
| |
| std::vector<test_case_t> test_cases; |
| |
| test_cases.push_back({{CAP_AUDIT_READ, 0, 0, 0, 0, 1}, "HasCapabilityAmbient"}); |
| test_cases.push_back({{CAP_AUDIT_READ, 0, 0, 0, 1, 1}, "HasCapabilityAmbient"}); |
| test_cases.push_back({{CAP_AUDIT_READ, 0, 0, 1, 0, 1}, "HasCapabilityAmbient"}); |
| test_cases.push_back({{CAP_AUDIT_READ, 0, 0, 1, 1, 1}, "HasCapabilityAmbient"}); |
| test_cases.push_back({{CAP_AUDIT_READ, 0, 1, 0, 0, 1}, "HasCapabilityAmbient"}); |
| test_cases.push_back({{CAP_AUDIT_READ, 0, 1, 0, 1, 1}, "HasCapabilityAmbient"}); |
| test_cases.push_back({{CAP_AUDIT_READ, 1, 1, 0, 0, 1}, "HasCapabilityAmbient"}); |
| test_cases.push_back({{CAP_AUDIT_READ, 1, 1, 0, 1, 1}, "HasCapabilityAmbient"}); |
| |
| test_helper::ForkHelper helper; |
| |
| for (const auto &test_case : test_cases) { |
| SCOPED_TRACE(fxl::StringPrintf("(Eff Per Inh Bnd Amb) (%d %d %d %d %d)", |
| test_case.caps.effective, test_case.caps.permitted, |
| test_case.caps.inheritable, test_case.caps.bounding, |
| test_case.caps.ambient)); |
| helper.RunInForkedProcess([test_case]() { |
| EXPECT_NONFATAL_FAILURE(SetUpCapabilities(test_case.caps), test_case.failure); |
| }); |
| EXPECT_TRUE(helper.WaitForChildren()); |
| } |
| } |
| |
| TEST_F(CapsExecTest, NonRootUserExecutingNonSUIDProgram) { |
| std::vector<capability_t> starting_caps; |
| std::vector<capability_t> expected_caps; |
| |
| // Effective Permitted Inheritable Bounding Ambient |
| // Ef Pe In Bn Am |
| starting_caps.push_back({CAP_AUDIT_READ, 0, 0, 0, 0, 0}); |
| expected_caps.push_back({CAP_AUDIT_READ, 0, 0, 0, 0, 0}); |
| |
| // NOT POSSIBLE 0, 0, 0, 0, 1 |
| |
| starting_caps.push_back({CAP_AUDIT_READ, 0, 0, 0, 1, 0}); |
| expected_caps.push_back({CAP_AUDIT_READ, 0, 0, 0, 1, 0}); |
| |
| // NOT POSSIBLE 0, 0, 0, 1, 1 |
| |
| starting_caps.push_back({CAP_AUDIT_READ, 0, 0, 1, 0, 0}); |
| expected_caps.push_back({CAP_AUDIT_READ, 0, 0, 1, 0, 0}); |
| |
| // NOT POSSIBLE 0, 0, 1, 0, 1 |
| |
| starting_caps.push_back({CAP_AUDIT_READ, 0, 0, 1, 1, 0}); |
| expected_caps.push_back({CAP_AUDIT_READ, 0, 0, 1, 1, 0}); |
| |
| // NOT POSSIBLE 0, 0, 1, 1, 1 |
| |
| starting_caps.push_back({CAP_AUDIT_READ, 0, 1, 0, 0, 0}); |
| expected_caps.push_back({CAP_AUDIT_READ, 0, 0, 0, 0, 0}); |
| |
| // NOT POSSIBLE 0, 1, 0, 0, 1 |
| |
| starting_caps.push_back({CAP_AUDIT_READ, 0, 1, 0, 1, 0}); |
| expected_caps.push_back({CAP_AUDIT_READ, 0, 0, 0, 1, 0}); |
| |
| // NOT POSSIBLE 0, 1, 0, 1, 1 |
| |
| starting_caps.push_back({CAP_AUDIT_READ, 0, 1, 1, 0, 0}); |
| expected_caps.push_back({CAP_AUDIT_READ, 0, 0, 1, 0, 0}); |
| |
| starting_caps.push_back({CAP_AUDIT_READ, 0, 1, 1, 0, 1}); |
| expected_caps.push_back({CAP_AUDIT_READ, 1, 1, 1, 0, 1}); |
| |
| starting_caps.push_back({CAP_AUDIT_READ, 0, 1, 1, 1, 0}); |
| expected_caps.push_back({CAP_AUDIT_READ, 0, 0, 1, 1, 0}); |
| |
| starting_caps.push_back({CAP_AUDIT_READ, 0, 1, 1, 1, 1}); |
| expected_caps.push_back({CAP_AUDIT_READ, 1, 1, 1, 1, 1}); |
| |
| // NOT POSSIBLE 1, 0, 0, 0, 0 |
| // NOT POSSIBLE 1, 0, 0, 0, 1 |
| // NOT POSSIBLE 1, 0, 0, 1, 0 |
| // NOT POSSIBLE 1, 0, 0, 1, 1 |
| // NOT POSSIBLE 1, 0, 1, 0, 0 |
| // NOT POSSIBLE 1, 0, 1, 0, 1 |
| // NOT POSSIBLE 1, 0, 1, 1, 0 |
| // NOT POSSIBLE 1, 0, 1, 1, 1 |
| |
| starting_caps.push_back({CAP_AUDIT_READ, 1, 1, 0, 0, 0}); |
| expected_caps.push_back({CAP_AUDIT_READ, 0, 0, 0, 0, 0}); |
| |
| // NOT POSSIBLE 1, 1, 0, 0, 1 |
| |
| starting_caps.push_back({CAP_AUDIT_READ, 1, 1, 0, 1, 0}); |
| expected_caps.push_back({CAP_AUDIT_READ, 0, 0, 0, 1, 0}); |
| |
| // NOT POSSIBLE 1, 1, 0, 1, 1 |
| |
| starting_caps.push_back({CAP_AUDIT_READ, 1, 1, 1, 0, 0}); |
| expected_caps.push_back({CAP_AUDIT_READ, 0, 0, 1, 0, 0}); |
| |
| starting_caps.push_back({CAP_AUDIT_READ, 1, 1, 1, 0, 1}); |
| expected_caps.push_back({CAP_AUDIT_READ, 1, 1, 1, 0, 1}); |
| |
| starting_caps.push_back({CAP_AUDIT_READ, 1, 1, 1, 1, 0}); |
| expected_caps.push_back({CAP_AUDIT_READ, 0, 0, 1, 1, 0}); |
| |
| starting_caps.push_back({CAP_AUDIT_READ, 1, 1, 1, 1, 1}); |
| expected_caps.push_back({CAP_AUDIT_READ, 1, 1, 1, 1, 1}); |
| |
| for (size_t test_case = 0; test_case < starting_caps.size(); test_case++) { |
| SCOPED_TRACE( |
| fxl::StringPrintf("(Eff Per Inh Bnd Amb) (%d %d %d %d %d) -> (%d %d %d %d %d)", |
| starting_caps[test_case].effective, starting_caps[test_case].permitted, |
| starting_caps[test_case].inheritable, starting_caps[test_case].bounding, |
| starting_caps[test_case].ambient, expected_caps[test_case].effective, |
| expected_caps[test_case].permitted, expected_caps[test_case].inheritable, |
| expected_caps[test_case].bounding, expected_caps[test_case].ambient)); |
| |
| std::vector<capability_t> capabilities; |
| ASSERT_TRUE(RunPrintCapabilities( |
| [&]() { |
| SAFE_SYSCALL(setresgid(kUser1Gid, kUser1Gid, kUser1Gid)); |
| SAFE_SYSCALL(setgroups(0, nullptr)); |
| |
| // Will not drop permitted capabilities. |
| SAFE_SYSCALL(prctl(PR_SET_SECUREBITS, SECBIT_KEEP_CAPS)); |
| SAFE_SYSCALL(setresuid(kUser1Uid, kUser1Uid, kUser1Uid)); |
| SetUpCapabilities(starting_caps[test_case]); |
| // Drop all other capabilities. |
| for (int cap = 0; cap <= cap_last_cap_; cap++) { |
| if (cap == starting_caps[test_case].cap_num) |
| continue; |
| test_helper::UnsetCapabilityEffective(cap); |
| test_helper::UnsetCapabilityPermitted(cap); |
| test_helper::UnsetCapabilityInheritable(cap); |
| test_helper::UnsetCapabilityAmbient(cap); |
| } |
| }, |
| capabilities)); |
| |
| int cap_num = starting_caps[test_case].cap_num; |
| |
| EXPECT_EQ(capabilities[cap_num].effective, expected_caps[test_case].effective); |
| EXPECT_EQ(capabilities[cap_num].permitted, expected_caps[test_case].permitted); |
| EXPECT_EQ(capabilities[cap_num].inheritable, expected_caps[test_case].inheritable); |
| EXPECT_EQ(capabilities[cap_num].bounding, expected_caps[test_case].bounding); |
| EXPECT_EQ(capabilities[cap_num].ambient, expected_caps[test_case].ambient); |
| } |
| } |
