diff options
Diffstat (limited to 'src/test/test-capability.c')
-rw-r--r-- | src/test/test-capability.c | 160 |
1 files changed, 0 insertions, 160 deletions
diff --git a/src/test/test-capability.c b/src/test/test-capability.c deleted file mode 100644 index f47452ce72..0000000000 --- a/src/test/test-capability.c +++ /dev/null @@ -1,160 +0,0 @@ -/*** - This file is part of systemd - - Copyright 2014 Ronny Chevalier - - systemd is free software; you can redistribute it and/or modify it - under the terms of the GNU Lesser General Public License as published by - the Free Software Foundation; either version 2.1 of the License, or - (at your option) any later version. - - systemd is distributed in the hope that it will be useful, but - WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - Lesser General Public License for more details. - - You should have received a copy of the GNU Lesser General Public License - along with systemd; If not, see <http://www.gnu.org/licenses/>. -***/ - -#include <sys/wait.h> -#include <sys/capability.h> -#include <sys/socket.h> -#include <netinet/in.h> -#include <pwd.h> -#include <unistd.h> - -#include "capability.h" -#include "util.h" -#include "macro.h" - -static uid_t test_uid = -1; -static gid_t test_gid = -1; -// We keep CAP_DAC_OVERRIDE to avoid errors with gcov when doing test coverage -static uint64_t test_flags = 1ULL << CAP_DAC_OVERRIDE; - -static void fork_test(void (*test_func)(void)) { - pid_t pid = 0; - - pid = fork(); - assert_se(pid >= 0); - if (pid == 0) { - test_func(); - exit(0); - } else if (pid > 0) { - int status; - - assert_se(waitpid(pid, &status, 0) > 0); - assert_se(WIFEXITED(status) && WEXITSTATUS(status) == 0); - } -} - -static void show_capabilities(void) { - cap_t caps; - char *text; - - caps = cap_get_proc(); - assert_se(caps); - - text = cap_to_text(caps, NULL); - assert_se(text); - - log_info("Capabilities:%s", text); - cap_free(caps); - cap_free(text); -} - -static int setup_tests(void) { - struct passwd *nobody; - - nobody = getpwnam("nobody"); - if (!nobody) { - log_error_errno(errno, "Could not find nobody user: %m"); - return -EXIT_TEST_SKIP; - } - test_uid = nobody->pw_uid; - test_gid = nobody->pw_gid; - - return 0; -} - -static void test_drop_privileges_keep_net_raw(void) { - int sock; - - sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP); - assert_se(sock >= 0); - safe_close(sock); - - assert_se(drop_privileges(test_uid, test_gid, test_flags | (1ULL << CAP_NET_RAW)) >= 0); - assert_se(getuid() == test_uid); - assert_se(getgid() == test_gid); - show_capabilities(); - - sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP); - assert_se(sock >= 0); - safe_close(sock); -} - -static void test_drop_privileges_dontkeep_net_raw(void) { - int sock; - - sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP); - assert_se(sock >= 0); - safe_close(sock); - - assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0); - assert_se(getuid() == test_uid); - assert_se(getgid() == test_gid); - show_capabilities(); - - sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP); - assert_se(sock < 0); -} - -static void test_drop_privileges_fail(void) { - assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0); - assert_se(getuid() == test_uid); - assert_se(getgid() == test_gid); - - assert_se(drop_privileges(test_uid, test_gid, test_flags) < 0); - assert_se(drop_privileges(0, 0, test_flags) < 0); -} - -static void test_drop_privileges(void) { - fork_test(test_drop_privileges_keep_net_raw); - fork_test(test_drop_privileges_dontkeep_net_raw); - fork_test(test_drop_privileges_fail); -} - -static void test_have_effective_cap(void) { - assert_se(have_effective_cap(CAP_KILL)); - assert_se(have_effective_cap(CAP_CHOWN)); - - assert_se(drop_privileges(test_uid, test_gid, test_flags | (1ULL << CAP_KILL)) >= 0); - assert_se(getuid() == test_uid); - assert_se(getgid() == test_gid); - - assert_se(have_effective_cap(CAP_KILL)); - assert_se(!have_effective_cap(CAP_CHOWN)); -} - -int main(int argc, char *argv[]) { - int r; - - log_parse_environment(); - log_open(); - - if (getuid() != 0) - return EXIT_TEST_SKIP; - - r = setup_tests(); - if (r < 0) - return -r; - - show_capabilities(); - - test_drop_privileges(); - fork_test(test_have_effective_cap); - - return 0; -} |