summaryrefslogtreecommitdiff
path: root/src/test/test-capability.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/test/test-capability.c')
-rw-r--r--src/test/test-capability.c160
1 files changed, 0 insertions, 160 deletions
diff --git a/src/test/test-capability.c b/src/test/test-capability.c
deleted file mode 100644
index f47452ce72..0000000000
--- a/src/test/test-capability.c
+++ /dev/null
@@ -1,160 +0,0 @@
-/***
- This file is part of systemd
-
- Copyright 2014 Ronny Chevalier
-
- systemd is free software; you can redistribute it and/or modify it
- under the terms of the GNU Lesser General Public License as published by
- the Free Software Foundation; either version 2.1 of the License, or
- (at your option) any later version.
-
- systemd is distributed in the hope that it will be useful, but
- WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- Lesser General Public License for more details.
-
- You should have received a copy of the GNU Lesser General Public License
- along with systemd; If not, see <http://www.gnu.org/licenses/>.
-***/
-
-#include <sys/wait.h>
-#include <sys/capability.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <pwd.h>
-#include <unistd.h>
-
-#include "capability.h"
-#include "util.h"
-#include "macro.h"
-
-static uid_t test_uid = -1;
-static gid_t test_gid = -1;
-// We keep CAP_DAC_OVERRIDE to avoid errors with gcov when doing test coverage
-static uint64_t test_flags = 1ULL << CAP_DAC_OVERRIDE;
-
-static void fork_test(void (*test_func)(void)) {
- pid_t pid = 0;
-
- pid = fork();
- assert_se(pid >= 0);
- if (pid == 0) {
- test_func();
- exit(0);
- } else if (pid > 0) {
- int status;
-
- assert_se(waitpid(pid, &status, 0) > 0);
- assert_se(WIFEXITED(status) && WEXITSTATUS(status) == 0);
- }
-}
-
-static void show_capabilities(void) {
- cap_t caps;
- char *text;
-
- caps = cap_get_proc();
- assert_se(caps);
-
- text = cap_to_text(caps, NULL);
- assert_se(text);
-
- log_info("Capabilities:%s", text);
- cap_free(caps);
- cap_free(text);
-}
-
-static int setup_tests(void) {
- struct passwd *nobody;
-
- nobody = getpwnam("nobody");
- if (!nobody) {
- log_error_errno(errno, "Could not find nobody user: %m");
- return -EXIT_TEST_SKIP;
- }
- test_uid = nobody->pw_uid;
- test_gid = nobody->pw_gid;
-
- return 0;
-}
-
-static void test_drop_privileges_keep_net_raw(void) {
- int sock;
-
- sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
- assert_se(sock >= 0);
- safe_close(sock);
-
- assert_se(drop_privileges(test_uid, test_gid, test_flags | (1ULL << CAP_NET_RAW)) >= 0);
- assert_se(getuid() == test_uid);
- assert_se(getgid() == test_gid);
- show_capabilities();
-
- sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
- assert_se(sock >= 0);
- safe_close(sock);
-}
-
-static void test_drop_privileges_dontkeep_net_raw(void) {
- int sock;
-
- sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
- assert_se(sock >= 0);
- safe_close(sock);
-
- assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0);
- assert_se(getuid() == test_uid);
- assert_se(getgid() == test_gid);
- show_capabilities();
-
- sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
- assert_se(sock < 0);
-}
-
-static void test_drop_privileges_fail(void) {
- assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0);
- assert_se(getuid() == test_uid);
- assert_se(getgid() == test_gid);
-
- assert_se(drop_privileges(test_uid, test_gid, test_flags) < 0);
- assert_se(drop_privileges(0, 0, test_flags) < 0);
-}
-
-static void test_drop_privileges(void) {
- fork_test(test_drop_privileges_keep_net_raw);
- fork_test(test_drop_privileges_dontkeep_net_raw);
- fork_test(test_drop_privileges_fail);
-}
-
-static void test_have_effective_cap(void) {
- assert_se(have_effective_cap(CAP_KILL));
- assert_se(have_effective_cap(CAP_CHOWN));
-
- assert_se(drop_privileges(test_uid, test_gid, test_flags | (1ULL << CAP_KILL)) >= 0);
- assert_se(getuid() == test_uid);
- assert_se(getgid() == test_gid);
-
- assert_se(have_effective_cap(CAP_KILL));
- assert_se(!have_effective_cap(CAP_CHOWN));
-}
-
-int main(int argc, char *argv[]) {
- int r;
-
- log_parse_environment();
- log_open();
-
- if (getuid() != 0)
- return EXIT_TEST_SKIP;
-
- r = setup_tests();
- if (r < 0)
- return -r;
-
- show_capabilities();
-
- test_drop_privileges();
- fork_test(test_have_effective_cap);
-
- return 0;
-}