xref: /freebsd/tests/sys/file/path_test.c (revision 6580f5c38dd5b01aeeaed16b370f1a12423437f0)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2021 The FreeBSD Foundation
5  *
6  * This software was developed by Mark Johnston under sponsorship from
7  * the FreeBSD Foundation.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions are
11  * met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in
16  *    the documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  */
30 
31 /*
32  * Basic regression tests for handling of O_PATH descriptors.
33  */
34 
35 #include <sys/param.h>
36 #include <sys/capsicum.h>
37 #include <sys/event.h>
38 #include <sys/ioctl.h>
39 #include <sys/memrange.h>
40 #include <sys/mman.h>
41 #include <sys/ptrace.h>
42 #include <sys/socket.h>
43 #include <sys/stat.h>
44 #include <sys/time.h>
45 #include <sys/uio.h>
46 #include <sys/un.h>
47 #include <sys/wait.h>
48 
49 #include <aio.h>
50 #include <dirent.h>
51 #include <errno.h>
52 #include <fcntl.h>
53 #include <poll.h>
54 #include <signal.h>
55 #include <stdio.h>
56 #include <stdlib.h>
57 #include <unistd.h>
58 
59 #include <atf-c.h>
60 
61 #define	FMT_ERR(s)		s ": %s", strerror(errno)
62 
63 #define	CHECKED_CLOSE(fd)	\
64 	ATF_REQUIRE_MSG(close(fd) == 0, FMT_ERR("close"))
65 
66 /* Create a temporary regular file containing some data. */
67 static void
68 mktfile(char path[PATH_MAX], const char *template)
69 {
70 	char buf[BUFSIZ];
71 	int fd;
72 
73 	snprintf(path, PATH_MAX, "%s", template);
74 	fd = mkstemp(path);
75 	ATF_REQUIRE_MSG(fd >= 0, FMT_ERR("mkstemp"));
76 	memset(buf, 0, sizeof(buf));
77 	ATF_REQUIRE_MSG(write(fd, buf, sizeof(buf)) == sizeof(buf),
78 	    FMT_ERR("write"));
79 	CHECKED_CLOSE(fd);
80 }
81 
82 /* Make a temporary directory. */
83 static void
84 mktdir(char path[PATH_MAX], const char *template)
85 {
86 	snprintf(path, PATH_MAX, "%s", template);
87 	ATF_REQUIRE_MSG(mkdtemp(path) == path, FMT_ERR("mkdtemp"));
88 }
89 
90 /* Wait for a child process to exit with status 0. */
91 static void
92 waitchild(pid_t child, int exstatus)
93 {
94 	int error, status;
95 
96 	error = waitpid(child, &status, 0);
97 	ATF_REQUIRE_MSG(error != -1, FMT_ERR("waitpid"));
98 	ATF_REQUIRE_MSG(WIFEXITED(status), "child exited abnormally, status %d",
99 	    status);
100 	ATF_REQUIRE_MSG(WEXITSTATUS(status) == exstatus,
101 	    "child exit status is %d, expected %d",
102 	    WEXITSTATUS(status), exstatus);
103 }
104 
105 ATF_TC_WITHOUT_HEAD(path_access);
106 ATF_TC_BODY(path_access, tc)
107 {
108 	char path[PATH_MAX];
109 	struct stat sb;
110 	struct timespec ts[2];
111 	struct timeval tv[2];
112 	int pathfd;
113 
114 	mktfile(path, "path_access.XXXXXX");
115 
116 	pathfd = open(path, O_PATH);
117 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
118 
119 	ATF_REQUIRE_ERRNO(EBADF, fchmod(pathfd, 0666) == -1);
120 	ATF_REQUIRE_ERRNO(EBADF, fchown(pathfd, getuid(), getgid()) == -1);
121 	ATF_REQUIRE_ERRNO(EBADF, fchflags(pathfd, UF_NODUMP) == -1);
122 	memset(tv, 0, sizeof(tv));
123 	ATF_REQUIRE_ERRNO(EBADF, futimes(pathfd, tv) == -1);
124 	memset(ts, 0, sizeof(ts));
125 	ATF_REQUIRE_ERRNO(EBADF, futimens(pathfd, ts) == -1);
126 
127 	/* fpathconf(2) and fstat(2) are permitted. */
128 	ATF_REQUIRE_MSG(fstat(pathfd, &sb) == 0, FMT_ERR("fstat"));
129 	ATF_REQUIRE_MSG(fpathconf(pathfd, _PC_LINK_MAX) != -1,
130 	    FMT_ERR("fpathconf"));
131 
132 	CHECKED_CLOSE(pathfd);
133 }
134 
135 /* Basic tests to verify that AIO operations fail. */
136 ATF_TC_WITHOUT_HEAD(path_aio);
137 ATF_TC_BODY(path_aio, tc)
138 {
139 	struct aiocb aio;
140 	char buf[BUFSIZ], path[PATH_MAX];
141 	int pathfd;
142 
143 	mktfile(path, "path_aio.XXXXXX");
144 
145 	pathfd = open(path, O_PATH);
146 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
147 
148 	memset(&aio, 0, sizeof(aio));
149 	aio.aio_buf = buf;
150 	aio.aio_nbytes = sizeof(buf);
151 	aio.aio_fildes = pathfd;
152 	aio.aio_offset = 0;
153 
154 	ATF_REQUIRE_ERRNO(EBADF, aio_read(&aio) == -1);
155 	ATF_REQUIRE_ERRNO(EBADF, aio_write(&aio) == -1);
156 	ATF_REQUIRE_ERRNO(EBADF, aio_fsync(O_SYNC, &aio) == -1);
157 	ATF_REQUIRE_ERRNO(EBADF, aio_fsync(O_DSYNC, &aio) == -1);
158 
159 	CHECKED_CLOSE(pathfd);
160 }
161 
162 /* Basic tests to verify that Capsicum restrictions apply to path fds. */
163 ATF_TC_WITHOUT_HEAD(path_capsicum);
164 ATF_TC_BODY(path_capsicum, tc)
165 {
166 	char path[PATH_MAX];
167 	cap_rights_t rights;
168 	int truefd;
169 	pid_t child;
170 
171 	mktfile(path, "path_capsicum.XXXXXX");
172 
173 	/* Make sure that filesystem namespace restrictions apply to O_PATH. */
174 	child = fork();
175 	ATF_REQUIRE_MSG(child != -1, FMT_ERR("fork"));
176 	if (child == 0) {
177 		if (cap_enter() != 0)
178 			_exit(1);
179 		if (open(path, O_PATH) >= 0)
180 			_exit(2);
181 		if (errno != ECAPMODE)
182 			_exit(3);
183 		if (open("/usr/bin/true", O_PATH | O_EXEC) >= 0)
184 			_exit(4);
185 		if (errno != ECAPMODE)
186 			_exit(5);
187 		_exit(0);
188 	}
189 	waitchild(child, 0);
190 
191 	/* Make sure that CAP_FEXECVE is required. */
192 	child = fork();
193 	ATF_REQUIRE_MSG(child != -1, FMT_ERR("fork"));
194 	if (child == 0) {
195 		truefd = open("/usr/bin/true", O_PATH | O_EXEC);
196 		if (truefd < 0)
197 			_exit(1);
198 		cap_rights_init(&rights);
199 		if (cap_rights_limit(truefd, &rights) != 0)
200 			_exit(2);
201 		(void)fexecve(truefd,
202 		    (char * const[]){__DECONST(char *, "/usr/bin/true"), NULL},
203 		    NULL);
204 		if (errno != ENOTCAPABLE)
205 			_exit(3);
206 		_exit(4);
207 	}
208 	waitchild(child, 4);
209 }
210 
211 /*
212  * Check that a pathfd can be converted to a regular fd using openat() in
213  * capability mode, but that rights on the pathfd are respected.
214  */
215 ATF_TC_WITHOUT_HEAD(path_capsicum_empty);
216 ATF_TC_BODY(path_capsicum_empty, tc)
217 {
218 	char path[PATH_MAX];
219 	cap_rights_t rights;
220 	int dfd, fd, pathfd, pathdfd;
221 
222 	mktfile(path, "path_capsicum.XXXXXX");
223 
224 	pathdfd = open(".", O_PATH);
225 	ATF_REQUIRE_MSG(pathdfd >= 0, FMT_ERR("open"));
226 	pathfd = open(path, O_PATH);
227 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
228 
229 	ATF_REQUIRE(cap_enter() == 0);
230 
231 	dfd = openat(pathdfd, "", O_DIRECTORY | O_EMPTY_PATH);
232 	ATF_REQUIRE(dfd >= 0);
233 	CHECKED_CLOSE(dfd);
234 
235 	/*
236 	 * CAP_READ and CAP_LOOKUP should be sufficient to open a directory.
237 	 */
238 	cap_rights_init(&rights, CAP_READ, CAP_LOOKUP);
239 	ATF_REQUIRE(cap_rights_limit(pathdfd, &rights) == 0);
240 	dfd = openat(pathdfd, "", O_DIRECTORY | O_EMPTY_PATH);
241 	ATF_REQUIRE(dfd >= 0);
242 	CHECKED_CLOSE(dfd);
243 
244 	/*
245 	 * ... CAP_READ on its own is not.
246 	 */
247 	cap_rights_init(&rights, CAP_READ);
248 	ATF_REQUIRE(cap_rights_limit(pathdfd, &rights) == 0);
249 	dfd = openat(pathdfd, "", O_DIRECTORY | O_EMPTY_PATH);
250 	ATF_REQUIRE_ERRNO(ENOTCAPABLE, dfd == -1);
251 
252 	/*
253 	 * Now try with a regular file.
254 	 */
255 	fd = openat(pathfd, "", O_RDWR | O_EMPTY_PATH);
256 	ATF_REQUIRE(fd >= 0);
257 	CHECKED_CLOSE(fd);
258 
259 	cap_rights_init(&rights, CAP_READ, CAP_LOOKUP, CAP_WRITE);
260 	ATF_REQUIRE(cap_rights_limit(pathfd, &rights) == 0);
261 	fd = openat(pathfd, "", O_RDWR | O_EMPTY_PATH | O_APPEND);
262 	ATF_REQUIRE(fd >= 0);
263 	CHECKED_CLOSE(fd);
264 
265 	/*
266 	 * CAP_SEEK is needed to open a file for writing without O_APPEND.
267 	 */
268 	cap_rights_init(&rights, CAP_READ, CAP_LOOKUP, CAP_WRITE);
269 	ATF_REQUIRE(cap_rights_limit(pathfd, &rights) == 0);
270 	fd = openat(pathfd, "", O_RDWR | O_EMPTY_PATH);
271 	ATF_REQUIRE_ERRNO(ENOTCAPABLE, fd == -1);
272 
273 	/*
274 	 * CAP_LOOKUP isn't sufficient to open a file for reading.
275 	 */
276 	cap_rights_init(&rights, CAP_LOOKUP);
277 	ATF_REQUIRE(cap_rights_limit(pathfd, &rights) == 0);
278 	fd = openat(pathfd, "", O_RDONLY | O_EMPTY_PATH);
279 	ATF_REQUIRE_ERRNO(ENOTCAPABLE, fd == -1);
280 
281 	CHECKED_CLOSE(pathfd);
282 	CHECKED_CLOSE(pathdfd);
283 }
284 
285 /* Make sure that ptrace(PT_COREDUMP) cannot be used to write to a path fd. */
286 ATF_TC_WITHOUT_HEAD(path_coredump);
287 ATF_TC_BODY(path_coredump, tc)
288 {
289 	char path[PATH_MAX];
290 	struct ptrace_coredump pc;
291 	int error, pathfd, status;
292 	pid_t child;
293 
294 	mktdir(path, "path_coredump.XXXXXX");
295 
296 	child = fork();
297 	ATF_REQUIRE_MSG(child != -1, FMT_ERR("fork"));
298 	if (child == 0) {
299 		while (true)
300 			(void)sleep(1);
301 	}
302 
303 	pathfd = open(path, O_PATH);
304 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
305 
306 	error = ptrace(PT_ATTACH, child, 0, 0);
307 	ATF_REQUIRE_MSG(error == 0, FMT_ERR("ptrace"));
308 	error = waitpid(child, &status, 0);
309 	ATF_REQUIRE_MSG(error != -1, FMT_ERR("waitpid"));
310 	ATF_REQUIRE_MSG(WIFSTOPPED(status), "unexpected status %d", status);
311 
312 	pc.pc_fd = pathfd;
313 	pc.pc_flags = 0;
314 	pc.pc_limit = 0;
315 	error = ptrace(PT_COREDUMP, child, (void *)&pc, sizeof(pc));
316 	ATF_REQUIRE_ERRNO(EBADF, error == -1);
317 
318 	error = ptrace(PT_DETACH, child, 0, 0);
319 	ATF_REQUIRE_MSG(error == 0, FMT_ERR("ptrace"));
320 
321 	ATF_REQUIRE_MSG(kill(child, SIGKILL) == 0, FMT_ERR("kill"));
322 
323 	CHECKED_CLOSE(pathfd);
324 }
325 
326 /* Verify operations on directory path descriptors. */
327 ATF_TC_WITHOUT_HEAD(path_directory);
328 ATF_TC_BODY(path_directory, tc)
329 {
330 	struct dirent de;
331 	struct stat sb;
332 	char path[PATH_MAX];
333 	int fd, pathfd;
334 
335 	mktdir(path, "path_directory.XXXXXX");
336 
337 	pathfd = open(path, O_PATH | O_DIRECTORY);
338 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
339 
340 	/* Should not be possible to list directory entries. */
341 	ATF_REQUIRE_ERRNO(EBADF,
342 	    getdirentries(pathfd, (char *)&de, sizeof(de), NULL) == -1);
343 
344 	/* It should be possible to create files under pathfd. */
345 	fd = openat(pathfd, "test", O_RDWR | O_CREAT, 0600);
346 	ATF_REQUIRE_MSG(fd >= 0, FMT_ERR("open"));
347 	ATF_REQUIRE_MSG(fstatat(pathfd, "test", &sb, 0) == 0,
348 	    FMT_ERR("fstatat"));
349 	CHECKED_CLOSE(fd);
350 
351 	/* ... but doing so requires write access. */
352 	if (geteuid() != 0) {
353 		ATF_REQUIRE_ERRNO(EBADF, fchmod(pathfd, 0500) == -1);
354 		ATF_REQUIRE_MSG(chmod(path, 0500) == 0, FMT_ERR("chmod"));
355 		ATF_REQUIRE_ERRNO(EACCES,
356 		    openat(pathfd, "test2", O_RDWR | O_CREAT, 0600) < 0);
357 	}
358 
359 	/* fchdir(2) is permitted. */
360 	ATF_REQUIRE_MSG(fchdir(pathfd) == 0, FMT_ERR("fchdir"));
361 
362 	CHECKED_CLOSE(pathfd);
363 }
364 
365 /* Verify access permission checking for a directory path fd. */
366 ATF_TC_WITH_CLEANUP(path_directory_not_root);
367 ATF_TC_HEAD(path_directory_not_root, tc)
368 {
369 	atf_tc_set_md_var(tc, "require.user", "unprivileged");
370 }
371 ATF_TC_BODY(path_directory_not_root, tc)
372 {
373 	char path[PATH_MAX];
374 	int pathfd;
375 
376 	mktdir(path, "path_directory.XXXXXX");
377 
378 	pathfd = open(path, O_PATH | O_DIRECTORY);
379 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
380 
381 	ATF_REQUIRE_ERRNO(EBADF, fchmod(pathfd, 0500) == -1);
382 	ATF_REQUIRE_MSG(chmod(path, 0500) == 0, FMT_ERR("chmod"));
383 	ATF_REQUIRE_ERRNO(EACCES,
384 	    openat(pathfd, "test2", O_RDWR | O_CREAT, 0600) < 0);
385 
386 	CHECKED_CLOSE(pathfd);
387 }
388 ATF_TC_CLEANUP(path_directory_not_root, tc)
389 {
390 }
391 
392 /* Validate system calls that handle AT_EMPTY_PATH. */
393 ATF_TC_WITHOUT_HEAD(path_empty);
394 ATF_TC_BODY(path_empty, tc)
395 {
396 	char path[PATH_MAX];
397 	struct timespec ts[2];
398 	struct stat sb;
399 	int pathfd;
400 
401 	mktfile(path, "path_empty.XXXXXX");
402 
403 	pathfd = open(path, O_PATH);
404 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
405 
406 	/* Various *at operations should work on path fds. */
407 	ATF_REQUIRE_MSG(faccessat(pathfd, "", F_OK, AT_EMPTY_PATH) == 0,
408 	    FMT_ERR("faccessat"));
409 	ATF_REQUIRE_MSG(chflagsat(pathfd, "", UF_NODUMP, AT_EMPTY_PATH) == 0,
410 	    FMT_ERR("chflagsat"));
411 	ATF_REQUIRE_MSG(fchmodat(pathfd, "", 0600, AT_EMPTY_PATH) == 0,
412 	    FMT_ERR("fchmodat"));
413 	ATF_REQUIRE_MSG(fchownat(pathfd, "", getuid(), getgid(),
414 	    AT_EMPTY_PATH) == 0, FMT_ERR("fchownat"));
415 	ATF_REQUIRE_MSG(fstatat(pathfd, "", &sb, AT_EMPTY_PATH) == 0,
416 	    FMT_ERR("fstatat"));
417 	ATF_REQUIRE_MSG(sb.st_size == BUFSIZ,
418 	    "unexpected size %ju", (uintmax_t)sb.st_size);
419 	memset(ts, 0, sizeof(ts));
420 	ATF_REQUIRE_MSG(utimensat(pathfd, "", ts, AT_EMPTY_PATH) == 0,
421 	    FMT_ERR("utimensat"));
422 
423 	CHECKED_CLOSE(pathfd);
424 }
425 
426 /* Verify that various operations on a path fd have access checks. */
427 ATF_TC_WITH_CLEANUP(path_empty_not_root);
428 ATF_TC_HEAD(path_empty_not_root, tc)
429 {
430 	atf_tc_set_md_var(tc, "require.user", "unprivileged");
431 }
432 ATF_TC_BODY(path_empty_not_root, tc)
433 {
434 	int pathfd;
435 
436 	pathfd = open("/dev/null", O_PATH);
437 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
438 
439 	ATF_REQUIRE_ERRNO(EPERM,
440 	    chflagsat(pathfd, "", UF_NODUMP, AT_EMPTY_PATH) == -1);
441 	ATF_REQUIRE_ERRNO(EPERM,
442 	    fchownat(pathfd, "", getuid(), getgid(), AT_EMPTY_PATH) == -1);
443 	ATF_REQUIRE_ERRNO(EPERM,
444 	    fchmodat(pathfd, "", 0600, AT_EMPTY_PATH) == -1);
445 	ATF_REQUIRE_ERRNO(EPERM,
446 	    linkat(pathfd, "", AT_FDCWD, "test", AT_EMPTY_PATH) == -1);
447 
448 	CHECKED_CLOSE(pathfd);
449 }
450 ATF_TC_CLEANUP(path_empty_not_root, tc)
451 {
452 }
453 
454 /* Test linkat(2) with AT_EMPTY_PATH, which requires privileges. */
455 ATF_TC_WITH_CLEANUP(path_empty_root);
456 ATF_TC_HEAD(path_empty_root, tc)
457 {
458 	atf_tc_set_md_var(tc, "require.user", "root");
459 }
460 ATF_TC_BODY(path_empty_root, tc)
461 {
462 	char path[PATH_MAX];
463 	struct stat sb, sb2;
464 	int pathfd;
465 
466 	mktfile(path, "path_empty_root.XXXXXX");
467 
468 	pathfd = open(path, O_PATH);
469 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
470 	ATF_REQUIRE_MSG(fstatat(pathfd, "", &sb, AT_EMPTY_PATH) == 0,
471 	    FMT_ERR("fstatat"));
472 
473 	ATF_REQUIRE_MSG(linkat(pathfd, "", AT_FDCWD, "test", AT_EMPTY_PATH) ==
474 	    0, FMT_ERR("linkat"));
475 	ATF_REQUIRE_MSG(fstatat(AT_FDCWD, "test", &sb2, 0) == 0,
476 	    FMT_ERR("fstatat"));
477 	ATF_REQUIRE_MSG(sb.st_dev == sb2.st_dev, "st_dev mismatch");
478 	ATF_REQUIRE_MSG(sb.st_ino == sb2.st_ino, "st_ino mismatch");
479 
480 	CHECKED_CLOSE(pathfd);
481 
482 }
483 ATF_TC_CLEANUP(path_empty_root, tc)
484 {
485 }
486 
487 /* poll(2) never returns an event for path fds, but kevent(2) does. */
488 ATF_TC_WITHOUT_HEAD(path_event);
489 ATF_TC_BODY(path_event, tc)
490 {
491 	char buf[BUFSIZ], path[PATH_MAX];
492 	struct kevent ev;
493 	struct pollfd pollfd;
494 	int kq, pathfd;
495 
496 	mktfile(path, "path_event.XXXXXX");
497 
498 	pathfd = open(path, O_PATH);
499 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
500 
501 	/* poll(2) should return POLLNVAL. */
502 	pollfd.fd = pathfd;
503 	pollfd.events = POLLIN;
504 	pollfd.revents = 0;
505 	ATF_REQUIRE_MSG(poll(&pollfd, 1, 0) == 1, FMT_ERR("poll"));
506 	ATF_REQUIRE_MSG(pollfd.revents == POLLNVAL, "unexpected revents %x",
507 	    pollfd.revents);
508 	pollfd.events = POLLOUT;
509 	pollfd.revents = 0;
510 	ATF_REQUIRE_MSG(poll(&pollfd, 1, 0) == 1, FMT_ERR("poll"));
511 	ATF_REQUIRE_MSG(pollfd.revents == POLLNVAL, "unexpected revents %x",
512 	    pollfd.revents);
513 
514 	/* Try to get a EVFILT_READ event through a path fd. */
515 	kq = kqueue();
516 	ATF_REQUIRE_MSG(kq >= 0, FMT_ERR("kqueue"));
517 	EV_SET(&ev, pathfd, EVFILT_READ, EV_ADD | EV_ENABLE, 0, 0, 0);
518 	ATF_REQUIRE_MSG(kevent(kq, &ev, 1, NULL, 0, NULL) == 0,
519 	    FMT_ERR("kevent"));
520 	ATF_REQUIRE_MSG(kevent(kq, NULL, 0, &ev, 1, NULL) == 1,
521 	    FMT_ERR("kevent"));
522 	ATF_REQUIRE_MSG((ev.flags & EV_ERROR) == 0, "EV_ERROR is set");
523 	ATF_REQUIRE_MSG(ev.data == sizeof(buf),
524 	    "data is %jd", (intmax_t)ev.data);
525 	EV_SET(&ev, pathfd, EVFILT_READ, EV_DELETE, 0, 0, 0);
526 	ATF_REQUIRE_MSG(kevent(kq, &ev, 1, NULL, 0, NULL) == 0,
527 	    FMT_ERR("kevent"));
528 
529 	/* Try to get a EVFILT_VNODE/NOTE_DELETE event through a path fd. */
530 	EV_SET(&ev, pathfd, EVFILT_VNODE, EV_ADD | EV_ENABLE, NOTE_DELETE, 0,
531 	    0);
532 	ATF_REQUIRE_MSG(kevent(kq, &ev, 1, NULL, 0, NULL) == 0,
533 	    FMT_ERR("kevent"));
534 	ATF_REQUIRE_MSG(funlinkat(AT_FDCWD, path, pathfd, 0) == 0,
535 	    FMT_ERR("funlinkat"));
536 	ATF_REQUIRE_MSG(kevent(kq, NULL, 0, &ev, 1, NULL) == 1,
537 	    FMT_ERR("kevent"));
538 	ATF_REQUIRE_MSG(ev.fflags == NOTE_DELETE,
539 	    "unexpected fflags %#x", ev.fflags);
540 	EV_SET(&ev, pathfd, EVFILT_VNODE, EV_DELETE, 0, 0, 0);
541 	ATF_REQUIRE_MSG(kevent(kq, &ev, 1, NULL, 0, NULL) == 0,
542 	    FMT_ERR("kevent"));
543 
544 	CHECKED_CLOSE(kq);
545 	CHECKED_CLOSE(pathfd);
546 }
547 
548 /* Check various fcntl(2) operations on a path desriptor. */
549 ATF_TC_WITHOUT_HEAD(path_fcntl);
550 ATF_TC_BODY(path_fcntl, tc)
551 {
552 	char path[PATH_MAX];
553 	int flags, pathfd, pathfd2;
554 
555 	mktfile(path, "path_fcntl.XXXXXX");
556 
557 	pathfd = open(path, O_PATH);
558 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
559 
560 	/* O_PATH should appear in the fd flags. */
561 	flags = fcntl(pathfd, F_GETFL);
562 	ATF_REQUIRE_MSG(flags != -1, FMT_ERR("fcntl"));
563 	ATF_REQUIRE_MSG((flags & O_PATH) != 0, "O_PATH not set");
564 
565 	ATF_REQUIRE_ERRNO(EBADF,
566 	    fcntl(pathfd, F_SETFL, flags & ~O_PATH));
567 	ATF_REQUIRE_ERRNO(EBADF,
568 	    fcntl(pathfd, F_SETFL, flags | O_APPEND));
569 
570 	/* A dup'ed O_PATH fd had better have O_PATH set too. */
571 	pathfd2 = fcntl(pathfd, F_DUPFD, 0);
572 	ATF_REQUIRE_MSG(pathfd2 >= 0, FMT_ERR("fcntl"));
573 	flags = fcntl(pathfd2, F_GETFL);
574 	ATF_REQUIRE_MSG(flags != -1, FMT_ERR("fcntl"));
575 	ATF_REQUIRE_MSG((flags & O_PATH) != 0, "O_PATH not set");
576 	CHECKED_CLOSE(pathfd2);
577 
578 	/* Double check with dup(2). */
579 	pathfd2 = dup(pathfd);
580 	ATF_REQUIRE_MSG(pathfd2 >= 0, FMT_ERR("dup"));
581 	flags = fcntl(pathfd2, F_GETFL);
582 	ATF_REQUIRE_MSG(flags != -1, FMT_ERR("fcntl"));
583 	ATF_REQUIRE_MSG((flags & O_PATH) != 0, "O_PATH not set");
584 	CHECKED_CLOSE(pathfd2);
585 
586 	/* It should be possible to set O_CLOEXEC. */
587 	ATF_REQUIRE_MSG(fcntl(pathfd, F_SETFD, FD_CLOEXEC) == 0,
588 	    FMT_ERR("fcntl"));
589 	ATF_REQUIRE_MSG(fcntl(pathfd, F_GETFD) == FD_CLOEXEC,
590 	    FMT_ERR("fcntl"));
591 
592 	CHECKED_CLOSE(pathfd);
593 }
594 
595 /* Verify that we can execute a file opened with O_PATH. */
596 ATF_TC_WITHOUT_HEAD(path_fexecve);
597 ATF_TC_BODY(path_fexecve, tc)
598 {
599 	char path[PATH_MAX];
600 	pid_t child;
601 	int fd, pathfd;
602 
603 	child = fork();
604 	ATF_REQUIRE_MSG(child != -1, FMT_ERR("fork"));
605 	if (child == 0) {
606 		pathfd = open("/usr/bin/true", O_PATH | O_EXEC);
607 		if (pathfd < 0)
608 			_exit(1);
609 		fexecve(pathfd,
610 		    (char * const[]){__DECONST(char *, "/usr/bin/true"), NULL},
611 		    NULL);
612 		_exit(2);
613 	}
614 	waitchild(child, 0);
615 
616 	/*
617 	 * Also verify that access permissions are checked when opening with
618 	 * O_PATH.
619 	 */
620 	snprintf(path, sizeof(path), "path_fexecve.XXXXXX");
621 	ATF_REQUIRE_MSG(mktemp(path) == path, FMT_ERR("mktemp"));
622 
623 	fd = open(path, O_CREAT | O_RDONLY, 0600);
624 	ATF_REQUIRE_MSG(fd >= 0, FMT_ERR("open"));
625 
626 	pathfd = open(path, O_PATH | O_EXEC);
627 	ATF_REQUIRE_ERRNO(EACCES, pathfd < 0);
628 }
629 
630 /* Make sure that O_PATH restrictions apply to named pipes as well. */
631 ATF_TC_WITHOUT_HEAD(path_fifo);
632 ATF_TC_BODY(path_fifo, tc)
633 {
634 	char path[PATH_MAX], buf[BUFSIZ];
635 	struct kevent ev;
636 	int kq, pathfd;
637 
638 	snprintf(path, sizeof(path), "path_fifo.XXXXXX");
639 	ATF_REQUIRE_MSG(mktemp(path) == path, FMT_ERR("mktemp"));
640 
641 	ATF_REQUIRE_MSG(mkfifo(path, 0666) == 0, FMT_ERR("mkfifo"));
642 
643 	pathfd = open(path, O_PATH);
644 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
645 	memset(buf, 0, sizeof(buf));
646 	ATF_REQUIRE_ERRNO(EBADF, write(pathfd, buf, sizeof(buf)));
647 	ATF_REQUIRE_ERRNO(EBADF, read(pathfd, buf, sizeof(buf)));
648 
649 	kq = kqueue();
650 	ATF_REQUIRE_MSG(kq >= 0, FMT_ERR("kqueue"));
651 	EV_SET(&ev, pathfd, EVFILT_READ, EV_ADD | EV_ENABLE, 0, 0, 0);
652 	ATF_REQUIRE_ERRNO(EBADF, kevent(kq, &ev, 1, NULL, 0, NULL) == -1);
653 
654 	CHECKED_CLOSE(pathfd);
655 }
656 
657 /* Files may be unlinked using a path fd. */
658 ATF_TC_WITHOUT_HEAD(path_funlinkat);
659 ATF_TC_BODY(path_funlinkat, tc)
660 {
661 	char path[PATH_MAX];
662 	struct stat sb;
663 	int pathfd;
664 
665 	mktfile(path, "path_rights.XXXXXX");
666 
667 	pathfd = open(path, O_PATH);
668 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
669 
670 	ATF_REQUIRE_MSG(funlinkat(AT_FDCWD, path, pathfd, 0) == 0,
671 	    FMT_ERR("funlinkat"));
672 	ATF_REQUIRE_ERRNO(ENOENT, stat(path, &sb) == -1);
673 
674 	CHECKED_CLOSE(pathfd);
675 }
676 
677 /* Verify that various I/O operations fail on an O_PATH descriptor. */
678 ATF_TC_WITHOUT_HEAD(path_io);
679 ATF_TC_BODY(path_io, tc)
680 {
681 	char path[PATH_MAX], path2[PATH_MAX];
682 	char buf[BUFSIZ];
683 	struct iovec iov;
684 	size_t page_size;
685 	int error, fd, pathfd, sd[2];
686 
687 	/* It shouldn't be possible to create new files with O_PATH. */
688 	snprintf(path, sizeof(path), "path_io.XXXXXX");
689 	ATF_REQUIRE_MSG(mktemp(path) == path, FMT_ERR("mktemp"));
690 	ATF_REQUIRE_ERRNO(ENOENT, open(path, O_PATH | O_CREAT, 0600) < 0);
691 
692 	/* Create a non-empty file for use in the rest of the tests. */
693 	mktfile(path, "path_io.XXXXXX");
694 
695 	pathfd = open(path, O_PATH);
696 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
697 
698 	/* Make sure that basic I/O operations aren't possible. */
699 	iov.iov_base = path;
700 	iov.iov_len = strlen(path);
701 	ATF_REQUIRE_ERRNO(EBADF,
702 	    write(pathfd, iov.iov_base, iov.iov_len) == -1);
703 	ATF_REQUIRE_ERRNO(EBADF,
704 	    pwrite(pathfd, iov.iov_base, iov.iov_len, 0) == -1);
705 	ATF_REQUIRE_ERRNO(EBADF,
706 	    writev(pathfd, &iov, 1) == -1);
707 	ATF_REQUIRE_ERRNO(EBADF,
708 	    pwritev(pathfd, &iov, 1, 0) == -1);
709 	ATF_REQUIRE_ERRNO(EBADF,
710 	    read(pathfd, path, 1) == -1);
711 	ATF_REQUIRE_ERRNO(EBADF,
712 	    pread(pathfd, path, 1, 0) == -1);
713 	ATF_REQUIRE_ERRNO(EBADF,
714 	    readv(pathfd, &iov, 1) == -1);
715 	ATF_REQUIRE_ERRNO(EBADF,
716 	    preadv(pathfd, &iov, 1, 0) == -1);
717 
718 	/* copy_file_range() should not be permitted. */
719 	mktfile(path2, "path_io.XXXXXX");
720 	fd = open(path2, O_RDWR);
721 	ATF_REQUIRE_ERRNO(EBADF,
722 	    copy_file_range(fd, NULL, pathfd, NULL, sizeof(buf), 0) == -1);
723 	ATF_REQUIRE_ERRNO(EBADF,
724 	    copy_file_range(pathfd, NULL, fd, NULL, sizeof(buf), 0) == -1);
725 	CHECKED_CLOSE(fd);
726 
727 	/* sendfile() should not be permitted. */
728 	ATF_REQUIRE_MSG(socketpair(PF_LOCAL, SOCK_STREAM, 0, sd) == 0,
729 	    FMT_ERR("socketpair"));
730 	ATF_REQUIRE_ERRNO(EBADF,
731 	    sendfile(pathfd, sd[0], 0, 0, NULL, NULL, 0));
732 	CHECKED_CLOSE(sd[0]);
733 	CHECKED_CLOSE(sd[1]);
734 
735 	/* No seeking. */
736 	ATF_REQUIRE_ERRNO(ESPIPE,
737 	    lseek(pathfd, 0, SEEK_SET) == -1);
738 
739 	/* No operations on the file extent. */
740 	ATF_REQUIRE_ERRNO(EINVAL,
741 	    ftruncate(pathfd, 0) == -1);
742 	error = posix_fallocate(pathfd, 0, sizeof(buf) * 2);
743 	ATF_REQUIRE_MSG(error == ESPIPE, "posix_fallocate() returned %d", error);
744 	error = posix_fadvise(pathfd, 0, sizeof(buf), POSIX_FADV_NORMAL);
745 	ATF_REQUIRE_MSG(error == ESPIPE, "posix_fadvise() returned %d", error);
746 
747 	/* mmap() is not allowed. */
748 	page_size = getpagesize();
749 	ATF_REQUIRE_ERRNO(ENODEV,
750 	    mmap(NULL, page_size, PROT_READ, MAP_SHARED, pathfd, 0) ==
751 	    MAP_FAILED);
752 	ATF_REQUIRE_ERRNO(ENODEV,
753 	    mmap(NULL, page_size, PROT_NONE, MAP_SHARED, pathfd, 0) ==
754 	    MAP_FAILED);
755 	ATF_REQUIRE_ERRNO(ENODEV,
756 	    mmap(NULL, page_size, PROT_READ, MAP_PRIVATE, pathfd, 0) ==
757 	    MAP_FAILED);
758 
759 	/* No fsync() or fdatasync(). */
760 	ATF_REQUIRE_ERRNO(EBADF, fsync(pathfd) == -1);
761 	ATF_REQUIRE_ERRNO(EBADF, fdatasync(pathfd) == -1);
762 
763 	CHECKED_CLOSE(pathfd);
764 }
765 
766 /* ioctl(2) is not permitted on path fds. */
767 ATF_TC_WITHOUT_HEAD(path_ioctl);
768 ATF_TC_BODY(path_ioctl, tc)
769 {
770 	char path[PATH_MAX];
771 	struct mem_extract me;
772 	int pathfd, val;
773 
774 	mktfile(path, "path_ioctl.XXXXXX");
775 
776 	/* Standard file descriptor ioctls should fail. */
777 	pathfd = open(path, O_PATH);
778 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
779 
780 	val = 0;
781 	ATF_REQUIRE_ERRNO(EBADF, ioctl(pathfd, FIONBIO, &val) == -1);
782 	ATF_REQUIRE_ERRNO(EBADF, ioctl(pathfd, FIONREAD, &val) == -1);
783 	ATF_REQUIRE_ERRNO(EBADF, ioctl(pathfd, FIONWRITE, &val) == -1);
784 	ATF_REQUIRE_ERRNO(EBADF, ioctl(pathfd, FIONSPACE, &val) == -1);
785 
786 	CHECKED_CLOSE(pathfd);
787 
788 	/* Device ioctls should fail. */
789 	pathfd = open("/dev/mem", O_PATH);
790 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
791 
792 	me.me_vaddr = (uintptr_t)&me;
793 	ATF_REQUIRE_ERRNO(EBADF, ioctl(pathfd, MEM_EXTRACT_PADDR, &me) == -1);
794 
795 	CHECKED_CLOSE(pathfd);
796 }
797 
798 ATF_TC_WITHOUT_HEAD(path_lock);
799 ATF_TC_BODY(path_lock, tc)
800 {
801 	char buf[BUFSIZ], path[PATH_MAX];
802 	struct flock flk;
803 	int fd, pathfd;
804 
805 	snprintf(path, sizeof(path), "path_rights.XXXXXX");
806 	fd = mkostemp(path, O_SHLOCK);
807 	ATF_REQUIRE_MSG(fd >= 0, FMT_ERR("mkostemp"));
808 	memset(buf, 0, sizeof(buf));
809 	ATF_REQUIRE_MSG(write(fd, buf, sizeof(buf)) == sizeof(buf),
810 	    FMT_ERR("write()"));
811 
812 	/* Verify that O_EXLOCK is ignored when combined with O_PATH. */
813 	pathfd = open(path, O_PATH | O_EXLOCK);
814 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
815 
816 	CHECKED_CLOSE(fd);
817 
818 	/* flock(2) is prohibited. */
819 	ATF_REQUIRE_ERRNO(EOPNOTSUPP, flock(pathfd, LOCK_SH) == -1);
820 	ATF_REQUIRE_ERRNO(EOPNOTSUPP, flock(pathfd, LOCK_EX) == -1);
821 	ATF_REQUIRE_ERRNO(EOPNOTSUPP, flock(pathfd, LOCK_SH | LOCK_NB) == -1);
822 	ATF_REQUIRE_ERRNO(EOPNOTSUPP, flock(pathfd, LOCK_EX | LOCK_NB) == -1);
823 	ATF_REQUIRE_ERRNO(EOPNOTSUPP, flock(pathfd, LOCK_UN) == -1);
824 
825 	/* fcntl(2) file locks are prohibited. */
826 	memset(&flk, 0, sizeof(flk));
827 	flk.l_whence = SEEK_CUR;
828 	ATF_REQUIRE_ERRNO(EBADF, fcntl(pathfd, F_GETLK, &flk) == -1);
829 	flk.l_type = F_RDLCK;
830 	ATF_REQUIRE_ERRNO(EBADF, fcntl(pathfd, F_SETLK, &flk) == -1);
831 	ATF_REQUIRE_ERRNO(EBADF, fcntl(pathfd, F_SETLKW, &flk) == -1);
832 	flk.l_type = F_WRLCK;
833 	ATF_REQUIRE_ERRNO(EBADF, fcntl(pathfd, F_SETLK, &flk) == -1);
834 	ATF_REQUIRE_ERRNO(EBADF, fcntl(pathfd, F_SETLKW, &flk) == -1);
835 
836 	CHECKED_CLOSE(pathfd);
837 }
838 
839 /*
840  * Verify fstatat(AT_EMPTY_PATH) on non-regular dirfd.
841  * Verify that fstatat(AT_EMPTY_PATH) on NULL path returns EFAULT.
842  */
843 ATF_TC_WITHOUT_HEAD(path_pipe_fstatat);
844 ATF_TC_BODY(path_pipe_fstatat, tc)
845 {
846 	struct stat sb;
847 	int fd[2];
848 
849 	ATF_REQUIRE_MSG(pipe(fd) == 0, FMT_ERR("pipe"));
850 	ATF_REQUIRE_MSG(fstatat(fd[0], "", &sb, AT_EMPTY_PATH) == 0,
851 	    FMT_ERR("fstatat pipe"));
852 	ATF_REQUIRE_ERRNO(EFAULT, fstatat(fd[0], NULL, &sb,
853 	    AT_EMPTY_PATH) == -1);
854 	CHECKED_CLOSE(fd[0]);
855 	CHECKED_CLOSE(fd[1]);
856 }
857 
858 /* Verify that we can send an O_PATH descriptor over a unix socket. */
859 ATF_TC_WITHOUT_HEAD(path_rights);
860 ATF_TC_BODY(path_rights, tc)
861 {
862 	char path[PATH_MAX];
863 	struct cmsghdr *cmsg;
864 	struct msghdr msg;
865 	struct iovec iov;
866 	int flags, pathfd, pathfd_copy, sd[2];
867 	char c;
868 
869 	ATF_REQUIRE_MSG(socketpair(PF_LOCAL, SOCK_STREAM, 0, sd) == 0,
870 	    FMT_ERR("socketpair"));
871 
872 	mktfile(path, "path_rights.XXXXXX");
873 
874 	pathfd = open(path, O_PATH);
875 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
876 
877 	/* Package up the O_PATH and send it over the socket pair. */
878 	cmsg = malloc(CMSG_SPACE(sizeof(pathfd)));
879 	ATF_REQUIRE_MSG(cmsg != NULL, FMT_ERR("malloc"));
880 
881 	cmsg->cmsg_len = CMSG_LEN(sizeof(pathfd));
882 	cmsg->cmsg_level = SOL_SOCKET;
883 	cmsg->cmsg_type = SCM_RIGHTS;
884 	*(int *)(void *)CMSG_DATA(cmsg) = pathfd;
885 
886 	c = 0;
887 	iov.iov_base = &c;
888 	iov.iov_len = 1;
889 
890 	memset(&msg, 0, sizeof(msg));
891 	msg.msg_iov = &iov;
892 	msg.msg_iovlen = 1;
893 	msg.msg_control = cmsg;
894 	msg.msg_controllen = CMSG_SPACE(sizeof(pathfd));
895 
896 	ATF_REQUIRE_MSG(sendmsg(sd[0], &msg, 0) == sizeof(c),
897 	    FMT_ERR("sendmsg"));
898 
899 	/* Grab the pathfd copy from the other end of the pair. */
900 	memset(&msg, 0, sizeof(msg));
901 	msg.msg_iov = &iov;
902 	msg.msg_iovlen = 1;
903 	msg.msg_control = cmsg;
904 	msg.msg_controllen = CMSG_SPACE(sizeof(pathfd));
905 
906 	ATF_REQUIRE_MSG(recvmsg(sd[1], &msg, 0) == 1,
907 	    FMT_ERR("recvmsg"));
908 	pathfd_copy = *(int *)(void *)CMSG_DATA(cmsg);
909 	ATF_REQUIRE_MSG(pathfd_copy != pathfd,
910 	    "pathfd and pathfd_copy are equal");
911 
912 	/* Verify that the copy has O_PATH properties. */
913 	flags = fcntl(pathfd_copy, F_GETFL);
914 	ATF_REQUIRE_MSG(flags != -1, FMT_ERR("fcntl"));
915 	ATF_REQUIRE_MSG((flags & O_PATH) != 0, "O_PATH is not set");
916 	ATF_REQUIRE_ERRNO(EBADF,
917 	    read(pathfd_copy, &c, 1) == -1);
918 	ATF_REQUIRE_ERRNO(EBADF,
919 	    write(pathfd_copy, &c, 1) == -1);
920 
921 	CHECKED_CLOSE(pathfd);
922 	CHECKED_CLOSE(pathfd_copy);
923 	CHECKED_CLOSE(sd[0]);
924 	CHECKED_CLOSE(sd[1]);
925 }
926 
927 /* Verify that a local socket can be opened with O_PATH. */
928 ATF_TC_WITHOUT_HEAD(path_unix);
929 ATF_TC_BODY(path_unix, tc)
930 {
931 	char buf[BUFSIZ], path[PATH_MAX];
932 	struct kevent ev;
933 	struct sockaddr_un sun;
934 	struct stat sb;
935 	int kq, pathfd, sd;
936 
937 	snprintf(path, sizeof(path), "path_unix.XXXXXX");
938 	ATF_REQUIRE_MSG(mktemp(path) == path, FMT_ERR("mktemp"));
939 
940 	sd = socket(PF_LOCAL, SOCK_STREAM, 0);
941 	ATF_REQUIRE_MSG(sd >= 0, FMT_ERR("socket"));
942 
943 	memset(&sun, 0, sizeof(sun));
944 	sun.sun_family = PF_LOCAL;
945 	(void)strlcpy(sun.sun_path, path, sizeof(sun.sun_path));
946 	ATF_REQUIRE_MSG(bind(sd, (struct sockaddr *)&sun, SUN_LEN(&sun)) == 0,
947 	    FMT_ERR("bind"));
948 
949 	pathfd = open(path, O_PATH);
950 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
951 
952 	ATF_REQUIRE_MSG(fstatat(pathfd, "", &sb, AT_EMPTY_PATH) == 0,
953 	    FMT_ERR("fstatat"));
954 	ATF_REQUIRE_MSG(sb.st_mode & S_IFSOCK, "socket mode %#x", sb.st_mode);
955 	ATF_REQUIRE_MSG(sb.st_ino != 0, "socket has inode number 0");
956 
957 	memset(buf, 0, sizeof(buf));
958 	ATF_REQUIRE_ERRNO(EBADF, write(pathfd, buf, sizeof(buf)));
959 	ATF_REQUIRE_ERRNO(EBADF, read(pathfd, buf, sizeof(buf)));
960 
961 	/* kevent() is disallowed with sockets. */
962 	kq = kqueue();
963 	ATF_REQUIRE_MSG(kq >= 0, FMT_ERR("kqueue"));
964 	EV_SET(&ev, pathfd, EVFILT_READ, EV_ADD | EV_ENABLE, 0, 0, 0);
965 	ATF_REQUIRE_ERRNO(EBADF, kevent(kq, &ev, 1, NULL, 0, NULL) == -1);
966 
967 	/* Should not be able to open a socket without O_PATH. */
968 	ATF_REQUIRE_ERRNO(EOPNOTSUPP, openat(pathfd, "", O_EMPTY_PATH) == -1);
969 
970 	ATF_REQUIRE_MSG(funlinkat(AT_FDCWD, path, pathfd, 0) == 0,
971 	    FMT_ERR("funlinkat"));
972 
973 	CHECKED_CLOSE(sd);
974 	CHECKED_CLOSE(pathfd);
975 }
976 
977 /*
978  * Check that we can perform operations using an O_PATH fd for an unlinked file.
979  */
980 ATF_TC_WITHOUT_HEAD(path_unlinked);
981 ATF_TC_BODY(path_unlinked, tc)
982 {
983 	char path[PATH_MAX];
984 	struct stat sb;
985 	int pathfd;
986 
987 	mktfile(path, "path_rights.XXXXXX");
988 
989 	pathfd = open(path, O_PATH);
990 	ATF_REQUIRE_MSG(pathfd >= 0, FMT_ERR("open"));
991 
992 	ATF_REQUIRE_MSG(fstatat(pathfd, "", &sb, AT_EMPTY_PATH) == 0,
993 	    FMT_ERR("fstatat"));
994 	ATF_REQUIRE(sb.st_nlink == 1);
995 	ATF_REQUIRE_MSG(fstat(pathfd, &sb) == 0, FMT_ERR("fstat"));
996 	ATF_REQUIRE(sb.st_nlink == 1);
997 
998 	ATF_REQUIRE_MSG(unlink(path) == 0, FMT_ERR("unlink"));
999 
1000 	ATF_REQUIRE_MSG(fstatat(pathfd, "", &sb, AT_EMPTY_PATH) == 0,
1001 	    FMT_ERR("fstatat"));
1002 	ATF_REQUIRE(sb.st_nlink == 0);
1003 	ATF_REQUIRE_MSG(fstat(pathfd, &sb) == 0, FMT_ERR("fstat"));
1004 	ATF_REQUIRE(sb.st_nlink == 0);
1005 
1006 	CHECKED_CLOSE(pathfd);
1007 }
1008 
1009 ATF_TP_ADD_TCS(tp)
1010 {
1011 	ATF_TP_ADD_TC(tp, path_access);
1012 	ATF_TP_ADD_TC(tp, path_aio);
1013 	ATF_TP_ADD_TC(tp, path_capsicum);
1014 	ATF_TP_ADD_TC(tp, path_capsicum_empty);
1015 	ATF_TP_ADD_TC(tp, path_coredump);
1016 	ATF_TP_ADD_TC(tp, path_directory);
1017 	ATF_TP_ADD_TC(tp, path_directory_not_root);
1018 	ATF_TP_ADD_TC(tp, path_empty);
1019 	ATF_TP_ADD_TC(tp, path_empty_not_root);
1020 	ATF_TP_ADD_TC(tp, path_empty_root);
1021 	ATF_TP_ADD_TC(tp, path_event);
1022 	ATF_TP_ADD_TC(tp, path_fcntl);
1023 	ATF_TP_ADD_TC(tp, path_fexecve);
1024 	ATF_TP_ADD_TC(tp, path_fifo);
1025 	ATF_TP_ADD_TC(tp, path_funlinkat);
1026 	ATF_TP_ADD_TC(tp, path_io);
1027 	ATF_TP_ADD_TC(tp, path_ioctl);
1028 	ATF_TP_ADD_TC(tp, path_lock);
1029 	ATF_TP_ADD_TC(tp, path_pipe_fstatat);
1030 	ATF_TP_ADD_TC(tp, path_rights);
1031 	ATF_TP_ADD_TC(tp, path_unix);
1032 	ATF_TP_ADD_TC(tp, path_unlinked);
1033 
1034 	return (atf_no_error());
1035 }
1036