1 /*-
2 * Copyright (c) 2005 McAfee, Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27 #include <sys/param.h>
28 #include <sys/mac.h>
29 #include <sys/mount.h>
30
31 #include <security/mac_bsdextended/mac_bsdextended.h>
32
33 #include <err.h>
34 #include <errno.h>
35 #include <grp.h>
36 #include <pwd.h>
37 #include <stdio.h>
38 #include <stdlib.h>
39 #include <string.h>
40 #include <ugidfw.h>
41 #include <unistd.h>
42
43 /*
44 * Starting point for a regression test for mac_bsdextended(4) and the
45 * supporting libugidfw(3).
46 */
47
48 /*
49 * This section of the regression test passes some test cases through the
50 * rule<->string routines to confirm they work approximately as desired.
51 */
52
53 /*
54 * List of users and groups we must check exists before we can begin, since
55 * they are used in the string test rules. We use users and groups that will
56 * always exist in a default install used for regression testing.
57 */
58 static const char *test_users[] = {
59 "root",
60 "daemon",
61 "operator",
62 "bin",
63 };
64
65 static const char *test_groups[] = {
66 "wheel",
67 "daemon",
68 "operator",
69 "bin",
70 };
71
72 static int test_num;
73
74 /*
75 * List of test strings that must go in (and come out) of libugidfw intact.
76 */
77 static const char *test_strings[] = {
78 /* Variations on subject and object uids. */
79 "subject uid root object uid root mode n",
80 "subject uid root object uid daemon mode n",
81 "subject uid daemon object uid root mode n",
82 "subject uid daemon object uid daemon mode n",
83 /* Variations on mode. */
84 "subject uid root object uid root mode a",
85 "subject uid root object uid root mode r",
86 "subject uid root object uid root mode s",
87 "subject uid root object uid root mode w",
88 "subject uid root object uid root mode x",
89 "subject uid root object uid root mode arswx",
90 /* Variations on subject and object gids. */
91 "subject gid wheel object gid wheel mode n",
92 "subject gid wheel object gid daemon mode n",
93 "subject gid daemon object gid wheel mode n",
94 "subject gid daemon object gid daemon mode n",
95 /* Subject uids and subject gids. */
96 "subject uid bin gid daemon object uid operator gid wheel mode n",
97 /* Not */
98 "subject not uid operator object uid bin mode n",
99 "subject uid bin object not uid operator mode n",
100 "subject not uid daemon object not uid operator mode n",
101 /* Ranges */
102 "subject uid root:operator object gid wheel:bin mode n",
103 /* Jail ID */
104 "subject jailid 1 object uid root mode n",
105 /* Filesys */
106 "subject uid root object filesys / mode n",
107 "subject uid root object filesys /dev mode n",
108 /* S/UGID */
109 "subject not uid root object sgid mode n",
110 "subject not uid root object sgid mode n",
111 /* Matching uid/gid */
112 "subject not uid root:operator object not uid_of_subject mode n",
113 "subject not gid wheel:bin object not gid_of_subject mode n",
114 /* Object types */
115 "subject uid root object type a mode a",
116 "subject uid root object type r mode a",
117 "subject uid root object type d mode a",
118 "subject uid root object type b mode a",
119 "subject uid root object type c mode a",
120 "subject uid root object type l mode a",
121 "subject uid root object type s mode a",
122 "subject uid root object type rbc mode a",
123 "subject uid root object type dls mode a",
124 /* Empty rules always match */
125 "subject object mode a",
126 /* Partial negations */
127 "subject ! uid root object mode n",
128 "subject ! gid wheel object mode n",
129 "subject ! jailid 2 object mode n",
130 "subject object ! uid root mode n",
131 "subject object ! gid wheel mode n",
132 "subject object ! filesys / mode n",
133 "subject object ! suid mode n",
134 "subject object ! sgid mode n",
135 "subject object ! uid_of_subject mode n",
136 "subject object ! gid_of_subject mode n",
137 "subject object ! type d mode n",
138 /* All out nonsense */
139 "subject uid root ! gid wheel:bin ! jailid 1 "
140 "object ! uid root:daemon gid daemon filesys / suid sgid uid_of_subject gid_of_subject ! type r "
141 "mode rsx",
142 };
143
144 static void
test_libugidfw_strings(void)145 test_libugidfw_strings(void)
146 {
147 struct mac_bsdextended_rule rule;
148 char errorstr[256];
149 char rulestr[256];
150 size_t i;
151 int error;
152
153 for (i = 0; i < nitems(test_users); i++, test_num++) {
154 if (getpwnam(test_users[i]) == NULL)
155 printf("not ok %d # test_libugidfw_strings: getpwnam(%s) "
156 "failed: %s\n", test_num, test_users[i], strerror(errno));
157 else
158 printf("ok %d\n", test_num);
159 }
160
161 for (i = 0; i < nitems(test_groups); i++, test_num++) {
162 if (getgrnam(test_groups[i]) == NULL)
163 printf("not ok %d # test_libugidfw_strings: getgrnam(%s) "
164 "failed: %s\n", test_num, test_groups[i], strerror(errno));
165 else
166 printf("ok %d\n", test_num);
167 }
168
169 for (i = 0; i < nitems(test_strings); i++) {
170 error = bsde_parse_rule_string(test_strings[i], &rule,
171 sizeof(errorstr), errorstr);
172 if (error == -1)
173 printf("not ok %d # bsde_parse_rule_string: '%s' (%zu) "
174 "failed: %s\n", test_num, test_strings[i], i, errorstr);
175 else
176 printf("ok %d\n", test_num);
177 test_num++;
178
179 error = bsde_rule_to_string(&rule, rulestr, sizeof(rulestr));
180 if (error < 0)
181 printf("not ok %d # bsde_rule_to_string: rule for '%s' "
182 "returned %d\n", test_num, test_strings[i], error);
183 else
184 printf("ok %d\n", test_num);
185 test_num++;
186
187 if (strcmp(test_strings[i], rulestr) != 0)
188 printf("not ok %d # test_libugidfw: '%s' in, '%s' "
189 "out\n", test_num, test_strings[i], rulestr);
190 else
191 printf("ok %d\n", test_num);
192 test_num++;
193 }
194 }
195
196 int
main(void)197 main(void)
198 {
199 char errorstr[256];
200 int count, slots;
201
202 test_num = 1;
203
204 /* Print an error if a non-root user attemps to run the tests. */
205 if (getuid() != 0) {
206 printf("1..0 # SKIP you must be root\n");
207 return (0);
208 }
209
210 switch (mac_is_present("bsdextended")) {
211 case -1:
212 printf("1..0 # SKIP mac_is_present failed: %s\n",
213 strerror(errno));
214 return (0);
215 case 1:
216 break;
217 case 0:
218 default:
219 printf("1..0 # SKIP mac_bsdextended not loaded\n");
220 return (0);
221 }
222
223 printf("1..%zu\n", nitems(test_users) + nitems(test_groups) +
224 3 * nitems(test_strings) + 2);
225
226 test_libugidfw_strings();
227
228 /*
229 * Some simple up-front checks to see if we're able to query the
230 * policy for basic state. We want the rule count to be 0 before
231 * starting, but "slots" is a property of prior runs and so we ignore
232 * the return value.
233 */
234 count = bsde_get_rule_count(sizeof(errorstr), errorstr);
235 if (count == -1)
236 printf("not ok %d # bsde_get_rule_count: %s\n", test_num,
237 errorstr);
238 else
239 printf("ok %d\n", test_num);
240
241 test_num++;
242
243 slots = bsde_get_rule_slots(sizeof(errorstr), errorstr);
244 if (slots == -1)
245 printf("not ok %d # bsde_get_rule_slots: %s\n", test_num,
246 errorstr);
247 else
248 printf("ok %d\n", test_num);
249
250 return (0);
251 }
252