1*cba191e2SOlivier Certner#!/usr/bin/env atf-sh 2*cba191e2SOlivier Certner# 3*cba191e2SOlivier Certner# Copyright (c) 2026, The FreeBSD Foundation 4*cba191e2SOlivier Certner# 5*cba191e2SOlivier Certner# This software was developed by Olivier Certner <olce@FreeBSD.org> at 6*cba191e2SOlivier Certner# Kumacom SARL under sponsorship from the FreeBSD Foundation. 7*cba191e2SOlivier Certner 8*cba191e2SOlivier Certneratf_test_case rule_no_target_part 9*cba191e2SOlivier Certnerrule_no_target_part_head() 10*cba191e2SOlivier Certner{ 11*cba191e2SOlivier Certner atf_set descr "Missing target part in a rule" 12*cba191e2SOlivier Certner} 13*cba191e2SOlivier Certnerrule_no_target_part_body() 14*cba191e2SOlivier Certner{ 15*cba191e2SOlivier Certner sysctl_set_and_check_fails_rules "uid=0>" 16*cba191e2SOlivier Certner sysctl_set_and_check_fails_rules "gid=0>" 17*cba191e2SOlivier Certner sysctl_set_and_check_fails_rules "uid=0" 18*cba191e2SOlivier Certner sysctl_set_and_check_fails_rules "gid=0" 19*cba191e2SOlivier Certner} 20*cba191e2SOlivier Certner 21*cba191e2SOlivier Certneratf_test_case rule_no_match_part 22*cba191e2SOlivier Certnerrule_no_match_part_head() 23*cba191e2SOlivier Certner{ 24*cba191e2SOlivier Certner atf_set descr "Missing match part in a rule" 25*cba191e2SOlivier Certner} 26*cba191e2SOlivier Certnerrule_no_match_part_body() 27*cba191e2SOlivier Certner{ 28*cba191e2SOlivier Certner sysctl_set_and_check_fails_rules ">uid=0" 29*cba191e2SOlivier Certner sysctl_set_and_check_fails_rules ">gid=0" 30*cba191e2SOlivier Certner} 31*cba191e2SOlivier Certner 32*cba191e2SOlivier Certneratf_test_case rule_space_between_flag_and_gid_fail 33*cba191e2SOlivier Certnerrule_space_between_flag_and_gid_fail_head() 34*cba191e2SOlivier Certner{ 35*cba191e2SOlivier Certner atf_set descr "No space allowed between flag and GID" 36*cba191e2SOlivier Certner} 37*cba191e2SOlivier Certnerrule_space_between_flag_and_gid_fail_body() 38*cba191e2SOlivier Certner{ 39*cba191e2SOlivier Certner sysctl_set_and_check_fails_rules "uid=1001>uid=0,gid=0,+ gid=0" 40*cba191e2SOlivier Certner} 41*cba191e2SOlivier Certner 42*cba191e2SOlivier Certneratf_test_case rule_user_names_fail 43*cba191e2SOlivier Certnerrule_user_names_fail_head() 44*cba191e2SOlivier Certner{ 45*cba191e2SOlivier Certner atf_set descr "Reject user names (only numerical IDs supported)" 46*cba191e2SOlivier Certner} 47*cba191e2SOlivier Certnerrule_user_names_fail_body() 48*cba191e2SOlivier Certner{ 49*cba191e2SOlivier Certner sysctl_set_and_check_fails_rules "uid=user>uid=0" 50*cba191e2SOlivier Certner sysctl_set_and_check_fails_rules "uid=1001>uid=root" 51*cba191e2SOlivier Certner} 52*cba191e2SOlivier Certner 53*cba191e2SOlivier Certneratf_test_case rule_group_names_fail 54*cba191e2SOlivier Certnerrule_group_names_fail_head() 55*cba191e2SOlivier Certner{ 56*cba191e2SOlivier Certner atf_set descr "Reject group names (only numerical IDs supported)" 57*cba191e2SOlivier Certner} 58*cba191e2SOlivier Certnerrule_group_names_fail_body() 59*cba191e2SOlivier Certner{ 60*cba191e2SOlivier Certner sysctl_set_and_check_fails_rules "gid=group>gid=0" 61*cba191e2SOlivier Certner sysctl_set_and_check_fails_rules "gid=1001>gid=root" 62*cba191e2SOlivier Certner sysctl_set_and_check_fails_rules "gid=1001>gid=0,+gid=operator" 63*cba191e2SOlivier Certner} 64*cba191e2SOlivier Certner 65*cba191e2SOlivier Certneratf_test_case rules_wrong_separator 66*cba191e2SOlivier Certnerrules_wrong_separator_head() 67*cba191e2SOlivier Certner{ 68*cba191e2SOlivier Certner atf_set descr "Wrong rules separator" 69*cba191e2SOlivier Certner} 70*cba191e2SOlivier Certnerrules_wrong_separator_body() 71*cba191e2SOlivier Certner{ 72*cba191e2SOlivier Certner sysctl_set_and_check_fails_rules "uid=1001>gid=0:gid=1001>gid=5" 73*cba191e2SOlivier Certner} 74*cba191e2SOlivier Certner 75*cba191e2SOlivier Certner 76*cba191e2SOlivier Certneratf_init_test_cases() 77*cba191e2SOlivier Certner{ 78*cba191e2SOlivier Certner . $(atf_get_srcdir)/common.sh 79*cba191e2SOlivier Certner 80*cba191e2SOlivier Certner atf_add_test_case rule_no_target_part 81*cba191e2SOlivier Certner atf_add_test_case rule_no_match_part 82*cba191e2SOlivier Certner atf_add_test_case rule_space_between_flag_and_gid_fail 83*cba191e2SOlivier Certner atf_add_test_case rule_user_names_fail 84*cba191e2SOlivier Certner atf_add_test_case rule_group_names_fail 85*cba191e2SOlivier Certner atf_add_test_case rules_wrong_separator 86*cba191e2SOlivier Certner} 87