xref: /freebsd/tools/regression/security/cap_test/cap_test_capmode.c (revision 1d386b48a555f61cb7325543adbbb5c3f3407a66)
1 /*-
2  * Copyright (c) 2008-2009 Robert N. M. Watson
3  * Copyright (c) 2011 Jonathan Anderson
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  */
27 
28 /*
29  * Test routines to make sure a variety of system calls are or are not
30  * available in capability mode.  The goal is not to see if they work, just
31  * whether or not they return the expected ECAPMODE.
32  */
33 
34 #include <sys/cdefs.h>
35 #include <sys/param.h>
36 #include <sys/capsicum.h>
37 #include <sys/errno.h>
38 #include <sys/mman.h>
39 #include <sys/mount.h>
40 #include <sys/socket.h>
41 #include <sys/stat.h>
42 #include <sys/wait.h>
43 
44 #include <machine/sysarch.h>
45 
46 #include <err.h>
47 #include <fcntl.h>
48 #include <stdlib.h>
49 #include <string.h>
50 #include <unistd.h>
51 
52 #include "cap_test.h"
53 
54 #define	CHECK_SYSCALL_VOID_NOT_ECAPMODE(syscall, ...)	do {		\
55 	errno = 0;							\
56 	(void)syscall(__VA_ARGS__);					\
57 	if (errno == ECAPMODE)						\
58 		FAIL("capmode: %s failed with ECAPMODE", #syscall);	\
59 } while (0)
60 
61 int
62 test_capmode(void)
63 {
64 	struct statfs statfs;
65 	struct stat sb;
66 	long sysarch_arg = 0;
67 	int fd_close, fd_dir, fd_file, fd_socket, fd2[2];
68 	int success = PASSED;
69 	pid_t pid, wpid;
70 	char ch;
71 
72 	/* Open some files to play with. */
73 	REQUIRE(fd_file = open("/tmp/cap_capmode", O_RDWR|O_CREAT, 0644));
74 	REQUIRE(fd_close = open("/dev/null", O_RDWR));
75 	REQUIRE(fd_dir = open("/tmp", O_RDONLY));
76 	REQUIRE(fd_socket = socket(PF_INET, SOCK_DGRAM, 0));
77 
78 	/* Enter capability mode. */
79 	REQUIRE(cap_enter());
80 
81 	/*
82 	 * System calls that are not permitted in capability mode.
83 	 */
84 	CHECK_CAPMODE(access, "/tmp/cap_capmode_access", F_OK);
85 	CHECK_CAPMODE(acct, "/tmp/cap_capmode_acct");
86 	CHECK_CAPMODE(bind, PF_INET, NULL, 0);
87 	CHECK_CAPMODE(chdir, "/tmp/cap_capmode_chdir");
88 	CHECK_CAPMODE(chflags, "/tmp/cap_capmode_chflags", UF_NODUMP);
89 	CHECK_CAPMODE(chmod, "/tmp/cap_capmode_chmod", 0644);
90 	CHECK_CAPMODE(chown, "/tmp/cap_capmode_chown", -1, -1);
91 	CHECK_CAPMODE(chroot, "/tmp/cap_capmode_chroot");
92 	CHECK_CAPMODE(connect, PF_INET, NULL, 0);
93 	CHECK_CAPMODE(creat, "/tmp/cap_capmode_creat", 0644);
94 	CHECK_CAPMODE(fchdir, fd_dir);
95 	CHECK_CAPMODE(getfsstat, &statfs, sizeof(statfs), MNT_NOWAIT);
96 	CHECK_CAPMODE(link, "/tmp/foo", "/tmp/bar");
97 	CHECK_CAPMODE(lstat, "/tmp/cap_capmode_lstat", &sb);
98 	CHECK_CAPMODE(mknod, "/tmp/capmode_mknod", 06440, 0);
99 	CHECK_CAPMODE(mount, "procfs", "/not_mounted", 0, NULL);
100 	CHECK_CAPMODE(open, "/dev/null", O_RDWR);
101 	CHECK_CAPMODE(readlink, "/tmp/cap_capmode_readlink", NULL, 0);
102 	CHECK_CAPMODE(revoke, "/tmp/cap_capmode_revoke");
103 	CHECK_CAPMODE(stat, "/tmp/cap_capmode_stat", &sb);
104 	CHECK_CAPMODE(symlink,
105 	    "/tmp/cap_capmode_symlink_from",
106 	    "/tmp/cap_capmode_symlink_to");
107 	CHECK_CAPMODE(unlink, "/tmp/cap_capmode_unlink");
108 	CHECK_CAPMODE(unmount, "/not_mounted", 0);
109 
110 	/*
111 	 * System calls that are permitted in capability mode.
112 	 */
113 	CHECK_SYSCALL_SUCCEEDS(close, fd_close);
114 	CHECK_SYSCALL_SUCCEEDS(dup, fd_file);
115 	CHECK_SYSCALL_SUCCEEDS(fstat, fd_file, &sb);
116 	CHECK_SYSCALL_SUCCEEDS(lseek, fd_file, 0, SEEK_SET);
117 	CHECK_SYSCALL_SUCCEEDS(msync, &fd_file, 8192, MS_ASYNC);
118 	CHECK_SYSCALL_SUCCEEDS(profil, NULL, 0, 0, 0);
119 	CHECK_SYSCALL_SUCCEEDS(read, fd_file, &ch, sizeof(ch));
120 	CHECK_SYSCALL_SUCCEEDS(recvfrom, fd_socket, NULL, 0, 0, NULL, NULL);
121 	CHECK_SYSCALL_SUCCEEDS(setuid, getuid());
122 	CHECK_SYSCALL_SUCCEEDS(write, fd_file, &ch, sizeof(ch));
123 
124 	/*
125 	 * These calls will fail for lack of e.g. a proper name to send to,
126 	 * but they are allowed in capability mode, so errno != ECAPMODE.
127 	 */
128 	CHECK_NOT_CAPMODE(accept, fd_socket, NULL, NULL);
129 	CHECK_NOT_CAPMODE(getpeername, fd_socket, NULL, NULL);
130 	CHECK_NOT_CAPMODE(getsockname, fd_socket, NULL, NULL);
131 	CHECK_NOT_CAPMODE(fchflags, fd_file, UF_NODUMP);
132 	CHECK_NOT_CAPMODE(recvmsg, fd_socket, NULL, 0);
133 	CHECK_NOT_CAPMODE(sendmsg, fd_socket, NULL, 0);
134 	CHECK_NOT_CAPMODE(sendto, fd_socket, NULL, 0, 0, NULL, 0);
135 
136 	/*
137 	 * System calls which should be allowed in capability mode, but which
138 	 * don't return errors, and are thus difficult to check.
139 	 *
140 	 * We will try anyway, by checking errno.
141 	 */
142 	CHECK_SYSCALL_VOID_NOT_ECAPMODE(getegid);
143 	CHECK_SYSCALL_VOID_NOT_ECAPMODE(geteuid);
144 	CHECK_SYSCALL_VOID_NOT_ECAPMODE(getgid);
145 	CHECK_SYSCALL_VOID_NOT_ECAPMODE(getpid);
146 	CHECK_SYSCALL_VOID_NOT_ECAPMODE(getppid);
147 	CHECK_SYSCALL_VOID_NOT_ECAPMODE(getuid);
148 
149 	/*
150 	 * Finally, tests for system calls that don't fit the pattern very well.
151 	 */
152 	pid = fork();
153 	if (pid >= 0) {
154 		if (pid == 0) {
155 			exit(0);
156 		} else if (pid > 0) {
157 			wpid = waitpid(pid, NULL, 0);
158 			if (wpid < 0) {
159 				if (errno != ECAPMODE)
160 					FAIL("capmode:waitpid");
161 			} else
162 				FAIL("capmode:waitpid succeeded");
163 		}
164 	} else
165 		FAIL("capmode:fork");
166 
167 	if (getlogin() == NULL)
168 		FAIL("test_sycalls:getlogin %d", errno);
169 
170 	if (getsockname(fd_socket, NULL, NULL) < 0) {
171 		if (errno == ECAPMODE)
172 			FAIL("capmode:getsockname");
173 	}
174 
175 	/* XXXRW: ktrace */
176 
177 	if (pipe(fd2) == 0) {
178 		close(fd2[0]);
179 		close(fd2[1]);
180 	} else if (errno == ECAPMODE)
181 		FAIL("capmode:pipe");
182 
183 	/* XXXRW: ptrace. */
184 
185 	/* sysarch() is, by definition, architecture-dependent */
186 #if defined (__amd64__) || defined (__i386__)
187 	CHECK_CAPMODE(sysarch, I386_SET_IOPERM, &sysarch_arg);
188 #else
189 	/* XXXJA: write a test for arm */
190 	FAIL("capmode:no sysarch() test for current architecture");
191 #endif
192 
193 	/* XXXRW: No error return from sync(2) to test. */
194 
195 	return (success);
196 }
197