1 /*- 2 * Copyright (c) 2008-2009 Robert N. M. Watson 3 * Copyright (c) 2011 Jonathan Anderson 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 */ 27 28 /* 29 * Test routines to make sure a variety of system calls are or are not 30 * available in capability mode. The goal is not to see if they work, just 31 * whether or not they return the expected ECAPMODE. 32 */ 33 34 #include <sys/cdefs.h> 35 __FBSDID("$FreeBSD$"); 36 37 #include <sys/param.h> 38 #include <sys/capsicum.h> 39 #include <sys/errno.h> 40 #include <sys/mman.h> 41 #include <sys/mount.h> 42 #include <sys/socket.h> 43 #include <sys/stat.h> 44 #include <sys/wait.h> 45 46 #include <machine/sysarch.h> 47 48 #include <err.h> 49 #include <fcntl.h> 50 #include <stdlib.h> 51 #include <string.h> 52 #include <unistd.h> 53 54 #include "cap_test.h" 55 56 #define CHECK_SYSCALL_VOID_NOT_ECAPMODE(syscall, ...) do { \ 57 errno = 0; \ 58 (void)syscall(__VA_ARGS__); \ 59 if (errno == ECAPMODE) \ 60 FAIL("capmode: %s failed with ECAPMODE", #syscall); \ 61 } while (0) 62 63 int 64 test_capmode(void) 65 { 66 struct statfs statfs; 67 struct stat sb; 68 long sysarch_arg = 0; 69 int fd_close, fd_dir, fd_file, fd_socket, fd2[2]; 70 int success = PASSED; 71 pid_t pid, wpid; 72 char ch; 73 74 /* Open some files to play with. */ 75 REQUIRE(fd_file = open("/tmp/cap_capmode", O_RDWR|O_CREAT, 0644)); 76 REQUIRE(fd_close = open("/dev/null", O_RDWR)); 77 REQUIRE(fd_dir = open("/tmp", O_RDONLY)); 78 REQUIRE(fd_socket = socket(PF_INET, SOCK_DGRAM, 0)); 79 80 /* Enter capability mode. */ 81 REQUIRE(cap_enter()); 82 83 /* 84 * System calls that are not permitted in capability mode. 85 */ 86 CHECK_CAPMODE(access, "/tmp/cap_capmode_access", F_OK); 87 CHECK_CAPMODE(acct, "/tmp/cap_capmode_acct"); 88 CHECK_CAPMODE(bind, PF_INET, NULL, 0); 89 CHECK_CAPMODE(chdir, "/tmp/cap_capmode_chdir"); 90 CHECK_CAPMODE(chflags, "/tmp/cap_capmode_chflags", UF_NODUMP); 91 CHECK_CAPMODE(chmod, "/tmp/cap_capmode_chmod", 0644); 92 CHECK_CAPMODE(chown, "/tmp/cap_capmode_chown", -1, -1); 93 CHECK_CAPMODE(chroot, "/tmp/cap_capmode_chroot"); 94 CHECK_CAPMODE(connect, PF_INET, NULL, 0); 95 CHECK_CAPMODE(creat, "/tmp/cap_capmode_creat", 0644); 96 CHECK_CAPMODE(fchdir, fd_dir); 97 CHECK_CAPMODE(getfsstat, &statfs, sizeof(statfs), MNT_NOWAIT); 98 CHECK_CAPMODE(link, "/tmp/foo", "/tmp/bar"); 99 CHECK_CAPMODE(lstat, "/tmp/cap_capmode_lstat", &sb); 100 CHECK_CAPMODE(mknod, "/tmp/capmode_mknod", 06440, 0); 101 CHECK_CAPMODE(mount, "procfs", "/not_mounted", 0, NULL); 102 CHECK_CAPMODE(open, "/dev/null", O_RDWR); 103 CHECK_CAPMODE(readlink, "/tmp/cap_capmode_readlink", NULL, 0); 104 CHECK_CAPMODE(revoke, "/tmp/cap_capmode_revoke"); 105 CHECK_CAPMODE(stat, "/tmp/cap_capmode_stat", &sb); 106 CHECK_CAPMODE(symlink, 107 "/tmp/cap_capmode_symlink_from", 108 "/tmp/cap_capmode_symlink_to"); 109 CHECK_CAPMODE(unlink, "/tmp/cap_capmode_unlink"); 110 CHECK_CAPMODE(unmount, "/not_mounted", 0); 111 112 /* 113 * System calls that are permitted in capability mode. 114 */ 115 CHECK_SYSCALL_SUCCEEDS(close, fd_close); 116 CHECK_SYSCALL_SUCCEEDS(dup, fd_file); 117 CHECK_SYSCALL_SUCCEEDS(fstat, fd_file, &sb); 118 CHECK_SYSCALL_SUCCEEDS(lseek, fd_file, 0, SEEK_SET); 119 CHECK_SYSCALL_SUCCEEDS(msync, &fd_file, 8192, MS_ASYNC); 120 CHECK_SYSCALL_SUCCEEDS(profil, NULL, 0, 0, 0); 121 CHECK_SYSCALL_SUCCEEDS(read, fd_file, &ch, sizeof(ch)); 122 CHECK_SYSCALL_SUCCEEDS(recvfrom, fd_socket, NULL, 0, 0, NULL, NULL); 123 CHECK_SYSCALL_SUCCEEDS(setuid, getuid()); 124 CHECK_SYSCALL_SUCCEEDS(write, fd_file, &ch, sizeof(ch)); 125 126 /* 127 * These calls will fail for lack of e.g. a proper name to send to, 128 * but they are allowed in capability mode, so errno != ECAPMODE. 129 */ 130 CHECK_NOT_CAPMODE(accept, fd_socket, NULL, NULL); 131 CHECK_NOT_CAPMODE(getpeername, fd_socket, NULL, NULL); 132 CHECK_NOT_CAPMODE(getsockname, fd_socket, NULL, NULL); 133 CHECK_NOT_CAPMODE(fchflags, fd_file, UF_NODUMP); 134 CHECK_NOT_CAPMODE(recvmsg, fd_socket, NULL, 0); 135 CHECK_NOT_CAPMODE(sendmsg, fd_socket, NULL, 0); 136 CHECK_NOT_CAPMODE(sendto, fd_socket, NULL, 0, 0, NULL, 0); 137 138 /* 139 * System calls which should be allowed in capability mode, but which 140 * don't return errors, and are thus difficult to check. 141 * 142 * We will try anyway, by checking errno. 143 */ 144 CHECK_SYSCALL_VOID_NOT_ECAPMODE(getegid); 145 CHECK_SYSCALL_VOID_NOT_ECAPMODE(geteuid); 146 CHECK_SYSCALL_VOID_NOT_ECAPMODE(getgid); 147 CHECK_SYSCALL_VOID_NOT_ECAPMODE(getpid); 148 CHECK_SYSCALL_VOID_NOT_ECAPMODE(getppid); 149 CHECK_SYSCALL_VOID_NOT_ECAPMODE(getuid); 150 151 /* 152 * Finally, tests for system calls that don't fit the pattern very well. 153 */ 154 pid = fork(); 155 if (pid >= 0) { 156 if (pid == 0) { 157 exit(0); 158 } else if (pid > 0) { 159 wpid = waitpid(pid, NULL, 0); 160 if (wpid < 0) { 161 if (errno != ECAPMODE) 162 FAIL("capmode:waitpid"); 163 } else 164 FAIL("capmode:waitpid succeeded"); 165 } 166 } else 167 FAIL("capmode:fork"); 168 169 if (getlogin() == NULL) 170 FAIL("test_sycalls:getlogin %d", errno); 171 172 if (getsockname(fd_socket, NULL, NULL) < 0) { 173 if (errno == ECAPMODE) 174 FAIL("capmode:getsockname"); 175 } 176 177 /* XXXRW: ktrace */ 178 179 if (pipe(fd2) == 0) { 180 close(fd2[0]); 181 close(fd2[1]); 182 } else if (errno == ECAPMODE) 183 FAIL("capmode:pipe"); 184 185 /* XXXRW: ptrace. */ 186 187 /* sysarch() is, by definition, architecture-dependent */ 188 #if defined (__amd64__) || defined (__i386__) 189 CHECK_CAPMODE(sysarch, I386_SET_IOPERM, &sysarch_arg); 190 #else 191 /* XXXJA: write a test for arm */ 192 FAIL("capmode:no sysarch() test for current architecture"); 193 #endif 194 195 /* XXXRW: No error return from sync(2) to test. */ 196 197 return (success); 198 } 199