1#!/bin/sh 2 3# 4# Copyright (c) 2014 EMC Corp. 5# All rights reserved. 6# 7# Redistribution and use in source and binary forms, with or without 8# modification, are permitted provided that the following conditions 9# are met: 10# 1. Redistributions of source code must retain the above copyright 11# notice, this list of conditions and the following disclaimer. 12# 2. Redistributions in binary form must reproduce the above copyright 13# notice, this list of conditions and the following disclaimer in the 14# documentation and/or other materials provided with the distribution. 15# 16# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26# SUCH DAMAGE. 27# 28 29[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1 30 31# Test that a non root user can at most have maxproc - 10 processes. 32 33. ../default.cfg 34 35here=`pwd` 36cd /tmp 37sed '1,/^EOF/d' < $here/$0 > maxproc.c 38mycc -o maxproc -Wall -Wextra maxproc.c -lkvm || exit 1 39rm -f maxproc.c 40[ `sysctl -n kern.maxproc` -gt 37028 ] && exit 0 # Excessive run time 41cd $here 42 43/tmp/maxproc 44 45rm -f /tmp/maxproc 46exit 47EOF 48#include <sys/wait.h> 49 50#include <err.h> 51#include <fcntl.h> 52#include <kvm.h> 53#include <limits.h> 54#include <pwd.h> 55#include <signal.h> 56#include <stdio.h> 57#include <string.h> 58#include <unistd.h> 59 60enum { 61 NL_NPROCS, 62 NL_MAXPROC, 63 NL_MARKER 64}; 65 66static struct { 67 int order; 68 const char *name; 69} namelist[] = { 70 { NL_NPROCS, "_nprocs" }, 71 { NL_MAXPROC, "_maxproc" }, 72 { NL_MARKER, "" }, 73}; 74 75#define NNAMES (sizeof(namelist) / sizeof(*namelist)) 76#define MULTIUSERFUZZ 5 77 78static struct nlist nl[NNAMES]; 79 80static void 81t2(void) 82{ 83 pid_t p; 84 85 for (;;) { 86 if ((p = fork()) == 0) { 87 sleep(2); 88 _exit(0); 89 } 90 if (p == -1) 91 break; 92 } 93} 94 95static void 96t1(int priv) 97{ 98 pid_t p; 99 struct passwd *pw; 100 101 if ((p = fork()) == 0) { 102 if ((pw = getpwnam("nobody")) == NULL) 103 err(1, "no such user: nobody"); 104 105 if (priv == 0) { 106 if (setgroups(1, &pw->pw_gid) || 107 setegid(pw->pw_gid) || setgid(pw->pw_gid) || 108 seteuid(pw->pw_uid) || setuid(pw->pw_uid)) 109 err(1, "Can't drop privileges to \"nobody\""); 110 } 111 endpwent(); 112 113 t2(); 114 _exit(0); 115 } 116 waitpid(p, NULL, 0); 117} 118 119int 120getprocs(void) 121{ 122 kvm_t *kd; 123 int i, nprocs, maxproc; 124 char buf[_POSIX2_LINE_MAX]; 125 char *nlistf, *memf; 126 127 nlistf = memf = NULL; 128 for (i = 0; i < (int)NNAMES; i++) 129 nl[namelist[i].order].n_name = strdup(namelist[i].name); 130 131 if ((kd = kvm_openfiles(nlistf, memf, NULL, O_RDONLY, buf)) == NULL) 132 errx(1, "kvm_openfile(%s, %s): %s", nlistf, memf, buf); 133 if (kvm_nlist(kd, nl) == -1) 134 errx(1, "kvm_nlist: %s", kvm_geterr(kd)); 135 if (kvm_read(kd, nl[NL_NPROCS].n_value, &nprocs, 136 sizeof(nprocs)) != sizeof(nprocs)) 137 errx(1, "kvm_read(): %s", kvm_geterr(kd)); 138 if (kvm_read(kd, nl[NL_MAXPROC].n_value, &maxproc, 139 sizeof(maxproc)) != sizeof(maxproc)) 140 errx(1, "kvm_read(): %s", kvm_geterr(kd)); 141 kvm_close(kd); 142 143 return (maxproc - nprocs - 1); 144} 145 146int 147main(void) 148{ 149 int i, n; 150 151 alarm(1200); 152 n = getprocs(); 153 for (i = 0; i < n / 10 * 8; i++) { 154 if (fork() == 0) { 155 sleep(2); 156 _exit(0); 157 } 158 } 159 160 t1(0); 161 162 n = getprocs(); 163 if (n < 10 - MULTIUSERFUZZ) 164 errx(1, "FAIL: nprocs = %d\n", n); 165 166 return (0); 167} 168