1 // SPDX-License-Identifier: GPL-2.0 2 #define _GNU_SOURCE 3 4 #include <cap-ng.h> 5 #include <linux/capability.h> 6 #include <stdbool.h> 7 #include <string.h> 8 #include <stdio.h> 9 #include <fcntl.h> 10 #include <errno.h> 11 #include <stdarg.h> 12 #include <sched.h> 13 #include <sys/mount.h> 14 #include <limits.h> 15 #include <libgen.h> 16 #include <malloc.h> 17 #include <sys/wait.h> 18 #include <sys/prctl.h> 19 #include <sys/stat.h> 20 21 #include "../kselftest.h" 22 23 #ifndef PR_CAP_AMBIENT 24 #define PR_CAP_AMBIENT 47 25 # define PR_CAP_AMBIENT_IS_SET 1 26 # define PR_CAP_AMBIENT_RAISE 2 27 # define PR_CAP_AMBIENT_LOWER 3 28 # define PR_CAP_AMBIENT_CLEAR_ALL 4 29 #endif 30 31 static int nerrs; 32 static pid_t mpid; /* main() pid is used to avoid duplicate test counts */ 33 34 static void vmaybe_write_file(bool enoent_ok, char *filename, char *fmt, va_list ap) 35 { 36 char buf[4096]; 37 int fd; 38 ssize_t written; 39 int buf_len; 40 41 buf_len = vsnprintf(buf, sizeof(buf), fmt, ap); 42 if (buf_len < 0) 43 ksft_exit_fail_msg("vsnprintf failed - %s\n", strerror(errno)); 44 45 if (buf_len >= sizeof(buf)) 46 ksft_exit_fail_msg("vsnprintf output truncated\n"); 47 48 49 fd = open(filename, O_WRONLY); 50 if (fd < 0) { 51 if ((errno == ENOENT) && enoent_ok) 52 return; 53 ksft_exit_fail_msg("open of %s failed - %s\n", 54 filename, strerror(errno)); 55 } 56 written = write(fd, buf, buf_len); 57 if (written != buf_len) { 58 if (written >= 0) { 59 ksft_exit_fail_msg("short write to %s\n", filename); 60 } else { 61 ksft_exit_fail_msg("write to %s failed - %s\n", 62 filename, strerror(errno)); 63 } 64 } 65 if (close(fd) != 0) { 66 ksft_exit_fail_msg("close of %s failed - %s\n", 67 filename, strerror(errno)); 68 } 69 } 70 71 static void maybe_write_file(char *filename, char *fmt, ...) 72 { 73 va_list ap; 74 75 va_start(ap, fmt); 76 vmaybe_write_file(true, filename, fmt, ap); 77 va_end(ap); 78 } 79 80 static void write_file(char *filename, char *fmt, ...) 81 { 82 va_list ap; 83 84 va_start(ap, fmt); 85 vmaybe_write_file(false, filename, fmt, ap); 86 va_end(ap); 87 } 88 89 static bool create_and_enter_ns(uid_t inner_uid) 90 { 91 uid_t outer_uid; 92 gid_t outer_gid; 93 int i; 94 bool have_outer_privilege; 95 96 outer_uid = getuid(); 97 outer_gid = getgid(); 98 99 /* 100 * TODO: If we're already root, we could skip creating the userns. 101 */ 102 103 if (unshare(CLONE_NEWNS) == 0) { 104 ksft_print_msg("[NOTE]\tUsing global UIDs for tests\n"); 105 if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) != 0) 106 ksft_exit_fail_msg("PR_SET_KEEPCAPS - %s\n", 107 strerror(errno)); 108 if (setresuid(inner_uid, inner_uid, -1) != 0) 109 ksft_exit_fail_msg("setresuid - %s\n", strerror(errno)); 110 111 // Re-enable effective caps 112 capng_get_caps_process(); 113 for (i = 0; i < CAP_LAST_CAP; i++) 114 if (capng_have_capability(CAPNG_PERMITTED, i)) 115 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, i); 116 if (capng_apply(CAPNG_SELECT_CAPS) != 0) 117 ksft_exit_fail_msg( 118 "capng_apply - %s\n", strerror(errno)); 119 120 have_outer_privilege = true; 121 } else if (unshare(CLONE_NEWUSER | CLONE_NEWNS) == 0) { 122 ksft_print_msg("[NOTE]\tUsing a user namespace for tests\n"); 123 maybe_write_file("/proc/self/setgroups", "deny"); 124 write_file("/proc/self/uid_map", "%d %d 1", inner_uid, outer_uid); 125 write_file("/proc/self/gid_map", "0 %d 1", outer_gid); 126 127 have_outer_privilege = false; 128 } else { 129 ksft_exit_skip("must be root or be able to create a userns\n"); 130 } 131 132 if (mount("none", "/", NULL, MS_REC | MS_PRIVATE, NULL) != 0) 133 ksft_exit_fail_msg("remount everything private - %s\n", 134 strerror(errno)); 135 136 return have_outer_privilege; 137 } 138 139 static void chdir_to_tmpfs(void) 140 { 141 char cwd[PATH_MAX]; 142 if (getcwd(cwd, sizeof(cwd)) != cwd) 143 ksft_exit_fail_msg("getcwd - %s\n", strerror(errno)); 144 145 if (mount("private_tmp", ".", "tmpfs", 0, "mode=0777") != 0) 146 ksft_exit_fail_msg("mount private tmpfs - %s\n", 147 strerror(errno)); 148 149 if (chdir(cwd) != 0) 150 ksft_exit_fail_msg("chdir to private tmpfs - %s\n", 151 strerror(errno)); 152 } 153 154 static void copy_fromat_to(int fromfd, const char *fromname, const char *toname) 155 { 156 int from = openat(fromfd, fromname, O_RDONLY); 157 if (from == -1) 158 ksft_exit_fail_msg("open copy source - %s\n", strerror(errno)); 159 160 int to = open(toname, O_CREAT | O_WRONLY | O_EXCL, 0700); 161 162 while (true) { 163 char buf[4096]; 164 ssize_t sz = read(from, buf, sizeof(buf)); 165 if (sz == 0) 166 break; 167 if (sz < 0) 168 ksft_exit_fail_msg("read - %s\n", strerror(errno)); 169 170 if (write(to, buf, sz) != sz) 171 /* no short writes on tmpfs */ 172 ksft_exit_fail_msg("write - %s\n", strerror(errno)); 173 } 174 175 close(from); 176 close(to); 177 } 178 179 static bool fork_wait(void) 180 { 181 pid_t child = fork(); 182 if (child == 0) { 183 nerrs = 0; 184 return true; 185 } else if (child > 0) { 186 int status; 187 if (waitpid(child, &status, 0) != child || 188 !WIFEXITED(status)) { 189 ksft_print_msg("Child died\n"); 190 nerrs++; 191 } else if (WEXITSTATUS(status) != 0) { 192 ksft_print_msg("Child failed\n"); 193 nerrs++; 194 } else { 195 /* don't print this message for mpid */ 196 if (getpid() != mpid) 197 ksft_test_result_pass("Passed\n"); 198 } 199 return false; 200 } else { 201 ksft_exit_fail_msg("fork - %s\n", strerror(errno)); 202 return false; 203 } 204 } 205 206 static void exec_other_validate_cap(const char *name, 207 bool eff, bool perm, bool inh, bool ambient) 208 { 209 execl(name, name, (eff ? "1" : "0"), 210 (perm ? "1" : "0"), (inh ? "1" : "0"), (ambient ? "1" : "0"), 211 NULL); 212 ksft_exit_fail_msg("execl - %s\n", strerror(errno)); 213 } 214 215 static void exec_validate_cap(bool eff, bool perm, bool inh, bool ambient) 216 { 217 exec_other_validate_cap("./validate_cap", eff, perm, inh, ambient); 218 } 219 220 static int do_tests(int uid, const char *our_path) 221 { 222 bool have_outer_privilege = create_and_enter_ns(uid); 223 224 int ourpath_fd = open(our_path, O_RDONLY | O_DIRECTORY); 225 if (ourpath_fd == -1) 226 ksft_exit_fail_msg("open '%s' - %s\n", 227 our_path, strerror(errno)); 228 229 chdir_to_tmpfs(); 230 231 copy_fromat_to(ourpath_fd, "validate_cap", "validate_cap"); 232 233 if (have_outer_privilege) { 234 uid_t gid = getegid(); 235 236 copy_fromat_to(ourpath_fd, "validate_cap", 237 "validate_cap_suidroot"); 238 if (chown("validate_cap_suidroot", 0, -1) != 0) 239 ksft_exit_fail_msg("chown - %s\n", strerror(errno)); 240 if (chmod("validate_cap_suidroot", S_ISUID | 0700) != 0) 241 ksft_exit_fail_msg("chmod - %s\n", strerror(errno)); 242 243 copy_fromat_to(ourpath_fd, "validate_cap", 244 "validate_cap_suidnonroot"); 245 if (chown("validate_cap_suidnonroot", uid + 1, -1) != 0) 246 ksft_exit_fail_msg("chown - %s\n", strerror(errno)); 247 if (chmod("validate_cap_suidnonroot", S_ISUID | 0700) != 0) 248 ksft_exit_fail_msg("chmod - %s\n", strerror(errno)); 249 250 copy_fromat_to(ourpath_fd, "validate_cap", 251 "validate_cap_sgidroot"); 252 if (chown("validate_cap_sgidroot", -1, 0) != 0) 253 ksft_exit_fail_msg("chown - %s\n", strerror(errno)); 254 if (chmod("validate_cap_sgidroot", S_ISGID | 0710) != 0) 255 ksft_exit_fail_msg("chmod - %s\n", strerror(errno)); 256 257 copy_fromat_to(ourpath_fd, "validate_cap", 258 "validate_cap_sgidnonroot"); 259 if (chown("validate_cap_sgidnonroot", -1, gid + 1) != 0) 260 ksft_exit_fail_msg("chown - %s\n", strerror(errno)); 261 if (chmod("validate_cap_sgidnonroot", S_ISGID | 0710) != 0) 262 ksft_exit_fail_msg("chmod - %s\n", strerror(errno)); 263 } 264 265 capng_get_caps_process(); 266 267 /* Make sure that i starts out clear */ 268 capng_update(CAPNG_DROP, CAPNG_INHERITABLE, CAP_NET_BIND_SERVICE); 269 if (capng_apply(CAPNG_SELECT_CAPS) != 0) 270 ksft_exit_fail_msg("capng_apply - %s\n", strerror(errno)); 271 272 if (uid == 0) { 273 ksft_print_msg("[RUN]\tRoot => ep\n"); 274 if (fork_wait()) 275 exec_validate_cap(true, true, false, false); 276 } else { 277 ksft_print_msg("[RUN]\tNon-root => no caps\n"); 278 if (fork_wait()) 279 exec_validate_cap(false, false, false, false); 280 } 281 282 ksft_print_msg("Check cap_ambient manipulation rules\n"); 283 284 /* We should not be able to add ambient caps yet. */ 285 if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_NET_BIND_SERVICE, 0, 0, 0) != -1 || errno != EPERM) { 286 if (errno == EINVAL) 287 ksft_test_result_fail( 288 "PR_CAP_AMBIENT_RAISE isn't supported\n"); 289 else 290 ksft_test_result_fail( 291 "PR_CAP_AMBIENT_RAISE should have failed eith EPERM on a non-inheritable cap\n"); 292 return 1; 293 } 294 ksft_test_result_pass( 295 "PR_CAP_AMBIENT_RAISE failed on non-inheritable cap\n"); 296 297 capng_update(CAPNG_ADD, CAPNG_INHERITABLE, CAP_NET_RAW); 298 capng_update(CAPNG_DROP, CAPNG_PERMITTED, CAP_NET_RAW); 299 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_NET_RAW); 300 if (capng_apply(CAPNG_SELECT_CAPS) != 0) 301 ksft_exit_fail_msg("capng_apply - %s\n", strerror(errno)); 302 if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_NET_RAW, 0, 0, 0) != -1 || errno != EPERM) { 303 ksft_test_result_fail( 304 "PR_CAP_AMBIENT_RAISE should have failed on a non-permitted cap\n"); 305 return 1; 306 } 307 ksft_test_result_pass( 308 "PR_CAP_AMBIENT_RAISE failed on non-permitted cap\n"); 309 310 capng_update(CAPNG_ADD, CAPNG_INHERITABLE, CAP_NET_BIND_SERVICE); 311 if (capng_apply(CAPNG_SELECT_CAPS) != 0) 312 ksft_exit_fail_msg("capng_apply - %s\n", strerror(errno)); 313 if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_NET_BIND_SERVICE, 0, 0, 0) != 0) { 314 ksft_test_result_fail( 315 "PR_CAP_AMBIENT_RAISE should have succeeded\n"); 316 return 1; 317 } 318 ksft_test_result_pass("PR_CAP_AMBIENT_RAISE worked\n"); 319 320 if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_NET_BIND_SERVICE, 0, 0, 0) != 1) { 321 ksft_test_result_fail("PR_CAP_AMBIENT_IS_SET is broken\n"); 322 return 1; 323 } 324 325 if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0, 0) != 0) 326 ksft_exit_fail_msg("PR_CAP_AMBIENT_CLEAR_ALL - %s\n", 327 strerror(errno)); 328 329 if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_NET_BIND_SERVICE, 0, 0, 0) != 0) { 330 ksft_test_result_fail( 331 "PR_CAP_AMBIENT_CLEAR_ALL didn't work\n"); 332 return 1; 333 } 334 335 if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_NET_BIND_SERVICE, 0, 0, 0) != 0) 336 ksft_exit_fail_msg("PR_CAP_AMBIENT_RAISE - %s\n", 337 strerror(errno)); 338 339 capng_update(CAPNG_DROP, CAPNG_INHERITABLE, CAP_NET_BIND_SERVICE); 340 if (capng_apply(CAPNG_SELECT_CAPS) != 0) 341 ksft_exit_fail_msg("capng_apply - %s\n", strerror(errno)); 342 343 if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_NET_BIND_SERVICE, 0, 0, 0) != 0) { 344 ksft_test_result_fail("Dropping I should have dropped A\n"); 345 return 1; 346 } 347 348 ksft_test_result_pass("Basic manipulation appears to work\n"); 349 350 capng_update(CAPNG_ADD, CAPNG_INHERITABLE, CAP_NET_BIND_SERVICE); 351 if (capng_apply(CAPNG_SELECT_CAPS) != 0) 352 ksft_exit_fail_msg("capng_apply - %s\n", strerror(errno)); 353 if (uid == 0) { 354 ksft_print_msg("[RUN]\tRoot +i => eip\n"); 355 if (fork_wait()) 356 exec_validate_cap(true, true, true, false); 357 } else { 358 ksft_print_msg("[RUN]\tNon-root +i => i\n"); 359 if (fork_wait()) 360 exec_validate_cap(false, false, true, false); 361 } 362 363 if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_NET_BIND_SERVICE, 0, 0, 0) != 0) 364 ksft_exit_fail_msg("PR_CAP_AMBIENT_RAISE - %s\n", 365 strerror(errno)); 366 367 ksft_print_msg("[RUN]\tUID %d +ia => eipa\n", uid); 368 if (fork_wait()) 369 exec_validate_cap(true, true, true, true); 370 371 /* The remaining tests need real privilege */ 372 373 if (!have_outer_privilege) { 374 ksft_test_result_skip("SUID/SGID tests (needs privilege)\n"); 375 goto done; 376 } 377 378 if (uid == 0) { 379 ksft_print_msg("[RUN]\tRoot +ia, suidroot => eipa\n"); 380 if (fork_wait()) 381 exec_other_validate_cap("./validate_cap_suidroot", 382 true, true, true, true); 383 384 ksft_print_msg("[RUN]\tRoot +ia, suidnonroot => ip\n"); 385 if (fork_wait()) 386 exec_other_validate_cap("./validate_cap_suidnonroot", 387 false, true, true, false); 388 389 ksft_print_msg("[RUN]\tRoot +ia, sgidroot => eipa\n"); 390 if (fork_wait()) 391 exec_other_validate_cap("./validate_cap_sgidroot", 392 true, true, true, true); 393 394 if (fork_wait()) { 395 ksft_print_msg( 396 "[RUN]\tRoot, gid != 0, +ia, sgidroot => eip\n"); 397 if (setresgid(1, 1, 1) != 0) 398 ksft_exit_fail_msg("setresgid - %s\n", 399 strerror(errno)); 400 exec_other_validate_cap("./validate_cap_sgidroot", 401 true, true, true, false); 402 } 403 404 ksft_print_msg("[RUN]\tRoot +ia, sgidnonroot => eip\n"); 405 if (fork_wait()) 406 exec_other_validate_cap("./validate_cap_sgidnonroot", 407 true, true, true, false); 408 } else { 409 ksft_print_msg("[RUN]\tNon-root +ia, sgidnonroot => i\n"); 410 if (fork_wait()) 411 exec_other_validate_cap("./validate_cap_sgidnonroot", 412 false, false, true, false); 413 414 if (fork_wait()) { 415 ksft_print_msg("[RUN]\tNon-root +ia, sgidroot => i\n"); 416 if (setresgid(1, 1, 1) != 0) 417 ksft_exit_fail_msg("setresgid - %s\n", 418 strerror(errno)); 419 exec_other_validate_cap("./validate_cap_sgidroot", 420 false, false, true, false); 421 } 422 } 423 424 done: 425 ksft_print_cnts(); 426 return nerrs ? 1 : 0; 427 } 428 429 int main(int argc, char **argv) 430 { 431 char *tmp1, *tmp2, *our_path; 432 433 /* Find our path */ 434 tmp1 = strdup(argv[0]); 435 if (!tmp1) 436 ksft_exit_fail_msg("strdup - %s\n", strerror(errno)); 437 tmp2 = dirname(tmp1); 438 our_path = strdup(tmp2); 439 if (!our_path) 440 ksft_exit_fail_msg("strdup - %s\n", strerror(errno)); 441 free(tmp1); 442 443 mpid = getpid(); 444 445 if (fork_wait()) { 446 ksft_print_header(); 447 ksft_set_plan(12); 448 ksft_print_msg("[RUN]\t+++ Tests with uid == 0 +++\n"); 449 return do_tests(0, our_path); 450 } 451 452 ksft_print_msg("==================================================\n"); 453 454 if (fork_wait()) { 455 ksft_print_header(); 456 ksft_set_plan(9); 457 ksft_print_msg("[RUN]\t+++ Tests with uid != 0 +++\n"); 458 return do_tests(1, our_path); 459 } 460 461 return nerrs ? 1 : 0; 462 } 463