daandemeyer / rpms / systemd

Forked from rpms/systemd 2 years ago
Clone
a19bc6
From 900251c41dab192ff863024e07864c09462e86d2 Mon Sep 17 00:00:00 2001
a19bc6
From: Lukas Nykryn <lnykryn@redhat.com>
a19bc6
Date: Mon, 20 Mar 2017 12:24:09 +0100
a19bc6
Subject: [PATCH] test-capability: rebase to upstream version
a19bc6
a19bc6
Related: #1387398
a19bc6
---
a19bc6
 src/test/test-capability.c                         | 80 +++++++++++++++++++---
a19bc6
 src/test/test-execute.c                            | 43 ++++++++++++
a19bc6
 ...ec-capabilityambientset-merge-nfsnobody.service |  9 +++
a19bc6
 test/exec-capabilityambientset-merge.service       |  9 +++
a19bc6
 test/exec-capabilityambientset-nfsnobody.service   |  8 +++
a19bc6
 test/exec-capabilityambientset.service             |  8 +++
a19bc6
 test/exec-capabilityboundingset-invert.service     |  7 ++
a19bc6
 test/exec-capabilityboundingset-merge.service      |  8 +++
a19bc6
 test/exec-capabilityboundingset-reset.service      |  8 +++
a19bc6
 test/exec-capabilityboundingset-simple.service     |  7 ++
a19bc6
 10 files changed, 179 insertions(+), 8 deletions(-)
a19bc6
 create mode 100644 test/exec-capabilityambientset-merge-nfsnobody.service
a19bc6
 create mode 100644 test/exec-capabilityambientset-merge.service
a19bc6
 create mode 100644 test/exec-capabilityambientset-nfsnobody.service
a19bc6
 create mode 100644 test/exec-capabilityambientset.service
a19bc6
 create mode 100644 test/exec-capabilityboundingset-invert.service
a19bc6
 create mode 100644 test/exec-capabilityboundingset-merge.service
a19bc6
 create mode 100644 test/exec-capabilityboundingset-reset.service
a19bc6
 create mode 100644 test/exec-capabilityboundingset-simple.service
a19bc6
a19bc6
diff --git a/src/test/test-capability.c b/src/test/test-capability.c
181b3f
index 43769923b..67a9ec2d1 100644
a19bc6
--- a/src/test/test-capability.c
a19bc6
+++ b/src/test/test-capability.c
a19bc6
@@ -17,21 +17,22 @@
a19bc6
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
a19bc6
 ***/
a19bc6
 
a19bc6
-#include <sys/types.h>
a19bc6
-#include <sys/wait.h>
a19bc6
-#include <sys/capability.h>
a19bc6
-#include <sys/socket.h>
a19bc6
 #include <netinet/in.h>
a19bc6
 #include <pwd.h>
a19bc6
+#include <sys/capability.h>
a19bc6
+#include <sys/prctl.h>
a19bc6
+#include <sys/socket.h>
a19bc6
+#include <sys/wait.h>
a19bc6
 #include <unistd.h>
a19bc6
 
a19bc6
 #include "capability.h"
a19bc6
-#include "util.h"
a19bc6
 #include "macro.h"
a19bc6
+#include "util.h"
a19bc6
 
a19bc6
 static uid_t test_uid = -1;
a19bc6
 static gid_t test_gid = -1;
a19bc6
-// We keep CAP_DAC_OVERRIDE to avoid errors with gcov when doing test coverage
a19bc6
+
a19bc6
+/* We keep CAP_DAC_OVERRIDE to avoid errors with gcov when doing test coverage */
a19bc6
 static uint64_t test_flags = 1ULL << CAP_DAC_OVERRIDE;
a19bc6
 
a19bc6
 static void fork_test(void (*test_func)(void)) {
a19bc6
@@ -65,8 +66,9 @@ static void show_capabilities(void) {
a19bc6
         cap_free(text);
a19bc6
 }
a19bc6
 
a19bc6
-static int setup_tests(void) {
a19bc6
+static int setup_tests(bool *run_ambient) {
a19bc6
         struct passwd *nobody;
a19bc6
+        int r;
a19bc6
 
a19bc6
         nobody = getpwnam("nobody");
a19bc6
         if (!nobody) {
a19bc6
@@ -76,6 +78,18 @@ static int setup_tests(void) {
a19bc6
         test_uid = nobody->pw_uid;
a19bc6
         test_gid = nobody->pw_gid;
a19bc6
 
a19bc6
+        *run_ambient = false;
a19bc6
+
a19bc6
+        r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
a19bc6
+
a19bc6
+        /* There's support for PR_CAP_AMBIENT if the prctl() call
a19bc6
+         * succeeded or error code was something else than EINVAL. The
a19bc6
+         * EINVAL check should be good enough to rule out false
a19bc6
+         * positives. */
a19bc6
+
a19bc6
+        if (r >= 0 || errno != EINVAL)
a19bc6
+                *run_ambient = true;
a19bc6
+
a19bc6
         return 0;
a19bc6
 }
a19bc6
 
a19bc6
@@ -139,8 +153,53 @@ static void test_have_effective_cap(void) {
a19bc6
         assert_se(!have_effective_cap(CAP_CHOWN));
a19bc6
 }
a19bc6
 
a19bc6
+static void test_update_inherited_set(void) {
a19bc6
+        cap_t caps;
a19bc6
+        uint64_t set = 0;
a19bc6
+        cap_flag_value_t fv;
a19bc6
+
a19bc6
+        caps = cap_get_proc();
a19bc6
+        assert_se(caps);
a19bc6
+        assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
a19bc6
+        assert(fv == CAP_CLEAR);
a19bc6
+
a19bc6
+        set = (UINT64_C(1) << CAP_CHOWN);
a19bc6
+
a19bc6
+        assert_se(!capability_update_inherited_set(caps, set));
a19bc6
+        assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
a19bc6
+        assert(fv == CAP_SET);
a19bc6
+
a19bc6
+        cap_free(caps);
a19bc6
+}
a19bc6
+
a19bc6
+static void test_set_ambient_caps(void) {
a19bc6
+        cap_t caps;
a19bc6
+        uint64_t set = 0;
a19bc6
+        cap_flag_value_t fv;
a19bc6
+
a19bc6
+        caps = cap_get_proc();
a19bc6
+        assert_se(caps);
a19bc6
+        assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
a19bc6
+        assert(fv == CAP_CLEAR);
a19bc6
+        cap_free(caps);
a19bc6
+
a19bc6
+        assert_se(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) == 0);
a19bc6
+
a19bc6
+        set = (UINT64_C(1) << CAP_CHOWN);
a19bc6
+
a19bc6
+        assert_se(!capability_ambient_set_apply(set, true));
a19bc6
+
a19bc6
+        caps = cap_get_proc();
a19bc6
+        assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
a19bc6
+        assert(fv == CAP_SET);
a19bc6
+        cap_free(caps);
a19bc6
+
a19bc6
+        assert_se(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) == 1);
a19bc6
+}
a19bc6
+
a19bc6
 int main(int argc, char *argv[]) {
a19bc6
         int r;
a19bc6
+        bool run_ambient;
a19bc6
 
a19bc6
         log_parse_environment();
a19bc6
         log_open();
a19bc6
@@ -148,14 +207,19 @@ int main(int argc, char *argv[]) {
a19bc6
         if (getuid() != 0)
a19bc6
                 return EXIT_TEST_SKIP;
a19bc6
 
a19bc6
-        r = setup_tests();
a19bc6
+        r = setup_tests(&run_ambient);
a19bc6
         if (r < 0)
a19bc6
                 return -r;
a19bc6
 
a19bc6
         show_capabilities();
a19bc6
 
a19bc6
         test_drop_privileges();
a19bc6
+        test_update_inherited_set();
a19bc6
+
a19bc6
         fork_test(test_have_effective_cap);
a19bc6
 
a19bc6
+        if (run_ambient)
a19bc6
+                fork_test(test_set_ambient_caps);
a19bc6
+
a19bc6
         return 0;
a19bc6
 }
a19bc6
diff --git a/src/test/test-execute.c b/src/test/test-execute.c
181b3f
index 6e5567c3e..8e70702cb 100644
a19bc6
--- a/src/test/test-execute.c
a19bc6
+++ b/src/test/test-execute.c
a19bc6
@@ -17,7 +17,11 @@
a19bc6
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
a19bc6
 ***/
a19bc6
 
a19bc6
+#include <grp.h>
a19bc6
+#include <pwd.h>
a19bc6
 #include <stdio.h>
a19bc6
+#include <sys/prctl.h>
a19bc6
+#include <sys/types.h>
a19bc6
 
a19bc6
 #include "unit.h"
a19bc6
 #include "manager.h"
a19bc6
@@ -25,6 +29,7 @@
a19bc6
 #include "macro.h"
a19bc6
 #include "strv.h"
a19bc6
 #include "mkdir.h"
a19bc6
+#include "path-util.h"
a19bc6
 
a19bc6
 typedef void (*test_function_t)(Manager *m);
a19bc6
 
a19bc6
@@ -177,6 +182,42 @@ static void test_exec_runtimedirectory(Manager *m) {
a19bc6
         test(m, "exec-runtimedirectory-owner.service", 0, CLD_EXITED);
a19bc6
 }
a19bc6
 
a19bc6
+static void test_exec_capabilityboundingset(Manager *m) {
a19bc6
+        int r;
a19bc6
+
a19bc6
+        r = find_binary("capsh", true, NULL);
a19bc6
+        if (r < 0) {
a19bc6
+                log_error_errno(r, "Skipping %s, could not find capsh binary: %m", __func__);
a19bc6
+                return;
a19bc6
+        }
a19bc6
+
a19bc6
+        test(m, "exec-capabilityboundingset-simple.service", 0, CLD_EXITED);
a19bc6
+        test(m, "exec-capabilityboundingset-reset.service", 0, CLD_EXITED);
a19bc6
+        test(m, "exec-capabilityboundingset-merge.service", 0, CLD_EXITED);
a19bc6
+        test(m, "exec-capabilityboundingset-invert.service", 0, CLD_EXITED);
a19bc6
+}
a19bc6
+
a19bc6
+static void test_exec_capabilityambientset(Manager *m) {
a19bc6
+        int r;
a19bc6
+
a19bc6
+        /* Check if the kernel has support for ambient capabilities. Run
a19bc6
+         * the tests only if that's the case. Clearing all ambient
a19bc6
+         * capabilities is fine, since we are expecting them to be unset
a19bc6
+         * in the first place for the tests. */
a19bc6
+        r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
a19bc6
+        if (r >= 0 || errno != EINVAL) {
a19bc6
+                if (getpwnam("nobody")) {
a19bc6
+                        test(m, "exec-capabilityambientset.service", 0, CLD_EXITED);
a19bc6
+                        test(m, "exec-capabilityambientset-merge.service", 0, CLD_EXITED);
a19bc6
+                } else if (getpwnam("nfsnobody")) {
a19bc6
+                        test(m, "exec-capabilityambientset-nfsnobody.service", 0, CLD_EXITED);
a19bc6
+                        test(m, "exec-capabilityambientset-merge-nfsnobody.service", 0, CLD_EXITED);
a19bc6
+                } else
a19bc6
+                        log_error_errno(errno, "Skipping %s, could not find nobody/nfsnobody user: %m", __func__);
a19bc6
+        } else
a19bc6
+                log_error_errno(errno, "Skipping %s, the kernel does not support ambient capabilities: %m", __func__);
a19bc6
+}
a19bc6
+
a19bc6
 int main(int argc, char *argv[]) {
a19bc6
         test_function_t tests[] = {
a19bc6
                 test_exec_workingdirectory,
a19bc6
@@ -192,6 +233,8 @@ int main(int argc, char *argv[]) {
a19bc6
                 test_exec_passenvironment,
a19bc6
                 test_exec_umask,
a19bc6
                 test_exec_runtimedirectory,
a19bc6
+                test_exec_capabilityboundingset,
a19bc6
+                test_exec_capabilityambientset,
a19bc6
                 NULL,
a19bc6
         };
a19bc6
         test_function_t *test = NULL;
a19bc6
diff --git a/test/exec-capabilityambientset-merge-nfsnobody.service b/test/exec-capabilityambientset-merge-nfsnobody.service
a19bc6
new file mode 100644
181b3f
index 000000000..00bec581b
a19bc6
--- /dev/null
a19bc6
+++ b/test/exec-capabilityambientset-merge-nfsnobody.service
a19bc6
@@ -0,0 +1,9 @@
a19bc6
+[Unit]
a19bc6
+Description=Test for AmbientCapabilities
a19bc6
+
a19bc6
+[Service]
a19bc6
+ExecStart=/bin/sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000003000"'
a19bc6
+Type=oneshot
a19bc6
+User=nfsnobody
a19bc6
+AmbientCapabilities=CAP_NET_ADMIN
a19bc6
+AmbientCapabilities=CAP_NET_RAW
a19bc6
diff --git a/test/exec-capabilityambientset-merge.service b/test/exec-capabilityambientset-merge.service
a19bc6
new file mode 100644
181b3f
index 000000000..64964380e
a19bc6
--- /dev/null
a19bc6
+++ b/test/exec-capabilityambientset-merge.service
a19bc6
@@ -0,0 +1,9 @@
a19bc6
+[Unit]
a19bc6
+Description=Test for AmbientCapabilities
a19bc6
+
a19bc6
+[Service]
a19bc6
+ExecStart=/bin/sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000003000"'
a19bc6
+Type=oneshot
a19bc6
+User=nobody
a19bc6
+AmbientCapabilities=CAP_NET_ADMIN
a19bc6
+AmbientCapabilities=CAP_NET_RAW
a19bc6
diff --git a/test/exec-capabilityambientset-nfsnobody.service b/test/exec-capabilityambientset-nfsnobody.service
a19bc6
new file mode 100644
181b3f
index 000000000..614cfdd58
a19bc6
--- /dev/null
a19bc6
+++ b/test/exec-capabilityambientset-nfsnobody.service
a19bc6
@@ -0,0 +1,8 @@
a19bc6
+[Unit]
a19bc6
+Description=Test for AmbientCapabilities
a19bc6
+
a19bc6
+[Service]
a19bc6
+ExecStart=/bin/sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000003000"'
a19bc6
+Type=oneshot
a19bc6
+User=nfsnobody
a19bc6
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
a19bc6
diff --git a/test/exec-capabilityambientset.service b/test/exec-capabilityambientset.service
a19bc6
new file mode 100644
181b3f
index 000000000..d63f884ef
a19bc6
--- /dev/null
a19bc6
+++ b/test/exec-capabilityambientset.service
a19bc6
@@ -0,0 +1,8 @@
a19bc6
+[Unit]
a19bc6
+Description=Test for AmbientCapabilities
a19bc6
+
a19bc6
+[Service]
a19bc6
+ExecStart=/bin/sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb:	0000000000003000"'
a19bc6
+Type=oneshot
a19bc6
+User=nobody
a19bc6
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
a19bc6
diff --git a/test/exec-capabilityboundingset-invert.service b/test/exec-capabilityboundingset-invert.service
a19bc6
new file mode 100644
181b3f
index 000000000..fd5d24870
a19bc6
--- /dev/null
a19bc6
+++ b/test/exec-capabilityboundingset-invert.service
a19bc6
@@ -0,0 +1,7 @@
a19bc6
+[Unit]
a19bc6
+Description=Test for CapabilityBoundingSet
a19bc6
+
a19bc6
+[Service]
a19bc6
+ExecStart=/bin/sh -x -c 'c=$$(capsh --print | grep "^Bounding set .*cap_chown"); test -z "$$c"'
a19bc6
+Type=oneshot
a19bc6
+CapabilityBoundingSet=~CAP_CHOWN
a19bc6
diff --git a/test/exec-capabilityboundingset-merge.service b/test/exec-capabilityboundingset-merge.service
a19bc6
new file mode 100644
181b3f
index 000000000..5c7fcaf43
a19bc6
--- /dev/null
a19bc6
+++ b/test/exec-capabilityboundingset-merge.service
a19bc6
@@ -0,0 +1,8 @@
a19bc6
+[Unit]
a19bc6
+Description=Test for CapabilityBoundingSet
a19bc6
+
a19bc6
+[Service]
a19bc6
+ExecStart=/bin/sh -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_chown,cap_fowner,cap_kill"'
a19bc6
+Type=oneshot
a19bc6
+CapabilityBoundingSet=CAP_FOWNER
a19bc6
+CapabilityBoundingSet=CAP_KILL CAP_CHOWN
a19bc6
diff --git a/test/exec-capabilityboundingset-reset.service b/test/exec-capabilityboundingset-reset.service
a19bc6
new file mode 100644
181b3f
index 000000000..d7d332020
a19bc6
--- /dev/null
a19bc6
+++ b/test/exec-capabilityboundingset-reset.service
a19bc6
@@ -0,0 +1,8 @@
a19bc6
+[Unit]
a19bc6
+Description=Test for CapabilityBoundingSet
a19bc6
+
a19bc6
+[Service]
a19bc6
+ExecStart=/bin/sh -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set ="'
a19bc6
+Type=oneshot
a19bc6
+CapabilityBoundingSet=CAP_FOWNER CAP_KILL
a19bc6
+CapabilityBoundingSet=
a19bc6
diff --git a/test/exec-capabilityboundingset-simple.service b/test/exec-capabilityboundingset-simple.service
a19bc6
new file mode 100644
181b3f
index 000000000..bf1a7f575
a19bc6
--- /dev/null
a19bc6
+++ b/test/exec-capabilityboundingset-simple.service
a19bc6
@@ -0,0 +1,7 @@
a19bc6
+[Unit]
a19bc6
+Description=Test for CapabilityBoundingSet
a19bc6
+
a19bc6
+[Service]
a19bc6
+ExecStart=/bin/sh -x -c 'c=$$(capsh --print | grep "Bounding set "); test "$$c" = "Bounding set =cap_fowner,cap_kill"'
a19bc6
+Type=oneshot
a19bc6
+CapabilityBoundingSet=CAP_FOWNER CAP_KILL