14458263136

Committed 14 Apr 2025 06:41PM UTC coverage: 72.031% (+0.001%) from 72.03%

Build # 14458263136

Build Type

push

github

Committed by

yuwata

Commit Message

test: drop error conditions for old kernels (<3.2)

Now our baseline on the kernel is 5.4.

Coverage Stats

2 of 4 new or added lines in 1 file covered. (50.0%)

1428 existing lines in 44 files now uncovered.

297292 of 412726 relevant lines covered (72.03%)

683119.61 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

95.69

/src/test/test-capability.c

/* SPDX-License-Identifier: LGPL-2.1-or-later */

#include <linux/prctl.h>
#include <netinet/in.h>
#include <pwd.h>
#include <sys/prctl.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <unistd.h>

#define TEST_CAPABILITY_C

#include "alloc-util.h"
#include "capability-util.h"
#include "errno-util.h"
#include "fd-util.h"
#include "fileio.h"
#include "macro.h"
#include "parse-util.h"
#include "process-util.h"
#include "string-util.h"
#include "tests.h"

static uid_t test_uid = -1;
static gid_t test_gid = -1;

#if HAS_FEATURE_ADDRESS_SANITIZER
/* Keep CAP_SYS_PTRACE when running under Address Sanitizer */
static const uint64_t test_flags = UINT64_C(1) << CAP_SYS_PTRACE;
#else
/* We keep CAP_DAC_OVERRIDE to avoid errors with gcov when doing test coverage */
static const uint64_t test_flags = UINT64_C(1) << CAP_DAC_OVERRIDE;
#endif

/* verify cap_last_cap() against /proc/sys/kernel/cap_last_cap */
static void test_last_cap_file(void) {
        _cleanup_free_ char *content = NULL;
        unsigned long val = 0;
        int r;

        r = read_one_line_file("/proc/sys/kernel/cap_last_cap", &content);
        if (ERRNO_IS_NEG_PRIVILEGE(r))
                return (void) log_tests_skipped_errno(r, "Failed to /proc/sys/kernel/cap_last_cap");
        ASSERT_OK(r);

        r = safe_atolu(content, &val);
        ASSERT_OK(r);
        assert_se(val != 0);
        ASSERT_EQ(val, cap_last_cap());
}

/* verify cap_last_cap() against syscall probing */
static void test_last_cap_probe(void) {
        unsigned long p = (unsigned long)CAP_LAST_CAP;

        if (prctl(PR_CAPBSET_READ, p) < 0) {
                for (p--; p > 0; p--)
                        if (prctl(PR_CAPBSET_READ, p) >= 0)
                                break;
        } else {
                for (;; p++)
                        if (prctl(PR_CAPBSET_READ, p+1) < 0)
                                break;
        }

        assert_se(p != 0);
        ASSERT_EQ(p, cap_last_cap());
}

static void fork_test(void (*test_func)(void)) {
        pid_t pid = 0;

        pid = fork();
        assert_se(pid >= 0);
        if (pid == 0) {
                test_func();
                exit(EXIT_SUCCESS);
        } else if (pid > 0) {
                int status;

                assert_se(waitpid(pid, &status, 0) > 0);
                assert_se(WIFEXITED(status) && WEXITSTATUS(status) == 0);
        }
}

static void show_capabilities(void) {
        cap_t caps;
        char *text;

        caps = cap_get_proc();
        assert_se(caps);

        text = cap_to_text(caps, NULL);
        assert_se(text);

        log_info("Capabilities:%s", text);
        cap_free(caps);
        cap_free(text);
}

static int setup_tests(bool *run_ambient) {
        struct passwd *nobody;
        int r;

        nobody = getpwnam(NOBODY_USER_NAME);
        if (!nobody)
                return log_warning_errno(SYNTHETIC_ERRNO(ENOENT), "Couldn't find 'nobody' user.");

        test_uid = nobody->pw_uid;
        test_gid = nobody->pw_gid;

        r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
        /* There's support for PR_CAP_AMBIENT if the prctl() call succeeded or error code was something else
         * than EINVAL. The EINVAL check should be good enough to rule out false positives. */
        *run_ambient = r >= 0 || errno != EINVAL;

        return 0;
}

static void test_drop_privileges_keep_net_raw(void) {
        int sock;

        sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
        assert_se(sock >= 0);
        safe_close(sock);

        assert_se(drop_privileges(test_uid, test_gid, test_flags | (1ULL << CAP_NET_RAW)) >= 0);
        assert_se(getuid() == test_uid);
        assert_se(getgid() == test_gid);
        show_capabilities();

        sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
        ASSERT_OK(sock);
        safe_close(sock);
}

static void test_drop_privileges_dontkeep_net_raw(void) {
        int sock;

        sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
        ASSERT_OK(sock);
        safe_close(sock);

        assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0);
        assert_se(getuid() == test_uid);
        assert_se(getgid() == test_gid);
        show_capabilities();

        sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
        ASSERT_LT(sock, 0);
}

static void test_drop_privileges_fail(void) {
        assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0);
        assert_se(getuid() == test_uid);
        assert_se(getgid() == test_gid);

        ASSERT_LT(drop_privileges(test_uid, test_gid, test_flags), 0);
        ASSERT_LT(drop_privileges(0, 0, test_flags), 0);
}

static void test_drop_privileges(void) {
        fork_test(test_drop_privileges_fail);

        if (have_effective_cap(CAP_NET_RAW) <= 0) /* The remaining two tests only work if we have CAP_NET_RAW
                                                   * in the first place. If we are run in some restricted
                                                   * container environment we might not. */
                return;

        fork_test(test_drop_privileges_keep_net_raw);
        fork_test(test_drop_privileges_dontkeep_net_raw);
}

static void test_have_effective_cap(void) {
        ASSERT_GT(have_effective_cap(CAP_KILL), 0);
        ASSERT_GT(have_effective_cap(CAP_CHOWN), 0);

        ASSERT_OK(drop_privileges(test_uid, test_gid, test_flags | (1ULL << CAP_KILL)));
        assert_se(getuid() == test_uid);
        assert_se(getgid() == test_gid);

        ASSERT_GT(have_effective_cap(CAP_KILL), 0);
        assert_se(have_effective_cap(CAP_CHOWN) == 0);
}

static void test_update_inherited_set(void) {
        cap_t caps;
        uint64_t set = 0;
        cap_flag_value_t fv;

        caps = cap_get_proc();
        assert_se(caps);

        set = (UINT64_C(1) << CAP_CHOWN);

        assert_se(!capability_update_inherited_set(caps, set));
        assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
        assert_se(fv == CAP_SET);

        cap_free(caps);
}

static void test_apply_ambient_caps(void) {
        cap_t caps;
        uint64_t set = 0;
        cap_flag_value_t fv;

        assert_se(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) == 0);

        set = (UINT64_C(1) << CAP_CHOWN);

        assert_se(!capability_ambient_set_apply(set, true));

        caps = cap_get_proc();
        assert_se(caps);
        assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
        assert_se(fv == CAP_SET);
        cap_free(caps);

        assert_se(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) == 1);

        assert_se(!capability_ambient_set_apply(0, true));
        caps = cap_get_proc();
        assert_se(caps);
        assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
        assert_se(fv == CAP_CLEAR);
        cap_free(caps);

        assert_se(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) == 0);
}

static void test_ensure_cap_64_bit(void) {
        _cleanup_free_ char *content = NULL;
        unsigned long p = 0;
        int r;

        r = read_one_line_file("/proc/sys/kernel/cap_last_cap", &content);
        if (ERRNO_IS_NEG_PRIVILEGE(r))
                return (void) log_tests_skipped_errno(r, "Failed to /proc/sys/kernel/cap_last_cap");
        ASSERT_OK(r);

        ASSERT_OK(safe_atolu(content, &p));

        /* If caps don't fit into 64-bit anymore, we have a problem, fail the test. */
        assert_se(p <= 63);

        /* Also check for the header definition */
        assert_cc(CAP_LAST_CAP <= 63);
}

static void test_capability_get_ambient(void) {
        uint64_t c;
        int r;

        ASSERT_OK(capability_get_ambient(&c));

        r = prctl(PR_CAPBSET_READ, CAP_MKNOD);
        if (r <= 0)
                return (void) log_tests_skipped("Lacking CAP_MKNOD, skipping getambient test.");
        r = prctl(PR_CAPBSET_READ, CAP_LINUX_IMMUTABLE);
        if (r <= 0)
                return (void) log_tests_skipped("Lacking CAP_LINUX_IMMUTABLE, skipping getambient test.");

        r = safe_fork("(getambient)", FORK_RESET_SIGNALS|FORK_DEATHSIG_SIGTERM|FORK_WAIT|FORK_LOG, NULL);
        ASSERT_OK(r);

        if (r == 0) {
                int x, y;
                /* child */
                assert_se(capability_get_ambient(&c) >= 0);

                x = capability_ambient_set_apply(
                                (UINT64_C(1) << CAP_MKNOD)|
                                (UINT64_C(1) << CAP_LINUX_IMMUTABLE),
                                /* also_inherit= */ true);
                assert_se(x >= 0 || ERRNO_IS_PRIVILEGE(x));

                assert_se(capability_get_ambient(&c) >= 0);
                assert_se(x < 0 || FLAGS_SET(c, UINT64_C(1) << CAP_MKNOD));
                assert_se(x < 0 || FLAGS_SET(c, UINT64_C(1) << CAP_LINUX_IMMUTABLE));
                assert_se(x < 0 || !FLAGS_SET(c, UINT64_C(1) << CAP_SETPCAP));

                y = capability_bounding_set_drop(
                                ((UINT64_C(1) << CAP_LINUX_IMMUTABLE)|
                                 (UINT64_C(1) << CAP_SETPCAP)),
                                /* right_now= */ true);
                assert_se(y >= 0 || ERRNO_IS_PRIVILEGE(y));

                assert_se(capability_get_ambient(&c) >= 0);
                assert_se(x < 0 || y < 0 || !FLAGS_SET(c, UINT64_C(1) << CAP_MKNOD));
                assert_se(x < 0 || y < 0 || FLAGS_SET(c, UINT64_C(1) << CAP_LINUX_IMMUTABLE));
                assert_se(x < 0 || y < 0 || !FLAGS_SET(c, UINT64_C(1) << CAP_SETPCAP));

                y = capability_bounding_set_drop(
                                (UINT64_C(1) << CAP_SETPCAP),
                                /* right_now= */ true);
                assert_se(y >= 0 || ERRNO_IS_PRIVILEGE(y));

                assert_se(capability_get_ambient(&c) >= 0);
                assert_se(x < 0 || y < 0 || !FLAGS_SET(c, UINT64_C(1) << CAP_MKNOD));
                assert_se(x < 0 || y < 0 || !FLAGS_SET(c, UINT64_C(1) << CAP_LINUX_IMMUTABLE));
                assert_se(x < 0 || y < 0 || !FLAGS_SET(c, UINT64_C(1) << CAP_SETPCAP));

                _exit(EXIT_SUCCESS);
        }
}

static void test_pidref_get_capability(void) {
        CapabilityQuintet q = CAPABILITY_QUINTET_NULL;

        assert_se(pidref_get_capability(&PIDREF_MAKE_FROM_PID(getpid_cached()), &q) >= 0);

        assert_se(q.effective != CAP_MASK_UNSET);
        assert_se(q.inheritable != CAP_MASK_UNSET);
        assert_se(q.permitted != CAP_MASK_UNSET);
        assert_se(q.effective != CAP_MASK_UNSET);
        assert_se(q.ambient != CAP_MASK_UNSET);
}

int main(int argc, char *argv[]) {
        bool run_ambient;

        test_setup_logging(LOG_DEBUG);

        test_ensure_cap_64_bit();

        test_last_cap_file();
        test_last_cap_probe();

        if (getuid() != 0)
                return log_tests_skipped("not running as root");

        if (setup_tests(&run_ambient) < 0)
                return log_tests_skipped("setup failed");

        show_capabilities();

        if (!userns_has_single_user())
                test_drop_privileges();

        test_update_inherited_set();

        if (!userns_has_single_user())
                fork_test(test_have_effective_cap);

        if (run_ambient)
                fork_test(test_apply_ambient_caps);

        test_capability_get_ambient();

        test_pidref_get_capability();

        return 0;
}

1	/* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3	#include <linux/prctl.h>
4	#include <netinet/in.h>
5	#include <pwd.h>
6	#include <sys/prctl.h>
7	#include <sys/socket.h>
8	#include <sys/wait.h>
9	#include <unistd.h>
10
11	#define TEST_CAPABILITY_C
12
13	#include "alloc-util.h"
14	#include "capability-util.h"
15	#include "errno-util.h"
16	#include "fd-util.h"
17	#include "fileio.h"
18	#include "macro.h"
19	#include "parse-util.h"
20	#include "process-util.h"
21	#include "string-util.h"
22	#include "tests.h"
23
24	static uid_t test_uid = -1;
25	static gid_t test_gid = -1;
26
27	#if HAS_FEATURE_ADDRESS_SANITIZER
28	/* Keep CAP_SYS_PTRACE when running under Address Sanitizer */
29	static const uint64_t test_flags = UINT64_C(1) << CAP_SYS_PTRACE;
30	#else
31	/* We keep CAP_DAC_OVERRIDE to avoid errors with gcov when doing test coverage */
32	static const uint64_t test_flags = UINT64_C(1) << CAP_DAC_OVERRIDE;
33	#endif
34
35	/* verify cap_last_cap() against /proc/sys/kernel/cap_last_cap */
36	static void test_last_cap_file(void) {	1✔
37	_cleanup_free_ char *content = NULL;	1✔
38	unsigned long val = 0;	1✔
39	int r;	1✔
40
41	r = read_one_line_file("/proc/sys/kernel/cap_last_cap", &content);	1✔
42	if (ERRNO_IS_NEG_PRIVILEGE(r))	1✔
NEW 43	return (void) log_tests_skipped_errno(r, "Failed to /proc/sys/kernel/cap_last_cap");	×
44	ASSERT_OK(r);	1✔
45
46	r = safe_atolu(content, &val);	1✔
47	ASSERT_OK(r);	1✔
48	assert_se(val != 0);	1✔
49	ASSERT_EQ(val, cap_last_cap());	1✔
50	}
51
52	/* verify cap_last_cap() against syscall probing */
53	static void test_last_cap_probe(void) {	1✔
54	unsigned long p = (unsigned long)CAP_LAST_CAP;	1✔
55
56	if (prctl(PR_CAPBSET_READ, p) < 0) {	1✔
57	for (p--; p > 0; p--)	×
58	if (prctl(PR_CAPBSET_READ, p) >= 0)	×
59	break;
60	} else {
61	for (;; p++)	1✔
62	if (prctl(PR_CAPBSET_READ, p+1) < 0)	1✔
63	break;
64	}
65
66	assert_se(p != 0);	1✔
67	ASSERT_EQ(p, cap_last_cap());	1✔
68	}	1✔
69
70	static void fork_test(void (*test_func)(void)) {	5✔
71	pid_t pid = 0;	5✔
72
73	pid = fork();	5✔
74	assert_se(pid >= 0);	10✔
75	if (pid == 0) {	10✔
76	test_func();	5✔
77	exit(EXIT_SUCCESS);	5✔
78	} else if (pid > 0) {	5✔
79	int status;	5✔
80
81	assert_se(waitpid(pid, &status, 0) > 0);	5✔
82	assert_se(WIFEXITED(status) && WEXITSTATUS(status) == 0);	5✔
83	}
84	}	5✔
85
86	static void show_capabilities(void) {	3✔
87	cap_t caps;	3✔
88	char *text;	3✔
89
90	caps = cap_get_proc();	3✔
91	assert_se(caps);	3✔
92
93	text = cap_to_text(caps, NULL);	3✔
94	assert_se(text);	3✔
95
96	log_info("Capabilities:%s", text);	3✔
97	cap_free(caps);	3✔
98	cap_free(text);	3✔
99	}	3✔
100
101	static int setup_tests(bool *run_ambient) {	1✔
102	struct passwd *nobody;	1✔
103	int r;	1✔
104
105	nobody = getpwnam(NOBODY_USER_NAME);	1✔
106	if (!nobody)	1✔
107	return log_warning_errno(SYNTHETIC_ERRNO(ENOENT), "Couldn't find 'nobody' user.");	×
108
109	test_uid = nobody->pw_uid;	1✔
110	test_gid = nobody->pw_gid;	1✔
111
112	r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);	1✔
113	/* There's support for PR_CAP_AMBIENT if the prctl() call succeeded or error code was something else
114	* than EINVAL. The EINVAL check should be good enough to rule out false positives. */
115	*run_ambient = r >= 0 \|\| errno != EINVAL;	1✔
116
117	return 0;	1✔
118	}
119
120	static void test_drop_privileges_keep_net_raw(void) {	1✔
121	int sock;	1✔
122
123	sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);	1✔
124	assert_se(sock >= 0);	1✔
125	safe_close(sock);	1✔
126
127	assert_se(drop_privileges(test_uid, test_gid, test_flags \| (1ULL << CAP_NET_RAW)) >= 0);	1✔
128	assert_se(getuid() == test_uid);	1✔
129	assert_se(getgid() == test_gid);	1✔
130	show_capabilities();	1✔
131
132	sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);	1✔
133	ASSERT_OK(sock);	1✔
134	safe_close(sock);	1✔
135	}	1✔
136
137	static void test_drop_privileges_dontkeep_net_raw(void) {	1✔
138	int sock;	1✔
139
140	sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);	1✔
141	ASSERT_OK(sock);	1✔
142	safe_close(sock);	1✔
143
144	assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0);	1✔
145	assert_se(getuid() == test_uid);	1✔
146	assert_se(getgid() == test_gid);	1✔
147	show_capabilities();	1✔
148
149	sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);	1✔
150	ASSERT_LT(sock, 0);	1✔
151	}	1✔
152
153	static void test_drop_privileges_fail(void) {	1✔
154	assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0);	1✔
155	assert_se(getuid() == test_uid);	1✔
156	assert_se(getgid() == test_gid);	1✔
157
158	ASSERT_LT(drop_privileges(test_uid, test_gid, test_flags), 0);	1✔
159	ASSERT_LT(drop_privileges(0, 0, test_flags), 0);	1✔
160	}	1✔
161
162	static void test_drop_privileges(void) {	1✔
163	fork_test(test_drop_privileges_fail);	1✔
164
165	if (have_effective_cap(CAP_NET_RAW) <= 0) /* The remaining two tests only work if we have CAP_NET_RAW	1✔
166	* in the first place. If we are run in some restricted
167	* container environment we might not. */
168	return;
169
170	fork_test(test_drop_privileges_keep_net_raw);	1✔
171	fork_test(test_drop_privileges_dontkeep_net_raw);	1✔
172	}
173
174	static void test_have_effective_cap(void) {	1✔
175	ASSERT_GT(have_effective_cap(CAP_KILL), 0);	1✔
176	ASSERT_GT(have_effective_cap(CAP_CHOWN), 0);	1✔
177
178	ASSERT_OK(drop_privileges(test_uid, test_gid, test_flags \| (1ULL << CAP_KILL)));	1✔
179	assert_se(getuid() == test_uid);	1✔
180	assert_se(getgid() == test_gid);	1✔
181
182	ASSERT_GT(have_effective_cap(CAP_KILL), 0);	1✔
183	assert_se(have_effective_cap(CAP_CHOWN) == 0);	1✔
184	}	1✔
185
186	static void test_update_inherited_set(void) {	1✔
187	cap_t caps;	1✔
188	uint64_t set = 0;	1✔
189	cap_flag_value_t fv;	1✔
190
191	caps = cap_get_proc();	1✔
192	assert_se(caps);	1✔
193
194	set = (UINT64_C(1) << CAP_CHOWN);	1✔
195
196	assert_se(!capability_update_inherited_set(caps, set));	1✔
197	assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));	1✔
198	assert_se(fv == CAP_SET);	1✔
199
200	cap_free(caps);	1✔
201	}	1✔
202
203	static void test_apply_ambient_caps(void) {	1✔
204	cap_t caps;	1✔
205	uint64_t set = 0;	1✔
206	cap_flag_value_t fv;	1✔
207
208	assert_se(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) == 0);	1✔
209
210	set = (UINT64_C(1) << CAP_CHOWN);	1✔
211
212	assert_se(!capability_ambient_set_apply(set, true));	1✔
213
214	caps = cap_get_proc();	1✔
215	assert_se(caps);	1✔
216	assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));	1✔
217	assert_se(fv == CAP_SET);	1✔
218	cap_free(caps);	1✔
219
220	assert_se(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) == 1);	1✔
221
222	assert_se(!capability_ambient_set_apply(0, true));	1✔
223	caps = cap_get_proc();	1✔
224	assert_se(caps);	1✔
225	assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));	1✔
226	assert_se(fv == CAP_CLEAR);	1✔
227	cap_free(caps);	1✔
228
229	assert_se(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) == 0);	1✔
230	}	1✔
231
232	static void test_ensure_cap_64_bit(void) {	1✔
233	_cleanup_free_ char *content = NULL;	1✔
234	unsigned long p = 0;	1✔
235	int r;	1✔
236
237	r = read_one_line_file("/proc/sys/kernel/cap_last_cap", &content);	1✔
238	if (ERRNO_IS_NEG_PRIVILEGE(r))	1✔
NEW 239	return (void) log_tests_skipped_errno(r, "Failed to /proc/sys/kernel/cap_last_cap");	×
240	ASSERT_OK(r);	1✔
241
242	ASSERT_OK(safe_atolu(content, &p));	1✔
243
244	/* If caps don't fit into 64-bit anymore, we have a problem, fail the test. */
245	assert_se(p <= 63);	1✔
246
247	/* Also check for the header definition */
248	assert_cc(CAP_LAST_CAP <= 63);	1✔
249	}
250
251	static void test_capability_get_ambient(void) {	1✔
252	uint64_t c;	1✔
253	int r;	1✔
254
255	ASSERT_OK(capability_get_ambient(&c));	1✔
256
257	r = prctl(PR_CAPBSET_READ, CAP_MKNOD);	1✔
258	if (r <= 0)	1✔
259	return (void) log_tests_skipped("Lacking CAP_MKNOD, skipping getambient test.");	×
260	r = prctl(PR_CAPBSET_READ, CAP_LINUX_IMMUTABLE);	1✔
261	if (r <= 0)	1✔
262	return (void) log_tests_skipped("Lacking CAP_LINUX_IMMUTABLE, skipping getambient test.");	×
263
264	r = safe_fork("(getambient)", FORK_RESET_SIGNALS\|FORK_DEATHSIG_SIGTERM\|FORK_WAIT\|FORK_LOG, NULL);	1✔
265	ASSERT_OK(r);	2✔
266
267	if (r == 0) {	2✔
268	int x, y;	1✔
269	/* child */
270	assert_se(capability_get_ambient(&c) >= 0);	1✔
271
272	x = capability_ambient_set_apply(	1✔
273	(UINT64_C(1) << CAP_MKNOD)\|
274	(UINT64_C(1) << CAP_LINUX_IMMUTABLE),
275	/* also_inherit= */ true);
276	assert_se(x >= 0 \|\| ERRNO_IS_PRIVILEGE(x));	1✔
277
278	assert_se(capability_get_ambient(&c) >= 0);	1✔
279	assert_se(x < 0 \|\| FLAGS_SET(c, UINT64_C(1) << CAP_MKNOD));	1✔
280	assert_se(x < 0 \|\| FLAGS_SET(c, UINT64_C(1) << CAP_LINUX_IMMUTABLE));	1✔
281	assert_se(x < 0 \|\| !FLAGS_SET(c, UINT64_C(1) << CAP_SETPCAP));	1✔
282
283	y = capability_bounding_set_drop(	1✔
284	((UINT64_C(1) << CAP_LINUX_IMMUTABLE)\|
285	(UINT64_C(1) << CAP_SETPCAP)),
286	/* right_now= */ true);
287	assert_se(y >= 0 \|\| ERRNO_IS_PRIVILEGE(y));	1✔
288
289	assert_se(capability_get_ambient(&c) >= 0);	1✔
290	assert_se(x < 0 \|\| y < 0 \|\| !FLAGS_SET(c, UINT64_C(1) << CAP_MKNOD));	1✔
291	assert_se(x < 0 \|\| y < 0 \|\| FLAGS_SET(c, UINT64_C(1) << CAP_LINUX_IMMUTABLE));	1✔
292	assert_se(x < 0 \|\| y < 0 \|\| !FLAGS_SET(c, UINT64_C(1) << CAP_SETPCAP));	1✔
293
294	y = capability_bounding_set_drop(	1✔
295	(UINT64_C(1) << CAP_SETPCAP),
296	/* right_now= */ true);
297	assert_se(y >= 0 \|\| ERRNO_IS_PRIVILEGE(y));	1✔
298
299	assert_se(capability_get_ambient(&c) >= 0);	1✔
300	assert_se(x < 0 \|\| y < 0 \|\| !FLAGS_SET(c, UINT64_C(1) << CAP_MKNOD));	1✔
301	assert_se(x < 0 \|\| y < 0 \|\| !FLAGS_SET(c, UINT64_C(1) << CAP_LINUX_IMMUTABLE));	1✔
302	assert_se(x < 0 \|\| y < 0 \|\| !FLAGS_SET(c, UINT64_C(1) << CAP_SETPCAP));	1✔
303
304	_exit(EXIT_SUCCESS);	1✔
305	}
306	}
307
308	static void test_pidref_get_capability(void) {	1✔
309	CapabilityQuintet q = CAPABILITY_QUINTET_NULL;	1✔
310
311	assert_se(pidref_get_capability(&PIDREF_MAKE_FROM_PID(getpid_cached()), &q) >= 0);	1✔
312
313	assert_se(q.effective != CAP_MASK_UNSET);	1✔
314	assert_se(q.inheritable != CAP_MASK_UNSET);	1✔
315	assert_se(q.permitted != CAP_MASK_UNSET);	1✔
316	assert_se(q.effective != CAP_MASK_UNSET);	1✔
317	assert_se(q.ambient != CAP_MASK_UNSET);	1✔
318	}	1✔
319
320	int main(int argc, char *argv[]) {	1✔
321	bool run_ambient;	1✔
322
323	test_setup_logging(LOG_DEBUG);	1✔
324
325	test_ensure_cap_64_bit();	1✔
326
327	test_last_cap_file();	1✔
328	test_last_cap_probe();	1✔
329
330	if (getuid() != 0)	1✔
331	return log_tests_skipped("not running as root");	×
332
333	if (setup_tests(&run_ambient) < 0)	1✔
334	return log_tests_skipped("setup failed");	×
335
336	show_capabilities();	1✔
337
338	if (!userns_has_single_user())	1✔
339	test_drop_privileges();	1✔
340
341	test_update_inherited_set();	1✔
342
343	if (!userns_has_single_user())	1✔
344	fork_test(test_have_effective_cap);	1✔
345
346	if (run_ambient)	1✔
347	fork_test(test_apply_ambient_caps);	1✔
348
349	test_capability_get_ambient();	1✔
350
351	test_pidref_get_capability();	1✔
352
353	return 0;
354	}

systemd / systemd / 14458263136

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous