1 /*-
2 * Copyright (c) 2009-2011 Robert N. M. Watson
3 * Copyright (c) 2011 Jonathan Anderson
4 * Copyright (c) 2012 FreeBSD Foundation
5 * All rights reserved.
6 *
7 * Portions of this software were developed by Pawel Jakub Dawidek under
8 * sponsorship from the FreeBSD Foundation.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32 /*
33 * Test whether various operations on capabilities are properly masked for
34 * various object types.
35 */
36
37 #include <sys/cdefs.h>
38 #include <sys/param.h>
39 #include <sys/capsicum.h>
40 #include <sys/errno.h>
41 #include <sys/mman.h>
42 #include <sys/mount.h>
43 #include <sys/stat.h>
44
45 #include <err.h>
46 #include <fcntl.h>
47 #include <poll.h>
48 #include <stdint.h>
49 #include <stdio.h>
50 #include <stdlib.h>
51 #include <string.h>
52 #include <unistd.h>
53
54 #include "cap_test.h"
55
56 #define SYSCALL_FAIL(syscall, message) \
57 FAIL("%s:\t%s (rights 0x%jx)", #syscall, message, rights)
58
59 /*
60 * Ensure that, if the capability had enough rights for the system call to
61 * pass, then it did. Otherwise, ensure that the errno is ENOTCAPABLE;
62 * capability restrictions should kick in before any other error logic.
63 */
64 #define CHECK_RESULT(syscall, rights_needed, succeeded) do { \
65 if ((rights & (rights_needed)) == (rights_needed)) { \
66 if (succeeded) { \
67 if (success == -1) \
68 success = PASSED; \
69 } else { \
70 SYSCALL_FAIL(syscall, "failed"); \
71 } \
72 } else { \
73 if (succeeded) { \
74 FAILX("%s:\tsucceeded when it shouldn't have" \
75 " (rights 0x%jx)", #syscall, \
76 (uintmax_t)rights); \
77 } else if (errno != ENOTCAPABLE) { \
78 SYSCALL_FAIL(syscall, "errno != ENOTCAPABLE"); \
79 } \
80 } \
81 errno = 0; \
82 } while (0)
83
84 /*
85 * As above, but for the special mmap() case: unmap after successful mmap().
86 */
87 #define CHECK_MMAP_RESULT(rights_needed) do { \
88 if ((rights & (rights_needed)) == (rights_needed)) { \
89 if (p == MAP_FAILED) \
90 SYSCALL_FAIL(mmap, "failed"); \
91 else { \
92 (void)munmap(p, getpagesize()); \
93 if (success == -1) \
94 success = PASSED; \
95 } \
96 } else { \
97 if (p != MAP_FAILED) { \
98 FAILX("%s:\tsucceeded when it shouldn't have" \
99 " (rights 0x%jx)", "mmap", rights); \
100 (void)munmap(p, getpagesize()); \
101 } else if (errno != ENOTCAPABLE) \
102 SYSCALL_FAIL(syscall, "errno != ENOTCAPABLE"); \
103 } \
104 errno = 0; \
105 } while (0)
106
107 /*
108 * Given a file descriptor, create a capability with specific rights and
109 * make sure only those rights work.
110 */
111 static int
try_file_ops(int filefd,int dirfd,cap_rights_t rights)112 try_file_ops(int filefd, int dirfd, cap_rights_t rights)
113 {
114 struct stat sb;
115 struct statfs sf;
116 cap_rights_t erights;
117 int fd_cap, fd_capcap, dfd_cap;
118 ssize_t ssize, ssize2;
119 off_t off;
120 void *p;
121 char ch;
122 int ret, is_nfs;
123 struct pollfd pollfd;
124 int success = -1;
125
126 REQUIRE(fstatfs(filefd, &sf));
127 is_nfs = (strcmp("nfs", sf.f_fstypename) == 0);
128
129 REQUIRE(fd_cap = cap_new(filefd, rights));
130 CHECK(cap_getrights(fd_cap, &erights) == 0);
131 CHECK(rights == erights);
132 REQUIRE(fd_capcap = cap_new(fd_cap, rights));
133 CHECK(cap_getrights(fd_capcap, &erights) == 0);
134 CHECK(rights == erights);
135 CHECK(fd_capcap != fd_cap);
136 REQUIRE(dfd_cap = cap_new(dirfd, rights));
137 CHECK(cap_getrights(dfd_cap, &erights) == 0);
138 CHECK(rights == erights);
139
140 ssize = read(fd_cap, &ch, sizeof(ch));
141 CHECK_RESULT(read, CAP_READ, ssize >= 0);
142
143 ssize = write(fd_cap, &ch, sizeof(ch));
144 CHECK_RESULT(write, CAP_WRITE, ssize >= 0);
145
146 off = lseek(fd_cap, 0, SEEK_SET);
147 CHECK_RESULT(lseek, CAP_SEEK, off >= 0);
148
149 ssize = pread(fd_cap, &ch, sizeof(ch), 0);
150 ssize2 = pread(fd_cap, &ch, sizeof(ch), 0);
151 CHECK_RESULT(pread, CAP_PREAD, ssize >= 0);
152 CHECK(ssize == ssize2);
153
154 ssize = pwrite(fd_cap, &ch, sizeof(ch), 0);
155 CHECK_RESULT(pwrite, CAP_PWRITE, ssize >= 0);
156
157 p = mmap(NULL, getpagesize(), PROT_NONE, MAP_SHARED, fd_cap, 0);
158 CHECK_MMAP_RESULT(CAP_MMAP);
159
160 p = mmap(NULL, getpagesize(), PROT_READ, MAP_SHARED, fd_cap, 0);
161 CHECK_MMAP_RESULT(CAP_MMAP_R);
162
163 p = mmap(NULL, getpagesize(), PROT_WRITE, MAP_SHARED, fd_cap, 0);
164 CHECK_MMAP_RESULT(CAP_MMAP_W);
165
166 p = mmap(NULL, getpagesize(), PROT_EXEC, MAP_SHARED, fd_cap, 0);
167 CHECK_MMAP_RESULT(CAP_MMAP_X);
168
169 p = mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE, MAP_SHARED,
170 fd_cap, 0);
171 CHECK_MMAP_RESULT(CAP_MMAP_RW);
172
173 p = mmap(NULL, getpagesize(), PROT_READ | PROT_EXEC, MAP_SHARED,
174 fd_cap, 0);
175 CHECK_MMAP_RESULT(CAP_MMAP_RX);
176
177 p = mmap(NULL, getpagesize(), PROT_EXEC | PROT_WRITE, MAP_SHARED,
178 fd_cap, 0);
179 CHECK_MMAP_RESULT(CAP_MMAP_WX);
180
181 p = mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE | PROT_EXEC,
182 MAP_SHARED, fd_cap, 0);
183 CHECK_MMAP_RESULT(CAP_MMAP_RWX);
184
185 ret = openat(dfd_cap, "cap_create", O_CREAT | O_RDONLY, 0600);
186 CHECK_RESULT(openat(O_CREATE | O_RDONLY),
187 CAP_CREATE | CAP_READ | CAP_LOOKUP, ret >= 0);
188 CHECK(ret == -1 || close(ret) == 0);
189 CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0);
190 ret = openat(dfd_cap, "cap_create", O_CREAT | O_WRONLY | O_APPEND,
191 0600);
192 CHECK_RESULT(openat(O_CREATE | O_WRONLY | O_APPEND),
193 CAP_CREATE | CAP_WRITE | CAP_LOOKUP, ret >= 0);
194 CHECK(ret == -1 || close(ret) == 0);
195 CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0);
196 ret = openat(dfd_cap, "cap_create", O_CREAT | O_RDWR | O_APPEND, 0600);
197 CHECK_RESULT(openat(O_CREATE | O_RDWR | O_APPEND),
198 CAP_CREATE | CAP_READ | CAP_WRITE | CAP_LOOKUP, ret >= 0);
199 CHECK(ret == -1 || close(ret) == 0);
200 CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0);
201
202 ret = fsync(fd_cap);
203 CHECK_RESULT(fsync, CAP_FSYNC, ret == 0);
204
205 ret = openat(dirfd, "cap_fsync", O_CREAT, 0600);
206 CHECK(ret >= 0);
207 CHECK(close(ret) == 0);
208 ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_RDONLY);
209 CHECK_RESULT(openat(O_FSYNC | O_RDONLY),
210 CAP_FSYNC | CAP_READ | CAP_LOOKUP, ret >= 0);
211 CHECK(ret == -1 || close(ret) == 0);
212 ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_WRONLY | O_APPEND);
213 CHECK_RESULT(openat(O_FSYNC | O_WRONLY | O_APPEND),
214 CAP_FSYNC | CAP_WRITE | CAP_LOOKUP, ret >= 0);
215 CHECK(ret == -1 || close(ret) == 0);
216 ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_RDWR | O_APPEND);
217 CHECK_RESULT(openat(O_FSYNC | O_RDWR | O_APPEND),
218 CAP_FSYNC | CAP_READ | CAP_WRITE | CAP_LOOKUP, ret >= 0);
219 CHECK(ret == -1 || close(ret) == 0);
220 ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_RDONLY);
221 CHECK_RESULT(openat(O_SYNC | O_RDONLY),
222 CAP_FSYNC | CAP_READ | CAP_LOOKUP, ret >= 0);
223 CHECK(ret == -1 || close(ret) == 0);
224 ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_WRONLY | O_APPEND);
225 CHECK_RESULT(openat(O_SYNC | O_WRONLY | O_APPEND),
226 CAP_FSYNC | CAP_WRITE | CAP_LOOKUP, ret >= 0);
227 CHECK(ret == -1 || close(ret) == 0);
228 ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_RDWR | O_APPEND);
229 CHECK_RESULT(openat(O_SYNC | O_RDWR | O_APPEND),
230 CAP_FSYNC | CAP_READ | CAP_WRITE | CAP_LOOKUP, ret >= 0);
231 CHECK(ret == -1 || close(ret) == 0);
232 CHECK(unlinkat(dirfd, "cap_fsync", 0) == 0);
233
234 ret = ftruncate(fd_cap, 0);
235 CHECK_RESULT(ftruncate, CAP_FTRUNCATE, ret == 0);
236
237 ret = openat(dirfd, "cap_ftruncate", O_CREAT, 0600);
238 CHECK(ret >= 0);
239 CHECK(close(ret) == 0);
240 ret = openat(dfd_cap, "cap_ftruncate", O_TRUNC | O_RDONLY);
241 CHECK_RESULT(openat(O_TRUNC | O_RDONLY),
242 CAP_FTRUNCATE | CAP_READ | CAP_LOOKUP, ret >= 0);
243 CHECK(ret == -1 || close(ret) == 0);
244 ret = openat(dfd_cap, "cap_ftruncate", O_TRUNC | O_WRONLY);
245 CHECK_RESULT(openat(O_TRUNC | O_WRONLY),
246 CAP_FTRUNCATE | CAP_WRITE | CAP_LOOKUP, ret >= 0);
247 CHECK(ret == -1 || close(ret) == 0);
248 ret = openat(dfd_cap, "cap_ftruncate", O_TRUNC | O_RDWR);
249 CHECK_RESULT(openat(O_TRUNC | O_RDWR),
250 CAP_FTRUNCATE | CAP_READ | CAP_WRITE | CAP_LOOKUP, ret >= 0);
251 CHECK(ret == -1 || close(ret) == 0);
252 CHECK(unlinkat(dirfd, "cap_ftruncate", 0) == 0);
253
254 ret = openat(dfd_cap, "cap_create", O_CREAT | O_WRONLY, 0600);
255 CHECK_RESULT(openat(O_CREATE | O_WRONLY),
256 CAP_CREATE | CAP_WRITE | CAP_SEEK | CAP_LOOKUP, ret >= 0);
257 CHECK(ret == -1 || close(ret) == 0);
258 CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0);
259 ret = openat(dfd_cap, "cap_create", O_CREAT | O_RDWR, 0600);
260 CHECK_RESULT(openat(O_CREATE | O_RDWR),
261 CAP_CREATE | CAP_READ | CAP_WRITE | CAP_SEEK | CAP_LOOKUP,
262 ret >= 0);
263 CHECK(ret == -1 || close(ret) == 0);
264 CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0);
265
266 ret = openat(dirfd, "cap_fsync", O_CREAT, 0600);
267 CHECK(ret >= 0);
268 CHECK(close(ret) == 0);
269 ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_WRONLY);
270 CHECK_RESULT(openat(O_FSYNC | O_WRONLY),
271 CAP_FSYNC | CAP_WRITE | CAP_SEEK | CAP_LOOKUP, ret >= 0);
272 CHECK(ret == -1 || close(ret) == 0);
273 ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_RDWR);
274 CHECK_RESULT(openat(O_FSYNC | O_RDWR),
275 CAP_FSYNC | CAP_READ | CAP_WRITE | CAP_SEEK | CAP_LOOKUP, ret >= 0);
276 CHECK(ret == -1 || close(ret) == 0);
277 ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_WRONLY);
278 CHECK_RESULT(openat(O_SYNC | O_WRONLY),
279 CAP_FSYNC | CAP_WRITE | CAP_SEEK | CAP_LOOKUP, ret >= 0);
280 CHECK(ret == -1 || close(ret) == 0);
281 ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_RDWR);
282 CHECK_RESULT(openat(O_SYNC | O_RDWR),
283 CAP_FSYNC | CAP_READ | CAP_WRITE | CAP_SEEK | CAP_LOOKUP, ret >= 0);
284 CHECK(ret == -1 || close(ret) == 0);
285 CHECK(unlinkat(dirfd, "cap_fsync", 0) == 0);
286
287 /*
288 * Note: this is not expected to work over NFS.
289 */
290 ret = fchflags(fd_cap, UF_NODUMP);
291 CHECK_RESULT(fchflags, CAP_FCHFLAGS,
292 ret == 0 || (is_nfs && errno == EOPNOTSUPP));
293
294 ret = openat(dirfd, "cap_chflagsat", O_CREAT, 0600);
295 CHECK(ret >= 0);
296 CHECK(close(ret) == 0);
297 ret = chflagsat(dfd_cap, "cap_chflagsat", UF_NODUMP, 0);
298 CHECK_RESULT(chflagsat, CAP_CHFLAGSAT | CAP_LOOKUP, ret == 0);
299 CHECK(unlinkat(dirfd, "cap_chflagsat", 0) == 0);
300
301 ret = fchown(fd_cap, -1, -1);
302 CHECK_RESULT(fchown, CAP_FCHOWN, ret == 0);
303
304 ret = openat(dirfd, "cap_fchownat", O_CREAT, 0600);
305 CHECK(ret >= 0);
306 CHECK(close(ret) == 0);
307 ret = fchownat(dfd_cap, "cap_fchownat", -1, -1, 0);
308 CHECK_RESULT(fchownat, CAP_FCHOWN | CAP_LOOKUP, ret == 0);
309 CHECK(unlinkat(dirfd, "cap_fchownat", 0) == 0);
310
311 ret = fchmod(fd_cap, 0644);
312 CHECK_RESULT(fchmod, CAP_FCHMOD, ret == 0);
313
314 ret = openat(dirfd, "cap_fchmodat", O_CREAT, 0600);
315 CHECK(ret >= 0);
316 CHECK(close(ret) == 0);
317 ret = fchmodat(dfd_cap, "cap_fchmodat", 0600, 0);
318 CHECK_RESULT(fchmodat, CAP_FCHMOD | CAP_LOOKUP, ret == 0);
319 CHECK(unlinkat(dirfd, "cap_fchmodat", 0) == 0);
320
321 ret = fcntl(fd_cap, F_GETFL);
322 CHECK_RESULT(fcntl(F_GETFL), CAP_FCNTL, ret >= 0);
323 ret = fcntl(fd_cap, F_SETFL, ret);
324 CHECK_RESULT(fcntl(F_SETFL), CAP_FCNTL, ret == 0);
325
326 /* XXX flock */
327
328 ret = fstat(fd_cap, &sb);
329 CHECK_RESULT(fstat, CAP_FSTAT, ret == 0);
330
331 ret = openat(dirfd, "cap_fstatat", O_CREAT, 0600);
332 CHECK(ret >= 0);
333 CHECK(close(ret) == 0);
334 ret = fstatat(dfd_cap, "cap_fstatat", &sb, 0);
335 CHECK_RESULT(fstatat, CAP_FSTAT | CAP_LOOKUP, ret == 0);
336 CHECK(unlinkat(dirfd, "cap_fstatat", 0) == 0);
337
338 ret = fstatfs(fd_cap, &sf);
339 CHECK_RESULT(fstatfs, CAP_FSTATFS, ret == 0);
340
341 ret = fpathconf(fd_cap, _PC_NAME_MAX);
342 CHECK_RESULT(fpathconf, CAP_FPATHCONF, ret >= 0);
343
344 ret = futimes(fd_cap, NULL);
345 CHECK_RESULT(futimes, CAP_FUTIMES, ret == 0);
346
347 ret = openat(dirfd, "cap_futimesat", O_CREAT, 0600);
348 CHECK(ret >= 0);
349 CHECK(close(ret) == 0);
350 ret = futimesat(dfd_cap, "cap_futimesat", NULL);
351 CHECK_RESULT(futimesat, CAP_FUTIMES | CAP_LOOKUP, ret == 0);
352 CHECK(unlinkat(dirfd, "cap_futimesat", 0) == 0);
353
354 ret = openat(dirfd, "cap_linkat_src", O_CREAT, 0600);
355 CHECK(ret >= 0);
356 CHECK(close(ret) == 0);
357 ret = linkat(dirfd, "cap_linkat_src", dfd_cap, "cap_linkat_dst", 0);
358 CHECK_RESULT(linkat, CAP_LINKAT | CAP_LOOKUP, ret == 0);
359 CHECK(unlinkat(dirfd, "cap_linkat_src", 0) == 0);
360 CHECK(ret == -1 || unlinkat(dirfd, "cap_linkat_dst", 0) == 0);
361
362 ret = mkdirat(dfd_cap, "cap_mkdirat", 0700);
363 CHECK_RESULT(mkdirat, CAP_MKDIRAT | CAP_LOOKUP, ret == 0);
364 CHECK(ret == -1 || unlinkat(dirfd, "cap_mkdirat", AT_REMOVEDIR) == 0);
365
366 ret = mkfifoat(dfd_cap, "cap_mkfifoat", 0600);
367 CHECK_RESULT(mkfifoat, CAP_MKFIFOAT | CAP_LOOKUP, ret == 0);
368 CHECK(ret == -1 || unlinkat(dirfd, "cap_mkfifoat", 0) == 0);
369
370 ret = mknodat(dfd_cap, "cap_mknodat", S_IFCHR | 0600, 0);
371 CHECK_RESULT(mknodat, CAP_MKNODAT | CAP_LOOKUP, ret == 0);
372 CHECK(ret == -1 || unlinkat(dirfd, "cap_mknodat", 0) == 0);
373
374 /* TODO: renameat(2) */
375
376 ret = symlinkat("test", dfd_cap, "cap_symlinkat");
377 CHECK_RESULT(symlinkat, CAP_SYMLINKAT | CAP_LOOKUP, ret == 0);
378 CHECK(ret == -1 || unlinkat(dirfd, "cap_symlinkat", 0) == 0);
379
380 ret = openat(dirfd, "cap_unlinkat", O_CREAT, 0600);
381 CHECK(ret >= 0);
382 CHECK(close(ret) == 0);
383 ret = unlinkat(dfd_cap, "cap_unlinkat", 0);
384 CHECK_RESULT(unlinkat, CAP_UNLINKAT | CAP_LOOKUP, ret == 0);
385 CHECK(ret == 0 || unlinkat(dirfd, "cap_unlinkat", 0) == 0);
386 ret = mkdirat(dirfd, "cap_unlinkat", 0700);
387 CHECK(ret == 0);
388 ret = unlinkat(dfd_cap, "cap_unlinkat", AT_REMOVEDIR);
389 CHECK_RESULT(unlinkat, CAP_UNLINKAT | CAP_LOOKUP, ret == 0);
390 CHECK(ret == 0 || unlinkat(dirfd, "cap_unlinkat", AT_REMOVEDIR) == 0);
391
392 pollfd.fd = fd_cap;
393 pollfd.events = POLLIN | POLLERR | POLLHUP;
394 pollfd.revents = 0;
395
396 ret = poll(&pollfd, 1, 0);
397 if (rights & CAP_EVENT)
398 CHECK((pollfd.revents & POLLNVAL) == 0);
399 else
400 CHECK((pollfd.revents & POLLNVAL) != 0);
401
402 /* XXX: select, kqueue */
403
404 close(fd_cap);
405 close(fd_capcap);
406
407 if (success == -1) {
408 fprintf(stderr, "No tests for rights 0x%jx.\n",
409 (uintmax_t)rights);
410 success = FAILED;
411 }
412 return (success);
413 }
414
415 #define TRY(rights) \
416 do { \
417 if (success == PASSED) \
418 success = try_file_ops(filefd, dirfd, (rights)); \
419 else \
420 /* We've already failed, but try the test anyway. */ \
421 try_file_ops(filefd, dirfd, (rights)); \
422 } while (0)
423
424 #define KEEP_ERRNO(...) do { \
425 int _saved_errno = errno; \
426 __VA_ARGS__; \
427 errno = _saved_errno; \
428 } while (0);
429
430 int
test_capabilities(void)431 test_capabilities(void)
432 {
433 int filefd, dirfd, tmpfd;
434 int success = PASSED;
435 char file[] = "/tmp/cap_test.XXXXXXXXXX";
436 char dir[] = "/tmp/cap_test.XXXXXXXXXX";
437
438 filefd = mkstemp(file);
439 if (filefd < 0)
440 err(-1, "mkstemp");
441 if (mkdtemp(dir) == NULL) {
442 KEEP_ERRNO(unlink(file));
443 err(-1, "mkdtemp");
444 }
445 dirfd = open(dir, O_RDONLY | O_DIRECTORY);
446 if (dirfd == -1) {
447 KEEP_ERRNO(unlink(file));
448 KEEP_ERRNO(rmdir(dir));
449 err(-1, "open");
450 }
451 tmpfd = open("/tmp", O_RDONLY | O_DIRECTORY);
452 if (tmpfd == -1) {
453 KEEP_ERRNO(unlink(file));
454 KEEP_ERRNO(rmdir(dir));
455 err(-1, "open");
456 }
457
458 if (cap_enter() == -1) {
459 KEEP_ERRNO(unlink(file));
460 KEEP_ERRNO(rmdir(dir));
461 err(-1, "cap_enter");
462 }
463
464 TRY(CAP_READ);
465 TRY(CAP_WRITE);
466 TRY(CAP_SEEK);
467 TRY(CAP_PREAD);
468 TRY(CAP_PWRITE);
469 TRY(CAP_READ | CAP_WRITE);
470 TRY(CAP_PREAD | CAP_PWRITE);
471 TRY(CAP_MMAP);
472 TRY(CAP_MMAP_R);
473 TRY(CAP_MMAP_W);
474 TRY(CAP_MMAP_X);
475 TRY(CAP_MMAP_RW);
476 TRY(CAP_MMAP_RX);
477 TRY(CAP_MMAP_WX);
478 TRY(CAP_MMAP_RWX);
479 TRY(CAP_CREATE | CAP_READ | CAP_LOOKUP);
480 TRY(CAP_CREATE | CAP_WRITE | CAP_LOOKUP);
481 TRY(CAP_CREATE | CAP_READ | CAP_WRITE | CAP_LOOKUP);
482 #ifdef TODO
483 TRY(CAP_FEXECVE);
484 #endif
485 TRY(CAP_FSYNC);
486 TRY(CAP_FSYNC | CAP_READ | CAP_LOOKUP);
487 TRY(CAP_FSYNC | CAP_WRITE | CAP_LOOKUP);
488 TRY(CAP_FSYNC | CAP_READ | CAP_WRITE | CAP_LOOKUP);
489 TRY(CAP_FTRUNCATE);
490 TRY(CAP_FTRUNCATE | CAP_READ | CAP_LOOKUP);
491 TRY(CAP_FTRUNCATE | CAP_WRITE | CAP_LOOKUP);
492 TRY(CAP_FTRUNCATE | CAP_READ | CAP_WRITE | CAP_LOOKUP);
493 #ifdef TODO
494 TRY(CAP_FCHDIR);
495 #endif
496 TRY(CAP_FCHFLAGS);
497 TRY(CAP_FCHOWN);
498 TRY(CAP_FCHOWN | CAP_LOOKUP);
499 TRY(CAP_FCHMOD | CAP_LOOKUP);
500 TRY(CAP_FCNTL);
501 #ifdef TODO
502 TRY(CAP_FLOCK);
503 #endif
504 TRY(CAP_FPATHCONF);
505 #ifdef TODO
506 TRY(CAP_FSCK);
507 #endif
508 TRY(CAP_FSTAT | CAP_LOOKUP);
509 TRY(CAP_FSTATFS);
510 TRY(CAP_FUTIMES | CAP_LOOKUP);
511 TRY(CAP_LINKAT | CAP_LOOKUP);
512 TRY(CAP_MKDIRAT | CAP_LOOKUP);
513 TRY(CAP_MKFIFOAT | CAP_LOOKUP);
514 TRY(CAP_MKNODAT | CAP_LOOKUP);
515 TRY(CAP_SYMLINKAT | CAP_LOOKUP);
516 TRY(CAP_UNLINKAT | CAP_LOOKUP);
517 /* Rename needs CAP_RENAMEAT on source directory and CAP_LINKAT on destination directory. */
518 TRY(CAP_RENAMEAT | CAP_UNLINKAT | CAP_LOOKUP);
519 #ifdef TODO
520 TRY(CAP_LOOKUP);
521 TRY(CAP_EXTATTR_DELETE);
522 TRY(CAP_EXTATTR_GET);
523 TRY(CAP_EXTATTR_LIST);
524 TRY(CAP_EXTATTR_SET);
525 TRY(CAP_ACL_CHECK);
526 TRY(CAP_ACL_DELETE);
527 TRY(CAP_ACL_GET);
528 TRY(CAP_ACL_SET);
529 TRY(CAP_ACCEPT);
530 TRY(CAP_BIND);
531 TRY(CAP_CONNECT);
532 TRY(CAP_GETPEERNAME);
533 TRY(CAP_GETSOCKNAME);
534 TRY(CAP_GETSOCKOPT);
535 TRY(CAP_LISTEN);
536 TRY(CAP_PEELOFF);
537 TRY(CAP_RECV);
538 TRY(CAP_SEND);
539 TRY(CAP_SETSOCKOPT);
540 TRY(CAP_SHUTDOWN);
541 TRY(CAP_MAC_GET);
542 TRY(CAP_MAC_SET);
543 TRY(CAP_SEM_GETVALUE);
544 TRY(CAP_SEM_POST);
545 TRY(CAP_SEM_WAIT);
546 TRY(CAP_POST_EVENT);
547 TRY(CAP_EVENT);
548 TRY(CAP_IOCTL);
549 TRY(CAP_TTYHOOK);
550 TRY(CAP_PDGETPID);
551 TRY(CAP_PDWAIT);
552 TRY(CAP_PDKILL);
553 #endif
554
555 (void)unlinkat(tmpfd, file + strlen("/tmp/"), 0);
556 (void)unlinkat(tmpfd, dir + strlen("/tmp/"), AT_REMOVEDIR);
557
558 return (success);
559 }
560