1 /*- 2 * Copyright (c) 2009-2011 Robert N. M. Watson 3 * Copyright (c) 2011 Jonathan Anderson 4 * Copyright (c) 2012 FreeBSD Foundation 5 * All rights reserved. 6 * 7 * Portions of this software were developed by Pawel Jakub Dawidek under 8 * sponsorship from the FreeBSD Foundation. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 /* 33 * Test whether various operations on capabilities are properly masked for 34 * various object types. 35 */ 36 37 #include <sys/cdefs.h> 38 #include <sys/param.h> 39 #include <sys/capsicum.h> 40 #include <sys/errno.h> 41 #include <sys/mman.h> 42 #include <sys/mount.h> 43 #include <sys/stat.h> 44 45 #include <err.h> 46 #include <fcntl.h> 47 #include <poll.h> 48 #include <stdint.h> 49 #include <stdio.h> 50 #include <stdlib.h> 51 #include <string.h> 52 #include <unistd.h> 53 54 #include "cap_test.h" 55 56 #define SYSCALL_FAIL(syscall, message) \ 57 FAIL("%s:\t%s (rights 0x%jx)", #syscall, message, rights) 58 59 /* 60 * Ensure that, if the capability had enough rights for the system call to 61 * pass, then it did. Otherwise, ensure that the errno is ENOTCAPABLE; 62 * capability restrictions should kick in before any other error logic. 63 */ 64 #define CHECK_RESULT(syscall, rights_needed, succeeded) do { \ 65 if ((rights & (rights_needed)) == (rights_needed)) { \ 66 if (succeeded) { \ 67 if (success == -1) \ 68 success = PASSED; \ 69 } else { \ 70 SYSCALL_FAIL(syscall, "failed"); \ 71 } \ 72 } else { \ 73 if (succeeded) { \ 74 FAILX("%s:\tsucceeded when it shouldn't have" \ 75 " (rights 0x%jx)", #syscall, \ 76 (uintmax_t)rights); \ 77 } else if (errno != ENOTCAPABLE) { \ 78 SYSCALL_FAIL(syscall, "errno != ENOTCAPABLE"); \ 79 } \ 80 } \ 81 errno = 0; \ 82 } while (0) 83 84 /* 85 * As above, but for the special mmap() case: unmap after successful mmap(). 86 */ 87 #define CHECK_MMAP_RESULT(rights_needed) do { \ 88 if ((rights & (rights_needed)) == (rights_needed)) { \ 89 if (p == MAP_FAILED) \ 90 SYSCALL_FAIL(mmap, "failed"); \ 91 else { \ 92 (void)munmap(p, getpagesize()); \ 93 if (success == -1) \ 94 success = PASSED; \ 95 } \ 96 } else { \ 97 if (p != MAP_FAILED) { \ 98 FAILX("%s:\tsucceeded when it shouldn't have" \ 99 " (rights 0x%jx)", "mmap", rights); \ 100 (void)munmap(p, getpagesize()); \ 101 } else if (errno != ENOTCAPABLE) \ 102 SYSCALL_FAIL(syscall, "errno != ENOTCAPABLE"); \ 103 } \ 104 errno = 0; \ 105 } while (0) 106 107 /* 108 * Given a file descriptor, create a capability with specific rights and 109 * make sure only those rights work. 110 */ 111 static int 112 try_file_ops(int filefd, int dirfd, cap_rights_t rights) 113 { 114 struct stat sb; 115 struct statfs sf; 116 cap_rights_t erights; 117 int fd_cap, fd_capcap, dfd_cap; 118 ssize_t ssize, ssize2; 119 off_t off; 120 void *p; 121 char ch; 122 int ret, is_nfs; 123 struct pollfd pollfd; 124 int success = -1; 125 126 REQUIRE(fstatfs(filefd, &sf)); 127 is_nfs = (strcmp("nfs", sf.f_fstypename) == 0); 128 129 REQUIRE(fd_cap = cap_new(filefd, rights)); 130 CHECK(cap_getrights(fd_cap, &erights) == 0); 131 CHECK(rights == erights); 132 REQUIRE(fd_capcap = cap_new(fd_cap, rights)); 133 CHECK(cap_getrights(fd_capcap, &erights) == 0); 134 CHECK(rights == erights); 135 CHECK(fd_capcap != fd_cap); 136 REQUIRE(dfd_cap = cap_new(dirfd, rights)); 137 CHECK(cap_getrights(dfd_cap, &erights) == 0); 138 CHECK(rights == erights); 139 140 ssize = read(fd_cap, &ch, sizeof(ch)); 141 CHECK_RESULT(read, CAP_READ, ssize >= 0); 142 143 ssize = write(fd_cap, &ch, sizeof(ch)); 144 CHECK_RESULT(write, CAP_WRITE, ssize >= 0); 145 146 off = lseek(fd_cap, 0, SEEK_SET); 147 CHECK_RESULT(lseek, CAP_SEEK, off >= 0); 148 149 ssize = pread(fd_cap, &ch, sizeof(ch), 0); 150 ssize2 = pread(fd_cap, &ch, sizeof(ch), 0); 151 CHECK_RESULT(pread, CAP_PREAD, ssize >= 0); 152 CHECK(ssize == ssize2); 153 154 ssize = pwrite(fd_cap, &ch, sizeof(ch), 0); 155 CHECK_RESULT(pwrite, CAP_PWRITE, ssize >= 0); 156 157 p = mmap(NULL, getpagesize(), PROT_NONE, MAP_SHARED, fd_cap, 0); 158 CHECK_MMAP_RESULT(CAP_MMAP); 159 160 p = mmap(NULL, getpagesize(), PROT_READ, MAP_SHARED, fd_cap, 0); 161 CHECK_MMAP_RESULT(CAP_MMAP_R); 162 163 p = mmap(NULL, getpagesize(), PROT_WRITE, MAP_SHARED, fd_cap, 0); 164 CHECK_MMAP_RESULT(CAP_MMAP_W); 165 166 p = mmap(NULL, getpagesize(), PROT_EXEC, MAP_SHARED, fd_cap, 0); 167 CHECK_MMAP_RESULT(CAP_MMAP_X); 168 169 p = mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE, MAP_SHARED, 170 fd_cap, 0); 171 CHECK_MMAP_RESULT(CAP_MMAP_RW); 172 173 p = mmap(NULL, getpagesize(), PROT_READ | PROT_EXEC, MAP_SHARED, 174 fd_cap, 0); 175 CHECK_MMAP_RESULT(CAP_MMAP_RX); 176 177 p = mmap(NULL, getpagesize(), PROT_EXEC | PROT_WRITE, MAP_SHARED, 178 fd_cap, 0); 179 CHECK_MMAP_RESULT(CAP_MMAP_WX); 180 181 p = mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE | PROT_EXEC, 182 MAP_SHARED, fd_cap, 0); 183 CHECK_MMAP_RESULT(CAP_MMAP_RWX); 184 185 ret = openat(dfd_cap, "cap_create", O_CREAT | O_RDONLY, 0600); 186 CHECK_RESULT(openat(O_CREATE | O_RDONLY), 187 CAP_CREATE | CAP_READ | CAP_LOOKUP, ret >= 0); 188 CHECK(ret == -1 || close(ret) == 0); 189 CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0); 190 ret = openat(dfd_cap, "cap_create", O_CREAT | O_WRONLY | O_APPEND, 191 0600); 192 CHECK_RESULT(openat(O_CREATE | O_WRONLY | O_APPEND), 193 CAP_CREATE | CAP_WRITE | CAP_LOOKUP, ret >= 0); 194 CHECK(ret == -1 || close(ret) == 0); 195 CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0); 196 ret = openat(dfd_cap, "cap_create", O_CREAT | O_RDWR | O_APPEND, 0600); 197 CHECK_RESULT(openat(O_CREATE | O_RDWR | O_APPEND), 198 CAP_CREATE | CAP_READ | CAP_WRITE | CAP_LOOKUP, ret >= 0); 199 CHECK(ret == -1 || close(ret) == 0); 200 CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0); 201 202 ret = fsync(fd_cap); 203 CHECK_RESULT(fsync, CAP_FSYNC, ret == 0); 204 205 ret = openat(dirfd, "cap_fsync", O_CREAT, 0600); 206 CHECK(ret >= 0); 207 CHECK(close(ret) == 0); 208 ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_RDONLY); 209 CHECK_RESULT(openat(O_FSYNC | O_RDONLY), 210 CAP_FSYNC | CAP_READ | CAP_LOOKUP, ret >= 0); 211 CHECK(ret == -1 || close(ret) == 0); 212 ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_WRONLY | O_APPEND); 213 CHECK_RESULT(openat(O_FSYNC | O_WRONLY | O_APPEND), 214 CAP_FSYNC | CAP_WRITE | CAP_LOOKUP, ret >= 0); 215 CHECK(ret == -1 || close(ret) == 0); 216 ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_RDWR | O_APPEND); 217 CHECK_RESULT(openat(O_FSYNC | O_RDWR | O_APPEND), 218 CAP_FSYNC | CAP_READ | CAP_WRITE | CAP_LOOKUP, ret >= 0); 219 CHECK(ret == -1 || close(ret) == 0); 220 ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_RDONLY); 221 CHECK_RESULT(openat(O_SYNC | O_RDONLY), 222 CAP_FSYNC | CAP_READ | CAP_LOOKUP, ret >= 0); 223 CHECK(ret == -1 || close(ret) == 0); 224 ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_WRONLY | O_APPEND); 225 CHECK_RESULT(openat(O_SYNC | O_WRONLY | O_APPEND), 226 CAP_FSYNC | CAP_WRITE | CAP_LOOKUP, ret >= 0); 227 CHECK(ret == -1 || close(ret) == 0); 228 ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_RDWR | O_APPEND); 229 CHECK_RESULT(openat(O_SYNC | O_RDWR | O_APPEND), 230 CAP_FSYNC | CAP_READ | CAP_WRITE | CAP_LOOKUP, ret >= 0); 231 CHECK(ret == -1 || close(ret) == 0); 232 CHECK(unlinkat(dirfd, "cap_fsync", 0) == 0); 233 234 ret = ftruncate(fd_cap, 0); 235 CHECK_RESULT(ftruncate, CAP_FTRUNCATE, ret == 0); 236 237 ret = openat(dirfd, "cap_ftruncate", O_CREAT, 0600); 238 CHECK(ret >= 0); 239 CHECK(close(ret) == 0); 240 ret = openat(dfd_cap, "cap_ftruncate", O_TRUNC | O_RDONLY); 241 CHECK_RESULT(openat(O_TRUNC | O_RDONLY), 242 CAP_FTRUNCATE | CAP_READ | CAP_LOOKUP, ret >= 0); 243 CHECK(ret == -1 || close(ret) == 0); 244 ret = openat(dfd_cap, "cap_ftruncate", O_TRUNC | O_WRONLY); 245 CHECK_RESULT(openat(O_TRUNC | O_WRONLY), 246 CAP_FTRUNCATE | CAP_WRITE | CAP_LOOKUP, ret >= 0); 247 CHECK(ret == -1 || close(ret) == 0); 248 ret = openat(dfd_cap, "cap_ftruncate", O_TRUNC | O_RDWR); 249 CHECK_RESULT(openat(O_TRUNC | O_RDWR), 250 CAP_FTRUNCATE | CAP_READ | CAP_WRITE | CAP_LOOKUP, ret >= 0); 251 CHECK(ret == -1 || close(ret) == 0); 252 CHECK(unlinkat(dirfd, "cap_ftruncate", 0) == 0); 253 254 ret = openat(dfd_cap, "cap_create", O_CREAT | O_WRONLY, 0600); 255 CHECK_RESULT(openat(O_CREATE | O_WRONLY), 256 CAP_CREATE | CAP_WRITE | CAP_SEEK | CAP_LOOKUP, ret >= 0); 257 CHECK(ret == -1 || close(ret) == 0); 258 CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0); 259 ret = openat(dfd_cap, "cap_create", O_CREAT | O_RDWR, 0600); 260 CHECK_RESULT(openat(O_CREATE | O_RDWR), 261 CAP_CREATE | CAP_READ | CAP_WRITE | CAP_SEEK | CAP_LOOKUP, 262 ret >= 0); 263 CHECK(ret == -1 || close(ret) == 0); 264 CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0); 265 266 ret = openat(dirfd, "cap_fsync", O_CREAT, 0600); 267 CHECK(ret >= 0); 268 CHECK(close(ret) == 0); 269 ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_WRONLY); 270 CHECK_RESULT(openat(O_FSYNC | O_WRONLY), 271 CAP_FSYNC | CAP_WRITE | CAP_SEEK | CAP_LOOKUP, ret >= 0); 272 CHECK(ret == -1 || close(ret) == 0); 273 ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_RDWR); 274 CHECK_RESULT(openat(O_FSYNC | O_RDWR), 275 CAP_FSYNC | CAP_READ | CAP_WRITE | CAP_SEEK | CAP_LOOKUP, ret >= 0); 276 CHECK(ret == -1 || close(ret) == 0); 277 ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_WRONLY); 278 CHECK_RESULT(openat(O_SYNC | O_WRONLY), 279 CAP_FSYNC | CAP_WRITE | CAP_SEEK | CAP_LOOKUP, ret >= 0); 280 CHECK(ret == -1 || close(ret) == 0); 281 ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_RDWR); 282 CHECK_RESULT(openat(O_SYNC | O_RDWR), 283 CAP_FSYNC | CAP_READ | CAP_WRITE | CAP_SEEK | CAP_LOOKUP, ret >= 0); 284 CHECK(ret == -1 || close(ret) == 0); 285 CHECK(unlinkat(dirfd, "cap_fsync", 0) == 0); 286 287 /* 288 * Note: this is not expected to work over NFS. 289 */ 290 ret = fchflags(fd_cap, UF_NODUMP); 291 CHECK_RESULT(fchflags, CAP_FCHFLAGS, 292 ret == 0 || (is_nfs && errno == EOPNOTSUPP)); 293 294 ret = openat(dirfd, "cap_chflagsat", O_CREAT, 0600); 295 CHECK(ret >= 0); 296 CHECK(close(ret) == 0); 297 ret = chflagsat(dfd_cap, "cap_chflagsat", UF_NODUMP, 0); 298 CHECK_RESULT(chflagsat, CAP_CHFLAGSAT | CAP_LOOKUP, ret == 0); 299 CHECK(unlinkat(dirfd, "cap_chflagsat", 0) == 0); 300 301 ret = fchown(fd_cap, -1, -1); 302 CHECK_RESULT(fchown, CAP_FCHOWN, ret == 0); 303 304 ret = openat(dirfd, "cap_fchownat", O_CREAT, 0600); 305 CHECK(ret >= 0); 306 CHECK(close(ret) == 0); 307 ret = fchownat(dfd_cap, "cap_fchownat", -1, -1, 0); 308 CHECK_RESULT(fchownat, CAP_FCHOWN | CAP_LOOKUP, ret == 0); 309 CHECK(unlinkat(dirfd, "cap_fchownat", 0) == 0); 310 311 ret = fchmod(fd_cap, 0644); 312 CHECK_RESULT(fchmod, CAP_FCHMOD, ret == 0); 313 314 ret = openat(dirfd, "cap_fchmodat", O_CREAT, 0600); 315 CHECK(ret >= 0); 316 CHECK(close(ret) == 0); 317 ret = fchmodat(dfd_cap, "cap_fchmodat", 0600, 0); 318 CHECK_RESULT(fchmodat, CAP_FCHMOD | CAP_LOOKUP, ret == 0); 319 CHECK(unlinkat(dirfd, "cap_fchmodat", 0) == 0); 320 321 ret = fcntl(fd_cap, F_GETFL); 322 CHECK_RESULT(fcntl(F_GETFL), CAP_FCNTL, ret >= 0); 323 ret = fcntl(fd_cap, F_SETFL, ret); 324 CHECK_RESULT(fcntl(F_SETFL), CAP_FCNTL, ret == 0); 325 326 /* XXX flock */ 327 328 ret = fstat(fd_cap, &sb); 329 CHECK_RESULT(fstat, CAP_FSTAT, ret == 0); 330 331 ret = openat(dirfd, "cap_fstatat", O_CREAT, 0600); 332 CHECK(ret >= 0); 333 CHECK(close(ret) == 0); 334 ret = fstatat(dfd_cap, "cap_fstatat", &sb, 0); 335 CHECK_RESULT(fstatat, CAP_FSTAT | CAP_LOOKUP, ret == 0); 336 CHECK(unlinkat(dirfd, "cap_fstatat", 0) == 0); 337 338 ret = fstatfs(fd_cap, &sf); 339 CHECK_RESULT(fstatfs, CAP_FSTATFS, ret == 0); 340 341 ret = fpathconf(fd_cap, _PC_NAME_MAX); 342 CHECK_RESULT(fpathconf, CAP_FPATHCONF, ret >= 0); 343 344 ret = futimes(fd_cap, NULL); 345 CHECK_RESULT(futimes, CAP_FUTIMES, ret == 0); 346 347 ret = openat(dirfd, "cap_futimesat", O_CREAT, 0600); 348 CHECK(ret >= 0); 349 CHECK(close(ret) == 0); 350 ret = futimesat(dfd_cap, "cap_futimesat", NULL); 351 CHECK_RESULT(futimesat, CAP_FUTIMES | CAP_LOOKUP, ret == 0); 352 CHECK(unlinkat(dirfd, "cap_futimesat", 0) == 0); 353 354 ret = openat(dirfd, "cap_linkat_src", O_CREAT, 0600); 355 CHECK(ret >= 0); 356 CHECK(close(ret) == 0); 357 ret = linkat(dirfd, "cap_linkat_src", dfd_cap, "cap_linkat_dst", 0); 358 CHECK_RESULT(linkat, CAP_LINKAT | CAP_LOOKUP, ret == 0); 359 CHECK(unlinkat(dirfd, "cap_linkat_src", 0) == 0); 360 CHECK(ret == -1 || unlinkat(dirfd, "cap_linkat_dst", 0) == 0); 361 362 ret = mkdirat(dfd_cap, "cap_mkdirat", 0700); 363 CHECK_RESULT(mkdirat, CAP_MKDIRAT | CAP_LOOKUP, ret == 0); 364 CHECK(ret == -1 || unlinkat(dirfd, "cap_mkdirat", AT_REMOVEDIR) == 0); 365 366 ret = mkfifoat(dfd_cap, "cap_mkfifoat", 0600); 367 CHECK_RESULT(mkfifoat, CAP_MKFIFOAT | CAP_LOOKUP, ret == 0); 368 CHECK(ret == -1 || unlinkat(dirfd, "cap_mkfifoat", 0) == 0); 369 370 ret = mknodat(dfd_cap, "cap_mknodat", S_IFCHR | 0600, 0); 371 CHECK_RESULT(mknodat, CAP_MKNODAT | CAP_LOOKUP, ret == 0); 372 CHECK(ret == -1 || unlinkat(dirfd, "cap_mknodat", 0) == 0); 373 374 /* TODO: renameat(2) */ 375 376 ret = symlinkat("test", dfd_cap, "cap_symlinkat"); 377 CHECK_RESULT(symlinkat, CAP_SYMLINKAT | CAP_LOOKUP, ret == 0); 378 CHECK(ret == -1 || unlinkat(dirfd, "cap_symlinkat", 0) == 0); 379 380 ret = openat(dirfd, "cap_unlinkat", O_CREAT, 0600); 381 CHECK(ret >= 0); 382 CHECK(close(ret) == 0); 383 ret = unlinkat(dfd_cap, "cap_unlinkat", 0); 384 CHECK_RESULT(unlinkat, CAP_UNLINKAT | CAP_LOOKUP, ret == 0); 385 CHECK(ret == 0 || unlinkat(dirfd, "cap_unlinkat", 0) == 0); 386 ret = mkdirat(dirfd, "cap_unlinkat", 0700); 387 CHECK(ret == 0); 388 ret = unlinkat(dfd_cap, "cap_unlinkat", AT_REMOVEDIR); 389 CHECK_RESULT(unlinkat, CAP_UNLINKAT | CAP_LOOKUP, ret == 0); 390 CHECK(ret == 0 || unlinkat(dirfd, "cap_unlinkat", AT_REMOVEDIR) == 0); 391 392 pollfd.fd = fd_cap; 393 pollfd.events = POLLIN | POLLERR | POLLHUP; 394 pollfd.revents = 0; 395 396 ret = poll(&pollfd, 1, 0); 397 if (rights & CAP_EVENT) 398 CHECK((pollfd.revents & POLLNVAL) == 0); 399 else 400 CHECK((pollfd.revents & POLLNVAL) != 0); 401 402 /* XXX: select, kqueue */ 403 404 close(fd_cap); 405 close(fd_capcap); 406 407 if (success == -1) { 408 fprintf(stderr, "No tests for rights 0x%jx.\n", 409 (uintmax_t)rights); 410 success = FAILED; 411 } 412 return (success); 413 } 414 415 #define TRY(rights) \ 416 do { \ 417 if (success == PASSED) \ 418 success = try_file_ops(filefd, dirfd, (rights)); \ 419 else \ 420 /* We've already failed, but try the test anyway. */ \ 421 try_file_ops(filefd, dirfd, (rights)); \ 422 } while (0) 423 424 #define KEEP_ERRNO(...) do { \ 425 int _saved_errno = errno; \ 426 __VA_ARGS__; \ 427 errno = _saved_errno; \ 428 } while (0); 429 430 int 431 test_capabilities(void) 432 { 433 int filefd, dirfd, tmpfd; 434 int success = PASSED; 435 char file[] = "/tmp/cap_test.XXXXXXXXXX"; 436 char dir[] = "/tmp/cap_test.XXXXXXXXXX"; 437 438 filefd = mkstemp(file); 439 if (filefd < 0) 440 err(-1, "mkstemp"); 441 if (mkdtemp(dir) == NULL) { 442 KEEP_ERRNO(unlink(file)); 443 err(-1, "mkdtemp"); 444 } 445 dirfd = open(dir, O_RDONLY | O_DIRECTORY); 446 if (dirfd == -1) { 447 KEEP_ERRNO(unlink(file)); 448 KEEP_ERRNO(rmdir(dir)); 449 err(-1, "open"); 450 } 451 tmpfd = open("/tmp", O_RDONLY | O_DIRECTORY); 452 if (tmpfd == -1) { 453 KEEP_ERRNO(unlink(file)); 454 KEEP_ERRNO(rmdir(dir)); 455 err(-1, "open"); 456 } 457 458 if (cap_enter() == -1) { 459 KEEP_ERRNO(unlink(file)); 460 KEEP_ERRNO(rmdir(dir)); 461 err(-1, "cap_enter"); 462 } 463 464 TRY(CAP_READ); 465 TRY(CAP_WRITE); 466 TRY(CAP_SEEK); 467 TRY(CAP_PREAD); 468 TRY(CAP_PWRITE); 469 TRY(CAP_READ | CAP_WRITE); 470 TRY(CAP_PREAD | CAP_PWRITE); 471 TRY(CAP_MMAP); 472 TRY(CAP_MMAP_R); 473 TRY(CAP_MMAP_W); 474 TRY(CAP_MMAP_X); 475 TRY(CAP_MMAP_RW); 476 TRY(CAP_MMAP_RX); 477 TRY(CAP_MMAP_WX); 478 TRY(CAP_MMAP_RWX); 479 TRY(CAP_CREATE | CAP_READ | CAP_LOOKUP); 480 TRY(CAP_CREATE | CAP_WRITE | CAP_LOOKUP); 481 TRY(CAP_CREATE | CAP_READ | CAP_WRITE | CAP_LOOKUP); 482 #ifdef TODO 483 TRY(CAP_FEXECVE); 484 #endif 485 TRY(CAP_FSYNC); 486 TRY(CAP_FSYNC | CAP_READ | CAP_LOOKUP); 487 TRY(CAP_FSYNC | CAP_WRITE | CAP_LOOKUP); 488 TRY(CAP_FSYNC | CAP_READ | CAP_WRITE | CAP_LOOKUP); 489 TRY(CAP_FTRUNCATE); 490 TRY(CAP_FTRUNCATE | CAP_READ | CAP_LOOKUP); 491 TRY(CAP_FTRUNCATE | CAP_WRITE | CAP_LOOKUP); 492 TRY(CAP_FTRUNCATE | CAP_READ | CAP_WRITE | CAP_LOOKUP); 493 #ifdef TODO 494 TRY(CAP_FCHDIR); 495 #endif 496 TRY(CAP_FCHFLAGS); 497 TRY(CAP_FCHOWN); 498 TRY(CAP_FCHOWN | CAP_LOOKUP); 499 TRY(CAP_FCHMOD | CAP_LOOKUP); 500 TRY(CAP_FCNTL); 501 #ifdef TODO 502 TRY(CAP_FLOCK); 503 #endif 504 TRY(CAP_FPATHCONF); 505 #ifdef TODO 506 TRY(CAP_FSCK); 507 #endif 508 TRY(CAP_FSTAT | CAP_LOOKUP); 509 TRY(CAP_FSTATFS); 510 TRY(CAP_FUTIMES | CAP_LOOKUP); 511 TRY(CAP_LINKAT | CAP_LOOKUP); 512 TRY(CAP_MKDIRAT | CAP_LOOKUP); 513 TRY(CAP_MKFIFOAT | CAP_LOOKUP); 514 TRY(CAP_MKNODAT | CAP_LOOKUP); 515 TRY(CAP_SYMLINKAT | CAP_LOOKUP); 516 TRY(CAP_UNLINKAT | CAP_LOOKUP); 517 /* Rename needs CAP_RENAMEAT on source directory and CAP_LINKAT on destination directory. */ 518 TRY(CAP_RENAMEAT | CAP_UNLINKAT | CAP_LOOKUP); 519 #ifdef TODO 520 TRY(CAP_LOOKUP); 521 TRY(CAP_EXTATTR_DELETE); 522 TRY(CAP_EXTATTR_GET); 523 TRY(CAP_EXTATTR_LIST); 524 TRY(CAP_EXTATTR_SET); 525 TRY(CAP_ACL_CHECK); 526 TRY(CAP_ACL_DELETE); 527 TRY(CAP_ACL_GET); 528 TRY(CAP_ACL_SET); 529 TRY(CAP_ACCEPT); 530 TRY(CAP_BIND); 531 TRY(CAP_CONNECT); 532 TRY(CAP_GETPEERNAME); 533 TRY(CAP_GETSOCKNAME); 534 TRY(CAP_GETSOCKOPT); 535 TRY(CAP_LISTEN); 536 TRY(CAP_PEELOFF); 537 TRY(CAP_RECV); 538 TRY(CAP_SEND); 539 TRY(CAP_SETSOCKOPT); 540 TRY(CAP_SHUTDOWN); 541 TRY(CAP_MAC_GET); 542 TRY(CAP_MAC_SET); 543 TRY(CAP_SEM_GETVALUE); 544 TRY(CAP_SEM_POST); 545 TRY(CAP_SEM_WAIT); 546 TRY(CAP_POST_EVENT); 547 TRY(CAP_EVENT); 548 TRY(CAP_IOCTL); 549 TRY(CAP_TTYHOOK); 550 TRY(CAP_PDGETPID); 551 TRY(CAP_PDWAIT); 552 TRY(CAP_PDKILL); 553 #endif 554 555 (void)unlinkat(tmpfd, file + strlen("/tmp/"), 0); 556 (void)unlinkat(tmpfd, dir + strlen("/tmp/"), AT_REMOVEDIR); 557 558 return (success); 559 } 560