1 /*- 2 * Copyright (c) 2009-2011 Robert N. M. Watson 3 * Copyright (c) 2011 Jonathan Anderson 4 * Copyright (c) 2012 FreeBSD Foundation 5 * All rights reserved. 6 * 7 * Portions of this software were developed by Pawel Jakub Dawidek under 8 * sponsorship from the FreeBSD Foundation. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 /* 33 * Test whether various operations on capabilities are properly masked for 34 * various object types. 35 */ 36 37 #include <sys/cdefs.h> 38 __FBSDID("$FreeBSD$"); 39 40 #include <sys/param.h> 41 #include <sys/capability.h> 42 #include <sys/errno.h> 43 #include <sys/mman.h> 44 #include <sys/mount.h> 45 #include <sys/stat.h> 46 47 #include <err.h> 48 #include <fcntl.h> 49 #include <poll.h> 50 #include <stdint.h> 51 #include <stdio.h> 52 #include <stdlib.h> 53 #include <string.h> 54 #include <unistd.h> 55 56 #include "cap_test.h" 57 58 #define SYSCALL_FAIL(syscall, message) \ 59 FAIL("%s:\t%s (rights 0x%jx)", #syscall, message, rights) 60 61 /* 62 * Ensure that, if the capability had enough rights for the system call to 63 * pass, then it did. Otherwise, ensure that the errno is ENOTCAPABLE; 64 * capability restrictions should kick in before any other error logic. 65 */ 66 #define CHECK_RESULT(syscall, rights_needed, succeeded) do { \ 67 if ((rights & (rights_needed)) == (rights_needed)) { \ 68 if (succeeded) { \ 69 if (success == -1) \ 70 success = PASSED; \ 71 } else { \ 72 SYSCALL_FAIL(syscall, "failed"); \ 73 } \ 74 } else { \ 75 if (succeeded) { \ 76 FAILX("%s:\tsucceeded when it shouldn't have" \ 77 " (rights 0x%jx)", #syscall, \ 78 (uintmax_t)rights); \ 79 } else if (errno != ENOTCAPABLE) { \ 80 SYSCALL_FAIL(syscall, "errno != ENOTCAPABLE"); \ 81 } \ 82 } \ 83 errno = 0; \ 84 } while (0) 85 86 /* 87 * As above, but for the special mmap() case: unmap after successful mmap(). 88 */ 89 #define CHECK_MMAP_RESULT(rights_needed) do { \ 90 if ((rights & (rights_needed)) == (rights_needed)) { \ 91 if (p == MAP_FAILED) \ 92 SYSCALL_FAIL(mmap, "failed"); \ 93 else { \ 94 (void)munmap(p, getpagesize()); \ 95 if (success == -1) \ 96 success = PASSED; \ 97 } \ 98 } else { \ 99 if (p != MAP_FAILED) { \ 100 FAILX("%s:\tsucceeded when it shouldn't have" \ 101 " (rights 0x%jx)", "mmap", rights); \ 102 (void)munmap(p, getpagesize()); \ 103 } else if (errno != ENOTCAPABLE) \ 104 SYSCALL_FAIL(syscall, "errno != ENOTCAPABLE"); \ 105 } \ 106 errno = 0; \ 107 } while (0) 108 109 /* 110 * Given a file descriptor, create a capability with specific rights and 111 * make sure only those rights work. 112 */ 113 static int 114 try_file_ops(int filefd, int dirfd, cap_rights_t rights) 115 { 116 struct stat sb; 117 struct statfs sf; 118 cap_rights_t erights; 119 int fd_cap, fd_capcap, dfd_cap; 120 ssize_t ssize, ssize2; 121 off_t off; 122 void *p; 123 char ch; 124 int ret, is_nfs; 125 struct pollfd pollfd; 126 int success = -1; 127 128 REQUIRE(fstatfs(filefd, &sf)); 129 is_nfs = (strcmp("nfs", sf.f_fstypename) == 0); 130 131 REQUIRE(fd_cap = cap_new(filefd, rights)); 132 CHECK(cap_getrights(fd_cap, &erights) == 0); 133 CHECK(rights == erights); 134 REQUIRE(fd_capcap = cap_new(fd_cap, rights)); 135 CHECK(cap_getrights(fd_capcap, &erights) == 0); 136 CHECK(rights == erights); 137 CHECK(fd_capcap != fd_cap); 138 REQUIRE(dfd_cap = cap_new(dirfd, rights)); 139 CHECK(cap_getrights(dfd_cap, &erights) == 0); 140 CHECK(rights == erights); 141 142 ssize = read(fd_cap, &ch, sizeof(ch)); 143 CHECK_RESULT(read, CAP_READ, ssize >= 0); 144 145 ssize = write(fd_cap, &ch, sizeof(ch)); 146 CHECK_RESULT(write, CAP_WRITE, ssize >= 0); 147 148 off = lseek(fd_cap, 0, SEEK_SET); 149 CHECK_RESULT(lseek, CAP_SEEK, off >= 0); 150 151 ssize = pread(fd_cap, &ch, sizeof(ch), 0); 152 ssize2 = pread(fd_cap, &ch, sizeof(ch), 0); 153 CHECK_RESULT(pread, CAP_PREAD, ssize >= 0); 154 CHECK(ssize == ssize2); 155 156 ssize = pwrite(fd_cap, &ch, sizeof(ch), 0); 157 CHECK_RESULT(pwrite, CAP_PWRITE, ssize >= 0); 158 159 p = mmap(NULL, getpagesize(), PROT_NONE, MAP_SHARED, fd_cap, 0); 160 CHECK_MMAP_RESULT(CAP_MMAP); 161 162 p = mmap(NULL, getpagesize(), PROT_READ, MAP_SHARED, fd_cap, 0); 163 CHECK_MMAP_RESULT(CAP_MMAP_R); 164 165 p = mmap(NULL, getpagesize(), PROT_WRITE, MAP_SHARED, fd_cap, 0); 166 CHECK_MMAP_RESULT(CAP_MMAP_W); 167 168 p = mmap(NULL, getpagesize(), PROT_EXEC, MAP_SHARED, fd_cap, 0); 169 CHECK_MMAP_RESULT(CAP_MMAP_X); 170 171 p = mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE, MAP_SHARED, 172 fd_cap, 0); 173 CHECK_MMAP_RESULT(CAP_MMAP_RW); 174 175 p = mmap(NULL, getpagesize(), PROT_READ | PROT_EXEC, MAP_SHARED, 176 fd_cap, 0); 177 CHECK_MMAP_RESULT(CAP_MMAP_RX); 178 179 p = mmap(NULL, getpagesize(), PROT_EXEC | PROT_WRITE, MAP_SHARED, 180 fd_cap, 0); 181 CHECK_MMAP_RESULT(CAP_MMAP_WX); 182 183 p = mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE | PROT_EXEC, 184 MAP_SHARED, fd_cap, 0); 185 CHECK_MMAP_RESULT(CAP_MMAP_RWX); 186 187 /* TODO: openat(O_APPEND) */ 188 ret = openat(dfd_cap, "cap_create", O_CREAT | O_RDONLY, 0600); 189 CHECK_RESULT(openat(O_CREATE | O_RDONLY), 190 CAP_CREATE | CAP_READ | CAP_LOOKUP, ret >= 0); 191 CHECK(ret == -1 || close(ret) == 0); 192 CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0); 193 ret = openat(dfd_cap, "cap_create", O_CREAT | O_WRONLY, 0600); 194 CHECK_RESULT(openat(O_CREATE | O_WRONLY), 195 CAP_CREATE | CAP_WRITE | CAP_LOOKUP, ret >= 0); 196 CHECK(ret == -1 || close(ret) == 0); 197 CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0); 198 ret = openat(dfd_cap, "cap_create", O_CREAT | O_RDWR, 0600); 199 CHECK_RESULT(openat(O_CREATE | O_RDWR), 200 CAP_CREATE | CAP_READ | CAP_WRITE | CAP_LOOKUP, ret >= 0); 201 CHECK(ret == -1 || close(ret) == 0); 202 CHECK(ret == -1 || unlinkat(dirfd, "cap_create", 0) == 0); 203 204 ret = fsync(fd_cap); 205 CHECK_RESULT(fsync, CAP_FSYNC, ret == 0); 206 207 ret = openat(dirfd, "cap_fsync", O_CREAT, 0600); 208 CHECK(ret >= 0); 209 CHECK(close(ret) == 0); 210 ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_RDONLY, 0600); 211 CHECK_RESULT(openat(O_FSYNC | O_RDONLY), 212 CAP_FSYNC | CAP_READ | CAP_LOOKUP, ret >= 0); 213 CHECK(ret == -1 || close(ret) == 0); 214 ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_WRONLY, 0600); 215 CHECK_RESULT(openat(O_FSYNC | O_WRONLY), 216 CAP_FSYNC | CAP_WRITE | CAP_LOOKUP, ret >= 0); 217 CHECK(ret == -1 || close(ret) == 0); 218 ret = openat(dfd_cap, "cap_fsync", O_FSYNC | O_RDWR, 0600); 219 CHECK_RESULT(openat(O_FSYNC | O_RDWR), 220 CAP_FSYNC | CAP_READ | CAP_WRITE | CAP_LOOKUP, ret >= 0); 221 CHECK(ret == -1 || close(ret) == 0); 222 ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_RDONLY, 0600); 223 CHECK_RESULT(openat(O_SYNC | O_RDONLY), 224 CAP_FSYNC | CAP_READ | CAP_LOOKUP, ret >= 0); 225 CHECK(ret == -1 || close(ret) == 0); 226 ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_WRONLY, 0600); 227 CHECK_RESULT(openat(O_SYNC | O_WRONLY), 228 CAP_FSYNC | CAP_WRITE | CAP_LOOKUP, ret >= 0); 229 CHECK(ret == -1 || close(ret) == 0); 230 ret = openat(dfd_cap, "cap_fsync", O_SYNC | O_RDWR, 0600); 231 CHECK_RESULT(openat(O_SYNC | O_RDWR), 232 CAP_FSYNC | CAP_READ | CAP_WRITE | CAP_LOOKUP, ret >= 0); 233 CHECK(ret == -1 || close(ret) == 0); 234 CHECK(unlinkat(dirfd, "cap_fsync", 0) == 0); 235 236 ret = ftruncate(fd_cap, 0); 237 CHECK_RESULT(ftruncate, CAP_FTRUNCATE, ret == 0); 238 239 ret = openat(dirfd, "cap_ftruncate", O_CREAT, 0600); 240 CHECK(ret >= 0); 241 CHECK(close(ret) == 0); 242 ret = openat(dfd_cap, "cap_ftruncate", O_TRUNC | O_RDONLY); 243 CHECK_RESULT(openat(O_TRUNC | O_RDONLY), 244 CAP_FTRUNCATE | CAP_READ | CAP_LOOKUP, ret >= 0); 245 CHECK(ret == -1 || close(ret) == 0); 246 ret = openat(dfd_cap, "cap_ftruncate", O_TRUNC | O_WRONLY); 247 CHECK_RESULT(openat(O_TRUNC | O_WRONLY), 248 CAP_FTRUNCATE | CAP_WRITE | CAP_LOOKUP, ret >= 0); 249 CHECK(ret == -1 || close(ret) == 0); 250 ret = openat(dfd_cap, "cap_ftruncate", O_TRUNC | O_RDWR); 251 CHECK_RESULT(openat(O_TRUNC | O_RDWR), 252 CAP_FTRUNCATE | CAP_READ | CAP_WRITE | CAP_LOOKUP, ret >= 0); 253 CHECK(ret == -1 || close(ret) == 0); 254 CHECK(unlinkat(dirfd, "cap_ftruncate", 0) == 0); 255 256 /* 257 * Note: this is not expected to work over NFS. 258 */ 259 ret = fchflags(fd_cap, UF_NODUMP); 260 CHECK_RESULT(fchflags, CAP_FCHFLAGS, 261 ret == 0 || (is_nfs && errno == EOPNOTSUPP)); 262 263 #ifdef TODO /* No such syscalls yet. */ 264 ret = openat(dirfd, "cap_fchflagsat", O_CREAT, 0600); 265 CHECK(ret >= 0); 266 CHECK(close(ret) == 0); 267 ret = fchflagsat(dfd_cap, "cap_fchflagsat", UF_NODUMP, 0); 268 CHECK_RESULT(fchflagsat, CAP_FCHFLAGSAT | CAP_LOOKUP, ret == 0); 269 CHECK(unlinkat(dirfd, "cap_fchflagsat", 0) == 0); 270 #endif 271 272 ret = fchown(fd_cap, -1, -1); 273 CHECK_RESULT(fchown, CAP_FCHOWN, ret == 0); 274 275 ret = openat(dirfd, "cap_fchownat", O_CREAT, 0600); 276 CHECK(ret >= 0); 277 CHECK(close(ret) == 0); 278 ret = fchownat(dfd_cap, "cap_fchownat", -1, -1, 0); 279 CHECK_RESULT(fchownat, CAP_FCHOWN | CAP_LOOKUP, ret == 0); 280 CHECK(unlinkat(dirfd, "cap_fchownat", 0) == 0); 281 282 ret = fchmod(fd_cap, 0644); 283 CHECK_RESULT(fchmod, CAP_FCHMOD, ret == 0); 284 285 ret = openat(dirfd, "cap_fchmodat", O_CREAT, 0600); 286 CHECK(ret >= 0); 287 CHECK(close(ret) == 0); 288 ret = fchmodat(dfd_cap, "cap_fchmodat", 0600, 0); 289 CHECK_RESULT(fchmodat, CAP_FCHMOD | CAP_LOOKUP, ret == 0); 290 CHECK(unlinkat(dirfd, "cap_fchmodat", 0) == 0); 291 292 ret = fcntl(fd_cap, F_GETFL); 293 CHECK_RESULT(fcntl(F_GETFL), CAP_FCNTL, ret >= 0); 294 ret = fcntl(fd_cap, F_SETFL, ret); 295 CHECK_RESULT(fcntl(F_SETFL), CAP_FCNTL, ret == 0); 296 297 /* XXX flock */ 298 299 ret = fstat(fd_cap, &sb); 300 CHECK_RESULT(fstat, CAP_FSTAT, ret == 0); 301 302 ret = openat(dirfd, "cap_fstatat", O_CREAT, 0600); 303 CHECK(ret >= 0); 304 CHECK(close(ret) == 0); 305 ret = fstatat(dfd_cap, "cap_fstatat", &sb, 0); 306 CHECK_RESULT(fstatat, CAP_FSTAT | CAP_LOOKUP, ret == 0); 307 CHECK(unlinkat(dirfd, "cap_fstatat", 0) == 0); 308 309 ret = fstatfs(fd_cap, &sf); 310 CHECK_RESULT(fstatfs, CAP_FSTATFS, ret == 0); 311 312 ret = fpathconf(fd_cap, _PC_NAME_MAX); 313 CHECK_RESULT(fpathconf, CAP_FPATHCONF, ret >= 0); 314 315 ret = futimes(fd_cap, NULL); 316 CHECK_RESULT(futimes, CAP_FUTIMES, ret == 0); 317 318 ret = openat(dirfd, "cap_futimesat", O_CREAT, 0600); 319 CHECK(ret >= 0); 320 CHECK(close(ret) == 0); 321 ret = futimesat(dfd_cap, "cap_futimesat", NULL); 322 CHECK_RESULT(futimesat, CAP_FUTIMES | CAP_LOOKUP, ret == 0); 323 CHECK(unlinkat(dirfd, "cap_futimesat", 0) == 0); 324 325 ret = openat(dirfd, "cap_linkat_src", O_CREAT, 0600); 326 CHECK(ret >= 0); 327 CHECK(close(ret) == 0); 328 ret = linkat(dirfd, "cap_linkat_src", dfd_cap, "cap_linkat_dst", 0); 329 CHECK_RESULT(linkat, CAP_LINKAT | CAP_LOOKUP, ret == 0); 330 CHECK(unlinkat(dirfd, "cap_linkat_src", 0) == 0); 331 CHECK(ret == -1 || unlinkat(dirfd, "cap_linkat_dst", 0) == 0); 332 333 ret = mkdirat(dfd_cap, "cap_mkdirat", 0700); 334 CHECK_RESULT(mkdirat, CAP_MKDIRAT | CAP_LOOKUP, ret == 0); 335 CHECK(ret == -1 || unlinkat(dirfd, "cap_mkdirat", AT_REMOVEDIR) == 0); 336 337 ret = mkfifoat(dfd_cap, "cap_mkfifoat", 0600); 338 CHECK_RESULT(mkfifoat, CAP_MKFIFOAT | CAP_LOOKUP, ret == 0); 339 CHECK(ret == -1 || unlinkat(dirfd, "cap_mkfifoat", 0) == 0); 340 341 ret = mknodat(dfd_cap, "cap_mknodat", S_IFCHR | 0600, 0); 342 CHECK_RESULT(mknodat, CAP_MKNODAT | CAP_LOOKUP, ret == 0); 343 CHECK(ret == -1 || unlinkat(dirfd, "cap_mknodat", 0) == 0); 344 345 /* TODO: renameat(2) */ 346 347 ret = symlinkat("test", dfd_cap, "cap_symlinkat"); 348 CHECK_RESULT(symlinkat, CAP_SYMLINKAT | CAP_LOOKUP, ret == 0); 349 CHECK(ret == -1 || unlinkat(dirfd, "cap_symlinkat", 0) == 0); 350 351 ret = openat(dirfd, "cap_unlinkat", O_CREAT, 0600); 352 CHECK(ret >= 0); 353 CHECK(close(ret) == 0); 354 ret = unlinkat(dfd_cap, "cap_unlinkat", 0); 355 CHECK_RESULT(unlinkat, CAP_UNLINKAT | CAP_LOOKUP, ret == 0); 356 CHECK(ret == 0 || unlinkat(dirfd, "cap_unlinkat", 0) == 0); 357 ret = mkdirat(dirfd, "cap_unlinkat", 0700); 358 CHECK(ret == 0); 359 ret = unlinkat(dfd_cap, "cap_unlinkat", AT_REMOVEDIR); 360 CHECK_RESULT(unlinkat, CAP_UNLINKAT | CAP_LOOKUP, ret == 0); 361 CHECK(ret == 0 || unlinkat(dirfd, "cap_unlinkat", AT_REMOVEDIR) == 0); 362 363 pollfd.fd = fd_cap; 364 pollfd.events = POLLIN | POLLERR | POLLHUP; 365 pollfd.revents = 0; 366 367 ret = poll(&pollfd, 1, 0); 368 if (rights & CAP_POLL_EVENT) 369 CHECK((pollfd.revents & POLLNVAL) == 0); 370 else 371 CHECK((pollfd.revents & POLLNVAL) != 0); 372 373 /* XXX: select, kqueue */ 374 375 close(fd_cap); 376 close(fd_capcap); 377 378 if (success == -1) { 379 fprintf(stderr, "No tests for rights 0x%jx.\n", 380 (uintmax_t)rights); 381 success = FAILED; 382 } 383 return (success); 384 } 385 386 #define TRY(rights) \ 387 do { \ 388 if (success == PASSED) \ 389 success = try_file_ops(filefd, dirfd, (rights)); \ 390 else \ 391 /* We've already failed, but try the test anyway. */ \ 392 try_file_ops(filefd, dirfd, (rights)); \ 393 } while (0) 394 395 #define KEEP_ERRNO(...) do { \ 396 int _saved_errno = errno; \ 397 __VA_ARGS__; \ 398 errno = _saved_errno; \ 399 } while (0); 400 401 int 402 test_capabilities(void) 403 { 404 int filefd, dirfd, tmpfd; 405 int success = PASSED; 406 char file[] = "/tmp/cap_test.XXXXXXXXXX"; 407 char dir[] = "/tmp/cap_test.XXXXXXXXXX"; 408 409 filefd = mkstemp(file); 410 if (filefd < 0) 411 err(-1, "mkstemp"); 412 if (mkdtemp(dir) == NULL) { 413 KEEP_ERRNO(unlink(file)); 414 err(-1, "mkdtemp"); 415 } 416 dirfd = open(dir, O_RDONLY | O_DIRECTORY); 417 if (dirfd == -1) { 418 KEEP_ERRNO(unlink(file)); 419 KEEP_ERRNO(rmdir(dir)); 420 err(-1, "open"); 421 } 422 tmpfd = open("/tmp", O_RDONLY | O_DIRECTORY); 423 if (tmpfd == -1) { 424 KEEP_ERRNO(unlink(file)); 425 KEEP_ERRNO(rmdir(dir)); 426 err(-1, "open"); 427 } 428 429 if (cap_enter() == -1) { 430 KEEP_ERRNO(unlink(file)); 431 KEEP_ERRNO(rmdir(dir)); 432 err(-1, "cap_enter"); 433 } 434 435 TRY(CAP_READ); 436 TRY(CAP_WRITE); 437 TRY(CAP_SEEK); 438 TRY(CAP_PREAD); 439 TRY(CAP_PWRITE); 440 TRY(CAP_READ | CAP_WRITE); 441 TRY(CAP_PREAD | CAP_PWRITE); 442 TRY(CAP_MMAP); 443 TRY(CAP_MMAP_R); 444 TRY(CAP_MMAP_W); 445 TRY(CAP_MMAP_X); 446 TRY(CAP_MMAP_RW); 447 TRY(CAP_MMAP_RX); 448 TRY(CAP_MMAP_WX); 449 TRY(CAP_MMAP_RWX); 450 TRY(CAP_CREATE | CAP_READ | CAP_LOOKUP); 451 TRY(CAP_CREATE | CAP_WRITE | CAP_LOOKUP); 452 TRY(CAP_CREATE | CAP_READ | CAP_WRITE | CAP_LOOKUP); 453 #ifdef TODO 454 TRY(CAP_FEXECVE); 455 #endif 456 TRY(CAP_FSYNC); 457 TRY(CAP_FSYNC | CAP_READ | CAP_LOOKUP); 458 TRY(CAP_FSYNC | CAP_WRITE | CAP_LOOKUP); 459 TRY(CAP_FSYNC | CAP_READ | CAP_WRITE | CAP_LOOKUP); 460 TRY(CAP_FTRUNCATE); 461 TRY(CAP_FTRUNCATE | CAP_READ | CAP_LOOKUP); 462 TRY(CAP_FTRUNCATE | CAP_WRITE | CAP_LOOKUP); 463 TRY(CAP_FTRUNCATE | CAP_READ | CAP_WRITE | CAP_LOOKUP); 464 #ifdef TODO 465 TRY(CAP_FCHDIR); 466 #endif 467 TRY(CAP_FCHFLAGS); 468 TRY(CAP_FCHOWN); 469 TRY(CAP_FCHOWN | CAP_LOOKUP); 470 TRY(CAP_FCHMOD | CAP_LOOKUP); 471 TRY(CAP_FCNTL); 472 #ifdef TODO 473 TRY(CAP_FLOCK); 474 #endif 475 TRY(CAP_FPATHCONF); 476 #ifdef TODO 477 TRY(CAP_FSCK); 478 #endif 479 TRY(CAP_FSTAT | CAP_LOOKUP); 480 TRY(CAP_FSTATFS); 481 TRY(CAP_FUTIMES | CAP_LOOKUP); 482 TRY(CAP_LINKAT | CAP_LOOKUP); 483 TRY(CAP_MKDIRAT | CAP_LOOKUP); 484 TRY(CAP_MKFIFOAT | CAP_LOOKUP); 485 TRY(CAP_MKNODAT | CAP_LOOKUP); 486 TRY(CAP_SYMLINKAT | CAP_LOOKUP); 487 TRY(CAP_UNLINKAT | CAP_LOOKUP); 488 /* Rename needs CAP_RENAMEAT on source directory and CAP_LINKAT on destination directory. */ 489 TRY(CAP_RENAMEAT | CAP_UNLINKAT | CAP_LOOKUP); 490 #ifdef TODO 491 TRY(CAP_LOOKUP); 492 TRY(CAP_EXTATTR_DELETE); 493 TRY(CAP_EXTATTR_GET); 494 TRY(CAP_EXTATTR_LIST); 495 TRY(CAP_EXTATTR_SET); 496 TRY(CAP_ACL_CHECK); 497 TRY(CAP_ACL_DELETE); 498 TRY(CAP_ACL_GET); 499 TRY(CAP_ACL_SET); 500 TRY(CAP_ACCEPT); 501 TRY(CAP_BIND); 502 TRY(CAP_CONNECT); 503 TRY(CAP_GETPEERNAME); 504 TRY(CAP_GETSOCKNAME); 505 TRY(CAP_GETSOCKOPT); 506 TRY(CAP_LISTEN); 507 TRY(CAP_PEELOFF); 508 TRY(CAP_RECV); 509 TRY(CAP_SEND); 510 TRY(CAP_SETSOCKOPT); 511 TRY(CAP_SHUTDOWN); 512 TRY(CAP_MAC_GET); 513 TRY(CAP_MAC_SET); 514 TRY(CAP_SEM_GETVALUE); 515 TRY(CAP_SEM_POST); 516 TRY(CAP_SEM_WAIT); 517 TRY(CAP_POST_EVENT); 518 TRY(CAP_POLL_EVENT); 519 TRY(CAP_IOCTL); 520 TRY(CAP_TTYHOOK); 521 TRY(CAP_PDGETPID); 522 TRY(CAP_PDWAIT); 523 TRY(CAP_PDKILL); 524 #endif 525 526 (void)unlinkat(tmpfd, file + strlen("/tmp/"), 0); 527 (void)unlinkat(tmpfd, dir + strlen("/tmp/"), AT_REMOVEDIR); 528 529 return (success); 530 } 531