1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2019 FUJITSU LIMITED. All rights reserved.
4 * Author: Yang Xu <[email protected]>
5 */
6
7 /*\
8 * [Description]
9 *
10 * Test the PR_CAP_AMBIENT of prctl(2).
11 *
12 * Reads or changes the ambient capability set of the calling thread,
13 * according to the value of arg2, which must be one of the following:
14 *
15 * - PR_CAP_AMBIENT_RAISE: The capability specified in arg3 is added to the
16 * ambient set. The specified capability must already be present in both pE
17 * and pI. If we set SECBIT_NO_CAP_AMBIENT_RAISE bit, raise option will be
18 * rejected and return EPERM. We also raise a CAP twice.
19 *
20 * - PR_CAP_AMBIENT_LOWER: The capability specified in arg3 is removed from the
21 * ambient set. Even though this cap is not in set, it also should return 0.
22 *
23 * - PR_CAP_AMBIENT_IS_SET: Returns 1 if the capability in arg3 is in the
24 * ambient set and 0 if it is not.
25 *
26 * - PR_CAP_AMBIENT_CLEAR_ALL: All capabilities will be removed from the
27 * ambient set. This operation requires setting arg3 to zero.
28 */
29
30 #include <sys/prctl.h>
31 #include <stdlib.h>
32 #include "config.h"
33 #ifdef HAVE_SYS_CAPABILITY_H
34 # include <sys/capability.h>
35 #endif
36 #include "lapi/syscalls.h"
37 #include "lapi/prctl.h"
38 #include "lapi/securebits.h"
39 #include "tst_test.h"
40
41 #define PROC_STATUS "/proc/self/status"
42 #define ZERO_STRING "0000000000000000"
43 /*CAP_NET_BIND_SERVICE stored in the CapAmb field of PROC_STATUS*/
44 #define CAP_STRING "0000000000000400"
45
check_cap_raise(unsigned int cap,char * message,int fail_flag)46 static inline void check_cap_raise(unsigned int cap, char *message, int fail_flag)
47 {
48 TEST(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0));
49 switch (fail_flag) {
50 case 0:
51 if (TST_RET == 0)
52 tst_res(TPASS, "PR_CAP_AMBIENT_RAISE %s succeeded", message);
53 else
54 tst_res(TFAIL, "PR_CAP_AMBIENT_RAISE %s failed unexpectedly",
55 message);
56 break;
57 case 1:
58 if (TST_RET == 0)
59 tst_res(TFAIL,
60 "PR_CAP_AMBIENT_RAISE succeeded unexpectedly %s",
61 message);
62 else if (TST_ERR == EPERM)
63 tst_res(TPASS,
64 "PR_CAP_AMBIENT_RAISE failed with EPERM %s", message);
65 else
66 tst_res(TFAIL | TTERRNO,
67 "PR_CAP_AMBIENT_RAISE failed %s", message);
68 break;
69 }
70 }
71
check_cap_is_set(unsigned int cap,char * message,int val)72 static inline void check_cap_is_set(unsigned int cap, char *message, int val)
73 {
74 TEST(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, cap, 0, 0));
75 if (TST_RET == 1)
76 tst_res(val ? TPASS : TFAIL,
77 "PR_CAP_AMBIENT_IS_SET %s in AmbientCap", message);
78 else if (TST_RET == 0)
79 tst_res(val ? TFAIL : TPASS,
80 "PR_CAP_AMBIENT_IS_SET %s not in AmbientCap", message);
81 else
82 tst_res(TFAIL | TTERRNO, "PR_CAP_AMBIENT_IS_SET failed");
83 }
84
check_cap_lower(unsigned int cap,char * message)85 static inline void check_cap_lower(unsigned int cap, char *message)
86 {
87 TEST(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_LOWER, cap, 0, 0));
88 if (TST_RET == -1)
89 tst_res(TFAIL | TTERRNO,
90 "PR_CAP_AMBIENT_LOWER %s failed", message);
91 else
92 tst_res(TPASS, "PR_CAP_AMBIENT_LOWER %s succeeded", message);
93 }
94
verify_prctl(void)95 static void verify_prctl(void)
96 {
97 #ifdef HAVE_LIBCAP
98 cap_t caps = cap_init();
99
100 cap_value_t caplist[3] = {CAP_NET_RAW, CAP_NET_BIND_SERVICE, CAP_SETPCAP};
101 unsigned int numcaps = 3;
102
103 cap_set_flag(caps, CAP_EFFECTIVE, numcaps, caplist, CAP_SET);
104 cap_set_flag(caps, CAP_INHERITABLE, numcaps, caplist, CAP_SET);
105 cap_set_flag(caps, CAP_PERMITTED, numcaps, caplist, CAP_SET);
106 cap_set_proc(caps);
107
108 tst_res(TINFO, "At the beginning");
109 TST_ASSERT_FILE_STR(PROC_STATUS, "CapAmb", ZERO_STRING);
110
111 cap_clear_flag(caps, CAP_INHERITABLE);
112 cap_set_proc(caps);
113 check_cap_raise(CAP_NET_BIND_SERVICE, "on non-inheritable cap", 1);
114
115 cap_set_flag(caps, CAP_INHERITABLE, numcaps, caplist, CAP_SET);
116 cap_clear_flag(caps, CAP_PERMITTED);
117 cap_set_proc(caps);
118 check_cap_raise(CAP_NET_RAW, "on non-permitted cap", 1);
119
120 cap_set_flag(caps, CAP_PERMITTED, numcaps, caplist, CAP_SET);
121 cap_set_proc(caps);
122 prctl(PR_SET_SECUREBITS, SECBIT_NO_CAP_AMBIENT_RAISE);
123 check_cap_raise(CAP_NET_BIND_SERVICE, "because of NO_RAISE_SECBIT set", 1);
124 prctl(PR_SET_SECUREBITS, 0);
125
126 check_cap_raise(CAP_NET_BIND_SERVICE, "CAP_NET_BIND_SERVICE", 0);
127 /*Even this cap has been in ambient set, raise succeeds and return 0*/
128 check_cap_raise(CAP_NET_BIND_SERVICE, "CAP_NET_BIND_SERIVCE twice", 0);
129
130 tst_res(TINFO, "After PR_CAP_AMBIENT_RAISE");
131 TST_ASSERT_FILE_STR(PROC_STATUS, "CapAmb", CAP_STRING);
132
133 check_cap_is_set(CAP_NET_BIND_SERVICE, "CAP_NET_BIND_SERVICE was", 1);
134 check_cap_is_set(CAP_NET_RAW, "CAP_NET_RAW was", 0);
135 /*move a cap what was not in ambient set, it also return 0*/
136 check_cap_lower(CAP_NET_RAW, "CAP_NET_RAW(it wasn't in ambient set)");
137 check_cap_lower(CAP_NET_BIND_SERVICE, "CAP_NET_BIND_SERVICE(it was in ambient set)");
138
139 tst_res(TINFO, "After PR_CAP_AMBIENT_LORWER");
140 TST_ASSERT_FILE_STR(PROC_STATUS, "CapAmb", ZERO_STRING);
141
142 prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_NET_BIND_SERVICE, 0, 0);
143 tst_res(TINFO, "raise cap for clear");
144 TEST(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0));
145 if (TST_RET == 0)
146 tst_res(TPASS, "PR_CAP_AMBIENT_CLEAR ALL succeeded");
147 else
148 tst_res(TFAIL | TTERRNO, "PR_AMBIENT_CLEAR_ALL failed");
149
150 tst_res(TINFO, "After PR_CAP_AMBIENT_CLEAR_ALL");
151 TST_ASSERT_FILE_STR(PROC_STATUS, "CapAmb", ZERO_STRING);
152
153 cap_free(caps);
154 #else
155 tst_res(TCONF, "libcap devel files missing during compilation");
156 #endif
157 }
158
setup(void)159 static void setup(void)
160 {
161 TEST(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0));
162 if (TST_RET == 0) {
163 tst_res(TINFO, "kernel supports PR_CAP_AMBIENT");
164 return;
165 }
166
167 if (TST_ERR == EINVAL)
168 tst_brk(TCONF, "kernel doesn't support PR_CAP_AMBIENT");
169
170 tst_brk(TBROK | TERRNO,
171 "current environment doesn't permit PR_CAP_AMBIENT");
172 }
173
174 static struct tst_test test = {
175 .setup = setup,
176 .test_all = verify_prctl,
177 .needs_root = 1,
178 };
179