test_switch_id.c 4.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192
  1. /* Copyright (c) 2015-2017, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. #include "or.h"
  4. #ifdef HAVE_SYS_CAPABILITY_H
  5. #include <sys/capability.h>
  6. #endif
  7. #define TEST_BUILT_WITH_CAPS 0
  8. #define TEST_HAVE_CAPS 1
  9. #define TEST_ROOT_CAN_BIND_LOW 2
  10. #define TEST_SETUID 3
  11. #define TEST_SETUID_KEEPCAPS 4
  12. #define TEST_SETUID_STRICT 5
  13. static const struct {
  14. const char *name;
  15. int test_id;
  16. } which_test[] = {
  17. { "built-with-caps", TEST_BUILT_WITH_CAPS },
  18. { "have-caps", TEST_HAVE_CAPS },
  19. { "root-bind-low", TEST_ROOT_CAN_BIND_LOW },
  20. { "setuid", TEST_SETUID },
  21. { "setuid-keepcaps", TEST_SETUID_KEEPCAPS },
  22. { "setuid-strict", TEST_SETUID_STRICT },
  23. { NULL, 0 }
  24. };
  25. #if !defined(_WIN32)
  26. /* 0 on no, 1 on yes, -1 on failure. */
  27. static int
  28. check_can_bind_low_ports(void)
  29. {
  30. int port;
  31. struct sockaddr_in sin;
  32. memset(&sin, 0, sizeof(sin));
  33. sin.sin_family = AF_INET;
  34. for (port = 600; port < 1024; ++port) {
  35. sin.sin_port = htons(port);
  36. tor_socket_t fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
  37. if (! SOCKET_OK(fd)) {
  38. perror("socket");
  39. return -1;
  40. }
  41. int one = 1;
  42. if (setsockopt(fd, SOL_SOCKET,SO_REUSEADDR, (void*)&one,
  43. (socklen_t)sizeof(one))) {
  44. perror("setsockopt");
  45. tor_close_socket_simple(fd);
  46. return -1;
  47. }
  48. int res = bind(fd, (struct sockaddr *)&sin, sizeof(sin));
  49. tor_close_socket_simple(fd);
  50. if (res == 0) {
  51. /* bind was successful */
  52. return 1;
  53. } else if (errno == EACCES || errno == EPERM) {
  54. /* Got a permission-denied error. */
  55. return 0;
  56. } else if (errno == EADDRINUSE) {
  57. /* Huh; somebody is using that port. */
  58. } else {
  59. perror("bind");
  60. }
  61. }
  62. return -1;
  63. }
  64. #endif /* !defined(_WIN32) */
  65. int
  66. main(int argc, char **argv)
  67. {
  68. #if defined(_WIN32)
  69. (void) argc;
  70. (void) argv;
  71. (void) which_test;
  72. fprintf(stderr, "This test is not supported on your OS.\n");
  73. return 77;
  74. #else /* !(defined(_WIN32)) */
  75. const char *username;
  76. const char *testname;
  77. if (argc != 3) {
  78. fprintf(stderr, "I want 2 arguments: a username and a command.\n");
  79. return 1;
  80. }
  81. if (getuid() != 0) {
  82. fprintf(stderr, "This test only works when it's run as root.\n");
  83. return 1;
  84. }
  85. username = argv[1];
  86. testname = argv[2];
  87. int test_id = -1;
  88. int i;
  89. for (i = 0; which_test[i].name; ++i) {
  90. if (!strcmp(which_test[i].name, testname)) {
  91. test_id = which_test[i].test_id;
  92. break;
  93. }
  94. }
  95. if (test_id == -1) {
  96. fprintf(stderr, "Unrecognized test '%s'\n", testname);
  97. return 1;
  98. }
  99. #ifdef HAVE_LINUX_CAPABILITIES
  100. const int have_cap_support = 1;
  101. #else
  102. const int have_cap_support = 0;
  103. #endif
  104. int okay;
  105. init_logging(1);
  106. log_severity_list_t sev;
  107. memset(&sev, 0, sizeof(sev));
  108. set_log_severity_config(LOG_WARN, LOG_ERR, &sev);
  109. add_stream_log(&sev, "", fileno(stderr));
  110. switch (test_id)
  111. {
  112. case TEST_BUILT_WITH_CAPS:
  113. /* Succeed if we were built with capability support. */
  114. okay = have_cap_support;
  115. break;
  116. case TEST_HAVE_CAPS:
  117. /* Succeed if "capabilities work" == "we were built with capability
  118. * support." */
  119. okay = have_cap_support == have_capability_support();
  120. break;
  121. case TEST_ROOT_CAN_BIND_LOW:
  122. /* Succeed if root can bind low ports. */
  123. okay = check_can_bind_low_ports() == 1;
  124. break;
  125. case TEST_SETUID:
  126. /* Succeed if we can do a setuid with no capability retention, and doing
  127. * so makes us lose the ability to bind low ports */
  128. case TEST_SETUID_KEEPCAPS:
  129. /* Succeed if we can do a setuid with capability retention, and doing so
  130. * does not make us lose the ability to bind low ports */
  131. {
  132. int keepcaps = (test_id == TEST_SETUID_KEEPCAPS);
  133. okay = switch_id(username, keepcaps ? SWITCH_ID_KEEP_BINDLOW : 0) == 0;
  134. if (okay) {
  135. okay = check_can_bind_low_ports() == keepcaps;
  136. }
  137. break;
  138. }
  139. case TEST_SETUID_STRICT:
  140. /* Succeed if, after a setuid, we cannot setuid back, and we cannot
  141. * re-grab any capabilities. */
  142. okay = switch_id(username, SWITCH_ID_KEEP_BINDLOW) == 0;
  143. if (okay) {
  144. /* We'd better not be able to setuid back! */
  145. if (setuid(0) == 0 || errno != EPERM) {
  146. okay = 0;
  147. }
  148. }
  149. #ifdef HAVE_LINUX_CAPABILITIES
  150. if (okay) {
  151. cap_t caps = cap_get_proc();
  152. const cap_value_t caplist[] = {
  153. CAP_SETUID,
  154. };
  155. cap_set_flag(caps, CAP_PERMITTED, 1, caplist, CAP_SET);
  156. if (cap_set_proc(caps) == 0 || errno != EPERM) {
  157. okay = 0;
  158. }
  159. cap_free(caps);
  160. }
  161. #endif /* defined(HAVE_LINUX_CAPABILITIES) */
  162. break;
  163. default:
  164. fprintf(stderr, "Unsupported test '%s'\n", testname);
  165. okay = 0;
  166. break;
  167. }
  168. if (!okay) {
  169. fprintf(stderr, "Test %s failed!\n", testname);
  170. }
  171. return (okay ? 0 : 1);
  172. #endif /* defined(_WIN32) */
  173. }