test_switch_id.c 4.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191
  1. /* Copyright (c) 2015-2017, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. #include "or.h"
  4. #ifdef HAVE_SYS_CAPABILITY_H
  5. #include <sys/capability.h>
  6. #endif
  7. #define TEST_BUILT_WITH_CAPS 0
  8. #define TEST_HAVE_CAPS 1
  9. #define TEST_ROOT_CAN_BIND_LOW 2
  10. #define TEST_SETUID 3
  11. #define TEST_SETUID_KEEPCAPS 4
  12. #define TEST_SETUID_STRICT 5
  13. static const struct {
  14. const char *name;
  15. int test_id;
  16. } which_test[] = {
  17. { "built-with-caps", TEST_BUILT_WITH_CAPS },
  18. { "have-caps", TEST_HAVE_CAPS },
  19. { "root-bind-low", TEST_ROOT_CAN_BIND_LOW },
  20. { "setuid", TEST_SETUID },
  21. { "setuid-keepcaps", TEST_SETUID_KEEPCAPS },
  22. { "setuid-strict", TEST_SETUID_STRICT },
  23. { NULL, 0 }
  24. };
  25. #if !defined(_WIN32)
  26. /* 0 on no, 1 on yes, -1 on failure. */
  27. static int
  28. check_can_bind_low_ports(void)
  29. {
  30. int port;
  31. struct sockaddr_in sin;
  32. memset(&sin, 0, sizeof(sin));
  33. sin.sin_family = AF_INET;
  34. for (port = 600; port < 1024; ++port) {
  35. sin.sin_port = htons(port);
  36. tor_socket_t fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
  37. if (! SOCKET_OK(fd)) {
  38. perror("socket");
  39. return -1;
  40. }
  41. int one = 1;
  42. if (setsockopt(fd, SOL_SOCKET,SO_REUSEADDR, (void*)&one,
  43. (socklen_t)sizeof(one))) {
  44. perror("setsockopt");
  45. tor_close_socket_simple(fd);
  46. return -1;
  47. }
  48. int res = bind(fd, (struct sockaddr *)&sin, sizeof(sin));
  49. tor_close_socket_simple(fd);
  50. if (res == 0) {
  51. /* bind was successful */
  52. return 1;
  53. } else if (errno == EACCES || errno == EPERM) {
  54. /* Got a permission-denied error. */
  55. return 0;
  56. } else if (errno == EADDRINUSE) {
  57. /* Huh; somebody is using that port. */
  58. } else {
  59. perror("bind");
  60. }
  61. }
  62. return -1;
  63. }
  64. #endif
  65. int
  66. main(int argc, char **argv)
  67. {
  68. #if defined(_WIN32)
  69. (void) argc;
  70. (void) argv;
  71. fprintf(stderr, "This test is not supported on your OS.\n");
  72. return 77;
  73. #else
  74. const char *username;
  75. const char *testname;
  76. if (argc != 3) {
  77. fprintf(stderr, "I want 2 arguments: a username and a command.\n");
  78. return 1;
  79. }
  80. if (getuid() != 0) {
  81. fprintf(stderr, "This test only works when it's run as root.\n");
  82. return 1;
  83. }
  84. username = argv[1];
  85. testname = argv[2];
  86. int test_id = -1;
  87. int i;
  88. for (i = 0; which_test[i].name; ++i) {
  89. if (!strcmp(which_test[i].name, testname)) {
  90. test_id = which_test[i].test_id;
  91. break;
  92. }
  93. }
  94. if (test_id == -1) {
  95. fprintf(stderr, "Unrecognized test '%s'\n", testname);
  96. return 1;
  97. }
  98. #ifdef HAVE_LINUX_CAPABILITIES
  99. const int have_cap_support = 1;
  100. #else
  101. const int have_cap_support = 0;
  102. #endif
  103. int okay;
  104. init_logging(1);
  105. log_severity_list_t sev;
  106. memset(&sev, 0, sizeof(sev));
  107. set_log_severity_config(LOG_WARN, LOG_ERR, &sev);
  108. add_stream_log(&sev, "", fileno(stderr));
  109. switch (test_id)
  110. {
  111. case TEST_BUILT_WITH_CAPS:
  112. /* Succeed if we were built with capability support. */
  113. okay = have_cap_support;
  114. break;
  115. case TEST_HAVE_CAPS:
  116. /* Succeed if "capabilities work" == "we were built with capability
  117. * support." */
  118. okay = have_cap_support == have_capability_support();
  119. break;
  120. case TEST_ROOT_CAN_BIND_LOW:
  121. /* Succeed if root can bind low ports. */
  122. okay = check_can_bind_low_ports() == 1;
  123. break;
  124. case TEST_SETUID:
  125. /* Succeed if we can do a setuid with no capability retention, and doing
  126. * so makes us lose the ability to bind low ports */
  127. case TEST_SETUID_KEEPCAPS:
  128. /* Succeed if we can do a setuid with capability retention, and doing so
  129. * does not make us lose the ability to bind low ports */
  130. {
  131. int keepcaps = (test_id == TEST_SETUID_KEEPCAPS);
  132. okay = switch_id(username, keepcaps ? SWITCH_ID_KEEP_BINDLOW : 0) == 0;
  133. if (okay) {
  134. okay = check_can_bind_low_ports() == keepcaps;
  135. }
  136. break;
  137. }
  138. case TEST_SETUID_STRICT:
  139. /* Succeed if, after a setuid, we cannot setuid back, and we cannot
  140. * re-grab any capabilities. */
  141. okay = switch_id(username, SWITCH_ID_KEEP_BINDLOW) == 0;
  142. if (okay) {
  143. /* We'd better not be able to setuid back! */
  144. if (setuid(0) == 0 || errno != EPERM) {
  145. okay = 0;
  146. }
  147. }
  148. #ifdef HAVE_LINUX_CAPABILITIES
  149. if (okay) {
  150. cap_t caps = cap_get_proc();
  151. const cap_value_t caplist[] = {
  152. CAP_SETUID,
  153. };
  154. cap_set_flag(caps, CAP_PERMITTED, 1, caplist, CAP_SET);
  155. if (cap_set_proc(caps) == 0 || errno != EPERM) {
  156. okay = 0;
  157. }
  158. cap_free(caps);
  159. }
  160. #endif
  161. break;
  162. default:
  163. fprintf(stderr, "Unsupported test '%s'\n", testname);
  164. okay = 0;
  165. break;
  166. }
  167. if (!okay) {
  168. fprintf(stderr, "Test %s failed!\n", testname);
  169. }
  170. return (okay ? 0 : 1);
  171. #endif
  172. }