test_switch_id.c 5.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195
  1. /* Copyright (c) 2015-2019, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. #include "core/or/or.h"
  4. #include "lib/process/setuid.h"
  5. #ifdef HAVE_SYS_CAPABILITY_H
  6. #include <sys/capability.h>
  7. #endif
  8. #ifdef HAVE_UNISTD_H
  9. #include <unistd.h>
  10. #endif
  11. #define TEST_BUILT_WITH_CAPS 0
  12. #define TEST_HAVE_CAPS 1
  13. #define TEST_ROOT_CAN_BIND_LOW 2
  14. #define TEST_SETUID 3
  15. #define TEST_SETUID_KEEPCAPS 4
  16. #define TEST_SETUID_STRICT 5
  17. static const struct {
  18. const char *name;
  19. int test_id;
  20. } which_test[] = {
  21. { "built-with-caps", TEST_BUILT_WITH_CAPS },
  22. { "have-caps", TEST_HAVE_CAPS },
  23. { "root-bind-low", TEST_ROOT_CAN_BIND_LOW },
  24. { "setuid", TEST_SETUID },
  25. { "setuid-keepcaps", TEST_SETUID_KEEPCAPS },
  26. { "setuid-strict", TEST_SETUID_STRICT },
  27. { NULL, 0 }
  28. };
  29. #if !defined(_WIN32)
  30. /* 0 on no, 1 on yes, -1 on failure. */
  31. static int
  32. check_can_bind_low_ports(void)
  33. {
  34. int port;
  35. struct sockaddr_in sin;
  36. memset(&sin, 0, sizeof(sin));
  37. sin.sin_family = AF_INET;
  38. for (port = 600; port < 1024; ++port) {
  39. sin.sin_port = htons(port);
  40. tor_socket_t fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
  41. if (! SOCKET_OK(fd)) {
  42. perror("socket");
  43. return -1;
  44. }
  45. int one = 1;
  46. if (setsockopt(fd, SOL_SOCKET,SO_REUSEADDR, (void*)&one,
  47. (socklen_t)sizeof(one))) {
  48. perror("setsockopt");
  49. tor_close_socket_simple(fd);
  50. return -1;
  51. }
  52. int res = bind(fd, (struct sockaddr *)&sin, sizeof(sin));
  53. tor_close_socket_simple(fd);
  54. if (res == 0) {
  55. /* bind was successful */
  56. return 1;
  57. } else if (errno == EACCES || errno == EPERM) {
  58. /* Got a permission-denied error. */
  59. return 0;
  60. } else if (errno == EADDRINUSE) {
  61. /* Huh; somebody is using that port. */
  62. } else {
  63. perror("bind");
  64. }
  65. }
  66. return -1;
  67. }
  68. #endif /* !defined(_WIN32) */
  69. int
  70. main(int argc, char **argv)
  71. {
  72. #if defined(_WIN32)
  73. (void) argc;
  74. (void) argv;
  75. (void) which_test;
  76. fprintf(stderr, "This test is not supported on your OS.\n");
  77. return 77;
  78. #else /* !(defined(_WIN32)) */
  79. const char *username;
  80. const char *testname;
  81. if (argc != 3) {
  82. fprintf(stderr, "I want 2 arguments: a username and a command.\n");
  83. return 1;
  84. }
  85. if (getuid() != 0) {
  86. fprintf(stderr, "This test only works when it's run as root.\n");
  87. return 1;
  88. }
  89. username = argv[1];
  90. testname = argv[2];
  91. int test_id = -1;
  92. int i;
  93. for (i = 0; which_test[i].name; ++i) {
  94. if (!strcmp(which_test[i].name, testname)) {
  95. test_id = which_test[i].test_id;
  96. break;
  97. }
  98. }
  99. if (test_id == -1) {
  100. fprintf(stderr, "Unrecognized test '%s'\n", testname);
  101. return 1;
  102. }
  103. #ifdef HAVE_LINUX_CAPABILITIES
  104. const int have_cap_support = 1;
  105. #else
  106. const int have_cap_support = 0;
  107. #endif
  108. int okay;
  109. init_logging(1);
  110. log_severity_list_t sev;
  111. memset(&sev, 0, sizeof(sev));
  112. set_log_severity_config(LOG_WARN, LOG_ERR, &sev);
  113. add_stream_log(&sev, "", fileno(stderr));
  114. switch (test_id)
  115. {
  116. case TEST_BUILT_WITH_CAPS:
  117. /* Succeed if we were built with capability support. */
  118. okay = have_cap_support;
  119. break;
  120. case TEST_HAVE_CAPS:
  121. /* Succeed if "capabilities work" == "we were built with capability
  122. * support." */
  123. okay = have_cap_support == have_capability_support();
  124. break;
  125. case TEST_ROOT_CAN_BIND_LOW:
  126. /* Succeed if root can bind low ports. */
  127. okay = check_can_bind_low_ports() == 1;
  128. break;
  129. case TEST_SETUID:
  130. /* Succeed if we can do a setuid with no capability retention, and doing
  131. * so makes us lose the ability to bind low ports */
  132. case TEST_SETUID_KEEPCAPS:
  133. /* Succeed if we can do a setuid with capability retention, and doing so
  134. * does not make us lose the ability to bind low ports */
  135. {
  136. int keepcaps = (test_id == TEST_SETUID_KEEPCAPS);
  137. okay = switch_id(username, keepcaps ? SWITCH_ID_KEEP_BINDLOW : 0) == 0;
  138. if (okay) {
  139. okay = check_can_bind_low_ports() == keepcaps;
  140. }
  141. break;
  142. }
  143. case TEST_SETUID_STRICT:
  144. /* Succeed if, after a setuid, we cannot setuid back, and we cannot
  145. * re-grab any capabilities. */
  146. okay = switch_id(username, SWITCH_ID_KEEP_BINDLOW) == 0;
  147. if (okay) {
  148. /* We'd better not be able to setuid back! */
  149. if (setuid(0) == 0 || errno != EPERM) {
  150. okay = 0;
  151. }
  152. }
  153. #ifdef HAVE_LINUX_CAPABILITIES
  154. if (okay) {
  155. cap_t caps = cap_get_proc();
  156. const cap_value_t caplist[] = {
  157. CAP_SETUID,
  158. };
  159. cap_set_flag(caps, CAP_PERMITTED, 1, caplist, CAP_SET);
  160. if (cap_set_proc(caps) == 0 || errno != EPERM) {
  161. okay = 0;
  162. }
  163. cap_free(caps);
  164. }
  165. #endif /* defined(HAVE_LINUX_CAPABILITIES) */
  166. break;
  167. default:
  168. fprintf(stderr, "Unsupported test '%s'\n", testname);
  169. okay = 0;
  170. break;
  171. }
  172. if (!okay) {
  173. fprintf(stderr, "Test %s failed!\n", testname);
  174. }
  175. return (okay ? 0 : 1);
  176. #endif /* defined(_WIN32) */
  177. }