diff options
Diffstat (limited to 'test/syscalls/linux/sticky.cc')
-rw-r--r-- | test/syscalls/linux/sticky.cc | 161 |
1 files changed, 0 insertions, 161 deletions
diff --git a/test/syscalls/linux/sticky.cc b/test/syscalls/linux/sticky.cc deleted file mode 100644 index 4afed6d08..000000000 --- a/test/syscalls/linux/sticky.cc +++ /dev/null @@ -1,161 +0,0 @@ -// Copyright 2018 The gVisor Authors. -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -#include <fcntl.h> -#include <grp.h> -#include <sys/prctl.h> -#include <sys/types.h> -#include <unistd.h> - -#include <vector> - -#include "gtest/gtest.h" -#include "absl/flags/flag.h" -#include "test/util/capability_util.h" -#include "test/util/file_descriptor.h" -#include "test/util/fs_util.h" -#include "test/util/temp_path.h" -#include "test/util/test_util.h" -#include "test/util/thread_util.h" - -ABSL_FLAG(int32_t, scratch_uid, 65534, "first scratch UID"); -ABSL_FLAG(int32_t, scratch_gid, 65534, "first scratch GID"); - -namespace gvisor { -namespace testing { - -namespace { - -TEST(StickyTest, StickyBitPermDenied) { - SKIP_IF(!ASSERT_NO_ERRNO_AND_VALUE(HaveCapability(CAP_SETUID))); - - const TempPath parent = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateDir()); - EXPECT_THAT(chmod(parent.path().c_str(), 0777 | S_ISVTX), SyscallSucceeds()); - - // After changing credentials below, we need to use an open fd to make - // modifications in the parent dir, because there is no guarantee that we will - // still have the ability to open it. - const FileDescriptor parent_fd = - ASSERT_NO_ERRNO_AND_VALUE(Open(parent.path(), O_DIRECTORY)); - ASSERT_THAT(openat(parent_fd.get(), "file", O_CREAT), SyscallSucceeds()); - ASSERT_THAT(mkdirat(parent_fd.get(), "dir", 0777), SyscallSucceeds()); - ASSERT_THAT(symlinkat("xyz", parent_fd.get(), "link"), SyscallSucceeds()); - - // Drop privileges and change IDs only in child thread, or else this parent - // thread won't be able to open some log files after the test ends. - ScopedThread([&] { - // Drop privileges. - if (HaveCapability(CAP_FOWNER).ValueOrDie()) { - EXPECT_NO_ERRNO(SetCapability(CAP_FOWNER, false)); - } - - // Change EUID and EGID. - EXPECT_THAT( - syscall(SYS_setresgid, -1, absl::GetFlag(FLAGS_scratch_gid), -1), - SyscallSucceeds()); - EXPECT_THAT( - syscall(SYS_setresuid, -1, absl::GetFlag(FLAGS_scratch_uid), -1), - SyscallSucceeds()); - - EXPECT_THAT(renameat(parent_fd.get(), "file", parent_fd.get(), "file2"), - SyscallFailsWithErrno(EPERM)); - EXPECT_THAT(unlinkat(parent_fd.get(), "file", 0), - SyscallFailsWithErrno(EPERM)); - EXPECT_THAT(unlinkat(parent_fd.get(), "dir", AT_REMOVEDIR), - SyscallFailsWithErrno(EPERM)); - EXPECT_THAT(unlinkat(parent_fd.get(), "link", 0), - SyscallFailsWithErrno(EPERM)); - }); -} - -TEST(StickyTest, StickyBitSameUID) { - SKIP_IF(!ASSERT_NO_ERRNO_AND_VALUE(HaveCapability(CAP_SETUID))); - - const TempPath parent = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateDir()); - EXPECT_THAT(chmod(parent.path().c_str(), 0777 | S_ISVTX), SyscallSucceeds()); - - // After changing credentials below, we need to use an open fd to make - // modifications in the parent dir, because there is no guarantee that we will - // still have the ability to open it. - const FileDescriptor parent_fd = - ASSERT_NO_ERRNO_AND_VALUE(Open(parent.path(), O_DIRECTORY)); - ASSERT_THAT(openat(parent_fd.get(), "file", O_CREAT), SyscallSucceeds()); - ASSERT_THAT(mkdirat(parent_fd.get(), "dir", 0777), SyscallSucceeds()); - ASSERT_THAT(symlinkat("xyz", parent_fd.get(), "link"), SyscallSucceeds()); - - // Drop privileges and change IDs only in child thread, or else this parent - // thread won't be able to open some log files after the test ends. - ScopedThread([&] { - // Drop privileges. - if (HaveCapability(CAP_FOWNER).ValueOrDie()) { - EXPECT_NO_ERRNO(SetCapability(CAP_FOWNER, false)); - } - - // Change EGID. - EXPECT_THAT( - syscall(SYS_setresgid, -1, absl::GetFlag(FLAGS_scratch_gid), -1), - SyscallSucceeds()); - - // We still have the same EUID. - EXPECT_THAT(renameat(parent_fd.get(), "file", parent_fd.get(), "file2"), - SyscallSucceeds()); - EXPECT_THAT(unlinkat(parent_fd.get(), "file2", 0), SyscallSucceeds()); - EXPECT_THAT(unlinkat(parent_fd.get(), "dir", AT_REMOVEDIR), - SyscallSucceeds()); - EXPECT_THAT(unlinkat(parent_fd.get(), "link", 0), SyscallSucceeds()); - }); -} - -TEST(StickyTest, StickyBitCapFOWNER) { - SKIP_IF(!ASSERT_NO_ERRNO_AND_VALUE(HaveCapability(CAP_SETUID))); - - const TempPath parent = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateDir()); - EXPECT_THAT(chmod(parent.path().c_str(), 0777 | S_ISVTX), SyscallSucceeds()); - - // After changing credentials below, we need to use an open fd to make - // modifications in the parent dir, because there is no guarantee that we will - // still have the ability to open it. - const FileDescriptor parent_fd = - ASSERT_NO_ERRNO_AND_VALUE(Open(parent.path(), O_DIRECTORY)); - ASSERT_THAT(openat(parent_fd.get(), "file", O_CREAT), SyscallSucceeds()); - ASSERT_THAT(mkdirat(parent_fd.get(), "dir", 0777), SyscallSucceeds()); - ASSERT_THAT(symlinkat("xyz", parent_fd.get(), "link"), SyscallSucceeds()); - - // Drop privileges and change IDs only in child thread, or else this parent - // thread won't be able to open some log files after the test ends. - ScopedThread([&] { - // Set PR_SET_KEEPCAPS. - EXPECT_THAT(prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0), SyscallSucceeds()); - - // Change EUID and EGID. - EXPECT_THAT( - syscall(SYS_setresgid, -1, absl::GetFlag(FLAGS_scratch_gid), -1), - SyscallSucceeds()); - EXPECT_THAT( - syscall(SYS_setresuid, -1, absl::GetFlag(FLAGS_scratch_uid), -1), - SyscallSucceeds()); - - EXPECT_NO_ERRNO(SetCapability(CAP_FOWNER, true)); - EXPECT_THAT(renameat(parent_fd.get(), "file", parent_fd.get(), "file2"), - SyscallSucceeds()); - EXPECT_THAT(unlinkat(parent_fd.get(), "file2", 0), SyscallSucceeds()); - EXPECT_THAT(unlinkat(parent_fd.get(), "dir", AT_REMOVEDIR), - SyscallSucceeds()); - EXPECT_THAT(unlinkat(parent_fd.get(), "link", 0), SyscallSucceeds()); - }); -} -} // namespace - -} // namespace testing -} // namespace gvisor |