1 /*
2 * Copyright (c) Huawei Technologies Co., Ltd., 2015
3 * This program is free software; you can redistribute it and/or modify
4 * it under the terms of the GNU General Public License as published by
5 * the Free Software Foundation; either version 2 of the License, or
6 * (at your option) any later version.
7 *
8 * This program is distributed in the hope that it will be useful,
9 * but WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
11 * the GNU General Public License for more details.
12 */
13
14 /*
15 * Verify that:
16 * If a user ID has no mapping inside the namespace, user ID and group
17 * ID will be the value defined in the file /proc/sys/kernel/overflowuid(65534)
18 * and /proc/sys/kernel/overflowgid(65534). A child process has a full set
19 * of permitted and effective capabilities, even though the program was
20 * run from an unprivileged account.
21 */
22
23 #define _GNU_SOURCE
24 #include <sys/wait.h>
25 #include <assert.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <unistd.h>
29 #include <string.h>
30 #include <errno.h>
31 #include "test.h"
32 #include "libclone.h"
33 #include "userns_helper.h"
34 #include "config.h"
35 #if HAVE_SYS_CAPABILITY_H
36 #include <sys/capability.h>
37 #endif
38
39 #define OVERFLOWUIDPATH "/proc/sys/kernel/overflowuid"
40 #define OVERFLOWGIDPATH "/proc/sys/kernel/overflowgid"
41
42 char *TCID = "user_namespace1";
43 int TST_TOTAL = 1;
44
45 static long overflowuid;
46 static long overflowgid;
47
48 /*
49 * child_fn1() - Inside a new user namespace
50 */
child_fn1(void * arg LTP_ATTRIBUTE_UNUSED)51 static int child_fn1(void *arg LTP_ATTRIBUTE_UNUSED)
52 {
53 int exit_val = 0;
54 int uid, gid;
55 #ifdef HAVE_LIBCAP
56 cap_t caps;
57 int i, last_cap;
58 cap_flag_value_t flag_val;
59 #endif
60
61 uid = geteuid();
62 gid = getegid();
63
64 tst_resm(TINFO, "USERNS test is running in a new user namespace.");
65
66 if (uid != overflowuid || gid != overflowgid) {
67 printf("Got unexpected result of uid=%d gid=%d\n", uid, gid);
68 exit_val = 1;
69 }
70
71 #ifdef HAVE_LIBCAP
72 caps = cap_get_proc();
73 SAFE_FILE_SCANF(NULL, "/proc/sys/kernel/cap_last_cap", "%d", &last_cap);
74 for (i = 0; i <= last_cap; i++) {
75 cap_get_flag(caps, i, CAP_EFFECTIVE, &flag_val);
76 if (flag_val == 0)
77 break;
78 cap_get_flag(caps, i, CAP_PERMITTED, &flag_val);
79 if (flag_val == 0)
80 break;
81 }
82
83 if (flag_val == 0) {
84 printf("unexpected effective/permitted caps at %d\n", i);
85 exit_val = 1;
86 }
87 #else
88 printf("System is missing libcap.\n");
89 #endif
90 return exit_val;
91 }
92
setup(void)93 static void setup(void)
94 {
95 check_newuser();
96 SAFE_FILE_SCANF(NULL, OVERFLOWUIDPATH, "%ld", &overflowuid);
97 SAFE_FILE_SCANF(NULL, OVERFLOWGIDPATH, "%ld", &overflowgid);
98 }
99
main(int argc,char * argv[])100 int main(int argc, char *argv[])
101 {
102 int lc;
103
104 tst_parse_opts(argc, argv, NULL, NULL);
105 setup();
106
107 for (lc = 0; TEST_LOOPING(lc); lc++) {
108 TEST(do_clone_unshare_test(T_CLONE, CLONE_NEWUSER,
109 child_fn1, NULL));
110
111 if (TEST_RETURN == -1)
112 tst_brkm(TFAIL | TTERRNO, NULL, "clone failed");
113 tst_record_childstatus(NULL, -1);
114 }
115 tst_exit();
116 }
117