1 /******************************************************************************/ 2 /* */ 3 /* Copyright (c) International Business Machines Corp., 2007, 2008 */ 4 /* */ 5 /* This program is free software; you can redistribute it and/or modify */ 6 /* it under the terms of the GNU General Public License as published by */ 7 /* the Free Software Foundation; either version 2 of the License, or */ 8 /* (at your option) any later version. */ 9 /* */ 10 /* This program is distributed in the hope that it will be useful, */ 11 /* but WITHOUT ANY WARRANTY; without even the implied warranty of */ 12 /* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See */ 13 /* the GNU General Public License for more details. */ 14 /* */ 15 /* You should have received a copy of the GNU General Public License */ 16 /* along with this program; if not, write to the Free Software */ 17 /* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ 18 /* */ 19 /******************************************************************************/ 20 /* 21 * File: exec_without_inh.c 22 * Author: Serge Hallyn 23 * Make sure that CAP_SYS_ADMIN is not in pI 24 * drop CAP_SYS_ADMIN from bounding set 25 * Then exec "check_pe 0" 26 * check_pe will return PASS if it does not have CAP_SYS_ADMIN in pE. 27 */ 28 29 #include <errno.h> 30 #include "config.h" 31 #if HAVE_SYS_CAPABILITY_H 32 #include <linux/types.h> 33 #include <sys/capability.h> 34 #endif 35 #include <sys/prctl.h> 36 #include "test.h" 37 38 char *TCID = "exec_without_inh"; 39 int TST_TOTAL = 1; 40 41 int main(int argc, char *argv[]) 42 { 43 #if HAVE_SYS_CAPABILITY_H 44 #ifdef HAVE_LIBCAP 45 int ret = 1; 46 cap_flag_value_t f; 47 cap_value_t v[1]; 48 cap_t cur; 49 50 /* Make sure CAP_SYS_ADMIN is not in pI */ 51 cur = cap_get_proc(); 52 ret = cap_get_flag(cur, CAP_SYS_ADMIN, CAP_INHERITABLE, &f); 53 if (f == CAP_SET) { 54 v[0] = CAP_SYS_ADMIN; 55 ret = cap_set_flag(cur, CAP_INHERITABLE, 1, v, CAP_CLEAR); 56 if (!ret) 57 ret = cap_set_proc(cur); 58 if (ret) { 59 tst_brkm(TBROK, 60 NULL, 61 "Failed to drop cap_sys_admin from pI\n"); 62 } 63 } else if (ret) { 64 tst_brkm(TBROK | TERRNO, NULL, "Failed to add \ 65 CAP_SYS_ADMIN to pI"); 66 } 67 cap_free(cur); 68 69 /* drop the capability from bounding set */ 70 ret = prctl(PR_CAPBSET_DROP, CAP_SYS_ADMIN); 71 if (ret) { 72 tst_resm(TFAIL, 73 "Failed to drop CAP_SYS_ADMIN from bounding set.\n"); 74 tst_resm(TINFO, "(ret=%d, errno %d)\n", ret, errno); 75 tst_exit(); 76 } 77 78 /* execute "check_pe 0" */ 79 execl("check_pe", "check_pe", "0", NULL); 80 tst_resm(TBROK, "Failed to execute check_pe (errno %d)\n", errno); 81 #else /* libcap */ 82 tst_resm(TCONF, "System doesn't have POSIX capabilities."); 83 #endif 84 #else /* capability_h */ 85 tst_resm(TCONF, "System doesn't have sys/capability.h."); 86 #endif 87 tst_exit(); 88 } 89