test_ugidfw.c revision 293246
1/*- 2 * Copyright (c) 2005 McAfee, Inc. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 * 26 * $FreeBSD: stable/10/tools/regression/mac/mac_bsdextended/test_ugidfw.c 293246 2016-01-06 19:40:37Z ngie $ 27 */ 28 29#include <sys/param.h> 30#include <sys/mac.h> 31#include <sys/mount.h> 32 33#include <security/mac_bsdextended/mac_bsdextended.h> 34 35#include <err.h> 36#include <errno.h> 37#include <grp.h> 38#include <pwd.h> 39#include <stdio.h> 40#include <stdlib.h> 41#include <string.h> 42#include <ugidfw.h> 43#include <unistd.h> 44 45/* 46 * Starting point for a regression test for mac_bsdextended(4) and the 47 * supporting libugidfw(3). 48 */ 49 50/* 51 * This section of the regression test passes some test cases through the 52 * rule<->string routines to confirm they work approximately as desired. 53 */ 54 55/* 56 * List of users and groups we must check exists before we can begin, since 57 * they are used in the string test rules. We use users and groups that will 58 * always exist in a default install used for regression testing. 59 */ 60static const char *test_users[] = { 61 "root", 62 "daemon", 63 "operator", 64 "bin", 65}; 66 67static const char *test_groups[] = { 68 "wheel", 69 "daemon", 70 "operator", 71 "bin", 72}; 73 74int test_num; 75 76/* 77 * List of test strings that must go in (and come out) of libugidfw intact. 78 */ 79static const char *test_strings[] = { 80 /* Variations on subject and object uids. */ 81 "subject uid root object uid root mode n", 82 "subject uid root object uid daemon mode n", 83 "subject uid daemon object uid root mode n", 84 "subject uid daemon object uid daemon mode n", 85 /* Variations on mode. */ 86 "subject uid root object uid root mode a", 87 "subject uid root object uid root mode r", 88 "subject uid root object uid root mode s", 89 "subject uid root object uid root mode w", 90 "subject uid root object uid root mode x", 91 "subject uid root object uid root mode arswx", 92 /* Variations on subject and object gids. */ 93 "subject gid wheel object gid wheel mode n", 94 "subject gid wheel object gid daemon mode n", 95 "subject gid daemon object gid wheel mode n", 96 "subject gid daemon object gid daemon mode n", 97 /* Subject uids and subject gids. */ 98 "subject uid bin gid daemon object uid operator gid wheel mode n", 99 /* Not */ 100 "subject not uid operator object uid bin mode n", 101 "subject uid bin object not uid operator mode n", 102 "subject not uid daemon object not uid operator mode n", 103 /* Ranges */ 104 "subject uid root:operator object gid wheel:bin mode n", 105 /* Jail ID */ 106 "subject jailid 1 object uid root mode n", 107 /* Filesys */ 108 "subject uid root object filesys / mode n", 109 "subject uid root object filesys /dev mode n", 110 /* S/UGID */ 111 "subject not uid root object sgid mode n", 112 "subject not uid root object sgid mode n", 113 /* Matching uid/gid */ 114 "subject not uid root:operator object not uid_of_subject mode n", 115 "subject not gid wheel:bin object not gid_of_subject mode n", 116 /* Object types */ 117 "subject uid root object type a mode a", 118 "subject uid root object type r mode a", 119 "subject uid root object type d mode a", 120 "subject uid root object type b mode a", 121 "subject uid root object type c mode a", 122 "subject uid root object type l mode a", 123 "subject uid root object type s mode a", 124 "subject uid root object type rbc mode a", 125 "subject uid root object type dls mode a", 126 /* Empty rules always match */ 127 "subject object mode a", 128 /* Partial negations */ 129 "subject ! uid root object mode n", 130 "subject ! gid wheel object mode n", 131 "subject ! jailid 2 object mode n", 132 "subject object ! uid root mode n", 133 "subject object ! gid wheel mode n", 134 "subject object ! filesys / mode n", 135 "subject object ! suid mode n", 136 "subject object ! sgid mode n", 137 "subject object ! uid_of_subject mode n", 138 "subject object ! gid_of_subject mode n", 139 "subject object ! type d mode n", 140 /* All out nonsense */ 141 "subject uid root ! gid wheel:bin ! jailid 1 " 142 "object ! uid root:daemon gid daemon filesys / suid sgid uid_of_subject gid_of_subject ! type r " 143 "mode rsx", 144}; 145 146static void 147test_libugidfw_strings(void) 148{ 149 struct mac_bsdextended_rule rule; 150 char errorstr[256]; 151 char rulestr[256]; 152 int error, i; 153 154 for (i = 0; i < nitems(test_users); i++, test_num++) { 155 if (getpwnam(test_users[i]) == NULL) 156 printf("not ok %d # test_libugidfw_strings: getpwnam(%s) " 157 "failed: %s\n", test_num, test_users[i], strerror(errno)); 158 else 159 printf("ok %d\n", test_num); 160 } 161 162 for (i = 0; i < nitems(test_groups); i++, test_num++) { 163 if (getgrnam(test_groups[i]) == NULL) 164 printf("not ok %d # test_libugidfw_strings: getgrnam(%s) " 165 "failed: %s\n", test_num, test_groups[i], strerror(errno)); 166 else 167 printf("ok %d\n", test_num); 168 } 169 170 for (i = 0; i < nitems(test_strings); i++) { 171 error = bsde_parse_rule_string(test_strings[i], &rule, 172 sizeof(errorstr), errorstr); 173 if (error == -1) 174 printf("not ok %d # bsde_parse_rule_string: '%s' (%d) " 175 "failed: %s\n", test_num, test_strings[i], i, errorstr); 176 else 177 printf("ok %d\n", test_num); 178 test_num++; 179 180 error = bsde_rule_to_string(&rule, rulestr, sizeof(rulestr)); 181 if (error < 0) 182 printf("not ok %d # bsde_rule_to_string: rule for '%s' " 183 "returned %d\n", test_num, test_strings[i], error); 184 else 185 printf("ok %d\n", test_num); 186 test_num++; 187 188 if (strcmp(test_strings[i], rulestr) != 0) 189 printf("not ok %d # test_libugidfw: '%s' in, '%s' " 190 "out\n", test_num, test_strings[i], rulestr); 191 else 192 printf("ok %d\n", test_num); 193 test_num++; 194 } 195} 196 197int 198main(void) 199{ 200 char errorstr[256]; 201 int count, slots; 202 203 test_num = 1; 204 205 /* Print an error if a non-root user attemps to run the tests. */ 206 if (getuid() != 0) { 207 printf("1..0 # SKIP you must be root\n"); 208 return (0); 209 } 210 211 printf("1..%lu\n", nitems(test_users) + nitems(test_groups) + 212 3 * nitems(test_strings) + 2); 213 214 /* 215 * We can test some parts of the library without the MAC Framework 216 * and policy loaded, so run those tests before calling 217 * mac_is_present(). 218 */ 219 test_libugidfw_strings(); 220 221 switch (mac_is_present("bsdextended")) { 222 case -1: 223 printf("1..0 # SKIP mac_is_present failed: %s\n", 224 strerror(errno)); 225 return (0); 226 case 1: 227 break; 228 case 0: 229 default: 230 printf("1..0 # SKIP mac_bsdextended not loaded\n"); 231 return (0); 232 } 233 234 /* 235 * Some simple up-front checks to see if we're able to query the 236 * policy for basic state. We want the rule count to be 0 before 237 * starting, but "slots" is a property of prior runs and so we ignore 238 * the return value. 239 */ 240 count = bsde_get_rule_count(sizeof(errorstr), errorstr); 241 if (count == -1) 242 printf("not ok %d # bsde_get_rule_count: %s\n", test_num, 243 errorstr); 244 else 245 printf("ok %d\n", test_num); 246 247 test_num++; 248 249 slots = bsde_get_rule_slots(sizeof(errorstr), errorstr); 250 if (slots == -1) 251 printf("not ok %d # bsde_get_rule_slots: %s\n", test_num, 252 errorstr); 253 else 254 printf("ok %d\n", test_num); 255 256 return (0); 257} 258