From e80cb4cba4e749a5e849626133de7a97c64e64e4 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 2 Jun 2021 15:50:16 +0200 Subject: [PATCH 1/4] test-capability: skip tests that need CAP_NET_RAW if cap is not passed See: #19746 --- src/test/test-capability.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/test/test-capability.c b/src/test/test-capability.c index 5fa8fe242e..7a781e57e4 100644 --- a/src/test/test-capability.c +++ b/src/test/test-capability.c @@ -159,9 +159,15 @@ static void test_drop_privileges_fail(void) { } static void test_drop_privileges(void) { + fork_test(test_drop_privileges_fail); + + if (have_effective_cap(CAP_NET_RAW) == 0) /* The remaining two tests only work if we have CAP_NET_RAW + * in the first place. If we are run in some restricted + * container environment we might not. */ + return; + fork_test(test_drop_privileges_keep_net_raw); fork_test(test_drop_privileges_dontkeep_net_raw); - fork_test(test_drop_privileges_fail); } static void test_have_effective_cap(void) { From 6da5d7de78dd6b98d42cbe177975887907ea6dc2 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 2 Jun 2021 21:38:44 +0200 Subject: [PATCH 2/4] test-seccomp: tighten privilege check before seccomp() geteuid() without CAP_SYS_ADMIN is not enough to do unrestricted seccomp(). Hence tighten the check. See: #19746 --- src/test/test-seccomp.c | 53 ++++++++++++++++++++++------------------- 1 file changed, 29 insertions(+), 24 deletions(-) diff --git a/src/test/test-seccomp.c b/src/test/test-seccomp.c index b1f917eb54..4cca55c5bb 100644 --- a/src/test/test-seccomp.c +++ b/src/test/test-seccomp.c @@ -15,6 +15,7 @@ #endif #include "alloc-util.h" +#include "capability-util.h" #include "fd-util.h" #include "fileio.h" #include "macro.h" @@ -41,6 +42,10 @@ # define SECCOMP_RESTRICT_ADDRESS_FAMILIES_BROKEN 0 #endif +static bool have_seccomp_privs(void) { + return geteuid() == 0 && have_effective_cap(CAP_SYS_ADMIN) > 0; /* If we are root but CAP_SYS_ADMIN we can't do caps (unless we also do NNP) */ +} + static void test_parse_syscall_and_errno(void) { _cleanup_free_ char *n = NULL; int e; @@ -168,8 +173,8 @@ static void test_filter_sets(void) { log_notice("Seccomp not available, skipping %s", __func__); return; } - if (geteuid() != 0) { - log_notice("Not root, skipping %s", __func__); + if (!have_seccomp_privs()) { + log_notice("Not privileged, skipping %s", __func__); return; } @@ -303,8 +308,8 @@ static void test_restrict_namespace(void) { log_notice("Seccomp not available, skipping remaining tests in %s", __func__); return; } - if (geteuid() != 0) { - log_notice("Not root, skipping remaining tests in %s", __func__); + if (!have_seccomp_privs()) { + log_notice("Not privileged, skipping remaining tests in %s", __func__); return; } @@ -373,8 +378,8 @@ static void test_protect_sysctl(void) { log_notice("Seccomp not available, skipping %s", __func__); return; } - if (geteuid() != 0) { - log_notice("Not root, skipping %s", __func__); + if (!have_seccomp_privs()) { + log_notice("Not privileged, skipping %s", __func__); return; } @@ -426,8 +431,8 @@ static void test_protect_syslog(void) { log_notice("Seccomp not available, skipping %s", __func__); return; } - if (geteuid() != 0) { - log_notice("Not root, skipping %s", __func__); + if (!have_seccomp_privs()) { + log_notice("Not privileged, skipping %s", __func__); return; } @@ -468,8 +473,8 @@ static void test_restrict_address_families(void) { log_notice("Seccomp not available, skipping %s", __func__); return; } - if (geteuid() != 0) { - log_notice("Not root, skipping %s", __func__); + if (!have_seccomp_privs()) { + log_notice("Not privileged, skipping %s", __func__); return; } @@ -557,8 +562,8 @@ static void test_restrict_realtime(void) { log_notice("Seccomp not available, skipping %s", __func__); return; } - if (geteuid() != 0) { - log_notice("Not root, skipping %s", __func__); + if (!have_seccomp_privs()) { + log_notice("Not privileged, skipping %s", __func__); return; } @@ -604,8 +609,8 @@ static void test_memory_deny_write_execute_mmap(void) { log_notice("Seccomp not available, skipping %s", __func__); return; } - if (geteuid() != 0) { - log_notice("Not root, skipping %s", __func__); + if (!have_seccomp_privs()) { + log_notice("Not privileged, skipping %s", __func__); return; } #if HAVE_VALGRIND_VALGRIND_H @@ -674,8 +679,8 @@ static void test_memory_deny_write_execute_shmat(void) { log_notice("Seccomp not available, skipping %s", __func__); return; } - if (geteuid() != 0) { - log_notice("Not root, skipping %s", __func__); + if (!have_seccomp_privs()) { + log_notice("Not privileged, skipping %s", __func__); return; } #if HAVE_VALGRIND_VALGRIND_H @@ -739,8 +744,8 @@ static void test_restrict_archs(void) { log_notice("Seccomp not available, skipping %s", __func__); return; } - if (geteuid() != 0) { - log_notice("Not root, skipping %s", __func__); + if (!have_seccomp_privs()) { + log_notice("Not privileged, skipping %s", __func__); return; } @@ -779,8 +784,8 @@ static void test_load_syscall_filter_set_raw(void) { log_notice("Seccomp not available, skipping %s", __func__); return; } - if (geteuid() != 0) { - log_notice("Not root, skipping %s", __func__); + if (!have_seccomp_privs()) { + log_notice("Not privileged, skipping %s", __func__); return; } @@ -877,8 +882,8 @@ static void test_lock_personality(void) { log_notice("Seccomp not available, skipping %s", __func__); return; } - if (geteuid() != 0) { - log_notice("Not root, skipping %s", __func__); + if (!have_seccomp_privs()) { + log_notice("Not privileged, skipping %s", __func__); return; } @@ -941,8 +946,8 @@ static void test_restrict_suid_sgid(void) { log_notice("Seccomp not available, skipping %s", __func__); return; } - if (geteuid() != 0) { - log_notice("Not root, skipping %s", __func__); + if (!have_seccomp_privs()) { + log_notice("Not privileged, skipping %s", __func__); return; } From c75370cc18d92a9a2cc3eafeb3b46e1d23ea0ac4 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 2 Jun 2021 22:10:22 +0200 Subject: [PATCH 3/4] test: tweak privilege tests for two more tests These tests require properly privileged root users, hence skip things when we don't have CAP_SYS_ADMIN. Fixes: #19746 --- src/test/test-execute.c | 4 ++-- src/test/test-mount-util.c | 9 +++++---- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/src/test/test-execute.c b/src/test/test-execute.c index 239fcea5e3..125e0bbf4f 100644 --- a/src/test/test-execute.c +++ b/src/test/test-execute.c @@ -924,8 +924,8 @@ int main(int argc, char *argv[]) { can_unshare = have_namespaces(); /* It is needed otherwise cgroup creation fails */ - if (getuid() != 0) - return log_tests_skipped("not root"); + if (geteuid() != 0 || have_effective_cap(CAP_SYS_ADMIN) <= 0) + return log_tests_skipped("not privileged"); r = enter_cgroup_subroot(NULL); if (r == -ENOMEDIUM) diff --git a/src/test/test-mount-util.c b/src/test/test-mount-util.c index 2e9116d359..ab5184121c 100644 --- a/src/test/test-mount-util.c +++ b/src/test/test-mount-util.c @@ -4,6 +4,7 @@ #include #include "alloc-util.h" +#include "capability-util.h" #include "fd-util.h" #include "fileio.h" #include "mount-util.h" @@ -75,8 +76,8 @@ static void test_bind_remount_recursive(void) { _cleanup_free_ char *subdir = NULL; const char *p; - if (geteuid() != 0) { - (void) log_tests_skipped("not running as root"); + if (geteuid() != 0 || have_effective_cap(CAP_SYS_ADMIN) <= 0) { + (void) log_tests_skipped("not running privileged"); return; } @@ -128,8 +129,8 @@ static void test_bind_remount_recursive(void) { static void test_bind_remount_one(void) { pid_t pid; - if (geteuid() != 0) { - (void) log_tests_skipped("not running as root"); + if (geteuid() != 0 || have_effective_cap(CAP_SYS_ADMIN) <= 0) { + (void) log_tests_skipped("not running privileged"); return; } From 9b1c5610e00ea2de74086f5e86760238b5ad943c Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 2 Jun 2021 22:11:34 +0200 Subject: [PATCH 4/4] test: add a 'static' on a global variable we don't actually export All global but not exported variables should be "static" in our codebase, add "static" to one more such variable hence. --- src/test/test-exec-util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/test/test-exec-util.c b/src/test/test-exec-util.c index e9e8e21040..4c11f54cef 100644 --- a/src/test/test-exec-util.c +++ b/src/test/test-exec-util.c @@ -22,7 +22,7 @@ #include "tests.h" static int here = 0, here2 = 0, here3 = 0; -void *ignore_stdout_args[] = {&here, &here2, &here3}; +static void *ignore_stdout_args[] = { &here, &here2, &here3 }; /* noop handlers, just check that arguments are passed correctly */ static int ignore_stdout_func(int fd, void *arg) {