102 lines
3.2 KiB
C++
102 lines
3.2 KiB
C++
// Copyright 2018 The gVisor Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
// Utilities for testing capabilties.
|
|
|
|
#ifndef GVISOR_TEST_UTIL_CAPABILITY_UTIL_H_
|
|
#define GVISOR_TEST_UTIL_CAPABILITY_UTIL_H_
|
|
|
|
#include <errno.h>
|
|
#include <linux/capability.h>
|
|
#include <sys/syscall.h>
|
|
#include <unistd.h>
|
|
|
|
#include "test/util/cleanup.h"
|
|
#include "test/util/posix_error.h"
|
|
#include "test/util/save_util.h"
|
|
#include "test/util/test_util.h"
|
|
|
|
#ifndef _LINUX_CAPABILITY_VERSION_3
|
|
#error Expecting _LINUX_CAPABILITY_VERSION_3 support
|
|
#endif
|
|
|
|
namespace gvisor {
|
|
namespace testing {
|
|
|
|
// HaveCapability returns true if the process has the specified EFFECTIVE
|
|
// capability.
|
|
inline PosixErrorOr<bool> HaveCapability(int cap) {
|
|
if (!cap_valid(cap)) {
|
|
return PosixError(EINVAL, "Invalid capability");
|
|
}
|
|
|
|
struct __user_cap_header_struct header = {_LINUX_CAPABILITY_VERSION_3, 0};
|
|
struct __user_cap_data_struct caps[_LINUX_CAPABILITY_U32S_3] = {};
|
|
RETURN_ERROR_IF_SYSCALL_FAIL(syscall(__NR_capget, &header, &caps));
|
|
MaybeSave();
|
|
|
|
return (caps[CAP_TO_INDEX(cap)].effective & CAP_TO_MASK(cap)) != 0;
|
|
}
|
|
|
|
// SetCapability sets the specified EFFECTIVE capability.
|
|
inline PosixError SetCapability(int cap, bool set) {
|
|
if (!cap_valid(cap)) {
|
|
return PosixError(EINVAL, "Invalid capability");
|
|
}
|
|
|
|
struct __user_cap_header_struct header = {_LINUX_CAPABILITY_VERSION_3, 0};
|
|
struct __user_cap_data_struct caps[_LINUX_CAPABILITY_U32S_3] = {};
|
|
RETURN_ERROR_IF_SYSCALL_FAIL(syscall(__NR_capget, &header, &caps));
|
|
MaybeSave();
|
|
|
|
if (set) {
|
|
caps[CAP_TO_INDEX(cap)].effective |= CAP_TO_MASK(cap);
|
|
} else {
|
|
caps[CAP_TO_INDEX(cap)].effective &= ~CAP_TO_MASK(cap);
|
|
}
|
|
header = {_LINUX_CAPABILITY_VERSION_3, 0};
|
|
RETURN_ERROR_IF_SYSCALL_FAIL(syscall(__NR_capset, &header, &caps));
|
|
MaybeSave();
|
|
|
|
return NoError();
|
|
}
|
|
|
|
// DropPermittedCapability drops the specified PERMITTED. The EFFECTIVE
|
|
// capabilities must be a subset of PERMITTED, so those are dropped as well.
|
|
inline PosixError DropPermittedCapability(int cap) {
|
|
if (!cap_valid(cap)) {
|
|
return PosixError(EINVAL, "Invalid capability");
|
|
}
|
|
|
|
struct __user_cap_header_struct header = {_LINUX_CAPABILITY_VERSION_3, 0};
|
|
struct __user_cap_data_struct caps[_LINUX_CAPABILITY_U32S_3] = {};
|
|
RETURN_ERROR_IF_SYSCALL_FAIL(syscall(__NR_capget, &header, &caps));
|
|
MaybeSave();
|
|
|
|
caps[CAP_TO_INDEX(cap)].effective &= ~CAP_TO_MASK(cap);
|
|
caps[CAP_TO_INDEX(cap)].permitted &= ~CAP_TO_MASK(cap);
|
|
|
|
header = {_LINUX_CAPABILITY_VERSION_3, 0};
|
|
RETURN_ERROR_IF_SYSCALL_FAIL(syscall(__NR_capset, &header, &caps));
|
|
MaybeSave();
|
|
|
|
return NoError();
|
|
}
|
|
|
|
PosixErrorOr<bool> CanCreateUserNamespace();
|
|
|
|
} // namespace testing
|
|
} // namespace gvisor
|
|
#endif // GVISOR_TEST_UTIL_CAPABILITY_UTIL_H_
|