1 // SPDX-License-Identifier: GPL-2.0
22  * - requries libcap-dev to be installed on test system
23  * - requires securityfs to me mounted at /sys/kernel/security, e.g.:
24  * mount -n -t securityfs -o nodev,noexec,nosuid securityfs /sys/kernel/security
25  * - needs CONFIG_SECURITYFS and CONFIG_SAFESETID to be enabled
43 static void die(char *fmt, ...)  in die()  function
118 			die("couldn't open file\n");  in ensure_user_exists()
120 			die("couldn't fseek\n");  in ensure_user_exists()
130 			die("putpwent failed\n");  in ensure_user_exists()
132 			die("fclose failed\n");  in ensure_user_exists()
147 			die("couldn't open group file\n");  in ensure_group_exists()
149 			die("couldn't fseek group file\n");  in ensure_group_exists()
157 			die("putgrent failed\n");  in ensure_group_exists()
159 			die("fclose failed\n");  in ensure_group_exists()
171 				die("mounting securityfs failed\n");  in ensure_securityfs_mounted()
173 			die("couldn't find securityfs for unknown reason\n");  in ensure_securityfs_mounted()
177 			die("close of %s failed: %s\n",  in ensure_securityfs_mounted()
191 		die("can't open add_uid_whitelist_policy file\n");  in write_uid_policies()
195 			die("short write to %s\n", add_uid_whitelist_policy_file);  in write_uid_policies()
197 			die("write to %s failed: %s\n",  in write_uid_policies()
202 		die("close of %s failed: %s\n",  in write_uid_policies()
215 		die("can't open add_gid_whitelist_policy file\n");  in write_gid_policies()
219 			die("short write to %s\n", add_gid_whitelist_policy_file);  in write_gid_policies()
221 			die("write to %s failed: %s\n",  in write_gid_policies()
226 		die("close of %s failed: %s\n",  in write_gid_policies()
244 	if (cpid == -1) {  in test_userns()
272 	if (cpid == -1) {  in test_setuid()
273 		die("fork\n");  in test_setuid()
286 			if (w == -1) {  in test_setuid()
287 				die("waitpid\n");  in test_setuid()
295 						die("unexpected success\n");  in test_setuid()
299 						die("unexpected failure\n");  in test_setuid()
307 						die("killed unexpectedly\n");  in test_setuid()
311 					die("unexpected signal: %d\n", wstatus);  in test_setuid()
314 				die("unexpected status: %d\n", wstatus);  in test_setuid()
319 	die("should not reach here\n");  in test_setuid()
328 	if (cpid == -1) {  in test_setgid()
329 		die("fork\n");  in test_setgid()
342 			if (w == -1) {  in test_setgid()
343 				die("waitpid\n");  in test_setgid()
351 						die("unexpected success\n");  in test_setgid()
355 						die("unexpected failure\n");  in test_setgid()
363 						die("killed unexpectedly\n");  in test_setgid()
367 					die("unexpected signal: %d\n", wstatus);  in test_setgid()
370 				die("unexpected status: %d\n", wstatus);  in test_setgid()
375 	die("should not reach here\n");  in test_setgid()
386 	if (cpid == -1) {  in test_setgroups()
387 		die("fork\n");  in test_setgroups()
399 				if (j == len - 1)  in test_setgroups()
407 			if (w == -1) {  in test_setgroups()
408 				die("waitpid\n");  in test_setgroups()
416 						die("unexpected success\n");  in test_setgroups()
420 						die("unexpected failure\n");  in test_setgroups()
428 						die("killed unexpectedly\n");  in test_setgroups()
432 					die("unexpected signal: %d\n", wstatus);  in test_setgroups()
435 				die("unexpected status: %d\n", wstatus);  in test_setgroups()
440 	die("should not reach here\n");  in test_setgroups()
485 		die("Error with set keepcaps\n");  in main()
487 	// First test to make sure we can write userns mappings from a non-root  in main()
491 		die("Error with set gid(%d)\n", NO_POLICY_UGID);  in main()
493 		die("Error with set uid(%d)\n", NO_POLICY_UGID);  in main()
497 	// from non-root parent process.  in main()
499 		die("Error with set dumpable\n");  in main()
501 		die("test_userns failed when it should work\n");  in main()
506 		die("Error with set gid(%d)\n", RESTRICTED_PARENT_UGID);  in main()
508 		die("Error with set uid(%d)\n", RESTRICTED_PARENT_UGID);  in main()
526 		die("test_userns worked when it should fail\n");  in main()