Add SetCapabilities for setting capabilities to an exact set.

sandbox/linux/services/credentials_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/services/credentials.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <stdio.h>
+#include <sys/capability.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
 
+#include <vector>
+
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_file.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "sandbox/linux/services/proc_util.h"
+#include "sandbox/linux/services/syscall_wrappers.h"
+#include "sandbox/linux/system_headers/capability.h"
 #include "sandbox/linux/tests/unit_tests.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace sandbox {
 
 namespace {
 
+struct CapFreeDeleter {
+  inline void operator()(cap_t cap) const {
+    int ret = cap_free(cap);
+    CHECK_EQ(0, ret);
+  }
+};
+
+// Wrapper to manage libcap2's cap_t type.
+typedef scoped_ptr<typeof(*((cap_t)0)), CapFreeDeleter> ScopedCap;
+
 bool WorkingDirectoryIsRoot() {
   char current_dir[PATH_MAX];
   char* cwd = getcwd(current_dir, sizeof(current_dir));
   PCHECK(cwd);
   if (strcmp("/", cwd)) return false;
 
   // The current directory is the root. Add a few paranoid checks.
   struct stat current;
   CHECK_EQ(0, stat(".", &current));
   struct stat parrent;
   CHECK_EQ(0, stat("..", &parrent));
   CHECK_EQ(current.st_dev, parrent.st_dev);
   CHECK_EQ(current.st_ino, parrent.st_ino);
   CHECK_EQ(current.st_mode, parrent.st_mode);
   CHECK_EQ(current.st_uid, parrent.st_uid);
   CHECK_EQ(current.st_gid, parrent.st_gid);
   return true;
 }
 
 SANDBOX_TEST(Credentials, DropAllCaps) {
   CHECK(Credentials::DropAllCapabilities());
   CHECK(!Credentials::HasAnyCapability());
 }
 
-SANDBOX_TEST(Credentials, GetCurrentCapString) {
-  CHECK(Credentials::DropAllCapabilities());
-  const char kNoCapabilityText[] = "=";
-  CHECK(*Credentials::GetCurrentCapString() == kNoCapabilityText);
-}
-
 SANDBOX_TEST(Credentials, MoveToNewUserNS) {
   CHECK(Credentials::DropAllCapabilities());
   bool moved_to_new_ns = Credentials::MoveToNewUserNS();
   fprintf(stdout,
           "Unprivileged CLONE_NEWUSER supported: %s\n",
           moved_to_new_ns ? "true." : "false.");
   fflush(stdout);
   if (!moved_to_new_ns) {
     fprintf(stdout, "This kernel does not support unprivileged namespaces. "
             "USERNS tests will succeed without running.\n");
@@ skipping 87 matching lines @@
   if (!Credentials::MoveToNewUserNS()) return;
   CHECK(Credentials::DropFileSystemAccess(proc_fd.get()));
   CHECK(Credentials::DropAllCapabilities(proc_fd.get()));
 
   // The kernel should now prevent us from regaining capabilities because we
   // are in a chroot.
   CHECK(!Credentials::CanCreateProcessInNewUserNS());
   CHECK(!Credentials::MoveToNewUserNS());
 }
 
+SANDBOX_TEST(Credentials, SetCapabilities) {
+  // Probably missing kernel support.
+  if (!Credentials::MoveToNewUserNS())
+    return;
+
+  base::ScopedFD proc_fd(ProcUtil::OpenProc());
+
+  CHECK(Credentials::HasCapability(LinuxCapability::kCapSysAdmin));
+  CHECK(Credentials::HasCapability(LinuxCapability::kCapSysChroot));
+
+  const std::vector<LinuxCapability> caps = {LinuxCapability::kCapSysChroot};
+  CHECK(Credentials::SetCapabilities(proc_fd.get(), caps));
+
+  CHECK(!Credentials::HasCapability(LinuxCapability::kCapSysAdmin));
+  CHECK(Credentials::HasCapability(LinuxCapability::kCapSysChroot));
+
+  const std::vector<LinuxCapability> no_caps;
+  CHECK(Credentials::SetCapabilities(proc_fd.get(), no_caps));
+  CHECK(!Credentials::HasAnyCapability());
+}
+
+SANDBOX_TEST(Credentials, SetCapabilitiesAndChroot) {

[jln (very slow on Chromium), 2015/03/16 21:38:10]

Might need DISABLE_ON_ASAN as above, no?

[rickyz (no longer on Chrome), 2015/03/16 23:10:12]

I don't think it's needed in this case since I only ever chroot to /.

+  // Probably missing kernel support.
+  if (!Credentials::MoveToNewUserNS())
+    return;
+
+  base::ScopedFD proc_fd(ProcUtil::OpenProc());
+
+  CHECK(Credentials::HasCapability(LinuxCapability::kCapSysChroot));
+  PCHECK(chroot("/") == 0);
+
+  const std::vector<LinuxCapability> caps = {LinuxCapability::kCapSysChroot};
+  CHECK(Credentials::SetCapabilities(proc_fd.get(), caps));
+  PCHECK(chroot("/") == 0);
+
+  CHECK(Credentials::DropAllCapabilities());
+  PCHECK(chroot("/") == -1 && errno == EPERM);
+}
+
+SANDBOX_TEST(Credentials, SetCapabilitiesMatchesLibCap2) {
+  // Probably missing kernel support.
+  if (!Credentials::MoveToNewUserNS())
+    return;
+
+  static_assert(
+      static_cast<int>(LinuxCapability::kCapSysChroot) == CAP_SYS_CHROOT,

[jln (very slow on Chromium), 2015/03/16 21:38:10]

I possible, I would rather have LinuxCapability values independent of actual
capability values and have a conversion function in the implementation.

[rickyz (no longer on Chrome), 2015/03/16 23:10:12]

Done.

+      "CAP_SYS_CHROOT values do not match.");
+  static_assert(
+      static_cast<int>(LinuxCapability::kCapSysAdmin) == CAP_SYS_ADMIN,
+      "CAP_SYS_ADMIN values do not match.");
+
+  base::ScopedFD proc_fd(ProcUtil::OpenProc());
+
+  const std::vector<LinuxCapability> caps = {LinuxCapability::kCapSysChroot};
+  CHECK(Credentials::SetCapabilities(proc_fd.get(), caps));
+
+  ScopedCap actual_cap(cap_get_proc());
+  PCHECK(actual_cap != nullptr);
+
+  ScopedCap expected_cap(cap_init());
+  PCHECK(expected_cap != nullptr);
+
+  const cap_value_t allowed_cap = CAP_SYS_CHROOT;
+  for (const cap_flag_t flag : {CAP_EFFECTIVE, CAP_PERMITTED}) {
+    PCHECK(cap_set_flag(expected_cap.get(), flag, 1, &allowed_cap, CAP_SET) ==
+           0);
+  }
+
+  CHECK_EQ(0, cap_compare(expected_cap.get(), actual_cap.get()));
+}
+
 }  // namespace.
 
 }  // namespace sandbox.