caps testing

10 files changed, 221 insertions, 52 deletions

diff --git a/src/firejail/caps.c b/src/firejail/caps.c
index ba811cada..6cfa36629 100644
--- a/src/firejail/caps.c
+++ b/src/firejail/caps.c
@@ -181,12 +181,10 @@ static int caps_find_name(const char *name) {
 }
 
 // return 1 if error, 0 if OK
-int caps_check_list(const char *clist, void (*callback)(int)) {
+void caps_check_list(const char *clist, void (*callback)(int)) {
         // don't allow empty lists
-        if (clist == NULL || *clist == '\0') {
-                fprintf(stderr, "Error: empty capabilities lists are not allowed\n");
-                return -1;
-        }
+        if (clist == NULL || *clist == '\0')
+                goto errexit;
 
         // work on a copy of the string
         char *str = strdup(clist);
@@ -201,11 +199,8 @@ int caps_check_list(const char *clist, void (*callback)(int)) {
                 else if (*ptr == ',') {
                         *ptr = '\0';
                         int nr = caps_find_name(start);
-                        if (nr == -1) {
-                                fprintf(stderr, "Error: capability %s not found\n", start);
-                                free(str);
-                                return -1;
-                        }
+                        if (nr == -1)
+                                goto errexit;
                         else if (callback != NULL)
                                 callback(nr);
                                 
@@ -215,17 +210,18 @@ int caps_check_list(const char *clist, void (*callback)(int)) {
         }
         if (*start != '\0') {
                 int nr = caps_find_name(start);
-                if (nr == -1) {
-                        fprintf(stderr, "Error: capability %s not found\n", start);
-                        free(str);      
-                        return -1;
-                }
+                if (nr == -1) 
+                        goto errexit;
                 else if (callback != NULL)
                         callback(nr);
         }
 
         free(str);      
-        return 0;
+        return;
+
+errexit:
+        fprintf(stderr, "Error: capability \"%s\" not found\n", start);
+        exit(1);        
 }
 
 void caps_print(void) {
@@ -256,49 +252,53 @@ void caps_print(void) {
 // enabled by default
 int caps_default_filter(void) {
         // drop capabilities
-        if (prctl(PR_CAPBSET_DROP, CAP_SYS_MODULE, 0, 0, 0) && arg_debug)
-                fprintf(stderr, "Warning: cannot drop CAP_SYS_MODULE");
+        if (prctl(PR_CAPBSET_DROP, CAP_SYS_MODULE, 0, 0, 0))
+                goto errexit;
         else if (arg_debug)
                 printf("Drop CAP_SYS_MODULE\n");
 
-        if (prctl(PR_CAPBSET_DROP, CAP_SYS_RAWIO, 0, 0, 0) && arg_debug)
-                fprintf(stderr, "Warning: cannot drop CAP_SYS_RAWIO");
+        if (prctl(PR_CAPBSET_DROP, CAP_SYS_RAWIO, 0, 0, 0))
+                goto errexit;
         else if (arg_debug)
                 printf("Drop CAP_SYS_RAWIO\n");
 
-        if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0) && arg_debug)
-                fprintf(stderr, "Warning: cannot drop CAP_SYS_BOOT");
+        if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0))
+                goto errexit;
         else if (arg_debug)
                 printf("Drop CAP_SYS_BOOT\n");
 
-        if (prctl(PR_CAPBSET_DROP, CAP_SYS_NICE, 0, 0, 0) && arg_debug)
-                fprintf(stderr, "Warning: cannot drop CAP_SYS_NICE");
+        if (prctl(PR_CAPBSET_DROP, CAP_SYS_NICE, 0, 0, 0))
+                goto errexit;
         else if (arg_debug)
                 printf("Drop CAP_SYS_NICE\n");
 
-        if (prctl(PR_CAPBSET_DROP, CAP_SYS_TTY_CONFIG, 0, 0, 0) && arg_debug)
-                fprintf(stderr, "Warning: cannot drop CAP_SYS_TTY_CONFIG");
+        if (prctl(PR_CAPBSET_DROP, CAP_SYS_TTY_CONFIG, 0, 0, 0))
+                goto errexit;
         else if (arg_debug)
                 printf("Drop CAP_SYS_TTY_CONFIG\n");
 
 #ifdef CAP_SYSLOG
-        if (prctl(PR_CAPBSET_DROP, CAP_SYSLOG, 0, 0, 0) && arg_debug)
-                fprintf(stderr, "Warning: cannot drop CAP_SYSLOG");
+        if (prctl(PR_CAPBSET_DROP, CAP_SYSLOG, 0, 0, 0))
+                goto errexit;
         else if (arg_debug)
                 printf("Drop CAP_SYSLOG\n");
 #endif
 
-        if (prctl(PR_CAPBSET_DROP, CAP_MKNOD, 0, 0, 0) && arg_debug)
-                fprintf(stderr, "Warning: cannot drop CAP_MKNOD");
+        if (prctl(PR_CAPBSET_DROP, CAP_MKNOD, 0, 0, 0))
+                goto errexit;
         else if (arg_debug)
                 printf("Drop CAP_MKNOD\n");
 
-        if (prctl(PR_CAPBSET_DROP, CAP_SYS_ADMIN, 0, 0, 0) && arg_debug)
-                fprintf(stderr, "Warning: cannot drop CAP_SYS_ADMIN");
+        if (prctl(PR_CAPBSET_DROP, CAP_SYS_ADMIN, 0, 0, 0))
+                goto errexit;
         else if (arg_debug)
                 printf("Drop CAP_SYS_ADMIN\n");
 
         return 0;
+
+errexit:
+        fprintf(stderr, "Error: cannot drop capabilities\n");
+        exit(1);        
 }
 
 void caps_drop_all(void) {
@@ -359,19 +359,14 @@ static uint64_t extract_caps(int pid) {
         EUID_ASSERT();
         
         char *file;
-        if (asprintf(&file, "/proc/%d/status", pid) == -1) {
+        if (asprintf(&file, "/proc/%d/status", pid) == -1)
                 errExit("asprintf");
-                exit(1);
-        }
 
         EUID_ROOT();    // grsecurity
         FILE *fp = fopen(file, "r");
         EUID_USER();    // grsecurity
-        if (!fp) {
-                printf("Error: cannot open %s\n", file);
-                free(file);
-                exit(1);
-        }
+        if (!fp)
+                goto errexit;
         
         char buf[MAXBUF];
         while (fgets(buf, MAXBUF, fp)) {
@@ -385,6 +380,8 @@ static uint64_t extract_caps(int pid) {
                 }
         }
         fclose(fp);
+
+errexit:        
         free(file);
         fprintf(stderr, "Error: cannot read caps configuration\n");
         exit(1);
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 2e031ce04..4ae3cfd9f 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -508,7 +508,7 @@ int caps_default_filter(void);
 void caps_print(void);
 void caps_drop_all(void);
 void caps_set(uint64_t caps);
-int caps_check_list(const char *clist, void (*callback)(int));
+void caps_check_list(const char *clist, void (*callback)(int));
 void caps_drop_list(const char *clist);
 void caps_keep_list(const char *clist);
 void caps_print_filter(pid_t pid);
diff --git a/src/firejail/main.c b/src/firejail/main.c
index ff7b762cd..111a1d751 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1186,8 +1186,7 @@ int main(int argc, char **argv) {
                         if (!arg_caps_list)
                                 errExit("strdup");
                         // verify caps list and exit if problems
-                        if (caps_check_list(arg_caps_list, NULL))
-                                return 1;
+                        caps_check_list(arg_caps_list, NULL);
                 }
                 else if (strncmp(argv[i], "--caps.keep=", 12) == 0) {
                         arg_caps_keep = 1;
@@ -1195,8 +1194,7 @@ int main(int argc, char **argv) {
                         if (!arg_caps_list)
                                 errExit("strdup");
                         // verify caps list and exit if problems
-                        if (caps_check_list(arg_caps_list, NULL))
-                                return 1;
+                        caps_check_list(arg_caps_list, NULL);
                 }
 
 
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 688fa9609..abb8bd9b6 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -570,8 +570,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 if (!arg_caps_list)
                         errExit("strdup");
                 // verify caps list and exit if problems
-                if (caps_check_list(arg_caps_list, NULL))
-                        exit(1);
+                caps_check_list(arg_caps_list, NULL);
                 return 0;
         }
         
@@ -582,8 +581,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 if (!arg_caps_list)
                         errExit("strdup");
                 // verify caps list and exit if problems
-                if (caps_check_list(arg_caps_list, NULL))
-                        exit(1);
+                caps_check_list(arg_caps_list, NULL);
                 return 0;
         }
 
diff --git a/test/filters/caps-print.exp b/test/filters/caps-print.exp
new file mode 100755
index 000000000..d9d662239
--- /dev/null
+++ b/test/filters/caps-print.exp
@@ -0,0 +1,103 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2016 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send -- "firejail --name=test --noprofile --caps --debug\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Drop CAP_SYS_MODULE"
+}
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "Drop CAP_SYS_RAWIO"
+}
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "Drop CAP_SYS_BOOT"
+}
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "Drop CAP_SYS_NICE"
+}
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "Drop CAP_SYS_TTY_CONFIG"
+}
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
+        "Drop CAP_SYSLOG"
+}
+expect {
+        timeout {puts "TESTING ERROR 6\n";exit}
+        "Drop CAP_MKNOD"
+}
+expect {
+        timeout {puts "TESTING ERROR 7\n";exit}
+        "Drop CAP_SYS_ADMIN"
+}
+expect {
+        timeout {puts "TESTING ERROR 8\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+spawn $env(SHELL)
+send -- "firejail --caps.print=test\r"
+expect {
+        timeout {puts "TESTING ERROR 9\n";exit}
+        "chown               - enabled"
+}
+expect {
+        timeout {puts "TESTING ERROR 10\n";exit}
+        "setgid              - enabled"
+}
+expect {
+        timeout {puts "TESTING ERROR 11\n";exit}
+        "setuid              - enabled"
+}
+expect {
+        timeout {puts "TESTING ERROR 12\n";exit}
+        "mknod               - disabled"
+}
+expect {
+        timeout {puts "TESTING ERROR 13\n";exit}
+        "syslog              - disabled"
+}
+after 100
+
+send -- "firejail --debug-caps\r"
+expect {
+        timeout {puts "TESTING ERROR 9\n";exit}
+        "21     - sys_admin"
+}
+expect {
+        timeout {puts "TESTING ERROR 9\n";exit}
+        "22     - sys_boot"
+}
+expect {
+        timeout {puts "TESTING ERROR 9\n";exit}
+        "23     - sys_nice"
+}
+expect {
+        timeout {puts "TESTING ERROR 9\n";exit}
+        "24     - sys_resource"
+}
+after 100
+
+send -- "firejail --caps.keep=\"bla bla bla\"\r"
+expect {
+        timeout {puts "TESTING ERROR 10\n";exit}
+        "capability"
+}
+expect {
+        timeout {puts "TESTING ERROR 11\n";exit}
+        "not found"
+}
+
+after 100
+puts "\nall done\n"
diff --git a/test/filters/caps.exp b/test/filters/caps.exp
index 7f7cf7dd1..2954f2e58 100755
--- a/test/filters/caps.exp
+++ b/test/filters/caps.exp
@@ -12,7 +12,7 @@ expect {
         timeout {puts "TESTING ERROR 1\n";exit}
         "Child process initialized"
 }
-sleep 2
+after 100
 
 send -- "cat /proc/self/status\r"
 expect {
@@ -31,7 +31,7 @@ expect {
         timeout {puts "TESTING ERROR 4\n";exit}
         "Child process initialized"
 }
-sleep 2
+after 100
 
 send -- "cat /proc/self/status\r"
 expect {
@@ -50,7 +50,7 @@ expect {
         timeout {puts "TESTING ERROR 7\n";exit}
         "Child process initialized"
 }
-sleep 2
+after 100
 
 send -- "cat /proc/self/status\r"
 expect {
@@ -66,7 +66,74 @@ expect {
         "Seccomp:"
 }
 send -- "exit\r"
+sleep 1
+
+
+send -- "firejail --profile=caps1.profile --debug\r"
+expect {
+        timeout {puts "TESTING ERROR 11\n";exit}
+        "Drop CAP_SYS_MODULE"
+}
+expect {
+        timeout {puts "TESTING ERROR 12\n";exit}
+        "Drop CAP_SYS_ADMIN"
+}
+expect {
+        timeout {puts "TESTING ERROR 13\n";exit}
+        "Drop CAP_" {puts "TESTING ERROR 14\n";exit}
+        "Child process initialized"
+}
 after 100
+send -- "exit\r"
+sleep 1
 
 
+## tofix: possible problem with caps.keep in profile files
+##send -- "firejail --caps.keep=chown,fowner --noprofile\r"
+#send -- "firejail --profile=caps2.profile\r"
+#expect {
+#       timeout {puts "TESTING ERROR 15\n";exit}
+#       "Child process initialized"
+#}
+#after 100
+#
+#send -- "cat /proc/self/status\r"
+#expect {
+#       timeout {puts "TESTING ERROR 16\n";exit}
+#       "CapBnd:        0000000000000009"
+#}
+#expect {
+#       timeout {puts "TESTING ERROR 17\n";exit}
+#       "Seccomp:"
+#}
+#send -- "exit\r"
+#sleep 1
+
+#send -- "firejail --caps.drop=chown,dac_override,dac_read_search,fowner --noprofile\r"
+send -- "firejail --profile=caps3.profile\r"
+expect {
+        timeout {puts "TESTING ERROR 18\n";exit}
+        "Child process initialized"
+}
+after 100
+
+send -- "cat /proc/self/status\r"
+expect {
+        timeout {puts "TESTING ERROR 19\n";exit}
+        "CapBnd:"
+}
+expect {
+        timeout {puts "TESTING ERROR 20\n";exit}
+        "fffffff0"
+}
+expect {
+        timeout {puts "TESTING ERROR 21\n";exit}
+        "Seccomp:"
+}
+send -- "exit\r"
+sleep 1
+
+
+
+after 100
 puts "\nall done\n"
diff --git a/test/filters/caps1.profile b/test/filters/caps1.profile
new file mode 100644
index 000000000..8b0c3b340
--- /dev/null
+++ b/test/filters/caps1.profile
@@ -0,0 +1 @@
+caps
diff --git a/test/filters/caps2.profile b/test/filters/caps2.profile
new file mode 100644
index 000000000..4f0016fad
--- /dev/null
+++ b/test/filters/caps2.profile
@@ -0,0 +1 @@
+caps.drop chown,dac_override,dac_read_search,fowner
\ No newline at end of file
diff --git a/test/filters/caps3.profile b/test/filters/caps3.profile
new file mode 100644
index 000000000..4f0016fad
--- /dev/null
+++ b/test/filters/caps3.profile
@@ -0,0 +1 @@
+caps.drop chown,dac_override,dac_read_search,fowner
\ No newline at end of file
diff --git a/test/filters/filters.sh b/test/filters/filters.sh
index 5c7c98b3e..fea4a0296 100755
--- a/test/filters/filters.sh
+++ b/test/filters/filters.sh
@@ -12,6 +12,9 @@ echo "TESTING: noroot (test/filters/noroot.exp)"
 echo "TESTING: capabilities (test/filters/caps.exp)"
 ./caps.exp
 
+echo "TESTING: capabilities print (test/filters/caps-print.exp)"
+./caps-print.exp
+
 rm -f seccomp-test-file
 if [ "$(uname -m)" = "x86_64" ]; then
        echo "TESTING: fseccomp (test/filters/fseccomp.exp)"