Commit Graph

11 Commits

Author SHA1 Message Date
Ed Maste
4ee9db7a1d Update capsicum-test to eab7a83b05becf64439b4b256b3d756b353fbbbb 2022-09-13 13:42:46 -04:00
Mark Johnston
8e8f1cc9bb Re-enable network ioctls in capability mode
This reverts a portion of 274579831b ("capsicum: Limit socket
operations in capability mode") as at least rtsol and dhcpcd rely on
being able to configure network interfaces while in capability mode.

Reported by:	bapt, Greg V
Sponsored by:	The FreeBSD Foundation
2021-04-23 09:22:49 -04:00
Mark Johnston
b856b51d14 Merge commit 'd0e943077d94e6266ece9856789c5d5313676e38' 2021-04-12 11:29:47 -04:00
Alex Richardson
8cf5812af4 capsicum-test: Update for O_BENEATH removal
Update the tests to check O_RESOLVE_BENEATH instead.
If this looks reasonable, I'll try to upstream this change.
This keeps a compat fallback for O_BENEATH since the Linux port still
has/had O_BENEATH with "no .., no absolute paths" semantics.

Test Plan:	`/usr/tests/sys/capsicum/capsicum-test -u 977` passes and
		runs the O_RESOLVE_BENEATH tests.
Reviewed By:	markj
Differential Revision: https://reviews.freebsd.org/D29016
2021-03-12 17:12:10 +00:00
Alex Richardson
47ceb65f3c Fix capsicum-test build with GCC
Apparently GCC defines NULL to 0 in C++11 mode (instead of nullptr), so
this causes the following error:
```
In file included from capsicum-test.h:15,
                 from capsicum-test.cc:1:
gtest-1.10.0/include/gtest/gtest.h: In instantiation of 'testing::AssertionResult testing::internal::CmpHelperNE(const char*, const char*, const T1&, const T2&) [with T1 = long int; T2 = procstat*]':
capsicum-test.cc:75:3:   required from here
gtest-1.10.0/include/gtest/gtest.h:1621:28: error: ISO C++ forbids comparison between pointer and integer [-fpermissive]
 1609 |   if (val1 op val2) {\
      |       ~~~~~~~~~~~~
......
 1621 | GTEST_IMPL_CMP_HELPER_(NE, !=);
gtest-1.10.0/include/gtest/gtest.h:1609:12: note: in definition of macro 'GTEST_IMPL_CMP_HELPER_'
 1609 |   if (val1 op val2) {\
      |            ^~
```

Fix this by using nullptr directly.

Submitted upstream as https://github.com/google/capsicum-test/pull/56

Reported by:	Jenkins CI
2021-03-03 13:53:45 +00:00
Alex Richardson
955a3f9ad5 Update capsicum-test to git commit f4d97414d48b8f8356b971ab9f45dc5c70d53c40
This includes various fixes that I submitted recently such as updating the
pdkill() tests for the actual implemented behaviour
(https://github.com/google/capsicum-test/pull/53) and lots of changes to
avoid calling sleep() and replacing it with reliable synchronization
(pull requests 49,51,52,53,54). This should make the testsuite more reliable
when running on Jenkins. Additionally, process status is now retrieved using
libprocstat instead of running `ps` and parsing the output
(https://github.com/google/capsicum-test/pull/50). This fixes one previously
failing test and speeds up execution.

Overall, this update reduces the total runtime from ~60s to about 4-5 seconds.
2021-03-02 16:38:05 +00:00
Alex Richardson
2d936e6c99 Update capsicum-test to git commit 7707222b46abe52d18fd4fbb76115ffdb3e6f74b
This includes changes to use GTEST_SKIP() instead of the local hand-rolled
mechanism as well as a few minor cleanups.
2021-02-16 14:35:12 +00:00
Li-Wen Hsu
85a6f8076f Revert r358001 in favor of r366509
Sponsored by:	The FreeBSD Foundation
2020-10-07 07:55:55 +00:00
Li-Wen Hsu
80986ae0c1 Really skip the tests in capsicum tests
Sponsored by:	The FreeBSD Foundation
2020-02-17 20:25:33 +00:00
Li-Wen Hsu
30fd7f5487 Temporarily skip flakey test in sys.capsicum.capsicum-test.main:
PipePdfork.WildcardWait

PR:		244165
Sponsored by:	The FreeBSD Foundation
2020-02-16 14:33:55 +00:00
Enji Cooper
8ac5aef8f3 Integrate capsicum-test into the FreeBSD test suite
This change takes capsicum-test from upstream and applies some local changes to make the
tests work on FreeBSD when executed via Kyua.

The local modifications are as follows:
1. Make `OpenatTest.WithFlag` pass with the new dot-dot lookup behavior in FreeBSD 12.x+.
2. capsicum-test references a set of helper binaries: `mini-me`, `mini-me.noexec`, and
   `mini-me.setuid`, as part of the execve/fexecve tests, via execve, fexecve, and open.
   It achieves this upstream by assuming `mini-me*` is in the current directory, however,
   in order for Kyua to execute `capsicum-test`, it needs to provide a full path to
   `mini-me*`. In order to achieve this, I made `capsicum-test` cache the executable's
   path from argv[0] in main(..) and use the cached value to compute the path to
   `mini-me*` as part of the execve/fexecve testcases.
3. The capsicum-test test suite assumes that it's always being run on CAPABILITIES enabled
   kernels. However, there's a chance that the test will be run on a host without a
   CAPABILITIES enabled kernel, so we must check for the support before running the tests.
   The way to achieve this is to add the relevant `feature_present("security_capabilities")`
   check to SetupEnvironment::SetUp() and skip the tests when the support is not available.
   While here, add a check for `kern.trap_enotcap` being enabled. As noted by markj@ in
   https://github.com/google/capsicum-test/issues/23, this sysctl being enabled can trigger
   non-deterministic failures. Therefore, the tests should be skipped if this sysctl is
   enabled.

All local changes have been submitted to the capsicum-test project
(https://github.com/google/capsicum-test) and are in various stages of review.
Please see the following pull requests for more details:
1. https://github.com/google/capsicum-test/pull/35
2. https://github.com/google/capsicum-test/pull/41
3. https://github.com/google/capsicum-test/pull/42

Reviewed by:	asomers
Discussed with:	emaste, markj
Approved by:	emaste (mentor)
MFC after:	2 months
Differential Revision: https://reviews.freebsd.org/D19758
2019-04-01 21:24:50 +00:00