8ac5aef8f3
This change takes capsicum-test from upstream and applies some local changes to make the
tests work on FreeBSD when executed via Kyua.
The local modifications are as follows:
1. Make `OpenatTest.WithFlag` pass with the new dot-dot lookup behavior in FreeBSD 12.x+.
2. capsicum-test references a set of helper binaries: `mini-me`, `mini-me.noexec`, and
`mini-me.setuid`, as part of the execve/fexecve tests, via execve, fexecve, and open.
It achieves this upstream by assuming `mini-me*` is in the current directory, however,
in order for Kyua to execute `capsicum-test`, it needs to provide a full path to
`mini-me*`. In order to achieve this, I made `capsicum-test` cache the executable's
path from argv[0] in main(..) and use the cached value to compute the path to
`mini-me*` as part of the execve/fexecve testcases.
3. The capsicum-test test suite assumes that it's always being run on CAPABILITIES enabled
kernels. However, there's a chance that the test will be run on a host without a
CAPABILITIES enabled kernel, so we must check for the support before running the tests.
The way to achieve this is to add the relevant `feature_present("security_capabilities")`
check to SetupEnvironment::SetUp() and skip the tests when the support is not available.
While here, add a check for `kern.trap_enotcap` being enabled. As noted by markj@ in
https://github.com/google/capsicum-test/issues/23, this sysctl being enabled can trigger
non-deterministic failures. Therefore, the tests should be skipped if this sysctl is
enabled.
All local changes have been submitted to the capsicum-test project
(https://github.com/google/capsicum-test) and are in various stages of review.
Please see the following pull requests for more details:
1. https://github.com/google/capsicum-test/pull/35
2. https://github.com/google/capsicum-test/pull/41
3. https://github.com/google/capsicum-test/pull/42
Reviewed by: asomers
Discussed with: emaste, markj
Approved by: emaste (mentor)
MFC after: 2 months
Differential Revision: https://reviews.freebsd.org/D19758
103 lines
2.6 KiB
C++
103 lines
2.6 KiB
C++
#include "capsicum-test.h"
|
|
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <signal.h>
|
|
|
|
#include <map>
|
|
#include <vector>
|
|
#include <string>
|
|
|
|
bool verbose = false;
|
|
bool tmpdir_on_tmpfs = false;
|
|
bool force_mt = false;
|
|
bool force_nofork = false;
|
|
uid_t other_uid = 0;
|
|
|
|
namespace {
|
|
std::map<std::string, std::string> tmp_paths;
|
|
}
|
|
|
|
const char *TmpFile(const char *p) {
|
|
std::string pathname(p);
|
|
if (tmp_paths.find(pathname) == tmp_paths.end()) {
|
|
std::string fullname = tmpdir + "/" + pathname;
|
|
tmp_paths[pathname] = fullname;
|
|
}
|
|
return tmp_paths[pathname].c_str();
|
|
}
|
|
|
|
char ProcessState(int pid) {
|
|
#ifdef __linux__
|
|
// Open the process status file.
|
|
char s[1024];
|
|
snprintf(s, sizeof(s), "/proc/%d/status", pid);
|
|
FILE *f = fopen(s, "r");
|
|
if (f == NULL) return '\0';
|
|
|
|
// Read the file line by line looking for the state line.
|
|
const char *prompt = "State:\t";
|
|
while (!feof(f)) {
|
|
fgets(s, sizeof(s), f);
|
|
if (!strncmp(s, prompt, strlen(prompt))) {
|
|
fclose(f);
|
|
return s[strlen(prompt)];
|
|
}
|
|
}
|
|
fclose(f);
|
|
return '?';
|
|
#endif
|
|
#ifdef __FreeBSD__
|
|
char buffer[1024];
|
|
snprintf(buffer, sizeof(buffer), "ps -p %d -o state | grep -v STAT", pid);
|
|
sig_t original = signal(SIGCHLD, SIG_IGN);
|
|
FILE* cmd = popen(buffer, "r");
|
|
usleep(50000); // allow any pending SIGCHLD signals to arrive
|
|
signal(SIGCHLD, original);
|
|
int result = fgetc(cmd);
|
|
fclose(cmd);
|
|
// Map FreeBSD codes to Linux codes.
|
|
switch (result) {
|
|
case EOF:
|
|
return '\0';
|
|
case 'D': // disk wait
|
|
case 'R': // runnable
|
|
case 'S': // sleeping
|
|
case 'T': // stopped
|
|
case 'Z': // zombie
|
|
return result;
|
|
case 'W': // idle interrupt thread
|
|
return 'S';
|
|
case 'I': // idle
|
|
return 'S';
|
|
case 'L': // waiting to acquire lock
|
|
default:
|
|
return '?';
|
|
}
|
|
#endif
|
|
}
|
|
|
|
typedef std::vector<std::string> TestList;
|
|
typedef std::map<std::string, TestList*> SkippedTestMap;
|
|
static SkippedTestMap skipped_tests;
|
|
void TestSkipped(const char *testcase, const char *test, const std::string& reason) {
|
|
if (skipped_tests.find(reason) == skipped_tests.end()) {
|
|
skipped_tests[reason] = new TestList;
|
|
}
|
|
std::string testname(testcase);
|
|
testname += ".";
|
|
testname += test;
|
|
skipped_tests[reason]->push_back(testname);
|
|
}
|
|
|
|
void ShowSkippedTests(std::ostream& os) {
|
|
for (SkippedTestMap::iterator skiplist = skipped_tests.begin();
|
|
skiplist != skipped_tests.end(); ++skiplist) {
|
|
os << "Following tests were skipped because: " << skiplist->first << std::endl;
|
|
for (size_t ii = 0; ii < skiplist->second->size(); ++ii) {
|
|
const std::string& testname((*skiplist->second)[ii]);
|
|
os << " " << testname << std::endl;
|
|
}
|
|
}
|
|
}
|