631df11d04
This change takes capsicum-test from upstream and applies some local changes to make the
tests work on FreeBSD when executed via Kyua.
The local modifications are as follows:
1. Make `OpenatTest.WithFlag` pass with the new dot-dot lookup behavior in FreeBSD 12.x+.
2. capsicum-test references a set of helper binaries: `mini-me`, `mini-me.noexec`, and
`mini-me.setuid`, as part of the execve/fexecve tests, via execve, fexecve, and open.
It achieves this upstream by assuming `mini-me*` is in the current directory, however,
in order for Kyua to execute `capsicum-test`, it needs to provide a full path to
`mini-me*`. In order to achieve this, I made `capsicum-test` cache the executable's
path from argv[0] in main(..) and use the cached value to compute the path to
`mini-me*` as part of the execve/fexecve testcases.
3. The capsicum-test test suite assumes that it's always being run on CAPABILITIES enabled
kernels. However, there's a chance that the test will be run on a host without a
CAPABILITIES enabled kernel, so we must check for the support before running the tests.
The way to achieve this is to add the relevant `feature_present("security_capabilities")`
check to SetupEnvironment::SetUp() and skip the tests when the support is not available.
While here, add a check for `kern.trap_enotcap` being enabled. As noted by markj@ in
https://github.com/google/capsicum-test/issues/23, this sysctl being enabled can trigger
non-deterministic failures. Therefore, the tests should be skipped if this sysctl is
enabled.
All local changes have been submitted to the capsicum-test project
(https://github.com/google/capsicum-test) and are in various stages of review.
Please see the following pull requests for more details:
1. https://github.com/google/capsicum-test/pull/35
2. https://github.com/google/capsicum-test/pull/41
3. https://github.com/google/capsicum-test/pull/42
Reviewed by: asomers
Discussed with: emaste, markj
Approved by: emaste (mentor)
MFC after: 2 months
Differential Revision: https://reviews.freebsd.org/D19758
100 lines
4.8 KiB
Python
Executable File
100 lines
4.8 KiB
Python
Executable File
#!/usr/bin/env python
|
|
import sys
|
|
import re
|
|
|
|
_values = { # 2-tuple => name
|
|
(0x0000000000000000, 0x0000000000000100) : 'TTYHOOK',
|
|
(0x0000000000000040, 0x0000000000000000) : 'CREATE',
|
|
(0x0000000200000000, 0x0000000000000000) : 'GETSOCKNAME',
|
|
(0x0000000000000000, 0x0000000000100000) : 'KQUEUE_CHANGE',
|
|
(0x0000000000000000, 0x0000000000004000) : 'EXTATTR_LIST',
|
|
(0x0000000000000080, 0x0000000000000000) : 'FEXECVE',
|
|
(0x0000001000000000, 0x0000000000000000) : 'PEELOFF',
|
|
(0x0000000000000000, 0x0000000000800000) : 'NOTIFY',
|
|
(0x0000000000000000, 0x0000000000001000) : 'EXTATTR_DELETE',
|
|
(0x0000000040000000, 0x0000000000000000) : 'BIND',
|
|
(0x0000000000000000, 0x0000000000002000) : 'EXTATTR_GET',
|
|
(0x0000000000008000, 0x0000000000000000) : 'FCNTL',
|
|
(0x0000000000000000, 0x0000000000400000) : 'EPOLL_CTL',
|
|
(0x0000000000000004, 0x0000000000000000) : 'SEEK_TELL',
|
|
(0x000000000000000c, 0x0000000000000000) : 'SEEK',
|
|
(0x0000004000000000, 0x0000000000000000) : 'SHUTDOWN',
|
|
(0x0000000000000000, 0x0000000000000080) : 'IOCTL',
|
|
(0x0000000000000000, 0x0000000000000020) : 'EVENT',
|
|
(0x0000000400000000, 0x0000000000000000) : 'GETSOCKOPT',
|
|
(0x0000000080000000, 0x0000000000000000) : 'CONNECT',
|
|
(0x0000000000000000, 0x0000000000200000) : 'FSIGNAL',
|
|
(0x0000000000000000, 0x0000000000008000) : 'EXTATTR_SET',
|
|
(0x0000000000100000, 0x0000000000000000) : 'FSTATFS',
|
|
(0x0000000000040000, 0x0000000000000000) : 'FSCK',
|
|
(0x0000000000000000, 0x0000000000000800) : 'PDKILL_FREEBSD',
|
|
(0x0000000000000000, 0x0000000000000004) : 'SEM_GETVALUE',
|
|
(0x0000000000000000, 0x0000000000080000) : 'ACL_SET',
|
|
(0x0000000000200000, 0x0000000000000000) : 'FUTIMES',
|
|
(0x0000000000000200, 0x0000000000000000) : 'FTRUNCATE',
|
|
(0x0000000000000000, 0x0000000000000001) : 'MAC_GET',
|
|
(0x0000000000020000, 0x0000000000000000) : 'FPATHCONF',
|
|
(0x0000002000000000, 0x0000000000000000) : 'SETSOCKOPT',
|
|
(0x0000000000002000, 0x0000000000000000) : 'FCHMOD',
|
|
(0x0000000000000000, 0x0000000002000000) : 'PERFMON',
|
|
(0x0000000000004000, 0x0000000000000000) : 'FCHOWN',
|
|
(0x0000000000000400, 0x0000000000000000) : 'LOOKUP',
|
|
(0x0000000000400400, 0x0000000000000000) : 'LINKAT_TARGET',
|
|
(0x0000000000800400, 0x0000000000000000) : 'MKDIRAT',
|
|
(0x0000000001000400, 0x0000000000000000) : 'MKFIFOAT',
|
|
(0x0000000002000400, 0x0000000000000000) : 'MKNODAT',
|
|
(0x0000000004000400, 0x0000000000000000) : 'RENAMEAT_SOURCE',
|
|
(0x0000000008000400, 0x0000000000000000) : 'SYMLINKAT',
|
|
(0x0000000010000400, 0x0000000000000000) : 'UNLINKAT',
|
|
(0x0000008000000400, 0x0000000000000000) : 'BINDAT',
|
|
(0x0000010000000400, 0x0000000000000000) : 'CONNECTAT',
|
|
(0x0000020000000400, 0x0000000000000000) : 'LINKAT_SOURCE',
|
|
(0x0000040000000400, 0x0000000000000000) : 'RENAMEAT_TARGET',
|
|
(0x0000000000000010, 0x0000000000000000) : 'MMAP',
|
|
(0x000000000000003c, 0x0000000000000000) : 'MMAP_X',
|
|
(0x0000000000000000, 0x0000000001000000) : 'SETNS',
|
|
(0x0000000000080000, 0x0000000000000000) : 'FSTAT',
|
|
(0x0000000000000001, 0x0000000000000000) : 'READ',
|
|
(0x0000000000000000, 0x0000000000000008) : 'SEM_POST',
|
|
(0x0000000000000000, 0x0000000000020000) : 'ACL_DELETE',
|
|
(0x0000000000001000, 0x0000000000000000) : 'FCHFLAGS',
|
|
(0x0000000800000000, 0x0000000000000000) : 'LISTEN',
|
|
(0x0000000100000000, 0x0000000000000000) : 'GETPEERNAME',
|
|
(0x0000000000000100, 0x0000000000000000) : 'FSYNC',
|
|
(0x0000000000000000, 0x0000000004000000) : 'BPF',
|
|
(0x0000000020000000, 0x0000000000000000) : 'ACCEPT',
|
|
(0x0000000000000800, 0x0000000000000000) : 'FCHDIR',
|
|
(0x0000000000000002, 0x0000000000000000) : 'WRITE',
|
|
(0x0000000000000000, 0x0000000000000010) : 'SEM_WAIT',
|
|
(0x0000000000000000, 0x0000000000000040) : 'KQUEUE_EVENT',
|
|
(0x0000000000000000, 0x0000000000000400) : 'PDWAIT',
|
|
(0x0000000000000000, 0x0000000000040000) : 'ACL_GET',
|
|
(0x0000000000010000, 0x0000000000000000) : 'FLOCK',
|
|
(0x0000000000000000, 0x0000000000010000) : 'ACL_CHECK',
|
|
(0x0000000000000000, 0x0000000000000002) : 'MAC_SET',
|
|
(0x0000000000000000, 0x0000000000000200) : 'PDGETPID_FREEBSD',
|
|
}
|
|
|
|
|
|
def _map_fdinfo(line):
|
|
RIGHTS_RE = re.compile(r'(?P<prefix>.*)rights:(?P<ws>\s+)0x(?P<v0>[0-9a-fA-F]+)\s+0x(?P<v1>[0-9a-fA-F]+)$')
|
|
m = RIGHTS_RE.match(line)
|
|
if m:
|
|
val0 = long(m.group('v0'), 16)
|
|
val0 = (val0 & ~(0x0200000000000000L))
|
|
val1 = long(m.group('v1'), 16)
|
|
val1 = (val1 & ~(0x0400000000000000L))
|
|
rights = []
|
|
for (right, name) in _values.items():
|
|
if ((right[0] == 0 or (val0 & right[0])) and
|
|
(right[1] == 0 or (val1 & right[1]))):
|
|
rights.append(name)
|
|
return "%srights:%s%s" % (m.group('prefix'), m.group('ws'), '|'.join(rights))
|
|
else:
|
|
return line.rstrip()
|
|
|
|
if __name__ == "__main__":
|
|
infile = open(sys.argv[1], 'r') if len(sys.argv) > 1 else sys.stdin
|
|
for line in infile.readlines():
|
|
print _map_fdinfo(line)
|