Page MenuHomeFreeBSD
Differential D16855

Fix temperature reporting on AMD 2990WX
ClosedPublic
Actions

Authored by gallatin on Aug 23 2018, 12:06 AM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Mar 30, 1:21 PM
Unknown Object (File)
Sun, Mar 30, 12:21 PM
Unknown Object (File)
Mar 5 2025, 5:52 PM
Unknown Object (File)
Mar 4 2025, 8:06 PM
Unknown Object (File)
Feb 27 2025, 10:32 PM
Unknown Object (File)
Feb 21 2025, 6:44 PM
Unknown Object (File)
Feb 18 2025, 11:09 PM
Unknown Object (File)
Feb 10 2025, 9:29 PM
View All 90 Files
Subscribers
imp

Details

Reviewers
cem
avg
Commits
rS340447: MFC r340426 (by cem)
rS340426: amdtemp(4): Fix temperature reporting on AMD 2990WX
Summary

Update the AMD family 17h temperature reporting based on AMD Tech Doc 56255 OSRR, section 4.2.1:

  • For CPUS w/CUR_TEMP_RANGE_SEL set, scale the reported temp in the range -49..206, eg, subtract 49C

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 19184

Event Timeline

gallatin created this revision.Aug 23 2018, 12:06 AM
Herald added a subscriber: imp. · View Herald TranscriptAug 23 2018, 12:06 AM
Harbormaster completed remote builds in B19077: Diff 47144.Aug 23 2018, 12:06 AM
cem added a reviewer: avg.Aug 23 2018, 12:37 AM

Change looks functionally correct to me. Some style-y nitpicks below:

sys/dev/amdtemp/amdtemp.c
143–147

I'd move these definitions to be up by AMDTEMP_17H_CUR_TMP.

FWIW, the PPR calls the register THM_TCON_CUR_TMP, the high 11 bits "CUR_TEMP," and bit 19 "CUR_TEMP_RANGE_SEL."

I'd suggest expanding the comment. The doc for the RANGE_SEL bit says "0=Report on 0C to 225C scale range. 1=Report on -49C to 206C scale range." I suspect the 225C is a typo for 255C.

The other bits in this register related to something called slewing and "Enable MCM for THM" (multi-chip module? Not sure what that does).

There are some nearby registers related to thermal temp limit and whether that has been tripped, but I don't think they really relate to this driver. It still might be interesting to display them (off-topic for this change).

gallatin added a comment.Aug 23 2018, 2:22 PM

Thank you so much for the pointer to the docs!!! It is much nicer to write from real docs, rather than crib from undocumented changes in another project.

Looking at the docs, it says that the range of CUR_TEMP is: 0..225C when CUR_TEMP_RANGE_SEL is not set, and -49C ... 206C when it is. So, based on my reading of the docs, our current scaling is wrong, since it does not scale from 0..225, but from 0..255. Eg, with our current scaling, max possible value, 0x7ff, would result in a temp of 255 not 225. So I've updated the scaling to reflect this. Interestingly, when bit 19 is set, the range is again 256 wide, so we can use the old scaling there.

gallatin updated this revision to Diff 47170.Aug 23 2018, 2:29 PM
gallatin edited the summary of this revision. (Show Details)
Harbormaster completed remote builds in B19098: Diff 47170.Aug 23 2018, 2:29 PM
cem added a comment.Aug 23 2018, 4:47 PM
In D16855#359181, @gallatin wrote:

Thank you so much for the pointer to the docs!!! It is much nicer to write from real docs, rather than crib from undocumented changes in another project.

Agreed!

Looking at the docs, it says that the range of CUR_TEMP is: 0..225C when CUR_TEMP_RANGE_SEL is not set, and -49C ... 206C when it is.

Yeah, like I said earlier, I think that's a pretty clear typo for 255C. The temperature scale does not change between the modes and 206+49=255.

So, based on my reading of the docs, our current scaling is wrong, since it does not scale from 0..225, but from 0..255. Eg, with our current scaling, max possible value, 0x7ff, would result in a temp of 255 not 225. So I've updated the scaling to reflect this. Interestingly, when bit 19 is set, the range is again 256 wide, so we can use the old scaling there.

I don't believe this is correct.

cem requested changes to this revision.EditedAug 23 2018, 5:12 PM
In D16855#359281, @cem wrote:

Yeah, like I said earlier, I think that's a pretty clear typo for 255C. The temperature scale does not change between the modes and 206+49=255.

The right document for the temperature sensor is SB-TSI (40821), which you may note is dated 2010 and has not changed from earlier sensors (i.e., amdtemp_gettemp directly above uses the same math).

§ 2.6 SB-TSI Temperature and Threshold Encodings:

SB-TSI CPU temperature readings and limit registers encode the temperature in increments of 0.125 from 0 to 255.875.

Essentially the encoding is: one byte (8 bits) for the integer portion of the value, and the remaining 3 bits specify the fractional temperature in increments of 1/8 °C.

This revision now requires changes to proceed.Aug 23 2018, 5:12 PM
gallatin updated this revision to Diff 47194.Aug 23 2018, 6:18 PM
gallatin edited the summary of this revision. (Show Details)
Harbormaster completed remote builds in B19112: Diff 47194.Aug 23 2018, 6:18 PM
gallatin added a comment.Aug 23 2018, 6:19 PM

Thanks for the clarification on the non-offset range!

cem added a comment.Aug 25 2018, 9:47 PM

Thanks! Mostly looks good to me. A few quibbles:

sys/dev/amdtemp/amdtemp.c
115–118

Sentences should end in a period.

I don't love the explanation of the range select bit but it's fine.

608–610

Why add excess parentheses?

610

Does this calculation work without producing a warning (the negative value 490 is treated as an unsigned value)? I'd just use -= and positive 490.

gallatin updated this revision to Diff 47299.Aug 25 2018, 11:09 PM
gallatin marked an inline comment as done.
Harbormaster completed remote builds in B19184: Diff 47299.Aug 25 2018, 11:09 PM
gallatin added inline comments.Aug 25 2018, 11:10 PM
sys/dev/amdtemp/amdtemp.c
608–610

typo, didn't notice in a plain text diff; removed

610

It compiled just fine, without warnings.

I would have preferred -= with a positive 490 as well, but I was trying to be consistent with the sc->offset. Since we both prefer it the other way around, let's do it that way.

cem accepted this revision.Aug 26 2018, 1:30 AM

Perfect, looks great to me! Thanks for adding this.

This revision is now accepted and ready to land.Aug 26 2018, 1:30 AM
Closed by commit rS340426: amdtemp(4): Fix temperature reporting on AMD 2990WX (authored by cem). · Explain WhyNov 14 2018, 4:50 AM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathSize
sys/
dev/
amdtemp/
18 lines

Diff 47299

View Options

sys/dev/amdtemp/amdtemp.c

Show First 20 Lines • Show All 44 Lines • ▼ Show 20 Lines
#include <errno.h> #include <errno.h>
#include <netdb.h> #include <netdb.h>
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
#include <unistd.h> #include <unistd.h>
#include <libcasper.h> #include <libcasper.h>
#include <casper/cap_sysctl.h> #include <casper/cap_sysctl.h>
#include <atf-c.h>
/* /*
* We need some sysctls to perform the tests on. * We need some sysctls to perform the tests on.
* We remember their values and restore them afer the test is done. * We remember their values and restore them afer the test is done.
*/ */
#define SYSCTL0_PARENT "kern" #define SYSCTL0_PARENT "kern"
#define SYSCTL0_NAME "kern.sync_on_panic" #define SYSCTL0_NAME "kern.sync_on_panic"
#define SYSCTL0_FILE "./sysctl0"
#define SYSCTL1_PARENT "debug" #define SYSCTL1_PARENT "debug"
#define SYSCTL1_NAME "debug.minidump" #define SYSCTL1_NAME "debug.minidump"
#define SYSCTL1_FILE "./sysctl1"
static int ntest = 1;
#define CHECK(expr) do { \
if ((expr)) \
printf("ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
else \
printf("not ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
fflush(stdout); \
ntest++; \
} while (0)
#define CHECKX(expr) do { \
if ((expr)) { \
printf("ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
} else { \
printf("not ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
exit(1); \
} \
fflush(stdout); \
ntest++; \
} while (0)
#define SYSCTL0_READ0 0x0001 #define SYSCTL0_READ0 0x0001
#define SYSCTL0_READ1 0x0002 #define SYSCTL0_READ1 0x0002
#define SYSCTL0_READ2 0x0004 #define SYSCTL0_READ2 0x0004
#define SYSCTL0_WRITE 0x0008 #define SYSCTL0_WRITE 0x0008
#define SYSCTL0_READ_WRITE 0x0010 #define SYSCTL0_READ_WRITE 0x0010
#define SYSCTL1_READ0 0x0020 #define SYSCTL1_READ0 0x0020
#define SYSCTL1_READ1 0x0040 #define SYSCTL1_READ1 0x0040
#define SYSCTL1_READ2 0x0080 #define SYSCTL1_READ2 0x0080
#define SYSCTL1_WRITE 0x0100 #define SYSCTL1_WRITE 0x0100
#define SYSCTL1_READ_WRITE 0x0200 #define SYSCTL1_READ_WRITE 0x0200
static void
save_int_sysctl(const char *name, const char *file)
{
ssize_t n;
size_t sz;
int error, fd, val;
sz = sizeof(val);
error = sysctlbyname(name, &val, &sz, NULL, 0);
ATF_REQUIRE_MSG(error == 0,
"sysctlbyname(%s): %s", name, strerror(errno));
fd = open(file, O_CREAT | O_WRONLY, 0600);
ATF_REQUIRE_MSG(fd >= 0, "open(%s): %s", file, strerror(errno));
n = write(fd, &val, sz);
ATF_REQUIRE(n >= 0 && (size_t)n == sz);
error = close(fd);
ATF_REQUIRE(error == 0);
}
static void
restore_int_sysctl(const char *name, const char *file)
{
ssize_t n;
size_t sz;
int error, fd, val;
fd = open(file, O_RDONLY);
ATF_REQUIRE(fd >= 0);
sz = sizeof(val);
n = read(fd, &val, sz);
ATF_REQUIRE(n >= 0 && (size_t)n == sz);
error = unlink(file);
ATF_REQUIRE(error == 0);
error = close(fd);
ATF_REQUIRE(error == 0);
error = sysctlbyname(name, NULL, NULL, &val, sz);
ATF_REQUIRE_MSG(error == 0,
"sysctlbyname(%s): %s", name, strerror(errno));
}
static cap_channel_t *
initcap(void)
{
cap_channel_t *capcas, *capsysctl;
save_int_sysctl(SYSCTL0_NAME, SYSCTL0_FILE);
save_int_sysctl(SYSCTL1_NAME, SYSCTL1_FILE);
capcas = cap_init();
ATF_REQUIRE(capcas != NULL);
capsysctl = cap_service_open(capcas, "system.sysctl");
ATF_REQUIRE(capsysctl != NULL);
cap_close(capcas);
return (capsysctl);
}
static void
cleanup(void)
{
restore_int_sysctl(SYSCTL0_NAME, SYSCTL0_FILE);
restore_int_sysctl(SYSCTL1_NAME, SYSCTL1_FILE);
}
static unsigned int static unsigned int
runtest(cap_channel_t *capsysctl) checkcaps(cap_channel_t *capsysctl)
{ {
unsigned int result; unsigned int result;
int oldvalue, newvalue; int oldvalue, newvalue;
size_t oldsize; size_t oldsize;
result = 0; result = 0;
oldsize = sizeof(oldvalue); oldsize = sizeof(oldvalue);
▲ Show 20 Lines • Show All 72 Lines • ▼ Show 20 Lines if (cap_sysctlbyname(capsysctl, SYSCTL1_NAME, &oldvalue,
if (oldsize == sizeof(oldvalue) && oldvalue == 7008) if (oldsize == sizeof(oldvalue) && oldvalue == 7008)
result |= SYSCTL1_READ2; result |= SYSCTL1_READ2;
} }
} }
return (result); return (result);
} }
static void ATF_TC_WITH_CLEANUP(cap_sysctl__operation);
test_operation(cap_channel_t *origcapsysctl) ATF_TC_HEAD(cap_sysctl__operation, tc)
{ {
cap_channel_t *capsysctl; }
ATF_TC_BODY(cap_sysctl__operation, tc)
{
cap_channel_t *capsysctl, *ocapsysctl;
void *limit; void *limit;
ocapsysctl = initcap();
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR/RECURSIVE * SYSCTL0_PARENT/RDWR/RECURSIVE
* SYSCTL1_PARENT/RDWR/RECURSIVE * SYSCTL1_PARENT/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, "foo.bar", (void)cap_sysctl_limit_name(limit, "foo.bar",
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, "foo.bar", (void)cap_sysctl_limit_name(limit, "foo.bar",
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == SYSCTL0_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL0_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/RDWR/RECURSIVE * SYSCTL0_NAME/RDWR/RECURSIVE
* SYSCTL1_NAME/RDWR/RECURSIVE * SYSCTL1_NAME/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR * SYSCTL0_PARENT/RDWR
* SYSCTL1_PARENT/RDWR * SYSCTL1_PARENT/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/RDWR * SYSCTL0_NAME/RDWR
* SYSCTL1_NAME/RDWR * SYSCTL1_NAME/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR * SYSCTL0_PARENT/RDWR
* SYSCTL1_PARENT/RDWR/RECURSIVE * SYSCTL1_PARENT/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 |
SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE)); SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/RDWR * SYSCTL0_NAME/RDWR
* SYSCTL1_NAME/RDWR/RECURSIVE * SYSCTL1_NAME/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ/RECURSIVE * SYSCTL0_PARENT/READ/RECURSIVE
* SYSCTL1_PARENT/READ/RECURSIVE * SYSCTL1_PARENT/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ/RECURSIVE * SYSCTL0_NAME/READ/RECURSIVE
* SYSCTL1_NAME/READ/RECURSIVE * SYSCTL1_NAME/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/READ * SYSCTL1_PARENT/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/READ * SYSCTL1_NAME/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/READ/RECURSIVE * SYSCTL1_PARENT/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/READ/RECURSIVE * SYSCTL1_NAME/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE/RECURSIVE * SYSCTL0_PARENT/WRITE/RECURSIVE
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/WRITE/RECURSIVE * SYSCTL0_NAME/WRITE/RECURSIVE
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE * SYSCTL0_PARENT/WRITE
* SYSCTL1_PARENT/WRITE * SYSCTL1_PARENT/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/WRITE * SYSCTL0_NAME/WRITE
* SYSCTL1_NAME/WRITE * SYSCTL1_NAME/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE * SYSCTL0_PARENT/WRITE
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/WRITE * SYSCTL0_NAME/WRITE
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ/RECURSIVE * SYSCTL0_PARENT/READ/RECURSIVE
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ/RECURSIVE * SYSCTL0_NAME/READ/RECURSIVE
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/WRITE * SYSCTL1_PARENT/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/WRITE * SYSCTL1_NAME/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
} }
ATF_TC_CLEANUP(cap_sysctl__operation, tc)
{
cleanup();
}
static void ATF_TC_WITH_CLEANUP(cap_sysctl__names);
test_names(cap_channel_t *origcapsysctl) ATF_TC_HEAD(cap_sysctl__names, tc)
{ {
cap_channel_t *capsysctl; }
ATF_TC_BODY(cap_sysctl__names, tc)
{
cap_channel_t *capsysctl, *ocapsysctl;
void *limit; void *limit;
ocapsysctl = initcap();
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ/RECURSIVE * SYSCTL0_PARENT/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL0_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL0_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/READ/RECURSIVE * SYSCTL1_NAME/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE/RECURSIVE * SYSCTL0_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL0_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL0_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR/RECURSIVE * SYSCTL0_PARENT/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE)); SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/RDWR/RECURSIVE * SYSCTL1_NAME/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 |
SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE)); SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/READ * SYSCTL1_NAME/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE * SYSCTL0_PARENT/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/WRITE * SYSCTL1_NAME/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR * SYSCTL0_PARENT/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/RDWR * SYSCTL1_NAME/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 |
SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE)); SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
} }
ATF_TC_CLEANUP(cap_sysctl__names, tc)
{
cleanup();
}
int ATF_TC_WITH_CLEANUP(cap_sysctl__no_limits);
main(void) ATF_TC_HEAD(cap_sysctl__no_limits, tc)
{ {
cap_channel_t *capcas, *capsysctl; }
int scvalue0, scvalue1; ATF_TC_BODY(cap_sysctl__no_limits, tc)
size_t scsize; {
cap_channel_t *capsysctl;
printf("1..256\n"); capsysctl = initcap();
fflush(stdout);
scsize = sizeof(scvalue0); ATF_REQUIRE_EQ(checkcaps(capsysctl), (SYSCTL0_READ0 | SYSCTL0_READ1 |
CHECKX(sysctlbyname(SYSCTL0_NAME, &scvalue0, &scsize, NULL, 0) == 0);
CHECKX(scsize == sizeof(scvalue0));
scsize = sizeof(scvalue1);
CHECKX(sysctlbyname(SYSCTL1_NAME, &scvalue1, &scsize, NULL, 0) == 0);
CHECKX(scsize == sizeof(scvalue1));
capcas = cap_init();
CHECKX(capcas != NULL);
capsysctl = cap_service_open(capcas, "system.sysctl");
CHECKX(capsysctl != NULL);
cap_close(capcas);
/* No limits set. */
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
}
ATF_TC_CLEANUP(cap_sysctl__no_limits, tc)
{
cleanup();
}
test_operation(capsysctl); ATF_TP_ADD_TCS(tp)
{
ATF_TP_ADD_TC(tp, cap_sysctl__operation);
ATF_TP_ADD_TC(tp, cap_sysctl__names);
ATF_TP_ADD_TC(tp, cap_sysctl__no_limits);
test_names(capsysctl); return (atf_no_error());
cap_close(capsysctl);
CHECK(sysctlbyname(SYSCTL0_NAME, NULL, NULL, &scvalue0,
sizeof(scvalue0)) == 0);
CHECK(sysctlbyname(SYSCTL1_NAME, NULL, NULL, &scvalue1,
sizeof(scvalue1)) == 0);
exit(0);
} }