Page MenuHomeFreeBSD
Differential D23313

lang/erlang*: bump patch versions to include serious scheduler bugfix
ClosedPublic
Actions

Authored by dch on Jan 22 2020, 10:21 AM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Mar 28, 3:42 PM
Unknown Object (File)
Feb 27 2025, 8:14 AM
Unknown Object (File)
Feb 27 2025, 12:44 AM
Unknown Object (File)
Feb 26 2025, 9:48 PM
Unknown Object (File)
Feb 26 2025, 6:54 PM
Unknown Object (File)
Feb 26 2025, 3:32 AM
Unknown Object (File)
Feb 25 2025, 11:54 PM
Unknown Object (File)
Feb 25 2025, 10:56 PM
View All Files
Subscribers
None

Details

Reviewers
None
Commits
rP523923: lang/erlang*: include serious scheduler bugfixes

Diff Detail

Lint
No Lint Coverage
Unit
No Test Coverage
Build Status
Buildable 28871
Build 26874: arc lint + arc unit

Event Timeline

dch created this revision.Jan 22 2020, 10:21 AM
Harbormaster completed remote builds in B28841: Diff 67140.Jan 22 2020, 10:21 AM
dch updated this revision to Diff 67169.Jan 22 2020, 10:58 PM

include wx & java bumps

Harbormaster completed remote builds in B28863: Diff 67169.Jan 22 2020, 10:58 PM
dch updated this revision to Diff 67172.Jan 23 2020, 12:51 AM

update java distinfo

Harbormaster completed remote builds in B28865: Diff 67172.Jan 23 2020, 12:51 AM
dch updated this revision to Diff 67173.Jan 23 2020, 12:53 AM

add more distinfos

Harbormaster completed remote builds in B28866: Diff 67173.Jan 23 2020, 12:53 AM
dch updated this revision to Diff 67195.Jan 23 2020, 11:37 AM

fix jinterface app version

Harbormaster completed remote builds in B28871: Diff 67195.Jan 23 2020, 11:37 AM
This revision was not accepted when it landed; it landed in state Needs Review.Jan 23 2020, 11:59 AM
Closed by commit rP523923: lang/erlang*: include serious scheduler bugfixes (authored by dch). · Explain Why
This revision was automatically updated to reflect the committed changes.
dch added a commit: rP523923: lang/erlang*: include serious scheduler bugfixes.
dch mentioned this in rP524181: MFH: r523921 r523923.Jan 26 2020, 3:36 PM

Revision Contents
Changeset List

PathSize
lang/
erlang-java/
2 lines
6 lines
erlang-man/
2 lines
2 lines
erlang-runtime20/
2 lines
6 lines
erlang-runtime21/
2 lines
6 lines
erlang-runtime22/
2 lines
6 lines
erlang-wx/
3 lines
6 lines
erlang/
2 lines
6 lines

Diff 67195

View Options

lang/erlang-java/Makefile

Show First 20 Lines • Show All 44 Lines • ▼ Show 20 Lines
#include <errno.h> #include <errno.h>
#include <netdb.h> #include <netdb.h>
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
#include <unistd.h> #include <unistd.h>
#include <libcasper.h> #include <libcasper.h>
#include <casper/cap_sysctl.h> #include <casper/cap_sysctl.h>
#include <atf-c.h>
/* /*
* We need some sysctls to perform the tests on. * We need some sysctls to perform the tests on.
* We remember their values and restore them afer the test is done. * We remember their values and restore them afer the test is done.
*/ */
#define SYSCTL0_PARENT "kern" #define SYSCTL0_PARENT "kern"
#define SYSCTL0_NAME "kern.sync_on_panic" #define SYSCTL0_NAME "kern.sync_on_panic"
#define SYSCTL0_FILE "./sysctl0"
#define SYSCTL1_PARENT "debug" #define SYSCTL1_PARENT "debug"
#define SYSCTL1_NAME "debug.minidump" #define SYSCTL1_NAME "debug.minidump"
#define SYSCTL1_FILE "./sysctl1"
static int ntest = 1;
#define CHECK(expr) do { \
if ((expr)) \
printf("ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
else \
printf("not ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
fflush(stdout); \
ntest++; \
} while (0)
#define CHECKX(expr) do { \
if ((expr)) { \
printf("ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
} else { \
printf("not ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
exit(1); \
} \
fflush(stdout); \
ntest++; \
} while (0)
#define SYSCTL0_READ0 0x0001 #define SYSCTL0_READ0 0x0001
#define SYSCTL0_READ1 0x0002 #define SYSCTL0_READ1 0x0002
#define SYSCTL0_READ2 0x0004 #define SYSCTL0_READ2 0x0004
#define SYSCTL0_WRITE 0x0008 #define SYSCTL0_WRITE 0x0008
#define SYSCTL0_READ_WRITE 0x0010 #define SYSCTL0_READ_WRITE 0x0010
#define SYSCTL1_READ0 0x0020 #define SYSCTL1_READ0 0x0020
#define SYSCTL1_READ1 0x0040 #define SYSCTL1_READ1 0x0040
#define SYSCTL1_READ2 0x0080 #define SYSCTL1_READ2 0x0080
#define SYSCTL1_WRITE 0x0100 #define SYSCTL1_WRITE 0x0100
#define SYSCTL1_READ_WRITE 0x0200 #define SYSCTL1_READ_WRITE 0x0200
static void
save_int_sysctl(const char *name, const char *file)
{
ssize_t n;
size_t sz;
int error, fd, val;
sz = sizeof(val);
error = sysctlbyname(name, &val, &sz, NULL, 0);
ATF_REQUIRE_MSG(error == 0,
"sysctlbyname(%s): %s", name, strerror(errno));
fd = open(file, O_CREAT | O_WRONLY, 0600);
ATF_REQUIRE_MSG(fd >= 0, "open(%s): %s", file, strerror(errno));
n = write(fd, &val, sz);
ATF_REQUIRE(n >= 0 && (size_t)n == sz);
error = close(fd);
ATF_REQUIRE(error == 0);
}
static void
restore_int_sysctl(const char *name, const char *file)
{
ssize_t n;
size_t sz;
int error, fd, val;
fd = open(file, O_RDONLY);
ATF_REQUIRE(fd >= 0);
sz = sizeof(val);
n = read(fd, &val, sz);
ATF_REQUIRE(n >= 0 && (size_t)n == sz);
error = unlink(file);
ATF_REQUIRE(error == 0);
error = close(fd);
ATF_REQUIRE(error == 0);
error = sysctlbyname(name, NULL, NULL, &val, sz);
ATF_REQUIRE_MSG(error == 0,
"sysctlbyname(%s): %s", name, strerror(errno));
}
static cap_channel_t *
initcap(void)
{
cap_channel_t *capcas, *capsysctl;
save_int_sysctl(SYSCTL0_NAME, SYSCTL0_FILE);
save_int_sysctl(SYSCTL1_NAME, SYSCTL1_FILE);
capcas = cap_init();
ATF_REQUIRE(capcas != NULL);
capsysctl = cap_service_open(capcas, "system.sysctl");
ATF_REQUIRE(capsysctl != NULL);
cap_close(capcas);
return (capsysctl);
}
static void
cleanup(void)
{
restore_int_sysctl(SYSCTL0_NAME, SYSCTL0_FILE);
restore_int_sysctl(SYSCTL1_NAME, SYSCTL1_FILE);
}
static unsigned int static unsigned int
runtest(cap_channel_t *capsysctl) checkcaps(cap_channel_t *capsysctl)
{ {
unsigned int result; unsigned int result;
int oldvalue, newvalue; int oldvalue, newvalue;
size_t oldsize; size_t oldsize;
result = 0; result = 0;
oldsize = sizeof(oldvalue); oldsize = sizeof(oldvalue);
▲ Show 20 Lines • Show All 72 Lines • ▼ Show 20 Lines if (cap_sysctlbyname(capsysctl, SYSCTL1_NAME, &oldvalue,
if (oldsize == sizeof(oldvalue) && oldvalue == 7008) if (oldsize == sizeof(oldvalue) && oldvalue == 7008)
result |= SYSCTL1_READ2; result |= SYSCTL1_READ2;
} }
} }
return (result); return (result);
} }
static void ATF_TC_WITH_CLEANUP(cap_sysctl__operation);
test_operation(cap_channel_t *origcapsysctl) ATF_TC_HEAD(cap_sysctl__operation, tc)
{ {
cap_channel_t *capsysctl; }
ATF_TC_BODY(cap_sysctl__operation, tc)
{
cap_channel_t *capsysctl, *ocapsysctl;
void *limit; void *limit;
ocapsysctl = initcap();
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR/RECURSIVE * SYSCTL0_PARENT/RDWR/RECURSIVE
* SYSCTL1_PARENT/RDWR/RECURSIVE * SYSCTL1_PARENT/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, "foo.bar", (void)cap_sysctl_limit_name(limit, "foo.bar",
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, "foo.bar", (void)cap_sysctl_limit_name(limit, "foo.bar",
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == SYSCTL0_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL0_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/RDWR/RECURSIVE * SYSCTL0_NAME/RDWR/RECURSIVE
* SYSCTL1_NAME/RDWR/RECURSIVE * SYSCTL1_NAME/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR * SYSCTL0_PARENT/RDWR
* SYSCTL1_PARENT/RDWR * SYSCTL1_PARENT/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/RDWR * SYSCTL0_NAME/RDWR
* SYSCTL1_NAME/RDWR * SYSCTL1_NAME/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR * SYSCTL0_PARENT/RDWR
* SYSCTL1_PARENT/RDWR/RECURSIVE * SYSCTL1_PARENT/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 |
SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE)); SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/RDWR * SYSCTL0_NAME/RDWR
* SYSCTL1_NAME/RDWR/RECURSIVE * SYSCTL1_NAME/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ/RECURSIVE * SYSCTL0_PARENT/READ/RECURSIVE
* SYSCTL1_PARENT/READ/RECURSIVE * SYSCTL1_PARENT/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ/RECURSIVE * SYSCTL0_NAME/READ/RECURSIVE
* SYSCTL1_NAME/READ/RECURSIVE * SYSCTL1_NAME/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/READ * SYSCTL1_PARENT/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/READ * SYSCTL1_NAME/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/READ/RECURSIVE * SYSCTL1_PARENT/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/READ/RECURSIVE * SYSCTL1_NAME/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE/RECURSIVE * SYSCTL0_PARENT/WRITE/RECURSIVE
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/WRITE/RECURSIVE * SYSCTL0_NAME/WRITE/RECURSIVE
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE * SYSCTL0_PARENT/WRITE
* SYSCTL1_PARENT/WRITE * SYSCTL1_PARENT/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/WRITE * SYSCTL0_NAME/WRITE
* SYSCTL1_NAME/WRITE * SYSCTL1_NAME/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE * SYSCTL0_PARENT/WRITE
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/WRITE * SYSCTL0_NAME/WRITE
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ/RECURSIVE * SYSCTL0_PARENT/READ/RECURSIVE
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ/RECURSIVE * SYSCTL0_NAME/READ/RECURSIVE
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/WRITE * SYSCTL1_PARENT/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/WRITE * SYSCTL1_NAME/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
} }
ATF_TC_CLEANUP(cap_sysctl__operation, tc)
{
cleanup();
}
static void ATF_TC_WITH_CLEANUP(cap_sysctl__names);
test_names(cap_channel_t *origcapsysctl) ATF_TC_HEAD(cap_sysctl__names, tc)
{ {
cap_channel_t *capsysctl; }
ATF_TC_BODY(cap_sysctl__names, tc)
{
cap_channel_t *capsysctl, *ocapsysctl;
void *limit; void *limit;
ocapsysctl = initcap();
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ/RECURSIVE * SYSCTL0_PARENT/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL0_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL0_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/READ/RECURSIVE * SYSCTL1_NAME/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE/RECURSIVE * SYSCTL0_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL0_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL0_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR/RECURSIVE * SYSCTL0_PARENT/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE)); SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/RDWR/RECURSIVE * SYSCTL1_NAME/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 |
SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE)); SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/READ * SYSCTL1_NAME/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE * SYSCTL0_PARENT/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/WRITE * SYSCTL1_NAME/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR * SYSCTL0_PARENT/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/RDWR * SYSCTL1_NAME/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 |
SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE)); SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
} }
ATF_TC_CLEANUP(cap_sysctl__names, tc)
{
cleanup();
}
int ATF_TC_WITH_CLEANUP(cap_sysctl__no_limits);
main(void) ATF_TC_HEAD(cap_sysctl__no_limits, tc)
{ {
cap_channel_t *capcas, *capsysctl; }
int scvalue0, scvalue1; ATF_TC_BODY(cap_sysctl__no_limits, tc)
size_t scsize; {
cap_channel_t *capsysctl;
printf("1..256\n"); capsysctl = initcap();
fflush(stdout);
scsize = sizeof(scvalue0); ATF_REQUIRE_EQ(checkcaps(capsysctl), (SYSCTL0_READ0 | SYSCTL0_READ1 |
CHECKX(sysctlbyname(SYSCTL0_NAME, &scvalue0, &scsize, NULL, 0) == 0);
CHECKX(scsize == sizeof(scvalue0));
scsize = sizeof(scvalue1);
CHECKX(sysctlbyname(SYSCTL1_NAME, &scvalue1, &scsize, NULL, 0) == 0);
CHECKX(scsize == sizeof(scvalue1));
capcas = cap_init();
CHECKX(capcas != NULL);
capsysctl = cap_service_open(capcas, "system.sysctl");
CHECKX(capsysctl != NULL);
cap_close(capcas);
/* No limits set. */
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
}
ATF_TC_CLEANUP(cap_sysctl__no_limits, tc)
{
cleanup();
}
test_operation(capsysctl); ATF_TP_ADD_TCS(tp)
{
ATF_TP_ADD_TC(tp, cap_sysctl__operation);
ATF_TP_ADD_TC(tp, cap_sysctl__names);
ATF_TP_ADD_TC(tp, cap_sysctl__no_limits);
test_names(capsysctl); return (atf_no_error());
cap_close(capsysctl);
CHECK(sysctlbyname(SYSCTL0_NAME, NULL, NULL, &scvalue0,
sizeof(scvalue0)) == 0);
CHECK(sysctlbyname(SYSCTL1_NAME, NULL, NULL, &scvalue1,
sizeof(scvalue1)) == 0);
exit(0);
} }
View Options

lang/erlang-java/distinfo

Show First 20 Lines • Show All 44 Lines • ▼ Show 20 Lines
#include <errno.h> #include <errno.h>
#include <netdb.h> #include <netdb.h>
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
#include <unistd.h> #include <unistd.h>
#include <libcasper.h> #include <libcasper.h>
#include <casper/cap_sysctl.h> #include <casper/cap_sysctl.h>
#include <atf-c.h>
/* /*
* We need some sysctls to perform the tests on. * We need some sysctls to perform the tests on.
* We remember their values and restore them afer the test is done. * We remember their values and restore them afer the test is done.
*/ */
#define SYSCTL0_PARENT "kern" #define SYSCTL0_PARENT "kern"
#define SYSCTL0_NAME "kern.sync_on_panic" #define SYSCTL0_NAME "kern.sync_on_panic"
#define SYSCTL0_FILE "./sysctl0"
#define SYSCTL1_PARENT "debug" #define SYSCTL1_PARENT "debug"
#define SYSCTL1_NAME "debug.minidump" #define SYSCTL1_NAME "debug.minidump"
#define SYSCTL1_FILE "./sysctl1"
static int ntest = 1;
#define CHECK(expr) do { \
if ((expr)) \
printf("ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
else \
printf("not ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
fflush(stdout); \
ntest++; \
} while (0)
#define CHECKX(expr) do { \
if ((expr)) { \
printf("ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
} else { \
printf("not ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
exit(1); \
} \
fflush(stdout); \
ntest++; \
} while (0)
#define SYSCTL0_READ0 0x0001 #define SYSCTL0_READ0 0x0001
#define SYSCTL0_READ1 0x0002 #define SYSCTL0_READ1 0x0002
#define SYSCTL0_READ2 0x0004 #define SYSCTL0_READ2 0x0004
#define SYSCTL0_WRITE 0x0008 #define SYSCTL0_WRITE 0x0008
#define SYSCTL0_READ_WRITE 0x0010 #define SYSCTL0_READ_WRITE 0x0010
#define SYSCTL1_READ0 0x0020 #define SYSCTL1_READ0 0x0020
#define SYSCTL1_READ1 0x0040 #define SYSCTL1_READ1 0x0040
#define SYSCTL1_READ2 0x0080 #define SYSCTL1_READ2 0x0080
#define SYSCTL1_WRITE 0x0100 #define SYSCTL1_WRITE 0x0100
#define SYSCTL1_READ_WRITE 0x0200 #define SYSCTL1_READ_WRITE 0x0200
static void
save_int_sysctl(const char *name, const char *file)
{
ssize_t n;
size_t sz;
int error, fd, val;
sz = sizeof(val);
error = sysctlbyname(name, &val, &sz, NULL, 0);
ATF_REQUIRE_MSG(error == 0,
"sysctlbyname(%s): %s", name, strerror(errno));
fd = open(file, O_CREAT | O_WRONLY, 0600);
ATF_REQUIRE_MSG(fd >= 0, "open(%s): %s", file, strerror(errno));
n = write(fd, &val, sz);
ATF_REQUIRE(n >= 0 && (size_t)n == sz);
error = close(fd);
ATF_REQUIRE(error == 0);
}
static void
restore_int_sysctl(const char *name, const char *file)
{
ssize_t n;
size_t sz;
int error, fd, val;
fd = open(file, O_RDONLY);
ATF_REQUIRE(fd >= 0);
sz = sizeof(val);
n = read(fd, &val, sz);
ATF_REQUIRE(n >= 0 && (size_t)n == sz);
error = unlink(file);
ATF_REQUIRE(error == 0);
error = close(fd);
ATF_REQUIRE(error == 0);
error = sysctlbyname(name, NULL, NULL, &val, sz);
ATF_REQUIRE_MSG(error == 0,
"sysctlbyname(%s): %s", name, strerror(errno));
}
static cap_channel_t *
initcap(void)
{
cap_channel_t *capcas, *capsysctl;
save_int_sysctl(SYSCTL0_NAME, SYSCTL0_FILE);
save_int_sysctl(SYSCTL1_NAME, SYSCTL1_FILE);
capcas = cap_init();
ATF_REQUIRE(capcas != NULL);
capsysctl = cap_service_open(capcas, "system.sysctl");
ATF_REQUIRE(capsysctl != NULL);
cap_close(capcas);
return (capsysctl);
}
static void
cleanup(void)
{
restore_int_sysctl(SYSCTL0_NAME, SYSCTL0_FILE);
restore_int_sysctl(SYSCTL1_NAME, SYSCTL1_FILE);
}
static unsigned int static unsigned int
runtest(cap_channel_t *capsysctl) checkcaps(cap_channel_t *capsysctl)
{ {
unsigned int result; unsigned int result;
int oldvalue, newvalue; int oldvalue, newvalue;
size_t oldsize; size_t oldsize;
result = 0; result = 0;
oldsize = sizeof(oldvalue); oldsize = sizeof(oldvalue);
▲ Show 20 Lines • Show All 72 Lines • ▼ Show 20 Lines if (cap_sysctlbyname(capsysctl, SYSCTL1_NAME, &oldvalue,
if (oldsize == sizeof(oldvalue) && oldvalue == 7008) if (oldsize == sizeof(oldvalue) && oldvalue == 7008)
result |= SYSCTL1_READ2; result |= SYSCTL1_READ2;
} }
} }
return (result); return (result);
} }
static void ATF_TC_WITH_CLEANUP(cap_sysctl__operation);
test_operation(cap_channel_t *origcapsysctl) ATF_TC_HEAD(cap_sysctl__operation, tc)
{ {
cap_channel_t *capsysctl; }
ATF_TC_BODY(cap_sysctl__operation, tc)
{
cap_channel_t *capsysctl, *ocapsysctl;
void *limit; void *limit;
ocapsysctl = initcap();
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR/RECURSIVE * SYSCTL0_PARENT/RDWR/RECURSIVE
* SYSCTL1_PARENT/RDWR/RECURSIVE * SYSCTL1_PARENT/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, "foo.bar", (void)cap_sysctl_limit_name(limit, "foo.bar",
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, "foo.bar", (void)cap_sysctl_limit_name(limit, "foo.bar",
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == SYSCTL0_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL0_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/RDWR/RECURSIVE * SYSCTL0_NAME/RDWR/RECURSIVE
* SYSCTL1_NAME/RDWR/RECURSIVE * SYSCTL1_NAME/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR * SYSCTL0_PARENT/RDWR
* SYSCTL1_PARENT/RDWR * SYSCTL1_PARENT/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/RDWR * SYSCTL0_NAME/RDWR
* SYSCTL1_NAME/RDWR * SYSCTL1_NAME/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR * SYSCTL0_PARENT/RDWR
* SYSCTL1_PARENT/RDWR/RECURSIVE * SYSCTL1_PARENT/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 |
SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE)); SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/RDWR * SYSCTL0_NAME/RDWR
* SYSCTL1_NAME/RDWR/RECURSIVE * SYSCTL1_NAME/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ/RECURSIVE * SYSCTL0_PARENT/READ/RECURSIVE
* SYSCTL1_PARENT/READ/RECURSIVE * SYSCTL1_PARENT/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ/RECURSIVE * SYSCTL0_NAME/READ/RECURSIVE
* SYSCTL1_NAME/READ/RECURSIVE * SYSCTL1_NAME/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/READ * SYSCTL1_PARENT/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/READ * SYSCTL1_NAME/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/READ/RECURSIVE * SYSCTL1_PARENT/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/READ/RECURSIVE * SYSCTL1_NAME/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE/RECURSIVE * SYSCTL0_PARENT/WRITE/RECURSIVE
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/WRITE/RECURSIVE * SYSCTL0_NAME/WRITE/RECURSIVE
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE * SYSCTL0_PARENT/WRITE
* SYSCTL1_PARENT/WRITE * SYSCTL1_PARENT/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/WRITE * SYSCTL0_NAME/WRITE
* SYSCTL1_NAME/WRITE * SYSCTL1_NAME/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE * SYSCTL0_PARENT/WRITE
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/WRITE * SYSCTL0_NAME/WRITE
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ/RECURSIVE * SYSCTL0_PARENT/READ/RECURSIVE
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ/RECURSIVE * SYSCTL0_NAME/READ/RECURSIVE
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/WRITE * SYSCTL1_PARENT/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/WRITE * SYSCTL1_NAME/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
} }
ATF_TC_CLEANUP(cap_sysctl__operation, tc)
{
cleanup();
}
static void ATF_TC_WITH_CLEANUP(cap_sysctl__names);
test_names(cap_channel_t *origcapsysctl) ATF_TC_HEAD(cap_sysctl__names, tc)
{ {
cap_channel_t *capsysctl; }
ATF_TC_BODY(cap_sysctl__names, tc)
{
cap_channel_t *capsysctl, *ocapsysctl;
void *limit; void *limit;
ocapsysctl = initcap();
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ/RECURSIVE * SYSCTL0_PARENT/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL0_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL0_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/READ/RECURSIVE * SYSCTL1_NAME/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE/RECURSIVE * SYSCTL0_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL0_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL0_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR/RECURSIVE * SYSCTL0_PARENT/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE)); SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/RDWR/RECURSIVE * SYSCTL1_NAME/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 |
SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE)); SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/READ * SYSCTL1_NAME/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE * SYSCTL0_PARENT/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/WRITE * SYSCTL1_NAME/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR * SYSCTL0_PARENT/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/RDWR * SYSCTL1_NAME/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 |
SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE)); SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
} }
ATF_TC_CLEANUP(cap_sysctl__names, tc)
{
cleanup();
}
int ATF_TC_WITH_CLEANUP(cap_sysctl__no_limits);
main(void) ATF_TC_HEAD(cap_sysctl__no_limits, tc)
{ {
cap_channel_t *capcas, *capsysctl; }
int scvalue0, scvalue1; ATF_TC_BODY(cap_sysctl__no_limits, tc)
size_t scsize; {
cap_channel_t *capsysctl;
printf("1..256\n"); capsysctl = initcap();
fflush(stdout);
scsize = sizeof(scvalue0); ATF_REQUIRE_EQ(checkcaps(capsysctl), (SYSCTL0_READ0 | SYSCTL0_READ1 |
CHECKX(sysctlbyname(SYSCTL0_NAME, &scvalue0, &scsize, NULL, 0) == 0);
CHECKX(scsize == sizeof(scvalue0));
scsize = sizeof(scvalue1);
CHECKX(sysctlbyname(SYSCTL1_NAME, &scvalue1, &scsize, NULL, 0) == 0);
CHECKX(scsize == sizeof(scvalue1));
capcas = cap_init();
CHECKX(capcas != NULL);
capsysctl = cap_service_open(capcas, "system.sysctl");
CHECKX(capsysctl != NULL);
cap_close(capcas);
/* No limits set. */
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
}
ATF_TC_CLEANUP(cap_sysctl__no_limits, tc)
{
cleanup();
}
test_operation(capsysctl); ATF_TP_ADD_TCS(tp)
{
ATF_TP_ADD_TC(tp, cap_sysctl__operation);
ATF_TP_ADD_TC(tp, cap_sysctl__names);
ATF_TP_ADD_TC(tp, cap_sysctl__no_limits);
test_names(capsysctl); return (atf_no_error());
cap_close(capsysctl);
CHECK(sysctlbyname(SYSCTL0_NAME, NULL, NULL, &scvalue0,
sizeof(scvalue0)) == 0);
CHECK(sysctlbyname(SYSCTL1_NAME, NULL, NULL, &scvalue1,
sizeof(scvalue1)) == 0);
exit(0);
} }
View Options

lang/erlang-man/Makefile

Show First 20 Lines • Show All 44 Lines • ▼ Show 20 Lines
#include <errno.h> #include <errno.h>
#include <netdb.h> #include <netdb.h>
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
#include <unistd.h> #include <unistd.h>
#include <libcasper.h> #include <libcasper.h>
#include <casper/cap_sysctl.h> #include <casper/cap_sysctl.h>
#include <atf-c.h>
/* /*
* We need some sysctls to perform the tests on. * We need some sysctls to perform the tests on.
* We remember their values and restore them afer the test is done. * We remember their values and restore them afer the test is done.
*/ */
#define SYSCTL0_PARENT "kern" #define SYSCTL0_PARENT "kern"
#define SYSCTL0_NAME "kern.sync_on_panic" #define SYSCTL0_NAME "kern.sync_on_panic"
#define SYSCTL0_FILE "./sysctl0"
#define SYSCTL1_PARENT "debug" #define SYSCTL1_PARENT "debug"
#define SYSCTL1_NAME "debug.minidump" #define SYSCTL1_NAME "debug.minidump"
#define SYSCTL1_FILE "./sysctl1"
static int ntest = 1;
#define CHECK(expr) do { \
if ((expr)) \
printf("ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
else \
printf("not ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
fflush(stdout); \
ntest++; \
} while (0)
#define CHECKX(expr) do { \
if ((expr)) { \
printf("ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
} else { \
printf("not ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
exit(1); \
} \
fflush(stdout); \
ntest++; \
} while (0)
#define SYSCTL0_READ0 0x0001 #define SYSCTL0_READ0 0x0001
#define SYSCTL0_READ1 0x0002 #define SYSCTL0_READ1 0x0002
#define SYSCTL0_READ2 0x0004 #define SYSCTL0_READ2 0x0004
#define SYSCTL0_WRITE 0x0008 #define SYSCTL0_WRITE 0x0008
#define SYSCTL0_READ_WRITE 0x0010 #define SYSCTL0_READ_WRITE 0x0010
#define SYSCTL1_READ0 0x0020 #define SYSCTL1_READ0 0x0020
#define SYSCTL1_READ1 0x0040 #define SYSCTL1_READ1 0x0040
#define SYSCTL1_READ2 0x0080 #define SYSCTL1_READ2 0x0080
#define SYSCTL1_WRITE 0x0100 #define SYSCTL1_WRITE 0x0100
#define SYSCTL1_READ_WRITE 0x0200 #define SYSCTL1_READ_WRITE 0x0200
static void
save_int_sysctl(const char *name, const char *file)
{
ssize_t n;
size_t sz;
int error, fd, val;
sz = sizeof(val);
error = sysctlbyname(name, &val, &sz, NULL, 0);
ATF_REQUIRE_MSG(error == 0,
"sysctlbyname(%s): %s", name, strerror(errno));
fd = open(file, O_CREAT | O_WRONLY, 0600);
ATF_REQUIRE_MSG(fd >= 0, "open(%s): %s", file, strerror(errno));
n = write(fd, &val, sz);
ATF_REQUIRE(n >= 0 && (size_t)n == sz);
error = close(fd);
ATF_REQUIRE(error == 0);
}
static void
restore_int_sysctl(const char *name, const char *file)
{
ssize_t n;
size_t sz;
int error, fd, val;
fd = open(file, O_RDONLY);
ATF_REQUIRE(fd >= 0);
sz = sizeof(val);
n = read(fd, &val, sz);
ATF_REQUIRE(n >= 0 && (size_t)n == sz);
error = unlink(file);
ATF_REQUIRE(error == 0);
error = close(fd);
ATF_REQUIRE(error == 0);
error = sysctlbyname(name, NULL, NULL, &val, sz);
ATF_REQUIRE_MSG(error == 0,
"sysctlbyname(%s): %s", name, strerror(errno));
}
static cap_channel_t *
initcap(void)
{
cap_channel_t *capcas, *capsysctl;
save_int_sysctl(SYSCTL0_NAME, SYSCTL0_FILE);
save_int_sysctl(SYSCTL1_NAME, SYSCTL1_FILE);
capcas = cap_init();
ATF_REQUIRE(capcas != NULL);
capsysctl = cap_service_open(capcas, "system.sysctl");
ATF_REQUIRE(capsysctl != NULL);
cap_close(capcas);
return (capsysctl);
}
static void
cleanup(void)
{
restore_int_sysctl(SYSCTL0_NAME, SYSCTL0_FILE);
restore_int_sysctl(SYSCTL1_NAME, SYSCTL1_FILE);
}
static unsigned int static unsigned int
runtest(cap_channel_t *capsysctl) checkcaps(cap_channel_t *capsysctl)
{ {
unsigned int result; unsigned int result;
int oldvalue, newvalue; int oldvalue, newvalue;
size_t oldsize; size_t oldsize;
result = 0; result = 0;
oldsize = sizeof(oldvalue); oldsize = sizeof(oldvalue);
▲ Show 20 Lines • Show All 72 Lines • ▼ Show 20 Lines if (cap_sysctlbyname(capsysctl, SYSCTL1_NAME, &oldvalue,
if (oldsize == sizeof(oldvalue) && oldvalue == 7008) if (oldsize == sizeof(oldvalue) && oldvalue == 7008)
result |= SYSCTL1_READ2; result |= SYSCTL1_READ2;
} }
} }
return (result); return (result);
} }
static void ATF_TC_WITH_CLEANUP(cap_sysctl__operation);
test_operation(cap_channel_t *origcapsysctl) ATF_TC_HEAD(cap_sysctl__operation, tc)
{ {
cap_channel_t *capsysctl; }
ATF_TC_BODY(cap_sysctl__operation, tc)
{
cap_channel_t *capsysctl, *ocapsysctl;
void *limit; void *limit;
ocapsysctl = initcap();
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR/RECURSIVE * SYSCTL0_PARENT/RDWR/RECURSIVE
* SYSCTL1_PARENT/RDWR/RECURSIVE * SYSCTL1_PARENT/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, "foo.bar", (void)cap_sysctl_limit_name(limit, "foo.bar",
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, "foo.bar", (void)cap_sysctl_limit_name(limit, "foo.bar",
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == SYSCTL0_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL0_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/RDWR/RECURSIVE * SYSCTL0_NAME/RDWR/RECURSIVE
* SYSCTL1_NAME/RDWR/RECURSIVE * SYSCTL1_NAME/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR * SYSCTL0_PARENT/RDWR
* SYSCTL1_PARENT/RDWR * SYSCTL1_PARENT/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/RDWR * SYSCTL0_NAME/RDWR
* SYSCTL1_NAME/RDWR * SYSCTL1_NAME/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR * SYSCTL0_PARENT/RDWR
* SYSCTL1_PARENT/RDWR/RECURSIVE * SYSCTL1_PARENT/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 |
SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE)); SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/RDWR * SYSCTL0_NAME/RDWR
* SYSCTL1_NAME/RDWR/RECURSIVE * SYSCTL1_NAME/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ/RECURSIVE * SYSCTL0_PARENT/READ/RECURSIVE
* SYSCTL1_PARENT/READ/RECURSIVE * SYSCTL1_PARENT/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ/RECURSIVE * SYSCTL0_NAME/READ/RECURSIVE
* SYSCTL1_NAME/READ/RECURSIVE * SYSCTL1_NAME/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/READ * SYSCTL1_PARENT/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/READ * SYSCTL1_NAME/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/READ/RECURSIVE * SYSCTL1_PARENT/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/READ/RECURSIVE * SYSCTL1_NAME/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE/RECURSIVE * SYSCTL0_PARENT/WRITE/RECURSIVE
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/WRITE/RECURSIVE * SYSCTL0_NAME/WRITE/RECURSIVE
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE * SYSCTL0_PARENT/WRITE
* SYSCTL1_PARENT/WRITE * SYSCTL1_PARENT/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/WRITE * SYSCTL0_NAME/WRITE
* SYSCTL1_NAME/WRITE * SYSCTL1_NAME/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE * SYSCTL0_PARENT/WRITE
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/WRITE * SYSCTL0_NAME/WRITE
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ/RECURSIVE * SYSCTL0_PARENT/READ/RECURSIVE
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ/RECURSIVE * SYSCTL0_NAME/READ/RECURSIVE
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/WRITE * SYSCTL1_PARENT/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/WRITE * SYSCTL1_NAME/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
} }
ATF_TC_CLEANUP(cap_sysctl__operation, tc)
{
cleanup();
}
static void ATF_TC_WITH_CLEANUP(cap_sysctl__names);
test_names(cap_channel_t *origcapsysctl) ATF_TC_HEAD(cap_sysctl__names, tc)
{ {
cap_channel_t *capsysctl; }
ATF_TC_BODY(cap_sysctl__names, tc)
{
cap_channel_t *capsysctl, *ocapsysctl;
void *limit; void *limit;
ocapsysctl = initcap();
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ/RECURSIVE * SYSCTL0_PARENT/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL0_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL0_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/READ/RECURSIVE * SYSCTL1_NAME/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE/RECURSIVE * SYSCTL0_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL0_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL0_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR/RECURSIVE * SYSCTL0_PARENT/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE)); SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/RDWR/RECURSIVE * SYSCTL1_NAME/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 |
SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE)); SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/READ * SYSCTL1_NAME/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE * SYSCTL0_PARENT/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/WRITE * SYSCTL1_NAME/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR * SYSCTL0_PARENT/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/RDWR * SYSCTL1_NAME/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 |
SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE)); SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
} }
ATF_TC_CLEANUP(cap_sysctl__names, tc)
{
cleanup();
}
int ATF_TC_WITH_CLEANUP(cap_sysctl__no_limits);
main(void) ATF_TC_HEAD(cap_sysctl__no_limits, tc)
{ {
cap_channel_t *capcas, *capsysctl; }
int scvalue0, scvalue1; ATF_TC_BODY(cap_sysctl__no_limits, tc)
size_t scsize; {
cap_channel_t *capsysctl;
printf("1..256\n"); capsysctl = initcap();
fflush(stdout);
scsize = sizeof(scvalue0); ATF_REQUIRE_EQ(checkcaps(capsysctl), (SYSCTL0_READ0 | SYSCTL0_READ1 |
CHECKX(sysctlbyname(SYSCTL0_NAME, &scvalue0, &scsize, NULL, 0) == 0);
CHECKX(scsize == sizeof(scvalue0));
scsize = sizeof(scvalue1);
CHECKX(sysctlbyname(SYSCTL1_NAME, &scvalue1, &scsize, NULL, 0) == 0);
CHECKX(scsize == sizeof(scvalue1));
capcas = cap_init();
CHECKX(capcas != NULL);
capsysctl = cap_service_open(capcas, "system.sysctl");
CHECKX(capsysctl != NULL);
cap_close(capcas);
/* No limits set. */
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
}
ATF_TC_CLEANUP(cap_sysctl__no_limits, tc)
{
cleanup();
}
test_operation(capsysctl); ATF_TP_ADD_TCS(tp)
{
ATF_TP_ADD_TC(tp, cap_sysctl__operation);
ATF_TP_ADD_TC(tp, cap_sysctl__names);
ATF_TP_ADD_TC(tp, cap_sysctl__no_limits);
test_names(capsysctl); return (atf_no_error());
cap_close(capsysctl);
CHECK(sysctlbyname(SYSCTL0_NAME, NULL, NULL, &scvalue0,
sizeof(scvalue0)) == 0);
CHECK(sysctlbyname(SYSCTL1_NAME, NULL, NULL, &scvalue1,
sizeof(scvalue1)) == 0);
exit(0);
} }
View Options

lang/erlang-man/distinfo

Show First 20 Lines • Show All 44 Lines • ▼ Show 20 Lines
#include <errno.h> #include <errno.h>
#include <netdb.h> #include <netdb.h>
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
#include <unistd.h> #include <unistd.h>
#include <libcasper.h> #include <libcasper.h>
#include <casper/cap_sysctl.h> #include <casper/cap_sysctl.h>
#include <atf-c.h>
/* /*
* We need some sysctls to perform the tests on. * We need some sysctls to perform the tests on.
* We remember their values and restore them afer the test is done. * We remember their values and restore them afer the test is done.
*/ */
#define SYSCTL0_PARENT "kern" #define SYSCTL0_PARENT "kern"
#define SYSCTL0_NAME "kern.sync_on_panic" #define SYSCTL0_NAME "kern.sync_on_panic"
#define SYSCTL0_FILE "./sysctl0"
#define SYSCTL1_PARENT "debug" #define SYSCTL1_PARENT "debug"
#define SYSCTL1_NAME "debug.minidump" #define SYSCTL1_NAME "debug.minidump"
#define SYSCTL1_FILE "./sysctl1"
static int ntest = 1;
#define CHECK(expr) do { \
if ((expr)) \
printf("ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
else \
printf("not ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
fflush(stdout); \
ntest++; \
} while (0)
#define CHECKX(expr) do { \
if ((expr)) { \
printf("ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
} else { \
printf("not ok %d # %s:%u\n", ntest, __FILE__, __LINE__); \
exit(1); \
} \
fflush(stdout); \
ntest++; \
} while (0)
#define SYSCTL0_READ0 0x0001 #define SYSCTL0_READ0 0x0001
#define SYSCTL0_READ1 0x0002 #define SYSCTL0_READ1 0x0002
#define SYSCTL0_READ2 0x0004 #define SYSCTL0_READ2 0x0004
#define SYSCTL0_WRITE 0x0008 #define SYSCTL0_WRITE 0x0008
#define SYSCTL0_READ_WRITE 0x0010 #define SYSCTL0_READ_WRITE 0x0010
#define SYSCTL1_READ0 0x0020 #define SYSCTL1_READ0 0x0020
#define SYSCTL1_READ1 0x0040 #define SYSCTL1_READ1 0x0040
#define SYSCTL1_READ2 0x0080 #define SYSCTL1_READ2 0x0080
#define SYSCTL1_WRITE 0x0100 #define SYSCTL1_WRITE 0x0100
#define SYSCTL1_READ_WRITE 0x0200 #define SYSCTL1_READ_WRITE 0x0200
static void
save_int_sysctl(const char *name, const char *file)
{
ssize_t n;
size_t sz;
int error, fd, val;
sz = sizeof(val);
error = sysctlbyname(name, &val, &sz, NULL, 0);
ATF_REQUIRE_MSG(error == 0,
"sysctlbyname(%s): %s", name, strerror(errno));
fd = open(file, O_CREAT | O_WRONLY, 0600);
ATF_REQUIRE_MSG(fd >= 0, "open(%s): %s", file, strerror(errno));
n = write(fd, &val, sz);
ATF_REQUIRE(n >= 0 && (size_t)n == sz);
error = close(fd);
ATF_REQUIRE(error == 0);
}
static void
restore_int_sysctl(const char *name, const char *file)
{
ssize_t n;
size_t sz;
int error, fd, val;
fd = open(file, O_RDONLY);
ATF_REQUIRE(fd >= 0);
sz = sizeof(val);
n = read(fd, &val, sz);
ATF_REQUIRE(n >= 0 && (size_t)n == sz);
error = unlink(file);
ATF_REQUIRE(error == 0);
error = close(fd);
ATF_REQUIRE(error == 0);
error = sysctlbyname(name, NULL, NULL, &val, sz);
ATF_REQUIRE_MSG(error == 0,
"sysctlbyname(%s): %s", name, strerror(errno));
}
static cap_channel_t *
initcap(void)
{
cap_channel_t *capcas, *capsysctl;
save_int_sysctl(SYSCTL0_NAME, SYSCTL0_FILE);
save_int_sysctl(SYSCTL1_NAME, SYSCTL1_FILE);
capcas = cap_init();
ATF_REQUIRE(capcas != NULL);
capsysctl = cap_service_open(capcas, "system.sysctl");
ATF_REQUIRE(capsysctl != NULL);
cap_close(capcas);
return (capsysctl);
}
static void
cleanup(void)
{
restore_int_sysctl(SYSCTL0_NAME, SYSCTL0_FILE);
restore_int_sysctl(SYSCTL1_NAME, SYSCTL1_FILE);
}
static unsigned int static unsigned int
runtest(cap_channel_t *capsysctl) checkcaps(cap_channel_t *capsysctl)
{ {
unsigned int result; unsigned int result;
int oldvalue, newvalue; int oldvalue, newvalue;
size_t oldsize; size_t oldsize;
result = 0; result = 0;
oldsize = sizeof(oldvalue); oldsize = sizeof(oldvalue);
▲ Show 20 Lines • Show All 72 Lines • ▼ Show 20 Lines if (cap_sysctlbyname(capsysctl, SYSCTL1_NAME, &oldvalue,
if (oldsize == sizeof(oldvalue) && oldvalue == 7008) if (oldsize == sizeof(oldvalue) && oldvalue == 7008)
result |= SYSCTL1_READ2; result |= SYSCTL1_READ2;
} }
} }
return (result); return (result);
} }
static void ATF_TC_WITH_CLEANUP(cap_sysctl__operation);
test_operation(cap_channel_t *origcapsysctl) ATF_TC_HEAD(cap_sysctl__operation, tc)
{ {
cap_channel_t *capsysctl; }
ATF_TC_BODY(cap_sysctl__operation, tc)
{
cap_channel_t *capsysctl, *ocapsysctl;
void *limit; void *limit;
ocapsysctl = initcap();
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR/RECURSIVE * SYSCTL0_PARENT/RDWR/RECURSIVE
* SYSCTL1_PARENT/RDWR/RECURSIVE * SYSCTL1_PARENT/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, "foo.bar", (void)cap_sysctl_limit_name(limit, "foo.bar",
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, "foo.bar", (void)cap_sysctl_limit_name(limit, "foo.bar",
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == SYSCTL0_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL0_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/RDWR/RECURSIVE * SYSCTL0_NAME/RDWR/RECURSIVE
* SYSCTL1_NAME/RDWR/RECURSIVE * SYSCTL1_NAME/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR * SYSCTL0_PARENT/RDWR
* SYSCTL1_PARENT/RDWR * SYSCTL1_PARENT/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/RDWR * SYSCTL0_NAME/RDWR
* SYSCTL1_NAME/RDWR * SYSCTL1_NAME/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR * SYSCTL0_PARENT/RDWR
* SYSCTL1_PARENT/RDWR/RECURSIVE * SYSCTL1_PARENT/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 |
SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE)); SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/RDWR * SYSCTL0_NAME/RDWR
* SYSCTL1_NAME/RDWR/RECURSIVE * SYSCTL1_NAME/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ/RECURSIVE * SYSCTL0_PARENT/READ/RECURSIVE
* SYSCTL1_PARENT/READ/RECURSIVE * SYSCTL1_PARENT/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ/RECURSIVE * SYSCTL0_NAME/READ/RECURSIVE
* SYSCTL1_NAME/READ/RECURSIVE * SYSCTL1_NAME/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/READ * SYSCTL1_PARENT/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/READ * SYSCTL1_NAME/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/READ/RECURSIVE * SYSCTL1_PARENT/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/READ/RECURSIVE * SYSCTL1_NAME/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_READ0));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE/RECURSIVE * SYSCTL0_PARENT/WRITE/RECURSIVE
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/WRITE/RECURSIVE * SYSCTL0_NAME/WRITE/RECURSIVE
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE * SYSCTL0_PARENT/WRITE
* SYSCTL1_PARENT/WRITE * SYSCTL1_PARENT/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/WRITE * SYSCTL0_NAME/WRITE
* SYSCTL1_NAME/WRITE * SYSCTL1_NAME/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE * SYSCTL0_PARENT/WRITE
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/WRITE * SYSCTL0_NAME/WRITE
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_WRITE | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ/RECURSIVE * SYSCTL0_PARENT/READ/RECURSIVE
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ/RECURSIVE * SYSCTL0_NAME/READ/RECURSIVE
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/WRITE * SYSCTL1_PARENT/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/WRITE * SYSCTL1_NAME/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
* SYSCTL1_PARENT/WRITE/RECURSIVE * SYSCTL1_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_NAME/READ * SYSCTL0_NAME/READ
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE)); ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL1_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
} }
ATF_TC_CLEANUP(cap_sysctl__operation, tc)
{
cleanup();
}
static void ATF_TC_WITH_CLEANUP(cap_sysctl__names);
test_names(cap_channel_t *origcapsysctl) ATF_TC_HEAD(cap_sysctl__names, tc)
{ {
cap_channel_t *capsysctl; }
ATF_TC_BODY(cap_sysctl__names, tc)
{
cap_channel_t *capsysctl, *ocapsysctl;
void *limit; void *limit;
ocapsysctl = initcap();
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ/RECURSIVE * SYSCTL0_PARENT/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL0_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL0_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/READ/RECURSIVE * SYSCTL1_NAME/READ/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_READ | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE/RECURSIVE * SYSCTL0_PARENT/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL0_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL0_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/WRITE/RECURSIVE * SYSCTL1_NAME/WRITE/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_WRITE | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR/RECURSIVE * SYSCTL0_PARENT/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE)); SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/RDWR/RECURSIVE * SYSCTL1_NAME/RDWR/RECURSIVE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME,
CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE); CAP_SYSCTL_RDWR | CAP_SYSCTL_RECURSIVE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 |
SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE)); SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/READ * SYSCTL0_PARENT/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/READ * SYSCTL1_NAME/READ
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_READ);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_READ0); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_READ0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/WRITE * SYSCTL0_PARENT/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/WRITE * SYSCTL1_NAME/WRITE
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_WRITE);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == SYSCTL1_WRITE); ATF_REQUIRE(checkcaps(capsysctl) == SYSCTL1_WRITE);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL0_PARENT/RDWR * SYSCTL0_PARENT/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_PARENT, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_PARENT, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == 0); ATF_REQUIRE(checkcaps(capsysctl) == 0);
cap_close(capsysctl); cap_close(capsysctl);
/* /*
* Allow: * Allow:
* SYSCTL1_NAME/RDWR * SYSCTL1_NAME/RDWR
*/ */
capsysctl = cap_clone(origcapsysctl); capsysctl = cap_clone(ocapsysctl);
CHECK(capsysctl != NULL); ATF_REQUIRE(capsysctl != NULL);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == 0); ATF_REQUIRE(cap_sysctl_limit(limit) == 0);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
(void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL1_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
limit = cap_sysctl_limit_init(capsysctl); limit = cap_sysctl_limit_init(capsysctl);
(void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR); (void)cap_sysctl_limit_name(limit, SYSCTL0_NAME, CAP_SYSCTL_RDWR);
CHECK(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE); ATF_REQUIRE(cap_sysctl_limit(limit) == -1 && errno == ENOTCAPABLE);
CHECK(runtest(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 | ATF_REQUIRE(checkcaps(capsysctl) == (SYSCTL1_READ0 | SYSCTL1_READ1 |
SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE)); SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ_WRITE));
cap_close(capsysctl); cap_close(capsysctl);
} }
ATF_TC_CLEANUP(cap_sysctl__names, tc)
{
cleanup();
}
int ATF_TC_WITH_CLEANUP(cap_sysctl__no_limits);
main(void) ATF_TC_HEAD(cap_sysctl__no_limits, tc)
{ {
cap_channel_t *capcas, *capsysctl; }
int scvalue0, scvalue1; ATF_TC_BODY(cap_sysctl__no_limits, tc)
size_t scsize; {
cap_channel_t *capsysctl;
printf("1..256\n"); capsysctl = initcap();
fflush(stdout);
scsize = sizeof(scvalue0); ATF_REQUIRE_EQ(checkcaps(capsysctl), (SYSCTL0_READ0 | SYSCTL0_READ1 |
CHECKX(sysctlbyname(SYSCTL0_NAME, &scvalue0, &scsize, NULL, 0) == 0);
CHECKX(scsize == sizeof(scvalue0));
scsize = sizeof(scvalue1);
CHECKX(sysctlbyname(SYSCTL1_NAME, &scvalue1, &scsize, NULL, 0) == 0);
CHECKX(scsize == sizeof(scvalue1));
capcas = cap_init();
CHECKX(capcas != NULL);
capsysctl = cap_service_open(capcas, "system.sysctl");
CHECKX(capsysctl != NULL);
cap_close(capcas);
/* No limits set. */
CHECK(runtest(capsysctl) == (SYSCTL0_READ0 | SYSCTL0_READ1 |
SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE | SYSCTL0_READ2 | SYSCTL0_WRITE | SYSCTL0_READ_WRITE |
SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE | SYSCTL1_READ0 | SYSCTL1_READ1 | SYSCTL1_READ2 | SYSCTL1_WRITE |
SYSCTL1_READ_WRITE)); SYSCTL1_READ_WRITE));
}
ATF_TC_CLEANUP(cap_sysctl__no_limits, tc)
{
cleanup();
}
test_operation(capsysctl); ATF_TP_ADD_TCS(tp)
{
ATF_TP_ADD_TC(tp, cap_sysctl__operation);
ATF_TP_ADD_TC(tp, cap_sysctl__names);
ATF_TP_ADD_TC(tp, cap_sysctl__no_limits);
test_names(capsysctl); return (atf_no_error());
cap_close(capsysctl);
CHECK(sysctlbyname(SYSCTL0_NAME, NULL, NULL, &scvalue0,
sizeof(scvalue0)) == 0);
CHECK(sysctlbyname(SYSCTL1_NAME, NULL, NULL, &scvalue1,
sizeof(scvalue1)) == 0);
exit(0);
} }
View Options

lang/erlang-runtime20/Makefile

Loading...
View Options

lang/erlang-runtime20/distinfo

Loading...
View Options

lang/erlang-runtime21/Makefile

Loading...
View Options

lang/erlang-runtime21/distinfo

Loading...
View Options

lang/erlang-runtime22/Makefile

Loading...
View Options

lang/erlang-runtime22/distinfo

Loading...
View Options

lang/erlang-wx/Makefile

Loading...
View Options

lang/erlang-wx/distinfo

Loading...
View Options

lang/erlang/Makefile

Loading...
View Options

lang/erlang/distinfo

Loading...