summaryrefslogtreecommitdiffstats
path: root/tools/regression/security
Commit message (Collapse)AuthorAgeFilesLines
* Use nitems(x) instead of sizeof(x)/sizeof(x[0])ngie2015-11-021-2/+2
| | | | | MFC after: 1 week Sponsored by: EMC / Isilon Storage Division
* Fix compiler warnings with open_to_operation.cngie2015-10-302-16/+13
| | | | | | | | | | | | | | | | | | Other sidenotes: - Remove unused variables with main(..) - Convert errx/exit with -1 to errx/exit with 1 - Fix a bogus test in try_directory_open (expected_errno == expected_errno -> errno == expected_errno) [*] - Fix some warnings related to discarded qualifiers - Remove a bogus else-statement at the end of check_mmap_exec(..) in the successful case. mmap(2), POSIX, Linux, etc all don't state what the behavior is when mixing O_WRONLY + PROT_EXEC, so assume success for now to get the test program to pass again. PR: 201286 [*] MFC after: 1 week Submitted by: David Binderman <dcb314@hotmail.com> Sponsored by: EMC / Isilon Storage Division
* NO_MAN= has been deprecated in favor of MAN= for some time, go aheadimp2014-04-134-4/+4
| | | | | | and finish the job. ncurses is now the only Makefile in the tree that uses it since it wasn't a simple mechanical change, and will be addressed in a future commit.
* Update most userspace consumers of capability.h to use capsicum.h instead.rwatson2014-03-167-7/+7
| | | | | | | auditdistd is not updated as I will make the change upstream and then do a vendor import sometime in the next week or two. MFC after: 3 weeks
* Use CAP_EVENT instead of the deprecated CAP_POLL_EVENT.brueffer2014-02-061-2/+2
| | | | | | | PR: 185382 (based on) Submitted by: Loganaden Velvindron Reviewed by: pjd MFC after: 1 week
* Update regression tests after adding chflagsat(2).pjd2013-03-211-6/+4
| | | | Sponsored by: The FreeBSD Foundation
* Update the tests now that absence of the O_APPEND flag requires CAP_SEEKpjd2013-03-161-13/+46
| | | | | | capability. Add some more tests. Sponsored by: The FreeBSD Foundation
* The mode argument for open(2)/openat(2) only makes sense if the O_CREAT flagpjd2013-03-161-6/+6
| | | | | | was given. Sponsored by: The FreeBSD Foundation
* Update existing regression tests after Capsicum overhaul.pjd2013-03-022-101/+349
|
* Fix order of arguments to lseek().brueffer2012-02-291-1/+1
| | | | | | PR: 160867 Submitted by: Henning Petersen <henning.petersen@t-online.de> MFC after: 1 week
* Spelling fixes for tools/uqs2011-12-301-2/+2
| | | | Add some $FreeBSD$ tags so svn will allow the commit.
* Test process descriptors.jonathan2011-08-185-0/+221
| | | | | | | | | | Ensure that process descriptors work as expected. We should be able to: - pdfork(), like regular fork(), but producing a process descriptor - pdgetpid() to convert a PD into a PID - pdkill() to send signals to a process identified by a PD Approved by: re (kib), mentor (rwatson) Sponsored by: Google Inc
* poll(2) implementation for capabilities.jonathan2011-08-161-2/+16
| | | | | | | | When calling poll(2) on a capability, unwrap first and then poll the underlying object. Approved by: re (kib), mentor (rwatson) Sponsored by: Google Inc
* Rename CAP_*_KEVENT to CAP_*_EVENT.jonathan2011-08-121-2/+2
| | | | | | | | Change the names of a couple of capability rights to be less FreeBSD-specific. Approved by: re (kib), mentor (rwatson) Sponsored by: Google Inc
* Test *at(2) calls with capability-mode lookup.jonathan2011-08-124-3/+157
| | | | | | | | | | | | | This commit adds regression testing for openat(), fstatat(), etc. with capability scoping ("strict relative" lookup), which applies: - in capability mode - when performing any *at() lookup relative to a capability These tests will fail until the *at() code is committed; on my local instance, with the *at() changes, they all pass. Approved by: re (kib), mentor (rwatson) Sponsored by: Google Inc
* Use the right printf() format string without a cast to maxint_t.jonathan2011-08-111-4/+4
| | | | | | | | As per kib's suggestion, we also change test_count from a size_t to an int; its value at the moment is 4, and we only expect it to go up to 7. Approved by: re (kib), mentor (rwatson) Sponsored by: Google Inc
* Second-to-last commit implementing Capsicum capabilities in the FreeBSDrwatson2011-08-112-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | kernel for FreeBSD 9.0: Add a new capability mask argument to fget(9) and friends, allowing system call code to declare what capabilities are required when an integer file descriptor is converted into an in-kernel struct file *. With options CAPABILITIES compiled into the kernel, this enforces capability protection; without, this change is effectively a no-op. Some cases require special handling, such as mmap(2), which must preserve information about the maximum rights at the time of mapping in the memory map so that they can later be enforced in mprotect(2) -- this is done by narrowing the rights in the existing max_protection field used for similar purposes with file permissions. In namei(9), we assert that the code is not reached from within capability mode, as we're not yet ready to enforce namespace capabilities there. This will follow in a later commit. Update two capability names: CAP_EVENT and CAP_KEVENT become CAP_POST_KEVENT and CAP_POLL_KEVENT to more accurately indicate what they represent. Approved by: re (bz) Submitted by: jonathan Sponsored by: Google Inc
* Expect fchflags(2) to fail with EOPNOTSUPP on NFS.jonathan2011-08-051-2/+11
| | | | | | | | | | | | Even if we have CAP_FCHFLAGS, fchflags(2) fails on NFS. This is normal and expected, so don't fail the test because of it. Note that, whether or not we are on NFS, fchflags(2) should always fail with ENOTCAPABLE if we are using a capability that does not have the CAP_FCHFLAGS right. Approved by: re (kib), mentor (rwatson) Sponsored by: Google Inc
* Flesh out the cap_test regression test.jonathan2011-08-043-0/+388
| | | | | | | | Add more regression testing, some of which is expected to fail until we commit more kernel implementation. Approved by: re (kib), mentor (rwatson) Sponsored by: Google Inc
* Flesh out the cap_test regression test.jonathan2011-08-045-344/+319
| | | | | | | | Add more regression testing, some of which is expected to fail until we commit more kernel implementation. Approved by: re (kib), mentor (rwatson) Sponsored by: Google Inc
* Regression tests for Capsicum capability mode.jonathan2011-05-045-0/+587
| | | | | | | Ensure that system calls that access global namespaces, e.g. open(2), are not permitted, and that whitelisted sysctls like kern.osreldate are. Approved by: rwatson Sponsored by: Google, Inc.
* Add open_to_operation, a security regression test that opens files withrwatson2008-02-142-0/+1263
| | | | | | | | | | various open flags and then tests various operations to make sure that they are properly constrained by open flags. Various I/O mechansms are tried, including aio if compiled into the kernel or loaded as a module. There's more to be done here but it's a useful start, running about 220 individual tests. This is in support of FreeBSD-SA-08:03.sendfile.
* Start the dreaded NOFOO -> NO_FOO conversion.ru2004-12-212-2/+2
| | | | OK'ed by: core
* For variables that are only checked with defined(), don't provideru2004-10-242-2/+2
| | | | any fake value.
* gcc now objects to a default label without any contents. Because I wantrwatson2004-07-171-0/+2
| | | | | to have a comment present in the default case, add a 'break' to each default case that previously had no actual statements.
* file system > filesystemtrhodes2002-05-161-2/+2
|
* NAI DBA update.rwatson2002-03-141-1/+1
|
* o Fix two eaccess() checks -- in one case, the wrong test filerwatson2001-09-211-2/+2
| | | | | | | was used, resulting in a regression failure, and in the other, the test on an error return was inverted. Obtained from: TrustedBSD Project
* o Regression test to check that appropriate parts of the processrwatson2001-09-202-0/+369
| | | | | | credential are used in the access() and new eaccess() system calls. Obtained from: TrustedBSD Project
* o Add a comment identifying the "privileged on privileged" scenario.rwatson2001-04-131-0/+1
| | | | Obtained from: TrustedBSD Project
* o Add inter-process authorization uid regression testing for ktrace().rwatson2001-04-131-43/+63
| | | | Obtained from: TrustedBSD Project
* o s/debug/ptrace/ since shortly there will be tests involving otherrwatson2001-04-131-3/+3
| | | | | | forms of debugging. Obtained from: TrustedBSD Project
* o Expand inter-process authorization regression test to includerwatson2001-04-122-46/+58
| | | | | | | signalling with sigsegv as one of the tests. o Teach errno_to_string() about ENOTSUPP. Obtained from: TrustedBSD Project
* o Enable -DSETSUGID_SUPPORTED in inter-process authorization regressionrwatson2001-04-111-1/+1
| | | | | | | test by default, as setugid() is now part of the base kernel (assuming (options REGRESSION) has been enabled for the running kernel). Obtained from: TrustedBSD Project
* o First pass at an inter-process authorization regression testing suite.rwatson2001-04-115-0/+563
This test utility attempts to evaluate the current kernel policy for authorization inter-process activities, currently ptrace(), kill(, SIGHUP), getpriority(), and setpriority(). The utility creates pairs of processes, initializes their credential sets to useful cases, and reports on whether the results are in keeping with hard-coded safety expectations. o Currently, this utility relies on the availability of __setugid(), an uncomitted system call used for managing the P_SUGID bit. Due to continuing discussion of optional regression testing kernel components ("options REGRESSION") I'll hold off on committing that until the discussion has reached its natural termination. o A number of additional testing factors should be taken into account in the testing, including tests for different classes of signals, interactions with process session characteristics, I/O signalling, broadcast activities such as broadcast signalling, mass priority setting, and to take into group-related aspects of credentials. Additional operations should also be taken into account, such as ktrace, debugging attach using procfs, and so on. o This testing suite is intended to prevent the introduction of bugs in the upcoming sets of authorization changes associated with the introduction of process capabilities and mandatory access control. Obtained from: TrustedBSD Project
OpenPOWER on IntegriCloud