Flesh out the cap_test regression test.

Add more regression testing, some of which is expected to fail until we
commit more kernel implementation.

Approved by: re (kib), mentor (rwatson)
Sponsored by: Google Inc

5 files changed, 319 insertions, 344 deletions

diff --git a/tools/regression/security/cap_test/Makefile b/tools/regression/security/cap_test/Makefile
index 86d495ce71cb..49e308e74bde 100644
--- a/tools/regression/security/cap_test/Makefile
+++ b/tools/regression/security/cap_test/Makefile
@@ -1,9 +1,22 @@
 # $FreeBSD$
 
 PROG=	cap_test
-SRCS=	cap_test.c cap_test_capmode.c cap_test_sysctl.c
+SRCS=	cap_test.c \
+	cap_test_capmode.c \
+	cap_test_capabilities.c \
+	cap_test_fcntl.c \
+	cap_test_sysctl.c
 WARNS=	3
 NO_MAN=
-CFLAGS+=	-DMACHINE=\"${MACHINE}\"
+
+# Use headers and libc from the build, if available.
+KERNCONF?=	GENERIC
+OBJROOT=	${.OBJDIR}/../../../../
+OBJKERN=	${OBJROOT}/sys/${KERNCONF}
+
+SRCROOT=	${.CURDIR}/../../../../
+
+CFLAGS+=	-DMACHINE=\"${MACHINE}\" -I${OBJKERN} -I${SRCROOT}/sys
+LDFLAGS+=	-L${OBJROOT}/lib/libc -lc
 
 .include <bsd.prog.mk>
diff --git a/tools/regression/security/cap_test/cap_test.c b/tools/regression/security/cap_test/cap_test.c
index 5a2dc15532ea..fb3440672337 100644
--- a/tools/regression/security/cap_test/cap_test.c
+++ b/tools/regression/security/cap_test/cap_test.c
@@ -1,5 +1,6 @@
 /*-
  * Copyright (c) 2008-2011 Robert N. M. Watson
+ * Copyright (c) 2011 Jonathan Anderson
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -29,19 +30,89 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include <sys/wait.h>
+
+#include <err.h>
+#include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
 
 #include "cap_test.h"
 
+/* Initialize a named test. Requires test_NAME() function to be declared. */
+#define	TEST_INIT(name)	{ #name, test_##name, FAILED }
+
+/* All of the tests that can be run. */
+struct test all_tests[] = {
+	TEST_INIT(capmode),
+	TEST_INIT(capabilities),
+	TEST_INIT(fcntl),
+	TEST_INIT(sysctl),
+};
+size_t test_count = sizeof(all_tests) / sizeof(struct test);
+
 int
 main(int argc, char *argv[])
 {
-	test_capmode();
-	test_sysctl();
+
 	/*
-	test_capabilities();
-	test_syscalls();
-	test_fcntl();
-	*/
-	exit(0);
+	 * If no tests have been specified at the command line, run them all.
+	 */
+	if (argc == 1) {
+		printf("1..%ld\n", test_count);
+
+		for (size_t i = 0; i < test_count; i++)
+			execute(i + 1, all_tests + i);
+		return (0);
+	}
+
+	/*
+	 * Otherwise, run only the specified tests.
+	 */
+	printf("1..%d\n", argc - 1);
+	for (int i = 1; i < argc; i++)
+	{
+		int found = 0;
+		for (size_t j = 0; j < test_count; j++) {
+			if (strncmp(argv[i], all_tests[j].t_name,
+			    strlen(argv[i])) == 0) {
+				found = 1;
+				execute(i, all_tests + j);
+				break;
+			}
+		}
+
+		if (found == 0)
+			errx(-1, "No such test '%s'", argv[i]);
+	}
+
+	return (0);
+}
+
+int
+execute(int id, struct test *t) {
+	int result;
+
+	pid_t pid = fork();
+	if (pid < 0)
+		err(-1, "fork");
+	if (pid) {
+		/* Parent: wait for result from child. */
+		int status;
+		while (waitpid(pid, &status, 0) != pid) {}
+		if (WIFEXITED(status))
+			result = WEXITSTATUS(status);
+		else
+			result = FAILED;
+	} else {
+		/* Child process: run the test. */
+		exit(t->t_run());
+	}
+
+	printf("%s %d - %s\n",
+		(result == PASSED) ? "ok" : "not ok",
+		id, t->t_name);
+
+	return (result);
 }
diff --git a/tools/regression/security/cap_test/cap_test.h b/tools/regression/security/cap_test/cap_test.h
index 18fa8147ee88..1839e01c4822 100644
--- a/tools/regression/security/cap_test/cap_test.h
+++ b/tools/regression/security/cap_test/cap_test.h
@@ -1,5 +1,6 @@
 /*-
  * Copyright (c) 2008-2011 Robert N. M. Watson
+ * Copyright (c) 2011 Jonathan Anderson
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -29,10 +30,126 @@
 #ifndef CAP_TEST_H
 #define	CAP_TEST_H
 
-void	test_capmode(void);
-void	test_capabilities(void);
-void	test_syscalls(void);
-void	test_sysctl(void);
-void	test_fcntl(void);
+#include <err.h>
+
+/*
+ * Define a file required by a test. The test can't complete without the file,
+ * so if we don't have it, just die.
+ */
+#define	REQUIRE(fd)	do {						\
+	if ((fd) < 0)							\
+		err(-1, "%s:%d: Missing required file '%s'",		\
+			__FILE__, __LINE__, #fd);			\
+} while (0)
+
+/* Whether a test passed or failed. */
+#define	PASSED	0
+#define	FAILED	1
+
+/* A test has failed; print a message and clear the 'success' flag. */
+#define	FAIL(...)	do {						\
+	warn(__VA_ARGS__);						\
+	success = FAILED;						\
+} while (0)
+
+/* As above, but do not print the errno message. */
+#define	FAILX(...)	do {						\
+	warnx(__VA_ARGS__);						\
+	success = FAILED;						\
+} while (0)
+
+/* Like an assertion, but don't kill the test, just fail and keep going. */
+#define	CHECK(condition) do {						\
+	if (!(condition))						\
+		FAILX("%s:%d: Assertion '%s' failed",			\
+		    __func__, __LINE__, #condition);			\
+} while (0)
+
+/* Make sure that a system call's return value is >= 0. */
+#define	CHECK_SYSCALL_SUCCEEDS(syscall, ...) do {			\
+	if (syscall(__VA_ARGS__) < 0)					\
+		FAIL("%s() at line %d: %s failed",			\
+		    __func__, __LINE__, #syscall);			\
+} while (0)
+
+/* Make sure that a system call fails with the correct errno. */
+#define	CHECK_SYSCALL_FAILS(expected_errno, syscall, ...)	do {	\
+	if (syscall(__VA_ARGS__) < 0) {					\
+		if (errno != expected_errno)				\
+			FAIL("%s() at line %d: %s",			\
+			    __func__, __LINE__, #syscall);		\
+	} else {							\
+		FAILX("%s() at line %d: %s succeeded; it should've failed", \
+		    __func__, __LINE__, #syscall);			\
+	}								\
+} while (0)
+
+/* Make sure that a system call fails, but not with a particular errno. */
+#define	CHECK_SYSCALL_FAILS_BUT_NOT_WITH(bad_errno, syscall, ...)	do { \
+	if (syscall(__VA_ARGS__) < 0) {					\
+		if (errno == bad_errno)					\
+			FAIL("%s() at line %d: %s",			\
+			    __func__, __LINE__, #syscall);		\
+	} else {							\
+		FAILX("%s() at line %d: %s succeeded; it should've failed", \
+		    __func__, __LINE__, #syscall);			\
+	}								\
+} while (0)
+
+/* A system call should fail with ECAPMODE. */
+#define	CHECK_CAPMODE(...) \
+	CHECK_SYSCALL_FAILS(ECAPMODE, __VA_ARGS__)
+
+/* A system call should fail, but not with ECAPMODE. */
+#define	CHECK_NOT_CAPMODE(...) \
+	CHECK_SYSCALL_FAILS_BUT_NOT_WITH(ECAPMODE, __VA_ARGS__)
+
+/* A system call should fail with ENOTCAPABLE. */
+#define	CHECK_NOTCAPABLE(...) \
+	CHECK_SYSCALL_FAILS(ENOTCAPABLE, __VA_ARGS__)
+
+/* Ensure that 'rights' are a subset of 'max'. */
+#define	CHECK_RIGHTS(rights, max)	do {				\
+	if ((success == PASSED) && (rights != max))			\
+		FAILX("Rights of opened file (%jx) > maximum (%jx)",	\
+		    (cap_rights_t) rights, (cap_rights_t) max);		\
+} while (0)
+
+/* Create a capability from a file descriptor, make sure it succeeds. */
+#define	MAKE_CAPABILITY(to, from, rights)	do {			\
+	cap_rights_t _rights;						\
+	REQUIRE(to = cap_new(from, rights));				\
+	CHECK_SYSCALL_SUCCEEDS(cap_getrights, to, &_rights);		\
+	if ((success == PASSED) && (_rights != (rights)))		\
+		FAILX("New capability's rights (%jx) != %jx",		\
+		    _rights, (cap_rights_t) (rights));			\
+} while (0)
+
+/*
+ * A top-level test should take no arguments and return an integer value,
+ * either PASSED or FAILED.
+ *
+ * Errors such as SIGSEGV will be caught and interpreted as FAILED.
+ */
+typedef int	(*test_function)(void);
+
+/* Information about a test. */
+struct test {
+	char		*t_name;
+	test_function	 t_run;
+	int		 t_result;
+};
+
+/*
+ * Run a test in a child process so that cap_enter(2) doesn't mess up
+ * subsequent tests.
+ */
+int	execute(int id, struct test*);
+
+int	test_capmode(void);
+int	test_capabilities(void);
+int	test_syscalls(void);
+int	test_sysctl(void);
+int	test_fcntl(void);
 
 #endif /* CAP_TEST_H */
diff --git a/tools/regression/security/cap_test/cap_test_capmode.c b/tools/regression/security/cap_test/cap_test_capmode.c
index 9d20dec083ee..37319901baa4 100644
--- a/tools/regression/security/cap_test/cap_test_capmode.c
+++ b/tools/regression/security/cap_test/cap_test_capmode.c
@@ -1,5 +1,6 @@
 /*-
  * Copyright (c) 2008-2009 Robert N. M. Watson
+ * Copyright (c) 2011 Jonathan Anderson
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -37,163 +38,121 @@ __FBSDID("$FreeBSD$");
 
 #include <sys/param.h>
 #include <sys/capability.h>
+#include <sys/errno.h>
 #include <sys/mman.h>
 #include <sys/mount.h>
-#include <sys/poll.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/wait.h>
 
 #include <machine/sysarch.h>
-#include <netinet/in.h>
 
 #include <err.h>
-#include <errno.h>
 #include <fcntl.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 
-/* Need to check machine-dependent sysarch(). */
-#define	ARCH_IS(s)	(!strncmp(s, MACHINE, sizeof(s) + 1))
-
 #include "cap_test.h"
 
-void
+#define	CHECK_SYSCALL_VOID_NOT_ECAPMODE(syscall, ...)	do {		\
+	errno = 0;							\
+	(void)syscall(__VA_ARGS__);					\
+	if (errno == ECAPMODE)						\
+		FAIL("capmode: %s failed with ECAPMODE", #syscall);	\
+} while (0)
+
+int
 test_capmode(void)
 {
-	struct sockaddr_in sin;
 	struct statfs statfs;
 	struct stat sb;
-	ssize_t len;
 	long sysarch_arg = 0;
-	int fd, fd_close, fd_dir, fd_file, fd_socket, fd2[2], ret;
+	int fd_close, fd_dir, fd_file, fd_socket, fd2[2];
+	int success = PASSED;
 	pid_t pid, wpid;
 	char ch;
 
-	fd_file = open("/tmp/cap_test_syscalls", O_RDWR|O_CREAT, 0644);
-	if (fd_file < 0)
-		err(-1, "test_syscalls:prep: open cap_test_syscalls");
-
-	fd_close = open("/dev/null", O_RDWR);
-	if (fd_close < 0)
-		err(-1, "test_syscalls:prep: open /dev/null");
-
-	fd_dir = open("/tmp", O_RDONLY);
-	if (fd_dir < 0)
-		err(-1, "test_syscalls:prep: open /tmp");
+	/* Open some files to play with. */
+	REQUIRE(fd_file = open("/tmp/cap_capmode", O_RDWR|O_CREAT, 0644));
+	REQUIRE(fd_close = open("/dev/null", O_RDWR));
+	REQUIRE(fd_dir = open("/tmp", O_RDONLY));
+	REQUIRE(fd_socket = socket(PF_INET, SOCK_DGRAM, 0));
 
-	fd_socket = socket(PF_INET, SOCK_DGRAM, 0);
-	if (fd_socket < 0)
-		err(-1, "test_syscalls:prep: socket");
-
-	if (cap_enter() < 0)
-		err(-1, "test_syscalls:prep: cap_enter");
-
-
-	bzero(&sin, sizeof(sin));
-	sin.sin_len = sizeof(sin);
-	sin.sin_family = AF_INET;
+	/* Enter capability mode. */
+	REQUIRE(cap_enter());
 
 	/*
-	 * Here begin the tests, sorted roughly alphabetically by system call
-	 * name.
+	 * System calls that are not permitted in capability mode.
 	 */
-	fd = accept(fd_socket, NULL, NULL);
-	if (fd < 0) {
-		if (errno == ECAPMODE)
-			warnx("test_syscalls:accept");
-	} else {
-		warnx("test_syscalls:accept succeeded");
-		close(fd);
-	}
-
-	if (access("/tmp/cap_test_syscalls_access", F_OK) < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:access");
-	} else
-		warnx("test_syscalls:access succeeded");
-
-	if (acct("/tmp/cap_test_syscalls_acct") < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:acct");
-	} else
-		warnx("test_syscalls:acct succeeded");
-
-	if (bind(PF_INET, (struct sockaddr *)&sin, sizeof(sin)) < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscall:bind");
-	} else
-		warnx("test_syscall:bind succeeded");
+	CHECK_CAPMODE(access, "/tmp/cap_capmode_access", F_OK);
+	CHECK_CAPMODE(acct, "/tmp/cap_capmode_acct");
+	CHECK_CAPMODE(bind, PF_INET, NULL, 0);
+	CHECK_CAPMODE(chdir, "/tmp/cap_capmode_chdir");
+	CHECK_CAPMODE(chflags, "/tmp/cap_capmode_chflags", UF_NODUMP);
+	CHECK_CAPMODE(chmod, "/tmp/cap_capmode_chmod", 0644);
+	CHECK_CAPMODE(chown, "/tmp/cap_capmode_chown", -1, -1);
+	CHECK_CAPMODE(chroot, "/tmp/cap_capmode_chroot");
+	CHECK_CAPMODE(connect, PF_INET, NULL, 0);
+	CHECK_CAPMODE(creat, "/tmp/cap_capmode_creat", 0644);
+	CHECK_CAPMODE(fchdir, fd_dir);
+	CHECK_CAPMODE(getfsstat, &statfs, sizeof(statfs), MNT_NOWAIT);
+	CHECK_CAPMODE(link, "/tmp/foo", "/tmp/bar");
+	CHECK_CAPMODE(lstat, "/tmp/cap_capmode_lstat", &sb);
+	CHECK_CAPMODE(mknod, "/tmp/capmode_mknod", 06440, 0);
+	CHECK_CAPMODE(mount, "procfs", "/not_mounted", 0, NULL);
+	CHECK_CAPMODE(open, "/dev/null", O_RDWR);
+	CHECK_CAPMODE(readlink, "/tmp/cap_capmode_readlink", NULL, 0);
+	CHECK_CAPMODE(revoke, "/tmp/cap_capmode_revoke");
+	CHECK_CAPMODE(stat, "/tmp/cap_capmode_stat", &sb);
+	CHECK_CAPMODE(symlink,
+	    "/tmp/cap_capmode_symlink_from",
+	    "/tmp/cap_capmode_symlink_to");
+	CHECK_CAPMODE(unlink, "/tmp/cap_capmode_unlink");
+	CHECK_CAPMODE(unmount, "/not_mounted", 0);
 
-	if (chdir("/tmp/cap_test_syscalls_chdir") < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:chdir");
-	} else
-		warnx("test_syscalls:chdir succeeded");
-
-	if (chflags("/tmp/cap_test_syscalls_chflags", UF_NODUMP) < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:chflags");
-	} else
-		warnx("test_syscalls:chflags succeeded");
-
-	if (chmod("/tmp/cap_test_syscalls_chmod", 0644) < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:chmod");
-	} else
-		warnx("test_syscalls:chmod succeeded");
-
-	if (chown("/tmp/cap_test_syscalls_chown", -1, -1) < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:chown");
-	} else
-		warnx("test_syscalls:chown succeeded");
-
-	if (chroot("/tmp/cap_test_syscalls_chroot") < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:chroot");
-	} else
-		warnx("test_syscalls:chroot succeeded");
-
-	if (close(fd_close)) {
-		if (errno == ECAPMODE)
-			warnx("test_syscalls:close");
-		else
-			warn("test_syscalls:close");
-	}
-
-	if (connect(PF_INET, (struct sockaddr *)&sin, sizeof(sin)) < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscall:connect");
-	} else
-		warnx("test_syscall:connect succeeded");
-
-	fd = creat("/tmp/cap_test_syscalls_creat", 0644);
-	if (fd >= 0) {
-		warnx("test_syscalls:creat succeeded");
-		close(fd);
-	} else if (errno != ECAPMODE)
-		warn("test_syscalls:creat");
-
-	fd = dup(fd_file);
-	if (fd < 0) {
-		if (errno == ECAPMODE)
-			warnx("test_syscalls:dup");
-	} else
-		close(fd);
+	/*
+	 * System calls that are permitted in capability mode.
+	 */
+	CHECK_SYSCALL_SUCCEEDS(close, fd_close);
+	CHECK_SYSCALL_SUCCEEDS(dup, fd_file);
+	CHECK_SYSCALL_SUCCEEDS(fstat, fd_file, &sb);
+	CHECK_SYSCALL_SUCCEEDS(lseek, fd_file, SEEK_SET, 0);
+	CHECK_SYSCALL_SUCCEEDS(msync, &fd_file, 8192, MS_ASYNC);
+	CHECK_SYSCALL_SUCCEEDS(profil, NULL, 0, 0, 0);
+	CHECK_SYSCALL_SUCCEEDS(read, fd_file, &ch, sizeof(ch));
+	CHECK_SYSCALL_SUCCEEDS(recvfrom, fd_socket, NULL, 0, 0, NULL, NULL);
+	CHECK_SYSCALL_SUCCEEDS(setuid, getuid());
+	CHECK_SYSCALL_SUCCEEDS(write, fd_file, &ch, sizeof(ch));
 
-	if (fchdir(fd_dir) < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscall:fchdir");
-	} else
-		warnx("test_syscalls:fchdir succeeded");
+	/*
+	 * These calls will fail for lack of e.g. a proper name to send to,
+	 * but they are allowed in capability mode, so errno != ECAPMODE.
+	 */
+	CHECK_NOT_CAPMODE(accept, fd_socket, NULL, NULL);
+	CHECK_NOT_CAPMODE(getpeername, fd_socket, NULL, NULL);
+	CHECK_NOT_CAPMODE(getsockname, fd_socket, NULL, NULL);
+	CHECK_NOT_CAPMODE(fchflags, fd_file, UF_NODUMP);
+	CHECK_NOT_CAPMODE(recvmsg, fd_socket, NULL, 0);
+	CHECK_NOT_CAPMODE(sendmsg, fd_socket, NULL, 0);
+	CHECK_NOT_CAPMODE(sendto, fd_socket, NULL, 0, 0, NULL, 0);
 
-	if (fchflags(fd_file, UF_NODUMP) < 0) {
-		if (errno == ECAPMODE)
-			warnx("test_syscall:fchflags");
-	}
+	/*
+	 * System calls which should be allowed in capability mode, but which
+	 * don't return errors, and are thus difficult to check.
+	 *
+	 * We will try anyway, by checking errno.
+	 */
+	CHECK_SYSCALL_VOID_NOT_ECAPMODE(getegid);
+	CHECK_SYSCALL_VOID_NOT_ECAPMODE(geteuid);
+	CHECK_SYSCALL_VOID_NOT_ECAPMODE(getgid);
+	CHECK_SYSCALL_VOID_NOT_ECAPMODE(getpid);
+	CHECK_SYSCALL_VOID_NOT_ECAPMODE(getppid);
+	CHECK_SYSCALL_VOID_NOT_ECAPMODE(getuid);
 
+	/*
+	 * Finally, tests for system calls that don't fit the pattern very well.
+	 */
 	pid = fork();
 	if (pid >= 0) {
 		if (pid == 0) {
@@ -202,225 +161,40 @@ test_capmode(void)
 			wpid = waitpid(pid, NULL, 0);
 			if (wpid < 0) {
 				if (errno != ECAPMODE)
-					warn("test_syscalls:waitpid");
+					FAIL("capmode:waitpid");
 			} else
-				warnx("test_syscalls:waitpid succeeded");
+				FAIL("capmode:waitpid succeeded");
 		}
 	} else
-		warn("test_syscalls:fork");
-
-	if (fstat(fd_file, &sb) < 0) {
-		if (errno == ECAPMODE)
-			warnx("test_syscalls:fstat");
-	}
-
-	/*
-	 * getegid() can't return an error but check for it anyway.
-	 */
-	errno = 0;
-	(void)getegid();
-	if (errno == ECAPMODE)
-		warnx("test_syscalls:getegid");
-
-	/*
-	 * geteuid() can't return an error but check for it anyway.
-	 */
-	errno = 0;
-	geteuid();
-	if (errno == ECAPMODE)
-		warnx("test_syscalls:geteuid");
-
-	if (getfsstat(&statfs, sizeof(statfs), MNT_NOWAIT) < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:getfsstat");
-	} else
-		warnx("test_syscalls:getfsstat succeeded");
-
-	/*
-	 * getgid() can't return an error but check for it anyway.
-	 */
-	errno = 0;
-	getgid();
-	if (errno == ECAPMODE)
-		warnx("test_syscalls:getgid");
-
-	if (getpeername(fd_socket, NULL, NULL) < 0) {
-		if (errno == ECAPMODE)
-			warnx("test_syscalls:getpeername");
-	}
+		FAIL("capmode:fork");
 
 	if (getlogin() == NULL)
-		warn("test_sycalls:getlogin %d", errno);
-
-	/*
-	 * getpid() can't return an error but check for it anyway.
-	 */
-	errno = 0;
-	(void)getpid();
-	if (errno == ECAPMODE)
-		warnx("test_syscalls:getpid");
-
-	/*
-	 * getppid() can't return an error but check for it anyway.
-	 */
-	errno = 0;
-	(void)getppid();
-	if (errno == ECAPMODE)
-		warnx("test_syscalls:getppid");
+		FAIL("test_sycalls:getlogin %d", errno);
 
 	if (getsockname(fd_socket, NULL, NULL) < 0) {
 		if (errno == ECAPMODE)
-			warnx("test_syscalls:getsockname");
+			FAIL("capmode:getsockname");
 	}
 
-	/*
-	 * getuid() can't return an error but check for it anyway.
-	 */
-	errno = 0;
-	(void)getuid();
-	if (errno == ECAPMODE)
-		warnx("test_syscalls:getuid");
-
 	/* XXXRW: ktrace */
 
-	if (link("/tmp/foo", "/tmp/bar") < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:link");
-	} else
-		warnx("test_syscalls:link succeeded");
-
-	ret = lseek(fd_file, SEEK_SET, 0);
-	if (ret < 0) {
-		if (errno == ECAPMODE)
-			warnx("test_syscalls:lseek");
-		else
-			warn("test_syscalls:lseek");
-	}
-
-	if (lstat("/tmp/cap_test_syscalls_lstat", &sb) < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:lstat");
-	} else
-		warnx("test_syscalls:lstat succeeded");
-
-	if (mknod("/tmp/test_syscalls_mknod", 06440, 0) < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:mknod");
-	} else
-		warnx("test_syscalls:mknod succeeded");
-
-	/*
-	 * mount() is a bit tricky but do our best.
-	 */
-	if (mount("procfs", "/not_mounted", 0, NULL) < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:mount");
-	} else
-		warnx("test_syscalls:mount succeeded");
-
-	if (msync(&fd_file, 8192, MS_ASYNC) < 0) {
-		if (errno == ECAPMODE)
-			warnx("test_syscalls:msync");
-	}
-
-	fd = open("/dev/null", O_RDWR);
-	if (fd >= 0) {
-		warnx("test_syscalls:open succeeded");
-		close(fd);
-	}
-
 	if (pipe(fd2) == 0) {
 		close(fd2[0]);
 		close(fd2[1]);
 	} else if (errno == ECAPMODE)
-		warnx("test_syscalls:pipe");
-
-	if (profil(NULL, 0, 0, 0) < 0) {
-		if (errno == ECAPMODE)
-			warnx("test_syscalls:profile");
-	}
+		FAIL("capmode:pipe");
 
 	/* XXXRW: ptrace. */
 
-	len = read(fd_file, &ch, sizeof(ch));
-	if (len < 0 && errno == ECAPMODE)
-		warnx("test_syscalls:read");
-
-	if (readlink("/tmp/cap_test_syscalls_readlink", NULL, 0) < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:readlink");
-	} else
-		warnx("test_syscalls:readlink succeeded");
-
-	len = recvfrom(fd_socket, NULL, 0, 0, NULL, NULL);
-	if (len < 0 && errno == ECAPMODE)
-		warnx("test_syscalls:recvfrom");
-
-	len = recvmsg(fd_socket, NULL, 0);
-	if (len < 0 && errno == ECAPMODE)
-		warnx("test_syscalls:recvmsg");
-
-	if (revoke("/tmp/cap_test_syscalls_revoke") < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:revoke");
-	} else
-		warnx("test_syscalls:revoke succeeded");
-
-	len = sendmsg(fd_socket, NULL, 0);
-	if (len < 0 && errno == ECAPMODE)
-		warnx("test_syscalls:sendmsg");
-
-	len = sendto(fd_socket, NULL, 0, 0, NULL, 0);
-	if (len < 0 && errno == ECAPMODE)
-		warn("test_syscalls:sendto(NULL)");
-
-	if (setuid(getuid()) < 0) {
-		if (errno == ECAPMODE)
-			warnx("test_syscalls:setuid");
-	}
-
-	if (stat("/tmp/cap_test_syscalls_stat", &sb) < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:stat");
-	} else
-		warnx("test_syscalls:stat succeeded");
-
-	if (symlink("/tmp/cap_test_syscalls_symlink_from",
-	    "/tmp/cap_test_syscalls_symlink_to") < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:symlink");
-	} else
-		warnx("test_syscalls:symlink succeeded");
-
 	/* sysarch() is, by definition, architecture-dependent */
-	if (ARCH_IS("i386") || ARCH_IS("amd64")) {
-		if (sysarch(I386_SET_IOPERM, &sysarch_arg) != -1)
-			warnx("test_syscalls:sysarch succeeded");
-		else if (errno != ECAPMODE)
-			warn("test_syscalls:sysarch errno != ECAPMODE");
-
-		/* XXXJA: write a test for arm */
-	} else {
-		warnx("test_syscalls:no sysarch() test for architecture '%s'", MACHINE);
-	}
+#if defined (__amd64__) || defined (__i386__)
+	CHECK_CAPMODE(sysarch, I386_SET_IOPERM, &sysarch_arg);
+#else
+	/* XXXJA: write a test for arm */
+	FAIL("capmode:no sysarch() test for current architecture");
+#endif
 
 	/* XXXRW: No error return from sync(2) to test. */
 
-	if (unlink("/tmp/cap_test_syscalls_unlink") < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:unlink");
-	} else
-		warnx("test_syscalls:unlink succeeded");
-
-	if (unmount("/not_mounted", 0) < 0) {
-		if (errno != ECAPMODE)
-			warn("test_syscalls:unmount");
-	} else
-		warnx("test_syscalls:unmount succeeded");
-
-	len = write(fd_file, &ch, sizeof(ch));
-	if (len < 0 && errno == ECAPMODE)
-		warnx("test_syscalls:write");
-
-	exit(0);
+	return (success);
 }
diff --git a/tools/regression/security/cap_test/cap_test_sysctl.c b/tools/regression/security/cap_test/cap_test_sysctl.c
index 4376eec30a2b..5ec6dafe086c 100644
--- a/tools/regression/security/cap_test/cap_test_sysctl.c
+++ b/tools/regression/security/cap_test/cap_test_sysctl.c
@@ -1,5 +1,6 @@
 /*-
  * Copyright (c) 2008-2011 Robert N. M. Watson
+ * Copyright (c) 2011 Jonathan Anderson
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -35,11 +36,11 @@ __FBSDID("$FreeBSD$");
 
 #include <sys/types.h>
 #include <sys/capability.h>
+#include <sys/errno.h>
 #include <sys/sysctl.h>
 #include <sys/wait.h>
 
 #include <err.h>
-#include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
@@ -50,18 +51,17 @@ __FBSDID("$FreeBSD$");
  * Certain sysctls are permitted in capability mode, but most are not.  Test
  * for the ones that should be, and try one or two that shouldn't.
  */
-void
+int
 test_sysctl(void)
 {
-	int error, i, oid[2];
+	int i, oid[2];
+	int success = PASSED;
 	size_t len;
 
 	oid[0] = CTL_KERN;
 	oid[1] = KERN_OSRELDATE;
 	len = sizeof(i);
-	error = sysctl(oid, 2, &i, &len, NULL, 0);
-	if (error)
-		warnx("capmode and kern.osreldate failed error %d", errno);
+	CHECK(sysctl(oid, 2, &i, &len, NULL, 0) == 0);
 
-	exit(0);
+	return (success);
 }