aboutsummaryrefslogtreecommitdiff
path: root/tests/sys/mac
Commit message (Collapse)AuthorAgeFilesLines
* cred: Fix group_is_primary()Mark Johnston12 days2-0/+85
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This helper wasn't updated in commit be1f7435ef21, so in reality it was testing whether "gid" is the first supplemental group. If a user doesn't belong to a supplementary group, then it's testing an uninitialized slot; since ucreds are allocated with M_ZERO, this typically means that we're testing gid == 0. group_is_primary() has exactly one use, in mac_do. There, it's used to determine whether the requested primary GID can be used in a setcred(2) call when the ruleset does not explicitly specify a target primary GID. I believe this is mostly exploitable by daemons which have explicitly dropped privileges and called setgroups(0, NULL); logged in users will have a non-empty supplementary group list by virtue of having gone through initgroups(3). Fix group_is_primary(), and add a regression test. Approved by: so Security: FreeBSD-SA-26:59.mac_do Security: CVE-2026-58092 Reported by: Hazley Samsudin of GovTech CSG Fixes: be1f7435ef21 ("kern: start tracking cr_gid outside of cr_groups[]") Reviewed by: olce, kevans Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59051
* mac_portacl tests: rewrite the test program and test unspecific family.K Rin2026-06-103-23/+94
| | | | | Reviewed by: imp,emaste Pull Request: https://github.com/freebsd/freebsd-src/pull/1659
* MAC/do: Fix double-free on parse error after "executable paths" featureOlivier Certner2026-06-011-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | parse_rules() has been calling toast_rules() in case of a parse error in order to deallocate the 'struct rule' objects it has constructed up to that point. toast_rules() would take a pointer to a full 'struct rules' object, and besides freeing all 'struct rule' referenced by it, would also free the holding 'struct rules' itself. With the introduction of the "executable paths" feature, and the embedding of 'struct rules' into 'struct conf', meaning that the lifecycle for 'struct rules' was no longer independent, toast_rules() was changed not to free the passed 'struct rules' (as it was a field of a 'struct conf' object). Unfortunately, this change was not completed with a reinitialization of the rules list head, so the 'struct conf' object would continue to reference just-freed rules, which then would be freed a second time on destruction of that container. So, make toast_rules() re-initialize the rules list in 'struct rules', which it logically has been having to do since not freeing the enclosing 'struct rules'. This alone is enough to fix the bug, but let's use the occasion to change the contract of parse_rules() and bring its herald comment up-to-date: On error, parse_rules() now simply leaves already constructed 'struct rule' objects in 'conf'. The latter is eventually destroyed and the rule objects reclaimed at that point. Add a test trying to set an invalid rules configuration with the first rule being valid and the second being invalid, which triggers the bug (and an immediate panic() on an INVARIANTS kernel). Reported by: impost0r(ret2plt) <impostor@ret2p.lt> Reviewed by: markj Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") Sponsored by: The FreeBSD Foundation
* MAC/do: Add consistency testsOlivier Certner2026-05-292-1/+212
| | | | | | | | | | | | | | | | | | Test that: 1. Concurrent changes to different parameters on the same jail are independent/atomic. 2. Inheritance works. 3. Relaxing only parent jail rules does not leak to a subjail thanks to sequential consistency. 4. Sysctl knobs and jail parameters stay consistent. Some of these tests may be extended in the future with several layers of jails (there is only a single subjail currently). Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38
* MAC/do: Tests: Add support for exec paths, jail parameters, subjailsOlivier Certner2026-05-291-9/+110
| | | | | | | | | | | | And also allow configuration of the mdo(1) executable path. This commit only contains new or modified infrastructure. No functional change intended at this point. Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38
* MAC/do: Tests: Quote the source directoryOlivier Certner2026-05-292-2/+2
| | | | | | | | | | In a standard test suite installation, this is not necessary, but be bullet-proof to custom ones, however improbable. Reviewed by: bapt MFC after: 3 days Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38
* MAC/do: Tests: Declare required programs closer to useOlivier Certner2026-05-292-1/+2
| | | | | | | Reviewed by: bapt MFC after: 3 days Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38
* MAC/do: Tests: Fix copyrightsOlivier Certner2026-05-293-3/+8
| | | | | | | | | No comma needed after a single year. Add SPDX. Reviewed by: bapt MFC after: 3 days Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38
* MAC/do: Tests: Remove shebang linesOlivier Certner2026-05-292-4/+0
| | | | | | | | | They are automatically added by <bsd.test.mk>. Reviewed by: bapt MFC after: 3 days Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38
* MAC/do: Add basic tests on setting rulesOlivier Certner2026-05-215-0/+308
| | | | | MFC after: 1 minute Sponsored by: The FreeBSD Foundation
* tests: Increase timeoutJose Luis Duran2026-01-071-1/+1
| | | | | | | | | | Bump the timeout value, to avoid cutoff on emulated architectures on ci.freebsd.org. Reported by: Jenkins Reviewed by: ngie MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D54550
* tests/mac_ipacl: restore sysctls after modificationSiva Mahadevan2025-10-083-8/+17
| | | | | | | | | | | | While here, use 'required_kmods' instead of ad-hoc checks. Signed-off-by: Siva Mahadevan <me@svmhdvn.name> Reviewed by: markj MFC after: 3 days Sponsored by: The FreeBSD Foundation Pull request: https://github.com/freebsd/freebsd-src/pull/1856
* tests/mac_portacl: restore sysctls after modificationSiva Mahadevan2025-10-084-10/+5
| | | | | | | | | | | | While here, use 'required_kmods' instead of ad-hoc checks. Signed-off-by: Siva Mahadevan <me@svmhdvn.name> Reviewed by: markj MFC after: 3 days Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/1855
* tests/mac_portacl: enable is_exclusive for nowSiva Mahadevan2025-07-251-0/+1
| | | | | | | | | | | | | | Both tests rely on ports 77 and 7777 to be available and thus cannot be run concurrently. This is a temporary measure to ensure that they don't conflict with each other. In the future, these should be rewritten to wait until the necessary ports are available, or deterministically select a free port instead. Signed-off-by: Siva Mahadevan <me@svmhdvn.name> Sponsored by: The FreeBSD Foundation Pull Request: https://github.com/freebsd/freebsd-src/pull/1790
* mac_bsdextended: report that all tests require the kernel moduleAlan Somers2025-07-232-3/+1
| | | | | | | | | | Use the standard required_kmods reporting mechanism to notify Kyua of which kernel modules are required. MFC after: 2 weeks Sponsored by: ConnectWise Reviewed by: Siva Mahadevan <me@svmhdvn.name> Pull Request: https://github.com/freebsd/freebsd-src/pull/1783
* Remove residual blank line at start of MakefileWarner Losh2024-07-155-5/+0
| | | | | | | This is a residual of the $FreeBSD$ removal. MFC After: 3 days (though I'll just run the command on the branches) Sponsored by: Netflix
* tests: Skip all tests that require mdconfig when /dev/mdctl missingWarner Losh2023-09-021-0/+1
| | | | | | | | | | When run in a jail, /dev/mdctl is missing. So skip any tests that use mdconfig or mdmfs with md in this case: they can't possibly work. This is in line with other tests that test for presence of required features and skip if they aren't present. I did this instead of checking for jails so they can still run in jails that allow creation of md devices. Sponsored by: Netflix
* Remove $FreeBSD$: one-line bare tagWarner Losh2023-08-161-1/+0
| | | | Remove /^\s*\$FreeBSD\$$\n/
* Remove $FreeBSD$: one-line sh patternWarner Losh2023-08-1614-14/+0
| | | | Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
* Remove $FreeBSD$: two-line .h patternWarner Losh2023-08-161-2/+0
| | | | Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/
* mac_ipacl: new MAC policy module to limit jail/vnet IP configurationShivank Garg2023-07-264-0/+312
| | | | | | | | | | | | | The mac_ipacl policy module enables fine-grained control over IP address configuration within VNET jails from the base system. It allows the root user to define rules governing IP addresses for jails and their interfaces using the sysctl interface. Requested by: multiple Sponsored by: Google, Inc. (GSoC 2019) MFC after: 2 months Reviewed by: bz, dch (both earlier versions) Differential Revision: https://reviews.freebsd.org/D20967
* Resolve conflict between the fusefs(5) and mac_bsdextended(4) testsAlan Somers2020-05-021-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | mac_bsdextended(4), when enabled, causes ordinary operations to send many more VOP_GETATTRs to file system. The fusefs tests expectations aren't written with those in mind. Optionally expecting them would greatly obfuscate the fusefs tests. Worse, certain fusefs functionality (like attribute caching) would be impossible to test if the tests couldn't expect an exact number of GETATTR operations. This commit resolves that conflict by making two changes: 1. The fusefs tests will now check for mac_bsdextended, and skip if it's enabled. 2. The mac_bsdextended tests will now check whether the module is enabled, not merely loaded. If it's loaded but disabled, the tests will automatically enable it for the duration of the tests. With these changes, a CI system can achieve best coverage by loading both fusefs and mac_bsdextended at boot, and setting security.mac.bsdextended.enabled=0 PR: 244229 Reported by: lwhsu Reviewed by: cem MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D24577 Notes: svn path=/head/; revision=360567
* mac_bsdextended: ATFify the testsAlan Somers2020-04-262-302/+329
| | | | | | | | | | | | The new tests have more complete setup and cleanup, are more granular, and correctly annotate expected failures and skipped tests. A follow-up commit will resolve a conflict with the fusefs tests (bug 244229). MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D24257 Notes: svn path=/head/; revision=360339
* Reduce nc timeout in sys.mac.portacl.*Li-Wen Hsu2020-02-111-2/+3
| | | | | | | | | It is not necessary to wait that long for localhost. Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=357778
* DIRDEPS_BUILD: Update dependencies.Bryan Drewery2017-10-311-1/+0
| | | | | | | Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=325188
* Make test scripts under tests/... non-executableEnji Cooper2017-08-083-0/+0
| | | | | | | | | | Executable bits should be set at install time instead of in the repo. Setting executable bits on files triggers false positives with Phabricator. MFC after: 2 months Notes: svn path=/head/; revision=322214
* Add include Makefiles for tests/sys/{fs,kern,kqueue,mac}/...Enji Cooper2017-01-141-0/+3
|\ | | | | | | | | | | | | | | | | | | | | | | The primary goal for doing this is to leverage the work done in r312114 for enabling WARNS to address trivial code quality issues with new tests MFC after: 6 days Tested with: make tinderbox Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=312194
| * Add include Makefiles for tests/sys/{fs,kern,kqueue,mac}/...Enji Cooper2017-01-141-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | The primary goal for doing this is to leverage the work done in r312114 for enabling WARNS to address trivial code quality issues with new tests MFC after: 6 days Tested with: make tinderbox Sponsored by: Dell EMC Isilon Notes: svn path=/projects/netbsd-tests-upstream-01-2017/; revision=312193
* | Fix -Wformat issueEnji Cooper2017-01-141-1/+1
|/ | | | | | | | | | | | Use %zu for printing out results from nitems, as it's size_t based MFC after: 1 week X-MFC with: r312120 Reported by: gcc (mips:mipsel tinderbox) Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=312164
* Fix warningsEnji Cooper2017-01-141-3/+4
| | | | | | | | | | | | - Staticize test_num - Promote i to size_t to deal with -Wsign-compare issues Tested with: clang, gcc, gcc49 MFC after: 1 week Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=312120
* Only chmod $TMPDIR if it's not /tmpEnji Cooper2016-09-181-3/+5
| | | | | | | | | | | | This is a safety belt to ensure that the /tmp sticky bit stuff doesn't get whacked by accident if someone runs the script outright MFC after: 1 week X-MFC with: r305916 Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=305918
* Make sure $TMPDIR is created with 0755 permissionsEnji Cooper2016-09-181-0/+4
| | | | | | | | | | | This is required to ensure that the temporary script can be executed, as the default mode is apparently too restrictive MFC after: 3 days Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=305916
* Skip testcases 9/10 if jail(8) isn't installedEnji Cooper2016-09-031-20/+26
| | | | | | | | | | These testcases require jail support MFC after: 1 week Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=305357
* Merge ^/user/ngie/release-pkg-fix-tests to unbreak how test files are installedEnji Cooper2016-05-043-10/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | after r298107 Summary of changes: - Replace all instances of FILES/TESTS with ${PACKAGE}FILES. This ensures that namespacing is kept with FILES appropriately, and that this shouldn't need to be repeated if the namespace changes -- only the definition of PACKAGE needs to be changed - Allow PACKAGE to be overridden by callers instead of forcing it to always be `tests`. In the event we get to the point where things can be split up enough in the base system, it would make more sense to group the tests with the blocks they're a part of, e.g. byacc with byacc-tests, etc - Remove PACKAGE definitions where possible, i.e. where FILES wasn't used previously. - Remove unnecessary TESTSPACKAGE definitions; this has been elided into bsd.tests.mk - Remove unnecessary BINDIRs used previously with ${PACKAGE}FILES; ${PACKAGE}FILESDIR is now automatically defined in bsd.test.mk. - Fix installation of files under data/ subdirectories in lib/libc/tests/hash and lib/libc/tests/net/getaddrinfo - Remove unnecessary .include <bsd.own.mk>s (some opportunistic cleanup) Document the proposed changes in share/examples/tests/tests/... via examples so it's clear that ${PACKAGES}FILES is the suggested way forward in terms of replacing FILES. share/mk/bsd.README didn't seem like the appropriate method of communicating that info. MFC after: never probably X-MFC with: r298107 PR: 209114 Relnotes: yes Tested with: buildworld, installworld, checkworld; buildworld, packageworld Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=299094
* MFHGlen Barber2016-03-103-0/+41
|\ | | | | | | | | | | | | Sponsored by: The FreeBSD Foundation Notes: svn path=/projects/release-pkg/; revision=296625
| * DIRDEPS_BUILD: Connect MK_TESTS.Bryan Drewery2016-03-093-0/+41
| | | | | | | | | | | | | | Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=296587
* | More 'tests' package fixes.Glen Barber2016-02-033-0/+9
|/ | | | | | | Sponsored by: The FreeBSD Foundation Notes: svn path=/projects/release-pkg/; revision=295179
* Delete the comment about running `test_libugidfw_strings` before testingEnji Cooper2015-12-231-5/+0
| | | | | | | | | | | `mac_is_present` so it doesn't accidentally confuse people MFC after: 3 days X-MFC with: r292650 Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=292651
* Move mac_bsdextended check up before running the test_libugidfw_strings ↵Enji Cooper2015-12-231-10/+10
| | | | | | | | | | | | | | | | testcases I realize that these tests could be run before mac_bsdextended is loaded, but it would overcomplicate things to special case handle the testcases before doing the mac_bsdextended(4) feature check The testcases will be split up so they can be run separately in the near future MFC after: 3 days Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=292650
* Integrate tools/regression/mac/mac_bsdextended andEnji Cooper2015-12-219-0/+898
tools/regression/mac/mac_portacl into the FreeBSD test suite as tests/sys/mac/bsdextended and tests/sys/mac/portacl, respectively MFC after: 1 month Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=292570
generated by cgit v1.3 (git 2.53.0) at 2026-09-06 06:31:57 +0000