Training courses

Kernel and Embedded Linux

Bootlin training courses

Embedded Linux, kernel,
Yocto Project, Buildroot, real-time,
graphics, boot time, debugging...

Bootlin logo

Elixir Cross Referencer

Open Menu /tests/sys/mac/portacl/misc.sh 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
#!/bin/sh
# $FreeBSD$

sysctl security.mac.portacl >/dev/null 2>&1
if [ $? -ne 0 ]; then
	echo "1..0 # SKIP MAC_PORTACL is unavailable."
	exit 0
fi
if [ $(id -u) -ne 0 ]; then
	echo "1..0 # SKIP testcases must be run as root"
	exit 0
fi

ntest=1

check_bind() {
	local host idtype name proto port udpflag

	host="127.0.0.1"
	timeout=1

	idtype=${1}
	name=${2}
	proto=${3}
	port=${4}

	[ "${proto}" = "udp" ] && udpflag="-u"

	out=$(
		case "${idtype}" in
		uid|gid)
			( echo -n | su -m ${name} -c "nc ${udpflag} -l -w ${timeout} $host $port" 2>&1 ) &
			;;
		jail)
			kill $$
			;;
		*)
			kill $$
		esac
		sleep 0.3
		echo | nc ${udpflag} -w ${timeout} $host $port >/dev/null 2>&1
		wait
	)
	case "${out}" in
	"nc: Permission denied"*|"nc: Operation not permitted"*)
		echo fl
		;;
	"")
		echo ok
		;;
	*)
		echo ${out}
		;;
	esac
}

bind_test() {
	local expect_without_rule expect_with_rule idtype name proto port

	expect_without_rule=${1}
	expect_with_rule=${2}
	idtype=${3}
	name=${4}
	proto=${5}
	port=${6}

	sysctl security.mac.portacl.rules= >/dev/null
	out=$(check_bind ${idtype} ${name} ${proto} ${port})
	if [ "${out}" = "${expect_without_rule}" ]; then
		echo "ok ${ntest}"
	elif [ "${out}" = "ok" -o "${out}" = "fl" ]; then
		echo "not ok ${ntest} # '${out}' != '${expect_without_rule}'"
	else
		echo "not ok ${ntest} # unexpected output: '${out}'"
	fi
	: $(( ntest += 1 ))

	if [ "${idtype}" = "uid" ]; then
		idstr=$(id -u ${name})
	elif [ "${idtype}" = "gid" ]; then
		idstr=$(id -g ${name})
	else
		idstr=${name}
	fi
	sysctl security.mac.portacl.rules=${idtype}:${idstr}:${proto}:${port} >/dev/null
	out=$(check_bind ${idtype} ${name} ${proto} ${port})
	if [ "${out}" = "${expect_with_rule}" ]; then
		echo "ok ${ntest}"
	elif [ "${out}" = "ok" -o "${out}" = "fl" ]; then
		echo "not ok ${ntest} # '${out}' != '${expect_with_rule}'"
	else
		echo "not ok ${ntest} # unexpected output: '${out}'"
	fi
	: $(( ntest += 1 ))

	sysctl security.mac.portacl.rules= >/dev/null
}

reserved_high=$(sysctl -n net.inet.ip.portrange.reservedhigh)
suser_exempt=$(sysctl -n security.mac.portacl.suser_exempt)
port_high=$(sysctl -n security.mac.portacl.port_high)

restore_settings() {
	sysctl -n net.inet.ip.portrange.reservedhigh=${reserved_high} >/dev/null
	sysctl -n security.mac.portacl.suser_exempt=${suser_exempt} >/dev/null
	sysctl -n security.mac.portacl.port_high=${port_high} >/dev/null
}