src/test/test-capability.c

6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier/***
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier  This file is part of systemd
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier  Copyright 2014 Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier  systemd is free software; you can redistribute it and/or modify it
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier  under the terms of the GNU Lesser General Public License as published by
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier  the Free Software Foundation; either version 2.1 of the License, or
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier  (at your option) any later version.
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier  systemd is distributed in the hope that it will be useful, but
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier  WITHOUT ANY WARRANTY; without even the implied warranty of
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier  Lesser General Public License for more details.
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier  You should have received a copy of the GNU Lesser General Public License
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier  along with systemd; If not, see <http://www.gnu.org/licenses/>.
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier***/
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier#include <netinet/in.h>
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier#include <pwd.h>
3ffd4af22052963e7a29431721ee204e634bea75Lennart Poettering#include <sys/capability.h>
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen#include <sys/prctl.h>
3ffd4af22052963e7a29431721ee204e634bea75Lennart Poettering#include <sys/socket.h>
3ffd4af22052963e7a29431721ee204e634bea75Lennart Poettering#include <sys/wait.h>
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier#include <unistd.h>
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
430f0182b72373145c839dbfe99d2382855cb8f8Lennart Poettering#include "capability-util.h"
3ffd4af22052963e7a29431721ee204e634bea75Lennart Poettering#include "fd-util.h"
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier#include "macro.h"
3ffd4af22052963e7a29431721ee204e634bea75Lennart Poettering#include "util.h"
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalierstatic uid_t test_uid = -1;
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalierstatic gid_t test_gid = -1;
3ffd4af22052963e7a29431721ee204e634bea75Lennart Poettering
3ffd4af22052963e7a29431721ee204e634bea75Lennart Poettering/* We keep CAP_DAC_OVERRIDE to avoid errors with gcov when doing test coverage */
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalierstatic uint64_t test_flags = 1ULL << CAP_DAC_OVERRIDE;
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalierstatic void fork_test(void (*test_func)(void)) {
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        pid_t pid = 0;
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        pid = fork();
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(pid >= 0);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        if (pid == 0) {
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier                test_func();
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier                exit(0);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        } else if (pid > 0) {
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier                int status;
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier                assert_se(waitpid(pid, &status, 0) > 0);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier                assert_se(WIFEXITED(status) && WEXITSTATUS(status) == 0);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        }
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier}
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalierstatic void show_capabilities(void) {
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        cap_t caps;
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        char *text;
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        caps = cap_get_proc();
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(caps);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        text = cap_to_text(caps, NULL);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(text);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        log_info("Capabilities:%s", text);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        cap_free(caps);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        cap_free(text);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier}
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinenstatic int setup_tests(bool *run_ambient) {
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        struct passwd *nobody;
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        int r;
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        nobody = getpwnam("nobody");
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        if (!nobody) {
56f64d95763a799ba4475daf44d8e9f72a1bd474Michal Schmidt                log_error_errno(errno, "Could not find nobody user: %m");
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier                return -EXIT_TEST_SKIP;
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        }
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        test_uid = nobody->pw_uid;
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        test_gid = nobody->pw_gid;
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        *run_ambient = false;
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        /* There's support for PR_CAP_AMBIENT if the prctl() call
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen         * succeeded or error code was something else than EINVAL. The
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen         * EINVAL check should be good enough to rule out false
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen         * positives. */
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        if (r >= 0 || errno != EINVAL)
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen                *run_ambient = true;
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        return 0;
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier}
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalierstatic void test_drop_privileges_keep_net_raw(void) {
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        int sock;
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(sock >= 0);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        safe_close(sock);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(drop_privileges(test_uid, test_gid, test_flags | (1ULL << CAP_NET_RAW)) >= 0);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(getuid() == test_uid);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(getgid() == test_gid);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        show_capabilities();
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(sock >= 0);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        safe_close(sock);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier}
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalierstatic void test_drop_privileges_dontkeep_net_raw(void) {
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        int sock;
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(sock >= 0);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        safe_close(sock);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(getuid() == test_uid);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(getgid() == test_gid);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        show_capabilities();
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(sock < 0);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier}
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalierstatic void test_drop_privileges_fail(void) {
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(drop_privileges(test_uid, test_gid, test_flags) >= 0);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(getuid() == test_uid);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(getgid() == test_gid);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(drop_privileges(test_uid, test_gid, test_flags) < 0);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(drop_privileges(0, 0, test_flags) < 0);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier}
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalierstatic void test_drop_privileges(void) {
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        fork_test(test_drop_privileges_keep_net_raw);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        fork_test(test_drop_privileges_dontkeep_net_raw);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        fork_test(test_drop_privileges_fail);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier}
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalierstatic void test_have_effective_cap(void) {
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(have_effective_cap(CAP_KILL));
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(have_effective_cap(CAP_CHOWN));
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(drop_privileges(test_uid, test_gid, test_flags | (1ULL << CAP_KILL)) >= 0);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(getuid() == test_uid);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(getgid() == test_gid);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(have_effective_cap(CAP_KILL));
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        assert_se(!have_effective_cap(CAP_CHOWN));
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier}
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinenstatic void test_update_inherited_set(void) {
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        cap_t caps;
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        uint64_t set = 0;
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        cap_flag_value_t fv;
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        caps = cap_get_proc();
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        assert_se(caps);
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        assert(fv == CAP_CLEAR);
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        set = (UINT64_C(1) << CAP_CHOWN);
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        assert_se(!capability_update_inherited_set(caps, set));
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        assert(fv == CAP_SET);
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        cap_free(caps);
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen}
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinenstatic void test_set_ambient_caps(void) {
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        cap_t caps;
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        uint64_t set = 0;
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        cap_flag_value_t fv;
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        caps = cap_get_proc();
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        assert_se(caps);
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        assert(fv == CAP_CLEAR);
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        cap_free(caps);
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        assert_se(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) == 0);
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        set = (UINT64_C(1) << CAP_CHOWN);
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        assert_se(!capability_ambient_set_apply(set, true));
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        caps = cap_get_proc();
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        assert_se(!cap_get_flag(caps, CAP_CHOWN, CAP_INHERITABLE, &fv));
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        assert(fv == CAP_SET);
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        cap_free(caps);
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        assert_se(prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) == 1);
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen}
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalierint main(int argc, char *argv[]) {
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        int r;
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        bool run_ambient;
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        log_parse_environment();
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        log_open();
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        if (getuid() != 0)
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier                return EXIT_TEST_SKIP;
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        r = setup_tests(&run_ambient);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        if (r < 0)
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier                return -r;
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        show_capabilities();
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        test_drop_privileges();
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        test_update_inherited_set();
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        fork_test(test_have_effective_cap);
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen        if (run_ambient)
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen                fork_test(test_set_ambient_caps);
70d7aea5c7270764ee71d6828e76402001afed13Ismo Puustinen
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier        return 0;
6160e473fc2c52ab7c06f1d884a8901d2a5b6b73Ronny Chevalier}