1 #include "config.h" 2 #include <stdio.h> 3 #include <stdlib.h> 4 #include <cap-ng.h> 5 #include <pthread.h> 6 7 //#define DEBUG 1 8 9 pthread_t thread1, thread2; 10 thread1_main(void * arg)11void *thread1_main(void *arg) 12 { 13 capng_fill(CAPNG_SELECT_BOTH); 14 #ifdef DEBUG 15 printf("thread1 filled capabilities\n"); 16 #endif 17 sleep(2); 18 if (capng_have_capabilities(CAPNG_SELECT_CAPS) < CAPNG_FULL) { 19 printf("Capabilities missing when there should be some\n"); 20 exit(1); 21 } 22 #ifdef DEBUG 23 printf("SUCCESS: Full capabilities reported\n"); 24 #endif 25 return NULL; 26 } 27 thread2_main(void * arg)28void *thread2_main(void *arg) 29 { 30 sleep(1); 31 #ifdef DEBUG 32 printf("thread2 getting capabilities\n"); 33 #endif 34 if (capng_get_caps_process()) { 35 printf("Unable to get process capabilities"); 36 exit(1); 37 } 38 if (capng_have_capabilities(CAPNG_SELECT_CAPS) != CAPNG_NONE) { 39 printf("Detected capabilities when there should not be any\n"); 40 exit(1); 41 } 42 capng_clear(CAPNG_SELECT_BOTH); 43 #ifdef DEBUG 44 printf("SUCCESS: No capabilities reported\n"); 45 #endif 46 return NULL; 47 } 48 main(void)49int main(void) 50 { 51 // This test must be run as root which naturally has all capabilities 52 // set. So, we need to clear the capabilities so that we can see if 53 // the test works. 54 capng_clear(CAPNG_SELECT_CAPS); 55 if (capng_apply(CAPNG_SELECT_CAPS)) { 56 printf("Clearing capabilities failed"); 57 return 1; 58 } 59 60 printf("Testing thread separation of capabilities\n"); 61 pthread_create(&thread1, NULL, thread1_main, NULL); 62 pthread_create(&thread2, NULL, thread2_main, NULL); 63 sleep(3); 64 return 0; 65 } 66 67