check.bend

bend-osdev-caps@0.1.0.0 · 108 lines · 9 definitions

1import Base
2import bend-osdev-caps@0.1.0.0/caps.bend as C
3import bend-osdev-caps@0.1.0.0/exec.bend as E
4import bend-osdev-caps@0.1.0.0/adjust.bend as A
5
6def show_err(e: C.CapsError) -> String:
7  match e:
8    case C.CapsInvalidCap{}:
9      "EINVAL invalid capability"
10    case C.CapsPermittedGrows{}:
11      "EPERM permitted set grows"
12    case C.CapsEffectiveNotPermitted{}:
13      "EPERM effective not permitted"
14    case C.CapsInheritableNotBounded{}:
15      "EPERM inheritable not bounded"
16    case C.CapsInheritableNotPermitted{}:
17      "EPERM inheritable not permitted"
18    case C.CapsNoSetpcap{}:
19      "EPERM no CAP_SETPCAP"
20    case C.CapsAmbientRaiseLocked{}:
21      "EPERM ambient raise locked"
22    case C.CapsAmbientNotAllowed{}:
23      "EPERM ambient not allowed"
24    case C.CapsCapabilityDumb{}:
25      "EPERM capability-dumb binary"
26
27def show_sets(s: C.CapState) -> String:
28  match s:
29    case C.CapState{p, i, e, b, a}:
30      "p=" ++ C.CapSet.show(p) ++ " i=" ++ C.CapSet.show(i) ++ " e=" ++ C.CapSet.show(e) ++ " b=" ++ C.CapSet.show(b) ++ " a=" ++ C.CapSet.show(a)
31
32def show(r: Result<&2, &2, C.CapsError, C.CapCred>) -> String:
33  match r:
34    case Fail{e}:
35      show_err(e)
36    case Done{C.CapCred{ru, eu, sv, nr, na, s}}:
37      "euid=" ++ U32.show(eu) ++ " " ++ show_sets(s)
38
39def show_name(m: Maybe<&2, String>) -> String:
40  match m:
41    case None{}:
42      "none"
43    case Some{s}:
44      s
45
46def user(s: C.CapState) -> C.CapCred:
47  C.CapCred{1000, 1000, 1000, False{}, False{}, s}
48
49# no capabilities, the full bounding set
50def nothing() -> C.CapState:
51  C.CapState{C.CapSet.empty(), C.CapSet.empty(), C.CapSet.empty(), C.CapSet.full(), C.CapSet.empty()}
52
53# CAP_NET_BIND_SERVICE permitted, inheritable and ambient
54def ambient_bind() -> C.CapState:
55  C.CapState{C.CapSet.of(10), C.CapSet.of(10), C.CapSet.empty(), C.CapSet.full(), C.CapSet.of(10)}
56
57def ping() -> C.CapFile:
58  C.CapFile{0, False{}, False{}, Some{C.CapFileSets{C.CapSet.of(13), C.CapSet.empty(), True{}}}}
59
60def main() -> IO(Unit):
61  do IO<Unit>:
62    IO.print(show_name(C.Cap.name(0)) ++ " " ++ show_name(C.Cap.name(21)) ++ " " ++ show_name(C.Cap.name(40)) ++ " " ++ show_name(C.Cap.name(41)))
63    IO.print(C.CapSet.show(C.CapSet.full()))
64    IO.print(C.CapSet.show(C.CapSet.from_list([0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 31, 32, 40])))
65    IO.print(List.show(~&2, ~U32, ~U32.show, C.CapSet.to_list(C.CapSet.from_w64(C.CapSet.to_w64(C.CapSet.from_list([40, 13, 2]))))))
66    IO.print(show(E.Caps.execve(C.CapsKernel.linux(), user(nothing()), ping(), False{})))
67    IO.print(show(E.Caps.execve(C.CapsKernel.linux(), user(C.CapState.with_bounding(nothing(), C.CapSet.del(C.CapSet.full(), 13))), ping(), False{})))
68    IO.print(show(E.Caps.execve(C.CapsKernel.linux(), user(nothing()), C.CapFile{0, True{}, False{}, None{}}, False{})))
69    IO.print(show(E.Caps.execve(C.CapsKernel.linux(), user(nothing()), C.CapFile{0, True{}, False{}, None{}}, True{})))
70    IO.print(show(E.Caps.execve(C.CapsKernel.linux(), C.CapCred{0, 0, 0, False{}, False{}, nothing()}, C.CapFile{1000, False{}, False{}, None{}}, False{})))
71    IO.print(show(E.Caps.execve(C.CapsKernel.linux(), C.CapCred{0, 0, 0, True{}, False{}, nothing()}, C.CapFile{1000, False{}, False{}, None{}}, False{})))
72    IO.print(show(E.Caps.execve(C.CapsKernel.linux(), user(ambient_bind()), C.CapFile{1000, False{}, False{}, None{}}, False{})))
73    IO.print(show(E.Caps.execve(C.CapsKernel.linux(), user(ambient_bind()), C.CapFile{1000, False{}, True{}, None{}}, False{})))
74    IO.print(show(E.Caps.execve(C.CapsKernel{40, False{}}, user(nothing()), ping(), False{})))
75    IO.print(show(A.Caps.capset(user(ambient_bind()), C.CapSet.empty(), C.CapSet.of(10), C.CapSet.empty())))
76    IO.print(show(A.Caps.capset(user(ambient_bind()), C.CapSet.of(10), C.CapSet.from_list([10, 12]), C.CapSet.of(10))))
77    IO.print(show(A.Caps.capset(user(ambient_bind()), C.CapSet.of(12), C.CapSet.of(10), C.CapSet.of(10))))
78    IO.print(show(A.Caps.capset(user(ambient_bind()), C.CapSet.empty(), C.CapSet.of(10), C.CapSet.from_list([10, 12]))))
79    IO.print(show(A.Caps.bset_drop(C.CapsKernel.linux(), user(ambient_bind()), 13)))
80    IO.print(show(A.Caps.bset_drop(C.CapsKernel.linux(), user(C.CapState{C.CapSet.of(8), C.CapSet.empty(), C.CapSet.of(8), C.CapSet.full(), C.CapSet.empty()}), 13)))
81    IO.print(show(A.Caps.bset_drop(C.CapsKernel{38, True{}}, user(C.CapState{C.CapSet.of(8), C.CapSet.empty(), C.CapSet.of(8), C.CapSet.full(), C.CapSet.empty()}), 39)))
82    IO.print(show(A.Caps.ambient_raise(C.CapsKernel.linux(), user(C.CapState{C.CapSet.of(12), C.CapSet.of(12), C.CapSet.empty(), C.CapSet.full(), C.CapSet.empty()}), 12)))
83    IO.print(show(A.Caps.ambient_raise(C.CapsKernel.linux(), C.CapCred{1000, 1000, 1000, False{}, True{}, C.CapState{C.CapSet.of(12), C.CapSet.of(12), C.CapSet.empty(), C.CapSet.full(), C.CapSet.empty()}}, 12)))
84    IO.print(show(A.Caps.ambient_lower(C.CapsKernel.linux(), user(ambient_bind()), 10)))
85
86#|CAP_CHOWN CAP_SYS_ADMIN CAP_CHECKPOINT_RESTORE none
87#|000001ffffffffff
88#|0000010180003fff
89#|[2, 13, 40]
90#|euid=1000 p=0000000000002000 i=0000000000000000 e=0000000000002000 b=000001ffffffffff a=0000000000000000
91#|EPERM capability-dumb binary
92#|euid=0 p=000001ffffffffff i=0000000000000000 e=000001ffffffffff b=000001ffffffffff a=0000000000000000
93#|euid=1000 p=0000000000000000 i=0000000000000000 e=0000000000000000 b=000001ffffffffff a=0000000000000000
94#|euid=0 p=000001ffffffffff i=0000000000000000 e=000001ffffffffff b=000001ffffffffff a=0000000000000000
95#|euid=0 p=0000000000000000 i=0000000000000000 e=0000000000000000 b=000001ffffffffff a=0000000000000000
96#|euid=1000 p=0000000000000400 i=0000000000000400 e=0000000000000400 b=000001ffffffffff a=0000000000000400
97#|euid=1000 p=0000000000000000 i=0000000000000400 e=0000000000000000 b=000001ffffffffff a=0000000000000000
98#|euid=1000 p=0000000000000000 i=0000000000000000 e=0000000000000000 b=000001ffffffffff a=0000000000000000
99#|euid=1000 p=0000000000000400 i=0000000000000000 e=0000000000000000 b=000001ffffffffff a=0000000000000000
100#|EPERM permitted set grows
101#|EPERM effective not permitted
102#|EPERM inheritable not permitted
103#|EPERM no CAP_SETPCAP
104#|euid=1000 p=0000000000000100 i=0000000000000000 e=0000000000000100 b=000001ffffffdfff a=0000000000000000
105#|EINVAL invalid capability
106#|euid=1000 p=0000000000001000 i=0000000000001000 e=0000000000000000 b=000001ffffffffff a=0000000000001000
107#|EPERM ambient raise locked
108#|euid=1000 p=0000000000000400 i=0000000000000400 e=0000000000000000 b=000001ffffffffff a=0000000000000000