1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
#
# NOTE the built tests are all designed to be run from this
# working directory when built DYNAMIC=yes. That is, they
# link to the shared libraries in ../libcap/ .
#
topdir=$(shell pwd)/..
include ../Make.Rules
#
all:
make libcap_launch_test
ifeq ($(PTHREADS),yes)
make psx_test libcap_psx_test libcap_psx_launch_test
endif
install: all
ifeq ($(DYNAMIC),yes)
LINKEXTRA=-Wl,-rpath,../libcap
DEPS=../libcap/libcap.so
ifeq ($(PTHREADS),yes)
DEPS += ../libcap/libpsx.so
endif
else
LDFLAGS += --static
DEPS=../libcap/libcap.a
ifeq ($(PTHREADS),yes)
DEPS += ../libcap/libpsx.a
endif
endif
../libcap/libcap.so:
make -C ../libcap libcap.so
../libcap/libcap.a:
make -C ../libcap libcap.a
ifeq ($(PTHREADS),yes)
../libcap/libpsx.so:
make -C ../libcap libpsx.so
../libcap/libpsx.a:
make -C ../libcap libpsx.a
endif
../progs/tcapsh-static:
make -C ../progs tcapsh-static
test:
ifeq ($(PTHREADS),yes)
make run_psx_test run_libcap_psx_test
endif
sudotest: test
make run_libcap_launch_test
ifeq ($(PTHREADS),yes)
make run_libcap_psx_launch_test run_exploit_test
endif
# unprivileged
run_psx_test: psx_test
./psx_test
psx_test: psx_test.c $(DEPS)
$(CC) $(CFLAGS) $(IPATH) $< -o $@ $(LINKEXTRA) $(LIBPSXLIB) $(LDFLAGS)
run_libcap_psx_test: libcap_psx_test
./libcap_psx_test
libcap_psx_test: libcap_psx_test.c $(DEPS)
$(CC) $(CFLAGS) $(IPATH) $< -o $@ $(LINKEXTRA) $(LIBCAPLIB) $(LIBPSXLIB) $(LDFLAGS)
# privileged
run_libcap_launch_test: libcap_launch_test noop ../progs/tcapsh-static
sudo ./libcap_launch_test
run_libcap_psx_launch_test: libcap_psx_launch_test ../progs/tcapsh-static
sudo ./libcap_psx_launch_test
libcap_launch_test: libcap_launch_test.c $(DEPS)
$(CC) $(CFLAGS) $(IPATH) $< -o $@ $(LINKEXTRA) $(LIBCAPLIB) $(LDFLAGS)
# This varies only slightly from the above insofar as it currently
# only links in the pthreads fork support. TODO() we need to change
# the source to do something interesting with pthreads.
libcap_psx_launch_test: libcap_launch_test.c $(DEPS)
$(CC) $(CFLAGS) $(IPATH) -DWITH_PTHREADS $< -o $@ $(LINKEXTRA) $(LIBCAPLIB) $(LIBPSXLIB) $(LDFLAGS)
# This test demonstrates that libpsx is needed to secure multithreaded
# programs that link against libcap.
run_exploit_test: exploit noexploit
@echo exploit should succeed
sudo ./exploit ; if [ $$? -ne 0 ]; then exit 0; else exit 1 ; fi
@echo exploit should fail
sudo ./noexploit ; if [ $$? -eq 0 ]; then exit 0; else exit 1 ; fi
exploit.o: exploit.c
$(CC) $(CFLAGS) $(IPATH) -c $<
exploit: exploit.o $(DEPS)
$(CC) $(CFLAGS) $(IPATH) $< -o $@ $(LINKEXTRA) $(LIBCAPLIB) -lpthread $(LDFLAGS)
# Note, for some reason, the order of libraries is important to avoid
# the exploit working for dynamic linking.
noexploit: exploit.o $(DEPS)
$(CC) $(CFLAGS) $(IPATH) $< -o $@ $(LINKEXTRA) $(LIBPSXLIB) $(LIBCAPLIB) $(LDFLAGS)
# This one runs in a chroot with no shared library files.
noop: noop.c
$(CC) $(CFLAGS) $< -o $@ --static
clean:
rm -f psx_test libcap_psx_test libcap_launch_test *~
rm -f libcap_launch_test libcap_psx_launch_test core noop
rm -f exploit noexploit exploit.o
|
