1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
// RUN: %clang_analyze_cc1 -analyzer-checker=core,security.SetgidSetuidOrder -analyzer-output=text -verify %s
typedef int uid_t;
typedef int gid_t;
int setuid(uid_t);
int setgid(gid_t);
uid_t getuid();
gid_t getgid();
void test_note_1() {
if (setuid(getuid()) == -1) // expected-note{{Assuming the condition is false}} \
// expected-note{{Taking false branch}}
return;
if (setuid(getuid()) == -1) // expected-note{{Call to 'setuid' found here that removes superuser privileges}} \
// expected-note{{Assuming the condition is false}} \
// expected-note{{Taking false branch}}
return;
if (setgid(getgid()) == -1) // expected-warning{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}} \
// expected-note{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}}
return;
}
void test_note_2() {
if (setuid(getuid()) == -1) // expected-note{{Call to 'setuid' found here that removes superuser privileges}} \
// expected-note 2 {{Assuming the condition is false}} \
// expected-note 2 {{Taking false branch}}
return;
if (setgid(getgid()) == -1) // expected-warning{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}} \
// expected-note{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}} \
// expected-note{{Assuming the condition is false}} \
// expected-note{{Taking false branch}}
return;
if (setuid(getuid()) == -1) // expected-note{{Call to 'setuid' found here that removes superuser privileges}} \
// expected-note{{Assuming the condition is false}} \
// expected-note{{Taking false branch}}
return;
if (setgid(getgid()) == -1) // expected-warning{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}} \
// expected-note{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}}
return;
}
int f_setuid() {
return setuid(getuid()); // expected-note{{Call to 'setuid' found here that removes superuser privileges}}
}
int f_setgid() {
return setgid(getgid()); // expected-warning{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}} \
// expected-note{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}}
}
void test_note_3() {
if (f_setuid() == -1) // expected-note{{Assuming the condition is false}} \
// expected-note{{Calling 'f_setuid'}} \
// expected-note{{Returning from 'f_setuid'}} \
// expected-note{{Taking false branch}}
return;
if (f_setgid() == -1) // expected-note{{Calling 'f_setgid'}}
return;
}
void test_note_4() {
if (setuid(getuid()) == 0) { // expected-note{{Assuming the condition is true}} \
// expected-note{{Call to 'setuid' found here that removes superuser privileges}} \
// expected-note{{Taking true branch}}
if (setgid(getgid()) == 0) { // expected-warning{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}} \
// expected-note{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}}
}
}
}
|
