drop_root_caps/
lib.rs

1// SPDX-License-Identifier: 0BSD
2// Drop Root Capabilities
3// Copyright (C) 2025 by LoRd_MuldeR <mulder2@gmx.de>
4
5#![no_std]
6
7//! On Linux, the "root" user (UID 0) has some special capabilities that "regular" users do **not** normally have. This can result in weird behavior, e.g., if unit tests (or integration tests) are executed in the context of the "root" user, as Docker&REG; containers do by default! For example, a file that **should not** be accessible (according to its access permissions) may suddenly become accessible – because the "root" user has the `CAP_DAC_OVERRIDE` capability, which allows them to access the file *regardless of the access permissions*. As a result, a test case that expects `File::open()` to return a "permission denied" error will suddenly start to fail &#x1F628;
8//!
9//! This crate uses the Linux syscall [`prctl()`](https://man7.org/linux/man-pages/man2/prctl.2.html) with argument [`PR_CAPBSET_DROP`](https://man7.org/linux/man-pages/man2/PR_CAPBSET_DROP.2const.html) to drop the "root"-specific capabilities at application startup and thus restores the expected behavior. It does *nothing* on other platforms.
10//!
11//! ## Usage
12//!
13//! Simply add the following code to the top of your test module(s):
14//!
15//! ```
16//! #[used]
17//! static DROP_ROOT_CAPS: () = drop_root_caps::set_up();
18//! ```
19//!
20//! ## See also
21//!
22//! &#x1F517; <https://crates.io/crates/drop-root-caps>  
23//! &#x1F517; <https://github.com/lordmulder/drop-root-caps>
24
25#[cfg(target_os = "linux")]
26mod linux {
27    use core::hint::black_box;
28    use ctor::ctor;
29    use libc::{c_long, prctl, PR_CAPBSET_DROP};
30
31    // Capability constants
32    // See linux/include/uapi/linux/capability.h for details!
33    const CAP_CHOWN: c_long = 0;
34    const CAP_DAC_OVERRIDE: c_long = 1;
35    const CAP_DAC_READ_SEARCH: c_long = 2;
36    const CAP_FOWNER: c_long = 3;
37    const CAP_FSETID: c_long = 4;
38    const CAP_LINUX_IMMUTABLE: c_long = 9;
39    const CAP_MKNOD: c_long = 27;
40    const CAP_MAC_OVERRIDE: c_long = 32;
41
42    /// The initialization function that will run before the "main" function (or any test function)
43    #[ctor]
44    unsafe fn initialize() {
45        for capability in [CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH, CAP_FOWNER, CAP_FSETID, CAP_LINUX_IMMUTABLE, CAP_MAC_OVERRIDE, CAP_MKNOD] {
46            black_box(prctl(PR_CAPBSET_DROP, capability, 0 as c_long, 0 as c_long, 0 as c_long));
47        }
48    }
49}
50
51/// Dummy set-up function to ensure that our crate will actually be linked
52pub const fn set_up() {}
drop_root_caps/lib.rs

drop_root_caps/
lib.rs
