1 // RUN: %clang_analyze_cc1 -analyzer-checker=core,security.SetgidSetuidOrder -analyzer-output=text -verify %s
2
3 typedef int uid_t;
4 typedef int gid_t;
5
6 int setuid(uid_t);
7 int setgid(gid_t);
8
9 uid_t getuid();
10 gid_t getgid();
11
12
13
test_note_1()14 void test_note_1() {
15 if (setuid(getuid()) == -1) // expected-note{{Assuming the condition is false}} \
16 // expected-note{{Taking false branch}}
17 return;
18 if (setuid(getuid()) == -1) // expected-note{{Call to 'setuid' found here that removes superuser privileges}} \
19 // expected-note{{Assuming the condition is false}} \
20 // expected-note{{Taking false branch}}
21 return;
22 if (setgid(getgid()) == -1) // expected-warning{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}} \
23 // expected-note{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}}
24 return;
25 }
26
test_note_2()27 void test_note_2() {
28 if (setuid(getuid()) == -1) // expected-note{{Call to 'setuid' found here that removes superuser privileges}} \
29 // expected-note 2 {{Assuming the condition is false}} \
30 // expected-note 2 {{Taking false branch}}
31 return;
32 if (setgid(getgid()) == -1) // expected-warning{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}} \
33 // expected-note{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}} \
34 // expected-note{{Assuming the condition is false}} \
35 // expected-note{{Taking false branch}}
36 return;
37 if (setuid(getuid()) == -1) // expected-note{{Call to 'setuid' found here that removes superuser privileges}} \
38 // expected-note{{Assuming the condition is false}} \
39 // expected-note{{Taking false branch}}
40 return;
41 if (setgid(getgid()) == -1) // expected-warning{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}} \
42 // expected-note{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}}
43 return;
44 }
45
f_setuid()46 int f_setuid() {
47 return setuid(getuid()); // expected-note{{Call to 'setuid' found here that removes superuser privileges}}
48 }
49
f_setgid()50 int f_setgid() {
51 return setgid(getgid()); // expected-warning{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}} \
52 // expected-note{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}}
53 }
54
test_note_3()55 void test_note_3() {
56 if (f_setuid() == -1) // expected-note{{Assuming the condition is false}} \
57 // expected-note{{Calling 'f_setuid'}} \
58 // expected-note{{Returning from 'f_setuid'}} \
59 // expected-note{{Taking false branch}}
60 return;
61 if (f_setgid() == -1) // expected-note{{Calling 'f_setgid'}}
62 return;
63 }
64
test_note_4()65 void test_note_4() {
66 if (setuid(getuid()) == 0) { // expected-note{{Assuming the condition is true}} \
67 // expected-note{{Call to 'setuid' found here that removes superuser privileges}} \
68 // expected-note{{Taking true branch}}
69 if (setgid(getgid()) == 0) { // expected-warning{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}} \
70 // expected-note{{A 'setgid(getgid())' call following a 'setuid(getuid())' call is likely to fail}}
71 }
72 }
73 }
74