OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #import <Cocoa/Cocoa.h> | 5 #import <Cocoa/Cocoa.h> |
6 #include <dirent.h> | 6 #include <dirent.h> |
7 | 7 |
8 extern "C" { | 8 extern "C" { |
9 #include <sandbox.h> | 9 #include <sandbox.h> |
10 } | 10 } |
(...skipping 160 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
171 std::string(sandbox_dir_cases[i]) + kDeniedSuffix; | 171 std::string(sandbox_dir_cases[i]) + kDeniedSuffix; |
172 FilePath sibling_sandbox_dir = tmp_dir.Append( | 172 FilePath sibling_sandbox_dir = tmp_dir.Append( |
173 sibling_sandbox_dir_name_denied.c_str()); | 173 sibling_sandbox_dir_name_denied.c_str()); |
174 ASSERT_TRUE(CreateDirectory(sibling_sandbox_dir)); | 174 ASSERT_TRUE(CreateDirectory(sibling_sandbox_dir)); |
175 ScopedDirectory cleanup_sandbox_sibling(&sibling_sandbox_dir); | 175 ScopedDirectory cleanup_sandbox_sibling(&sibling_sandbox_dir); |
176 | 176 |
177 EXPECT_TRUE(CheckSandbox(sandbox_dir.value())); | 177 EXPECT_TRUE(CheckSandbox(sandbox_dir.value())); |
178 } | 178 } |
179 } | 179 } |
180 | 180 |
181 MULTIPROCESS_TEST_MAIN(mac_sandbox_path_access) { | 181 MULTIPROCESS_TEST_MAIN(mac_sandbox_path_access, NULL) { |
182 char *sandbox_allowed_dir = getenv(kSandboxAccessPathKey); | 182 char *sandbox_allowed_dir = getenv(kSandboxAccessPathKey); |
183 if (!sandbox_allowed_dir) | 183 if (!sandbox_allowed_dir) |
184 return -1; | 184 return -1; |
185 | 185 |
186 // Build up a sandbox profile that only allows access to a single directory. | 186 // Build up a sandbox profile that only allows access to a single directory. |
187 NSString *sandbox_profile = | 187 NSString *sandbox_profile = |
188 @"(version 1)" \ | 188 @"(version 1)" \ |
189 "(deny default)" \ | 189 "(deny default)" \ |
190 "(allow signal (target self))" \ | 190 "(allow signal (target self))" \ |
191 "(allow sysctl-read)" \ | 191 "(allow sysctl-read)" \ |
(...skipping 107 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
299 PLOG(ERROR) << "Sandbox breach: was able to write (" | 299 PLOG(ERROR) << "Sandbox breach: was able to write (" |
300 << denied_file2.value() | 300 << denied_file2.value() |
301 << ")"; | 301 << ")"; |
302 return -1; | 302 return -1; |
303 } | 303 } |
304 | 304 |
305 return 0; | 305 return 0; |
306 } | 306 } |
307 | 307 |
308 } // namespace sandbox | 308 } // namespace sandbox |
OLD | NEW |