| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #import <Cocoa/Cocoa.h> | 5 #import <Cocoa/Cocoa.h> |
| 6 #include <dirent.h> | 6 #include <dirent.h> |
| 7 | 7 |
| 8 extern "C" { | 8 extern "C" { |
| 9 #include <sandbox.h> | 9 #include <sandbox.h> |
| 10 } | 10 } |
| (...skipping 160 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 171 std::string(sandbox_dir_cases[i]) + kDeniedSuffix; | 171 std::string(sandbox_dir_cases[i]) + kDeniedSuffix; |
| 172 FilePath sibling_sandbox_dir = tmp_dir.Append( | 172 FilePath sibling_sandbox_dir = tmp_dir.Append( |
| 173 sibling_sandbox_dir_name_denied.c_str()); | 173 sibling_sandbox_dir_name_denied.c_str()); |
| 174 ASSERT_TRUE(CreateDirectory(sibling_sandbox_dir)); | 174 ASSERT_TRUE(CreateDirectory(sibling_sandbox_dir)); |
| 175 ScopedDirectory cleanup_sandbox_sibling(&sibling_sandbox_dir); | 175 ScopedDirectory cleanup_sandbox_sibling(&sibling_sandbox_dir); |
| 176 | 176 |
| 177 EXPECT_TRUE(CheckSandbox(sandbox_dir.value())); | 177 EXPECT_TRUE(CheckSandbox(sandbox_dir.value())); |
| 178 } | 178 } |
| 179 } | 179 } |
| 180 | 180 |
| 181 MULTIPROCESS_TEST_MAIN(mac_sandbox_path_access) { | 181 MULTIPROCESS_TEST_MAIN(mac_sandbox_path_access, NULL) { |
| 182 char *sandbox_allowed_dir = getenv(kSandboxAccessPathKey); | 182 char *sandbox_allowed_dir = getenv(kSandboxAccessPathKey); |
| 183 if (!sandbox_allowed_dir) | 183 if (!sandbox_allowed_dir) |
| 184 return -1; | 184 return -1; |
| 185 | 185 |
| 186 // Build up a sandbox profile that only allows access to a single directory. | 186 // Build up a sandbox profile that only allows access to a single directory. |
| 187 NSString *sandbox_profile = | 187 NSString *sandbox_profile = |
| 188 @"(version 1)" \ | 188 @"(version 1)" \ |
| 189 "(deny default)" \ | 189 "(deny default)" \ |
| 190 "(allow signal (target self))" \ | 190 "(allow signal (target self))" \ |
| 191 "(allow sysctl-read)" \ | 191 "(allow sysctl-read)" \ |
| (...skipping 107 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 299 PLOG(ERROR) << "Sandbox breach: was able to write (" | 299 PLOG(ERROR) << "Sandbox breach: was able to write (" |
| 300 << denied_file2.value() | 300 << denied_file2.value() |
| 301 << ")"; | 301 << ")"; |
| 302 return -1; | 302 return -1; |
| 303 } | 303 } |
| 304 | 304 |
| 305 return 0; | 305 return 0; |
| 306 } | 306 } |
| 307 | 307 |
| 308 } // namespace sandbox | 308 } // namespace sandbox |
| OLD | NEW |