Mac: block ability to stat arbitrary files in the Sandbox

chrome/common/sandbox_mac_diraccess_unittest.mm

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import <Cocoa/Cocoa.h>
 #include <dirent.h>
 
 extern "C" {
 #include <sandbox.h>
 }
 
 #include "base/file_util.h"
 #include "base/file_path.h"
 #include "base/test/multiprocess_test.h"
 #include "base/sys_string_conversions.h"
 #include "base/utf_string_conversions.h"
 #include "chrome/common/sandbox_mac.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/multiprocess_func_list.h"
 
 // Tests to exercise directory-access-related restrictions of Mac sandbox.
 
 namespace sandbox {
 
 bool QuotePlainString(const std::string& str_utf8, std::string* dst);
 bool QuoteStringForRegex(const std::string& str_utf8, std::string* dst);
+NSString* BuildAllowDirectoryAccessSandboxString(const FilePath& allowed_dir);
 
 }  // namespace sandbox
 
 namespace {
 
 static const char* kSandboxAccessPathKey = "sandbox_dir";
+static const char* kDeniedSuffix = "_denied";
 
 class MacDirAccessSandboxTest : public base::MultiProcessTest {
  public:
   bool CheckSandbox(const std::string& directory_to_try) {
     setenv(kSandboxAccessPathKey, directory_to_try.c_str(), 1);
     base::ProcessHandle child_process = SpawnChild("mac_sandbox_path_access",
                                                    false);
     int code = -1;
     if (!base::WaitForExitCode(child_process, &code)) {
       LOG(WARNING) << "base::WaitForExitCode failed";
@@ skipping 93 matching lines @@
  public:
   inline void operator()(FilePath* x) const {
     if (x) {
       file_util::Delete(*x, true);
     }
   }
 };
 
 typedef scoped_ptr_malloc<FilePath, ScopedDirectoryDelete> ScopedDirectory;
 
-// Crashy, http://crbug.com/56765.
-TEST_F(MacDirAccessSandboxTest, DISABLED_SandboxAccess) {
+TEST_F(MacDirAccessSandboxTest, SandboxAccess) {
+  using file_util::CreateDirectory;
+
   FilePath tmp_dir;
   ASSERT_TRUE(file_util::CreateNewTempDirectory("", &tmp_dir));
   // This step is important on OS X since the sandbox only understands "real"
   // paths and the paths CreateNewTempDirectory() returns are empirically in
   // /var which is a symlink to /private/var .
   sandbox::GetCanonicalSandboxPath(&tmp_dir);
   ScopedDirectory cleanup(&tmp_dir);
 
   const char* sandbox_dir_cases[] = {
     "simple_dir_name",
     "^hello++ $",       // Regex.
     "\\^.$|()[]*+?{}",  // All regex characters.
   };
 
   for (size_t i = 0; i < ARRAYSIZE_UNSAFE(sandbox_dir_cases); ++i) {
     const char* sandbox_dir_name = sandbox_dir_cases[i];
     FilePath sandbox_dir = tmp_dir.Append(sandbox_dir_name);
-    ASSERT_TRUE(file_util::CreateDirectory(sandbox_dir));
+    ASSERT_TRUE(CreateDirectory(sandbox_dir));
     ScopedDirectory cleanup_sandbox(&sandbox_dir);
+
+    // Create a sibling directory of the sandbox dir, whose name has sandbox dir
+    // as a substring but to which access is denied.
+    std::string sibling_sandbox_dir_name_denied =
+        std::string(sandbox_dir_cases[i]) + kDeniedSuffix;
+    FilePath sibling_sandbox_dir = tmp_dir.Append(
+                                      sibling_sandbox_dir_name_denied.c_str());
+    ASSERT_TRUE(CreateDirectory(sibling_sandbox_dir));
+    ScopedDirectory cleanup_sandbox_sibling(&sibling_sandbox_dir);
+
     EXPECT_TRUE(CheckSandbox(sandbox_dir.value()));
   }
 }
 
 MULTIPROCESS_TEST_MAIN(mac_sandbox_path_access) {
   char *sandbox_allowed_dir = getenv(kSandboxAccessPathKey);
   if (!sandbox_allowed_dir)
     return -1;
 
-  // Build up a sandbox profile that only allows access to DIR_TO_ALLOW_ACCESS.
+  // Build up a sandbox profile that only allows access to a single directory.
   NSString *sandbox_profile =
       @"(version 1)" \
       "(deny default)" \
       "(allow signal (target self))" \
       "(allow sysctl-read)" \
-      "(allow file-read-metadata)" \
-      "(allow file-read* file-write* (regex #\"DIR_TO_ALLOW_ACCESS\"))";
+      ";ENABLE_DIRECTORY_ACCESS";
 
   std::string allowed_dir(sandbox_allowed_dir);
   std::string allowed_dir_escaped;
   if (!sandbox::QuoteStringForRegex(allowed_dir, &allowed_dir_escaped)) {
     LOG(ERROR) << "Regex string quoting failed " << allowed_dir;
     return -1;
   }
-  NSString* allowed_dir_escaped_ns = base::SysUTF8ToNSString(
-        allowed_dir_escaped.c_str());
+  NSString* allow_dir_sandbox_code =
+      sandbox::BuildAllowDirectoryAccessSandboxString(
+          FilePath(sandbox_allowed_dir));
   sandbox_profile = [sandbox_profile
-      stringByReplacingOccurrencesOfString:@"DIR_TO_ALLOW_ACCESS"
-                                withString:allowed_dir_escaped_ns];
+      stringByReplacingOccurrencesOfString:@";ENABLE_DIRECTORY_ACCESS"
+                                withString:allow_dir_sandbox_code];
   // Enable Sandbox.
   char* error_buff = NULL;
   int error = sandbox_init([sandbox_profile UTF8String], 0, &error_buff);
   if (error == -1) {
     LOG(ERROR) << "Failed to Initialize Sandbox: " << error_buff;
     return -1;
   }
   sandbox_free_error(error_buff);
 
   // Test Sandbox.
@@ skipping 10 matching lines @@
   closedir(file_list);
 
   // Test restrictions on accessing files.
   FilePath allowed_dir_path(sandbox_allowed_dir);
   FilePath allowed_file = allowed_dir_path.Append("ok_to_write");
   FilePath denied_file1 =  allowed_dir_path.DirName().Append("cant_access");
 
   // Try to write a file who's name has the same prefix as the directory we
   // allow access to.
   FilePath basename = allowed_dir_path.BaseName();
+  FilePath allowed_parent_dir = allowed_dir_path.DirName();
   std::string tricky_filename = basename.value() + "123";
-  FilePath denied_file2 =  allowed_dir_path.DirName().Append(tricky_filename);
+  FilePath denied_file2 =  allowed_parent_dir.Append(tricky_filename);
 
   if (open(allowed_file.value().c_str(), O_WRONLY | O_CREAT) <= 0) {
     PLOG(ERROR) << "Sandbox overly restrictive: failed to write ("
                 << allowed_file.value()
                 << ")";
     return -1;
   }
 
+  // Test that we deny access to a sibling of the sandboxed directory whose
+  // name has the sandboxed directory name as a substring. e.g. if the sandbox
+  // directory is /foo/baz then test /foo/baz_denied.
+  {
+    struct stat tmp_stat_info;
+    std::string denied_sibling =
+        std::string(sandbox_allowed_dir) + kDeniedSuffix;
+    if (stat(denied_sibling.c_str(), &tmp_stat_info) > 0) {
+      PLOG(ERROR) << "Sandbox breach: was able to stat ("
+                  << denied_sibling.c_str()
+                  << ")";
+      return -1;
+    }
+  }
+
+  // Test that we can stat parent directories of the "allowed" directory.
+  {
+    struct stat tmp_stat_info;
+    if (stat(allowed_parent_dir.value().c_str(), &tmp_stat_info) != 0) {
+      PLOG(ERROR) << "Sandbox overly restrictive: unable to stat ("
+                  << allowed_parent_dir.value()
+                  << ")";
+      return -1;
+    }
+  }
+
+  // Test that we can't stat files outside the "allowed" directory.
+  {
+    struct stat tmp_stat_info;
+    if (stat(denied_file1.value().c_str(), &tmp_stat_info) > 0) {
+      PLOG(ERROR) << "Sandbox breach: was able to stat ("
+                  << denied_file1.value()
+                  << ")";
+      return -1;
+    }
+  }
+
   if (open(denied_file1.value().c_str(), O_WRONLY | O_CREAT) > 0) {
     PLOG(ERROR) << "Sandbox breach: was able to write ("
                 << denied_file1.value()
                 << ")";
     return -1;
   }
 
   if (open(denied_file2.value().c_str(), O_WRONLY | O_CREAT) > 0) {
     PLOG(ERROR) << "Sandbox breach: was able to write ("
                 << denied_file2.value()
                 << ")";
     return -1;
   }
 
   return 0;
 }
 
 }  // namespace