[minijail] Add the ability to set capabilities from the command line

minijail_unittest.cc

-// Copyright (c) 2009-2010 The Chromium OS Authors. All rights reserved.
+// Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 // Some portions Copyright (c) 2009 The Chromium Authors.
 //
 // Tests for MiniJail
 #include "mock_env.h"
 #include "mock_options.h"
 #include "minijail.h"
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
@@ skipping 101 matching lines @@
   EXPECT_CALL(*options_, namespace_vfs())
     .Times(2)
     .WillOnce(Return(true))
     .WillOnce(Return(true));
   EXPECT_CALL(*env_, EnterNamespace(CLONE_NEWNS|CLONE_NEWPID))
     .Times(1)
     .WillOnce(Return(true));
   EXPECT_TRUE(jail.Jail());  // all works on first call
 }
 
+TEST_F(MiniJailTest, UseCapabilities) {
+  MiniJail jail;
+  jail.Initialize(options_.get());
+
+  uint64 caps = 7;
+  EXPECT_CALL(*env_, EnterNamespace(CLONE_NEWPID))
+      .WillOnce(Return(true));
+  EXPECT_CALL(*env_, KeepRootCapabilities())
+      .WillOnce(Return(true));
+  EXPECT_CALL(*env_, DisableDefaultRootPrivileges())
+      .WillOnce(Return(true));
+  EXPECT_CALL(*env_, SanitizeCapabilities(caps))
+      .WillOnce(Return(true));
+  EXPECT_CALL(*env_, SanitizeBoundingSet(caps))
+      .WillOnce(Return(true));
+
+  EXPECT_CALL(*options_, namespace_pid())
+      .WillRepeatedly(Return(true));
+  EXPECT_CALL(*options_, namespace_vfs())
+      .WillRepeatedly(Return(false));
+  EXPECT_CALL(*options_, use_capabilities())
+      .WillRepeatedly(Return(true));
+  EXPECT_CALL(*options_, caps_bitmask())
+      .WillRepeatedly(Return(caps));
+  EXPECT_TRUE(jail.Jail());
+}
+
 // TODO(wad) finish up test cases for each conditional
 
 
 }  // namespace chromeos