OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/renderer/renderer_main_platform_delegate.h" | 5 #include "content/renderer/renderer_main_platform_delegate.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <sys/stat.h> | 8 #include <sys/stat.h> |
9 | 9 |
10 #include "base/command_line.h" | 10 #include "base/command_line.h" |
(...skipping 50 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
61 // Here, we test that the status of SeccompBpf in the renderer is consistent | 61 // Here, we test that the status of SeccompBpf in the renderer is consistent |
62 // with what LinuxSandbox::GetStatus() said we would do. | 62 // with what LinuxSandbox::GetStatus() said we would do. |
63 class LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance(); | 63 class LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance(); |
64 if (linux_sandbox->GetStatus() & kSandboxLinuxSeccompBpf) { | 64 if (linux_sandbox->GetStatus() & kSandboxLinuxSeccompBpf) { |
65 CHECK(linux_sandbox->seccomp_bpf_started()); | 65 CHECK(linux_sandbox->seccomp_bpf_started()); |
66 } | 66 } |
67 | 67 |
68 // Under the setuid sandbox, we should not be able to open any file via the | 68 // Under the setuid sandbox, we should not be able to open any file via the |
69 // filesystem. | 69 // filesystem. |
70 if (linux_sandbox->GetStatus() & kSandboxLinuxSUID) { | 70 if (linux_sandbox->GetStatus() & kSandboxLinuxSUID) { |
71 CHECK(!file_util::PathExists(FilePath("/proc/cpuinfo"))); | 71 CHECK(!file_util::PathExists(base::FilePath("/proc/cpuinfo"))); |
72 } | 72 } |
73 | 73 |
74 #if defined(__x86_64__) | 74 #if defined(__x86_64__) |
75 // Limit this test to architectures where seccomp BPF is active in renderers. | 75 // Limit this test to architectures where seccomp BPF is active in renderers. |
76 if (linux_sandbox->seccomp_bpf_started()) { | 76 if (linux_sandbox->seccomp_bpf_started()) { |
77 errno = 0; | 77 errno = 0; |
78 // This should normally return EBADF since the first argument is bogus, | 78 // This should normally return EBADF since the first argument is bogus, |
79 // but we know that under the seccomp-bpf sandbox, this should return EPERM. | 79 // but we know that under the seccomp-bpf sandbox, this should return EPERM. |
80 CHECK_EQ(fchmod(-1, 07777), -1); | 80 CHECK_EQ(fchmod(-1, 07777), -1); |
81 CHECK_EQ(errno, EPERM); | 81 CHECK_EQ(errno, EPERM); |
82 } | 82 } |
83 #endif // __x86_64__ | 83 #endif // __x86_64__ |
84 } | 84 } |
85 | 85 |
86 } // namespace content | 86 } // namespace content |
OLD | NEW |