| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/services/credentials.h" | 5 #include "sandbox/linux/services/credentials.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <pthread.h> | |
| 10 #include <signal.h> | |
| 11 #include <stdio.h> | 9 #include <stdio.h> |
| 12 #include <sys/capability.h> | 10 #include <sys/capability.h> |
| 13 #include <sys/stat.h> | 11 #include <sys/stat.h> |
| 14 #include <sys/types.h> | 12 #include <sys/types.h> |
| 15 #include <unistd.h> | 13 #include <unistd.h> |
| 16 | 14 |
| 17 #include <vector> | 15 #include <vector> |
| 18 | 16 |
| 19 #include "base/files/file_path.h" | 17 #include "base/files/file_path.h" |
| 20 #include "base/files/file_util.h" | 18 #include "base/files/file_util.h" |
| (...skipping 211 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 232 | 230 |
| 233 const cap_value_t allowed_cap = CAP_SYS_CHROOT; | 231 const cap_value_t allowed_cap = CAP_SYS_CHROOT; |
| 234 for (const cap_flag_t flag : {CAP_EFFECTIVE, CAP_PERMITTED}) { | 232 for (const cap_flag_t flag : {CAP_EFFECTIVE, CAP_PERMITTED}) { |
| 235 PCHECK(cap_set_flag(expected_cap.get(), flag, 1, &allowed_cap, CAP_SET) == | 233 PCHECK(cap_set_flag(expected_cap.get(), flag, 1, &allowed_cap, CAP_SET) == |
| 236 0); | 234 0); |
| 237 } | 235 } |
| 238 | 236 |
| 239 CHECK_EQ(0, cap_compare(expected_cap.get(), actual_cap.get())); | 237 CHECK_EQ(0, cap_compare(expected_cap.get(), actual_cap.get())); |
| 240 } | 238 } |
| 241 | 239 |
| 242 volatile sig_atomic_t signal_handler_called; | |
| 243 void SignalHandler(int sig) { | |
| 244 signal_handler_called = 1; | |
| 245 } | |
| 246 | |
| 247 // Disabled on ASAN because of crbug.com/451603. | |
| 248 SANDBOX_TEST(Credentials, DISABLE_ON_ASAN(DropFileSystemAccessPreservesTLS)) { | |
| 249 // Probably missing kernel support. | |
| 250 if (!Credentials::MoveToNewUserNS()) return; | |
| 251 CHECK(Credentials::DropFileSystemAccess(ProcUtil::OpenProc().get())); | |
| 252 | |
| 253 // In glibc, pthread_getattr_np makes an assertion about the cached PID/TID in | |
| 254 // TLS. | |
| 255 pthread_attr_t attr; | |
| 256 EXPECT_EQ(0, pthread_getattr_np(pthread_self(), &attr)); | |
| 257 | |
| 258 // raise also uses the cached TID in glibc. | |
| 259 struct sigaction action = {}; | |
| 260 action.sa_handler = &SignalHandler; | |
| 261 PCHECK(sigaction(SIGUSR1, &action, nullptr) == 0); | |
| 262 | |
| 263 PCHECK(raise(SIGUSR1) == 0); | |
| 264 CHECK_EQ(1, signal_handler_called); | |
| 265 } | |
| 266 | |
| 267 } // namespace. | 240 } // namespace. |
| 268 | 241 |
| 269 } // namespace sandbox. | 242 } // namespace sandbox. |
| OLD | NEW |