| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <netinet/in.h> | 9 #include <netinet/in.h> |
| 10 #include <sys/socket.h> | 10 #include <sys/socket.h> |
| 11 #include <sys/syscall.h> | 11 #include <sys/syscall.h> |
| 12 #include <sys/utsname.h> | 12 #include <sys/utsname.h> |
| 13 #include <unistd.h> | 13 #include <unistd.h> |
| 14 | 14 |
| 15 #include <map> | 15 #include <map> |
| 16 #include <utility> | 16 #include <utility> |
| 17 | 17 |
| 18 #include "base/files/scoped_file.h" | 18 #include "base/files/scoped_file.h" |
| 19 #include "base/macros.h" | 19 #include "base/macros.h" |
| 20 #include "build/build_config.h" | 20 #include "build/build_config.h" |
| 21 #include "sandbox/linux/bpf_dsl/bpf_dsl_impl.h" | 21 #include "sandbox/linux/bpf_dsl/bpf_dsl_impl.h" |
| 22 #include "sandbox/linux/bpf_dsl/codegen.h" | 22 #include "sandbox/linux/bpf_dsl/codegen.h" |
| 23 #include "sandbox/linux/bpf_dsl/policy.h" | 23 #include "sandbox/linux/bpf_dsl/policy.h" |
| 24 #include "sandbox/linux/bpf_dsl/policy_compiler.h" | 24 #include "sandbox/linux/bpf_dsl/policy_compiler.h" |
| 25 #include "sandbox/linux/bpf_dsl/seccomp_macros.h" | 25 #include "sandbox/linux/bpf_dsl/seccomp_macros.h" |
| 26 #include "sandbox/linux/bpf_dsl/trap_registry.h" | 26 #include "sandbox/linux/bpf_dsl/test_trap_registry.h" |
| 27 #include "sandbox/linux/bpf_dsl/verifier.h" | 27 #include "sandbox/linux/bpf_dsl/verifier.h" |
| 28 #include "sandbox/linux/seccomp-bpf/errorcode.h" | |
| 29 #include "sandbox/linux/system_headers/linux_filter.h" | 28 #include "sandbox/linux/system_headers/linux_filter.h" |
| 30 #include "testing/gtest/include/gtest/gtest.h" | 29 #include "testing/gtest/include/gtest/gtest.h" |
| 31 | 30 |
| 32 #define CASES SANDBOX_BPF_DSL_CASES | 31 #define CASES SANDBOX_BPF_DSL_CASES |
| 33 | 32 |
| 34 namespace sandbox { | 33 namespace sandbox { |
| 35 namespace bpf_dsl { | 34 namespace bpf_dsl { |
| 36 namespace { | 35 namespace { |
| 37 | 36 |
| 38 // Helper function to construct fake arch_seccomp_data objects. | 37 // Helper function to construct fake arch_seccomp_data objects. |
| (...skipping 12 matching lines...) Expand all Loading... |
| 51 SECCOMP_ARCH, | 50 SECCOMP_ARCH, |
| 52 kFakePC, | 51 kFakePC, |
| 53 { | 52 { |
| 54 p0, p1, p2, p3, p4, p5, | 53 p0, p1, p2, p3, p4, p5, |
| 55 }, | 54 }, |
| 56 }; | 55 }; |
| 57 | 56 |
| 58 return data; | 57 return data; |
| 59 } | 58 } |
| 60 | 59 |
| 61 class FakeTrapRegistry : public TrapRegistry { | |
| 62 public: | |
| 63 FakeTrapRegistry() : map_() {} | |
| 64 virtual ~FakeTrapRegistry() {} | |
| 65 | |
| 66 uint16_t Add(TrapFnc fnc, const void* aux, bool safe) override { | |
| 67 EXPECT_TRUE(safe); | |
| 68 | |
| 69 const uint16_t next_id = map_.size() + 1; | |
| 70 return map_.insert(std::make_pair(Key(fnc, aux), next_id)).first->second; | |
| 71 } | |
| 72 | |
| 73 bool EnableUnsafeTraps() override { | |
| 74 ADD_FAILURE() << "Unimplemented"; | |
| 75 return false; | |
| 76 } | |
| 77 | |
| 78 private: | |
| 79 using Key = std::pair<TrapFnc, const void*>; | |
| 80 | |
| 81 std::map<Key, uint16_t> map_; | |
| 82 | |
| 83 DISALLOW_COPY_AND_ASSIGN(FakeTrapRegistry); | |
| 84 }; | |
| 85 | |
| 86 intptr_t FakeTrapFuncOne(const arch_seccomp_data& data, void* aux) { return 1; } | |
| 87 intptr_t FakeTrapFuncTwo(const arch_seccomp_data& data, void* aux) { return 2; } | |
| 88 | |
| 89 // Test that FakeTrapRegistry correctly assigns trap IDs to trap handlers. | |
| 90 TEST(FakeTrapRegistry, TrapIDs) { | |
| 91 struct { | |
| 92 TrapRegistry::TrapFnc fnc; | |
| 93 const void* aux; | |
| 94 } funcs[] = { | |
| 95 {FakeTrapFuncOne, nullptr}, | |
| 96 {FakeTrapFuncTwo, nullptr}, | |
| 97 {FakeTrapFuncOne, funcs}, | |
| 98 {FakeTrapFuncTwo, funcs}, | |
| 99 }; | |
| 100 | |
| 101 FakeTrapRegistry traps; | |
| 102 | |
| 103 // Add traps twice to test that IDs are reused correctly. | |
| 104 for (int i = 0; i < 2; ++i) { | |
| 105 for (size_t j = 0; j < arraysize(funcs); ++j) { | |
| 106 // Trap IDs start at 1. | |
| 107 EXPECT_EQ(j + 1, traps.Add(funcs[j].fnc, funcs[j].aux, true)); | |
| 108 } | |
| 109 } | |
| 110 } | |
| 111 | |
| 112 class PolicyEmulator { | 60 class PolicyEmulator { |
| 113 public: | 61 public: |
| 114 explicit PolicyEmulator(const Policy* policy) : program_(), traps_() { | 62 explicit PolicyEmulator(const Policy* policy) : program_(), traps_() { |
| 115 program_ = *PolicyCompiler(policy, &traps_).Compile(true /* verify */); | 63 program_ = *PolicyCompiler(policy, &traps_).Compile(true /* verify */); |
| 116 } | 64 } |
| 117 ~PolicyEmulator() {} | 65 ~PolicyEmulator() {} |
| 118 | 66 |
| 119 uint32_t Emulate(const struct arch_seccomp_data& data) const { | 67 uint32_t Emulate(const struct arch_seccomp_data& data) const { |
| 120 const char* err = nullptr; | 68 const char* err = nullptr; |
| 121 uint32_t res = Verifier::EvaluateBPF(program_, data, &err); | 69 uint32_t res = Verifier::EvaluateBPF(program_, data, &err); |
| (...skipping 11 matching lines...) Expand all Loading... |
| 133 void ExpectErrno(uint16_t err, const struct arch_seccomp_data& data) const { | 81 void ExpectErrno(uint16_t err, const struct arch_seccomp_data& data) const { |
| 134 EXPECT_EQ(SECCOMP_RET_ERRNO | err, Emulate(data)); | 82 EXPECT_EQ(SECCOMP_RET_ERRNO | err, Emulate(data)); |
| 135 } | 83 } |
| 136 | 84 |
| 137 void ExpectKill(const struct arch_seccomp_data& data) const { | 85 void ExpectKill(const struct arch_seccomp_data& data) const { |
| 138 EXPECT_EQ(SECCOMP_RET_KILL, Emulate(data)); | 86 EXPECT_EQ(SECCOMP_RET_KILL, Emulate(data)); |
| 139 } | 87 } |
| 140 | 88 |
| 141 private: | 89 private: |
| 142 CodeGen::Program program_; | 90 CodeGen::Program program_; |
| 143 FakeTrapRegistry traps_; | 91 TestTrapRegistry traps_; |
| 144 | 92 |
| 145 DISALLOW_COPY_AND_ASSIGN(PolicyEmulator); | 93 DISALLOW_COPY_AND_ASSIGN(PolicyEmulator); |
| 146 }; | 94 }; |
| 147 | 95 |
| 148 class BasicPolicy : public Policy { | 96 class BasicPolicy : public Policy { |
| 149 public: | 97 public: |
| 150 BasicPolicy() {} | 98 BasicPolicy() {} |
| 151 ~BasicPolicy() override {} | 99 ~BasicPolicy() override {} |
| 152 ResultExpr EvaluateSyscall(int sysno) const override { | 100 ResultExpr EvaluateSyscall(int sysno) const override { |
| 153 if (sysno == __NR_getpgid) { | 101 if (sysno == __NR_getpgid) { |
| (...skipping 352 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 506 EXPECT_TRUE(unsafe->HasUnsafeTraps()); | 454 EXPECT_TRUE(unsafe->HasUnsafeTraps()); |
| 507 | 455 |
| 508 const Arg<int> arg(0); | 456 const Arg<int> arg(0); |
| 509 ResultExpr maybe = If(arg == 0, allow).Else(unsafe); | 457 ResultExpr maybe = If(arg == 0, allow).Else(unsafe); |
| 510 EXPECT_TRUE(maybe->HasUnsafeTraps()); | 458 EXPECT_TRUE(maybe->HasUnsafeTraps()); |
| 511 } | 459 } |
| 512 | 460 |
| 513 } // namespace | 461 } // namespace |
| 514 } // namespace bpf_dsl | 462 } // namespace bpf_dsl |
| 515 } // namespace sandbox | 463 } // namespace sandbox |
| OLD | NEW |