| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <errno.h> | 5 #include <errno.h> |
| 6 #include <fcntl.h> | 6 #include <fcntl.h> |
| 7 #include <pthread.h> | 7 #include <pthread.h> |
| 8 #include <sched.h> | 8 #include <sched.h> |
| 9 #include <signal.h> | 9 #include <signal.h> |
| 10 #include <sys/prctl.h> | 10 #include <sys/prctl.h> |
| (...skipping 14 matching lines...) Expand all Loading... |
| 25 #include "base/bind.h" | 25 #include "base/bind.h" |
| 26 #include "base/logging.h" | 26 #include "base/logging.h" |
| 27 #include "base/macros.h" | 27 #include "base/macros.h" |
| 28 #include "base/memory/scoped_ptr.h" | 28 #include "base/memory/scoped_ptr.h" |
| 29 #include "base/posix/eintr_wrapper.h" | 29 #include "base/posix/eintr_wrapper.h" |
| 30 #include "base/synchronization/waitable_event.h" | 30 #include "base/synchronization/waitable_event.h" |
| 31 #include "base/sys_info.h" | 31 #include "base/sys_info.h" |
| 32 #include "base/threading/thread.h" | 32 #include "base/threading/thread.h" |
| 33 #include "build/build_config.h" | 33 #include "build/build_config.h" |
| 34 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 34 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
| 35 #include "sandbox/linux/bpf_dsl/errorcode.h" |
| 35 #include "sandbox/linux/bpf_dsl/linux_syscall_ranges.h" | 36 #include "sandbox/linux/bpf_dsl/linux_syscall_ranges.h" |
| 36 #include "sandbox/linux/bpf_dsl/policy.h" | 37 #include "sandbox/linux/bpf_dsl/policy.h" |
| 37 #include "sandbox/linux/bpf_dsl/seccomp_macros.h" | 38 #include "sandbox/linux/bpf_dsl/seccomp_macros.h" |
| 38 #include "sandbox/linux/seccomp-bpf/bpf_tests.h" | 39 #include "sandbox/linux/seccomp-bpf/bpf_tests.h" |
| 39 #include "sandbox/linux/seccomp-bpf/die.h" | 40 #include "sandbox/linux/seccomp-bpf/die.h" |
| 40 #include "sandbox/linux/seccomp-bpf/errorcode.h" | |
| 41 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 41 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
| 42 #include "sandbox/linux/seccomp-bpf/syscall.h" | 42 #include "sandbox/linux/seccomp-bpf/syscall.h" |
| 43 #include "sandbox/linux/seccomp-bpf/trap.h" | 43 #include "sandbox/linux/seccomp-bpf/trap.h" |
| 44 #include "sandbox/linux/services/syscall_wrappers.h" | 44 #include "sandbox/linux/services/syscall_wrappers.h" |
| 45 #include "sandbox/linux/services/thread_helpers.h" | 45 #include "sandbox/linux/services/thread_helpers.h" |
| 46 #include "sandbox/linux/system_headers/linux_syscalls.h" | 46 #include "sandbox/linux/system_headers/linux_syscalls.h" |
| 47 #include "sandbox/linux/tests/scoped_temporary_file.h" | 47 #include "sandbox/linux/tests/scoped_temporary_file.h" |
| 48 #include "sandbox/linux/tests/unit_tests.h" | 48 #include "sandbox/linux/tests/unit_tests.h" |
| 49 #include "testing/gtest/include/gtest/gtest.h" | 49 #include "testing/gtest/include/gtest/gtest.h" |
| 50 | 50 |
| (...skipping 1209 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1260 .Case(3, HasAllBits32(0x80000000)) | 1260 .Case(3, HasAllBits32(0x80000000)) |
| 1261 #if __SIZEOF_POINTER__ > 4 | 1261 #if __SIZEOF_POINTER__ > 4 |
| 1262 .Case(4, HasAllBits64(0x0)) | 1262 .Case(4, HasAllBits64(0x0)) |
| 1263 .Case(5, HasAllBits64(0x1)) | 1263 .Case(5, HasAllBits64(0x1)) |
| 1264 .Case(6, HasAllBits64(0x3)) | 1264 .Case(6, HasAllBits64(0x3)) |
| 1265 .Case(7, HasAllBits64(0x80000000)) | 1265 .Case(7, HasAllBits64(0x80000000)) |
| 1266 .Case(8, HasAllBits64(0x100000000ULL)) | 1266 .Case(8, HasAllBits64(0x100000000ULL)) |
| 1267 .Case(9, HasAllBits64(0x300000000ULL)) | 1267 .Case(9, HasAllBits64(0x300000000ULL)) |
| 1268 .Case(10, HasAllBits64(0x100000001ULL)) | 1268 .Case(10, HasAllBits64(0x100000001ULL)) |
| 1269 #endif | 1269 #endif |
| 1270 .Default(Kill("Invalid test case number")); | 1270 .Default(Kill()); |
| 1271 } | 1271 } |
| 1272 return Allow(); | 1272 return Allow(); |
| 1273 } | 1273 } |
| 1274 | 1274 |
| 1275 // Define a macro that performs tests using our test policy. | 1275 // Define a macro that performs tests using our test policy. |
| 1276 // NOTE: Not all of the arguments in this macro are actually used! | 1276 // NOTE: Not all of the arguments in this macro are actually used! |
| 1277 // They are here just to serve as documentation of the conditions | 1277 // They are here just to serve as documentation of the conditions |
| 1278 // implemented in the test policy. | 1278 // implemented in the test policy. |
| 1279 // Most notably, "op" and "mask" are unused by the macro. If you want | 1279 // Most notably, "op" and "mask" are unused by the macro. If you want |
| 1280 // to make changes to these values, you will have to edit the | 1280 // to make changes to these values, you will have to edit the |
| (...skipping 165 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1446 .Case(3, HasAnyBits32(0x80000000)) | 1446 .Case(3, HasAnyBits32(0x80000000)) |
| 1447 #if __SIZEOF_POINTER__ > 4 | 1447 #if __SIZEOF_POINTER__ > 4 |
| 1448 .Case(4, HasAnyBits64(0x0)) | 1448 .Case(4, HasAnyBits64(0x0)) |
| 1449 .Case(5, HasAnyBits64(0x1)) | 1449 .Case(5, HasAnyBits64(0x1)) |
| 1450 .Case(6, HasAnyBits64(0x3)) | 1450 .Case(6, HasAnyBits64(0x3)) |
| 1451 .Case(7, HasAnyBits64(0x80000000)) | 1451 .Case(7, HasAnyBits64(0x80000000)) |
| 1452 .Case(8, HasAnyBits64(0x100000000ULL)) | 1452 .Case(8, HasAnyBits64(0x100000000ULL)) |
| 1453 .Case(9, HasAnyBits64(0x300000000ULL)) | 1453 .Case(9, HasAnyBits64(0x300000000ULL)) |
| 1454 .Case(10, HasAnyBits64(0x100000001ULL)) | 1454 .Case(10, HasAnyBits64(0x100000001ULL)) |
| 1455 #endif | 1455 #endif |
| 1456 .Default(Kill("Invalid test case number")); | 1456 .Default(Kill()); |
| 1457 } | 1457 } |
| 1458 return Allow(); | 1458 return Allow(); |
| 1459 } | 1459 } |
| 1460 | 1460 |
| 1461 BPF_TEST_C(SandboxBPF, AnyBitTests, AnyBitTestPolicy) { | 1461 BPF_TEST_C(SandboxBPF, AnyBitTests, AnyBitTestPolicy) { |
| 1462 // 32bit test: any of 0x0 (should always be false) | 1462 // 32bit test: any of 0x0 (should always be false) |
| 1463 BITMASK_TEST( 0, 0, ANYBITS32, 0x0, EXPECT_FAILURE); | 1463 BITMASK_TEST( 0, 0, ANYBITS32, 0x0, EXPECT_FAILURE); |
| 1464 BITMASK_TEST( 0, 1, ANYBITS32, 0x0, EXPECT_FAILURE); | 1464 BITMASK_TEST( 0, 1, ANYBITS32, 0x0, EXPECT_FAILURE); |
| 1465 BITMASK_TEST( 0, 3, ANYBITS32, 0x0, EXPECT_FAILURE); | 1465 BITMASK_TEST( 0, 3, ANYBITS32, 0x0, EXPECT_FAILURE); |
| 1466 BITMASK_TEST( 0, 0xFFFFFFFFU, ANYBITS32, 0x0, EXPECT_FAILURE); | 1466 BITMASK_TEST( 0, 0xFFFFFFFFU, ANYBITS32, 0x0, EXPECT_FAILURE); |
| (...skipping 124 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1591 DCHECK(SandboxBPF::IsValidSyscallNumber(sysno)); | 1591 DCHECK(SandboxBPF::IsValidSyscallNumber(sysno)); |
| 1592 | 1592 |
| 1593 if (sysno == __NR_uname) { | 1593 if (sysno == __NR_uname) { |
| 1594 const Arg<int> option(0); | 1594 const Arg<int> option(0); |
| 1595 return Switch(option) | 1595 return Switch(option) |
| 1596 .Case(0, MaskedEqual32(0x00ff00ff, 0x005500aa)) | 1596 .Case(0, MaskedEqual32(0x00ff00ff, 0x005500aa)) |
| 1597 #if __SIZEOF_POINTER__ > 4 | 1597 #if __SIZEOF_POINTER__ > 4 |
| 1598 .Case(1, MaskedEqual64(0x00ff00ff00000000, 0x005500aa00000000)) | 1598 .Case(1, MaskedEqual64(0x00ff00ff00000000, 0x005500aa00000000)) |
| 1599 .Case(2, MaskedEqual64(0x00ff00ff00ff00ff, 0x005500aa005500aa)) | 1599 .Case(2, MaskedEqual64(0x00ff00ff00ff00ff, 0x005500aa005500aa)) |
| 1600 #endif | 1600 #endif |
| 1601 .Default(Kill("Invalid test case number")); | 1601 .Default(Kill()); |
| 1602 } | 1602 } |
| 1603 | 1603 |
| 1604 return Allow(); | 1604 return Allow(); |
| 1605 } | 1605 } |
| 1606 | 1606 |
| 1607 #define MASKEQ_TEST(rulenum, arg, expected_result) \ | 1607 #define MASKEQ_TEST(rulenum, arg, expected_result) \ |
| 1608 BPF_ASSERT(Syscall::Call(__NR_uname, (rulenum), (arg)) == (expected_result)) | 1608 BPF_ASSERT(Syscall::Call(__NR_uname, (rulenum), (arg)) == (expected_result)) |
| 1609 | 1609 |
| 1610 BPF_TEST_C(SandboxBPF, MaskedEqualTests, MaskedEqualTestPolicy) { | 1610 BPF_TEST_C(SandboxBPF, MaskedEqualTests, MaskedEqualTestPolicy) { |
| 1611 // Allowed: 0x__55__aa | 1611 // Allowed: 0x__55__aa |
| (...skipping 638 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 2250 BPF_ASSERT_EQ(ENOSYS, errno); | 2250 BPF_ASSERT_EQ(ENOSYS, errno); |
| 2251 | 2251 |
| 2252 BPF_ASSERT_EQ(-1, syscall(__NR_setgid, 300)); | 2252 BPF_ASSERT_EQ(-1, syscall(__NR_setgid, 300)); |
| 2253 BPF_ASSERT_EQ(EPERM, errno); | 2253 BPF_ASSERT_EQ(EPERM, errno); |
| 2254 } | 2254 } |
| 2255 | 2255 |
| 2256 } // namespace | 2256 } // namespace |
| 2257 | 2257 |
| 2258 } // namespace bpf_dsl | 2258 } // namespace bpf_dsl |
| 2259 } // namespace sandbox | 2259 } // namespace sandbox |
| OLD | NEW |