| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/renderer/renderer_main_platform_delegate.h" | 5 #include "content/renderer/renderer_main_platform_delegate.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <sys/stat.h> | 8 #include <sys/stat.h> |
| 9 | 9 |
| 10 #include "base/command_line.h" | 10 #include "base/command_line.h" |
| (...skipping 58 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 69 // Here, we test that the status of SeccompBpf in the renderer is consistent | 69 // Here, we test that the status of SeccompBpf in the renderer is consistent |
| 70 // with what LinuxSandbox::GetStatus() said we would do. | 70 // with what LinuxSandbox::GetStatus() said we would do. |
| 71 class LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance(); | 71 class LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance(); |
| 72 if (linux_sandbox->GetStatus() & kSandboxLinuxSeccompBpf) { | 72 if (linux_sandbox->GetStatus() & kSandboxLinuxSeccompBpf) { |
| 73 CHECK(linux_sandbox->seccomp_bpf_started()); | 73 CHECK(linux_sandbox->seccomp_bpf_started()); |
| 74 } | 74 } |
| 75 | 75 |
| 76 // Under the setuid sandbox, we should not be able to open any file via the | 76 // Under the setuid sandbox, we should not be able to open any file via the |
| 77 // filesystem. | 77 // filesystem. |
| 78 if (linux_sandbox->GetStatus() & kSandboxLinuxSUID) { | 78 if (linux_sandbox->GetStatus() & kSandboxLinuxSUID) { |
| 79 CHECK(!file_util::PathExists(base::FilePath("/proc/cpuinfo"))); | 79 CHECK(!base::PathExists(base::FilePath("/proc/cpuinfo"))); |
| 80 } | 80 } |
| 81 | 81 |
| 82 #if defined(__x86_64__) | 82 #if defined(__x86_64__) |
| 83 // Limit this test to architectures where seccomp BPF is active in renderers. | 83 // Limit this test to architectures where seccomp BPF is active in renderers. |
| 84 if (linux_sandbox->seccomp_bpf_started()) { | 84 if (linux_sandbox->seccomp_bpf_started()) { |
| 85 errno = 0; | 85 errno = 0; |
| 86 // This should normally return EBADF since the first argument is bogus, | 86 // This should normally return EBADF since the first argument is bogus, |
| 87 // but we know that under the seccomp-bpf sandbox, this should return EPERM. | 87 // but we know that under the seccomp-bpf sandbox, this should return EPERM. |
| 88 CHECK_EQ(fchmod(-1, 07777), -1); | 88 CHECK_EQ(fchmod(-1, 07777), -1); |
| 89 CHECK_EQ(errno, EPERM); | 89 CHECK_EQ(errno, EPERM); |
| 90 } | 90 } |
| 91 #endif // __x86_64__ | 91 #endif // __x86_64__ |
| 92 } | 92 } |
| 93 | 93 |
| 94 } // namespace content | 94 } // namespace content |
| OLD | NEW |