OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/renderer/renderer_main_platform_delegate.h" | 5 #include "content/renderer/renderer_main_platform_delegate.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <sys/stat.h> | 8 #include <sys/stat.h> |
9 | 9 |
10 #include "base/command_line.h" | 10 #include "base/command_line.h" |
(...skipping 58 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
69 // Here, we test that the status of SeccompBpf in the renderer is consistent | 69 // Here, we test that the status of SeccompBpf in the renderer is consistent |
70 // with what LinuxSandbox::GetStatus() said we would do. | 70 // with what LinuxSandbox::GetStatus() said we would do. |
71 class LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance(); | 71 class LinuxSandbox* linux_sandbox = LinuxSandbox::GetInstance(); |
72 if (linux_sandbox->GetStatus() & kSandboxLinuxSeccompBpf) { | 72 if (linux_sandbox->GetStatus() & kSandboxLinuxSeccompBpf) { |
73 CHECK(linux_sandbox->seccomp_bpf_started()); | 73 CHECK(linux_sandbox->seccomp_bpf_started()); |
74 } | 74 } |
75 | 75 |
76 // Under the setuid sandbox, we should not be able to open any file via the | 76 // Under the setuid sandbox, we should not be able to open any file via the |
77 // filesystem. | 77 // filesystem. |
78 if (linux_sandbox->GetStatus() & kSandboxLinuxSUID) { | 78 if (linux_sandbox->GetStatus() & kSandboxLinuxSUID) { |
79 CHECK(!file_util::PathExists(base::FilePath("/proc/cpuinfo"))); | 79 CHECK(!base::PathExists(base::FilePath("/proc/cpuinfo"))); |
80 } | 80 } |
81 | 81 |
82 #if defined(__x86_64__) | 82 #if defined(__x86_64__) |
83 // Limit this test to architectures where seccomp BPF is active in renderers. | 83 // Limit this test to architectures where seccomp BPF is active in renderers. |
84 if (linux_sandbox->seccomp_bpf_started()) { | 84 if (linux_sandbox->seccomp_bpf_started()) { |
85 errno = 0; | 85 errno = 0; |
86 // This should normally return EBADF since the first argument is bogus, | 86 // This should normally return EBADF since the first argument is bogus, |
87 // but we know that under the seccomp-bpf sandbox, this should return EPERM. | 87 // but we know that under the seccomp-bpf sandbox, this should return EPERM. |
88 CHECK_EQ(fchmod(-1, 07777), -1); | 88 CHECK_EQ(fchmod(-1, 07777), -1); |
89 CHECK_EQ(errno, EPERM); | 89 CHECK_EQ(errno, EPERM); |
90 } | 90 } |
91 #endif // __x86_64__ | 91 #endif // __x86_64__ |
92 } | 92 } |
93 | 93 |
94 } // namespace content | 94 } // namespace content |
OLD | NEW |