| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/mac/bootstrap_sandbox.h" | 5 #include "sandbox/mac/bootstrap_sandbox.h" |
| 6 | 6 |
| 7 #include <CoreFoundation/CoreFoundation.h> | 7 #include <CoreFoundation/CoreFoundation.h> |
| 8 #import <Foundation/Foundation.h> | 8 #import <Foundation/Foundation.h> |
| 9 #include <mach/mach.h> | 9 #include <mach/mach.h> |
| 10 #include <servers/bootstrap.h> | 10 #include <servers/bootstrap.h> |
| (...skipping 62 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 73 ++receivedCount_; | 73 ++receivedCount_; |
| 74 object_.reset([[notification object] copy]); | 74 object_.reset([[notification object] copy]); |
| 75 CFRunLoopStop(CFRunLoopGetCurrent()); | 75 CFRunLoopStop(CFRunLoopGetCurrent()); |
| 76 } | 76 } |
| 77 @end | 77 @end |
| 78 | 78 |
| 79 //////////////////////////////////////////////////////////////////////////////// | 79 //////////////////////////////////////////////////////////////////////////////// |
| 80 | 80 |
| 81 namespace sandbox { | 81 namespace sandbox { |
| 82 | 82 |
| 83 void InitializeXPCIfRequired() { | |
| 84 if (base::mac::IsOSYosemiteOrLater()) | |
| 85 CHECK(InitializeXPC()); | |
| 86 } | |
| 87 | |
| 88 class BootstrapSandboxTest : public base::MultiProcessTest { | 83 class BootstrapSandboxTest : public base::MultiProcessTest { |
| 89 public: | 84 public: |
| 90 void SetUp() override { | 85 void SetUp() override { |
| 91 base::MultiProcessTest::SetUp(); | 86 base::MultiProcessTest::SetUp(); |
| 92 | 87 |
| 93 sandbox_ = BootstrapSandbox::Create(); | 88 sandbox_ = BootstrapSandbox::Create(); |
| 94 ASSERT_TRUE(sandbox_.get()); | 89 ASSERT_TRUE(sandbox_.get()); |
| 95 } | 90 } |
| 96 | 91 |
| 97 BootstrapSandboxPolicy BaselinePolicy() { | 92 BootstrapSandboxPolicy BaselinePolicy() { |
| (...skipping 74 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 172 | 167 |
| 173 base::ProcessHandle pid; | 168 base::ProcessHandle pid; |
| 174 RunChildWithPolicy(2, kNotificationTestMain, &pid); | 169 RunChildWithPolicy(2, kNotificationTestMain, &pid); |
| 175 | 170 |
| 176 [observer waitForNotification]; | 171 [observer waitForNotification]; |
| 177 EXPECT_EQ(1, [observer receivedCount]); | 172 EXPECT_EQ(1, [observer receivedCount]); |
| 178 EXPECT_EQ(pid, [[observer object] intValue]); | 173 EXPECT_EQ(pid, [[observer object] intValue]); |
| 179 } | 174 } |
| 180 | 175 |
| 181 MULTIPROCESS_TEST_MAIN(PostNotification) { | 176 MULTIPROCESS_TEST_MAIN(PostNotification) { |
| 182 InitializeXPCIfRequired(); | |
| 183 | |
| 184 [[NSDistributedNotificationCenter defaultCenter] | 177 [[NSDistributedNotificationCenter defaultCenter] |
| 185 postNotificationName:kTestNotification | 178 postNotificationName:kTestNotification |
| 186 object:[NSString stringWithFormat:@"%d", getpid()]]; | 179 object:[NSString stringWithFormat:@"%d", getpid()]]; |
| 187 return 0; | 180 return 0; |
| 188 } | 181 } |
| 189 | 182 |
| 190 const char kTestServer[] = "org.chromium.test_bootstrap_server"; | 183 const char kTestServer[] = "org.chromium.test_bootstrap_server"; |
| 191 | 184 |
| 192 TEST_F(BootstrapSandboxTest, PolicyDenyError) { | 185 TEST_F(BootstrapSandboxTest, PolicyDenyError) { |
| 193 BootstrapSandboxPolicy policy(BaselinePolicy()); | 186 BootstrapSandboxPolicy policy(BaselinePolicy()); |
| 194 policy.rules[kTestServer] = Rule(POLICY_DENY_ERROR); | 187 policy.rules[kTestServer] = Rule(POLICY_DENY_ERROR); |
| 195 sandbox_->RegisterSandboxPolicy(1, policy); | 188 sandbox_->RegisterSandboxPolicy(1, policy); |
| 196 | 189 |
| 197 RunChildWithPolicy(1, "PolicyDenyError", NULL); | 190 RunChildWithPolicy(1, "PolicyDenyError", NULL); |
| 198 } | 191 } |
| 199 | 192 |
| 200 MULTIPROCESS_TEST_MAIN(PolicyDenyError) { | 193 MULTIPROCESS_TEST_MAIN(PolicyDenyError) { |
| 201 InitializeXPCIfRequired(); | |
| 202 | |
| 203 mach_port_t port = MACH_PORT_NULL; | 194 mach_port_t port = MACH_PORT_NULL; |
| 204 kern_return_t kr = bootstrap_look_up(bootstrap_port, kTestServer, | 195 kern_return_t kr = bootstrap_look_up(bootstrap_port, kTestServer, |
| 205 &port); | 196 &port); |
| 206 CHECK_EQ(BOOTSTRAP_UNKNOWN_SERVICE, kr); | 197 CHECK_EQ(BOOTSTRAP_UNKNOWN_SERVICE, kr); |
| 207 CHECK(port == MACH_PORT_NULL); | 198 CHECK(port == MACH_PORT_NULL); |
| 208 | 199 |
| 209 kr = bootstrap_look_up(bootstrap_port, "org.chromium.some_other_server", | 200 kr = bootstrap_look_up(bootstrap_port, "org.chromium.some_other_server", |
| 210 &port); | 201 &port); |
| 211 CHECK_EQ(BOOTSTRAP_UNKNOWN_SERVICE, kr); | 202 CHECK_EQ(BOOTSTRAP_UNKNOWN_SERVICE, kr); |
| 212 CHECK(port == MACH_PORT_NULL); | 203 CHECK(port == MACH_PORT_NULL); |
| 213 | 204 |
| 214 return 0; | 205 return 0; |
| 215 } | 206 } |
| 216 | 207 |
| 217 TEST_F(BootstrapSandboxTest, PolicyDenyDummyPort) { | 208 TEST_F(BootstrapSandboxTest, PolicyDenyDummyPort) { |
| 218 BootstrapSandboxPolicy policy(BaselinePolicy()); | 209 BootstrapSandboxPolicy policy(BaselinePolicy()); |
| 219 policy.rules[kTestServer] = Rule(POLICY_DENY_DUMMY_PORT); | 210 policy.rules[kTestServer] = Rule(POLICY_DENY_DUMMY_PORT); |
| 220 sandbox_->RegisterSandboxPolicy(1, policy); | 211 sandbox_->RegisterSandboxPolicy(1, policy); |
| 221 | 212 |
| 222 RunChildWithPolicy(1, "PolicyDenyDummyPort", NULL); | 213 RunChildWithPolicy(1, "PolicyDenyDummyPort", NULL); |
| 223 } | 214 } |
| 224 | 215 |
| 225 MULTIPROCESS_TEST_MAIN(PolicyDenyDummyPort) { | 216 MULTIPROCESS_TEST_MAIN(PolicyDenyDummyPort) { |
| 226 InitializeXPCIfRequired(); | |
| 227 | |
| 228 mach_port_t port = MACH_PORT_NULL; | 217 mach_port_t port = MACH_PORT_NULL; |
| 229 kern_return_t kr = bootstrap_look_up(bootstrap_port, kTestServer, | 218 kern_return_t kr = bootstrap_look_up(bootstrap_port, kTestServer, |
| 230 &port); | 219 &port); |
| 231 CHECK_EQ(KERN_SUCCESS, kr); | 220 CHECK_EQ(KERN_SUCCESS, kr); |
| 232 CHECK(port != MACH_PORT_NULL); | 221 CHECK(port != MACH_PORT_NULL); |
| 233 return 0; | 222 return 0; |
| 234 } | 223 } |
| 235 | 224 |
| 236 struct SubstitutePortAckSend { | 225 struct SubstitutePortAckSend { |
| 237 mach_msg_header_t header; | 226 mach_msg_header_t header; |
| (...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 283 | 272 |
| 284 send_rights = 0; | 273 send_rights = 0; |
| 285 ASSERT_EQ(KERN_SUCCESS, mach_port_get_refs(task, port, MACH_PORT_RIGHT_SEND, | 274 ASSERT_EQ(KERN_SUCCESS, mach_port_get_refs(task, port, MACH_PORT_RIGHT_SEND, |
| 286 &send_rights)); | 275 &send_rights)); |
| 287 EXPECT_EQ(1u, send_rights); | 276 EXPECT_EQ(1u, send_rights); |
| 288 | 277 |
| 289 EXPECT_EQ(0, strncmp(kSubstituteAck, msg.buf, sizeof(msg.buf))); | 278 EXPECT_EQ(0, strncmp(kSubstituteAck, msg.buf, sizeof(msg.buf))); |
| 290 } | 279 } |
| 291 | 280 |
| 292 MULTIPROCESS_TEST_MAIN(PolicySubstitutePort) { | 281 MULTIPROCESS_TEST_MAIN(PolicySubstitutePort) { |
| 293 InitializeXPCIfRequired(); | |
| 294 | |
| 295 mach_port_t port = MACH_PORT_NULL; | 282 mach_port_t port = MACH_PORT_NULL; |
| 296 kern_return_t kr = bootstrap_look_up(bootstrap_port, kTestServer, &port); | 283 kern_return_t kr = bootstrap_look_up(bootstrap_port, kTestServer, &port); |
| 297 CHECK_EQ(KERN_SUCCESS, kr); | 284 CHECK_EQ(KERN_SUCCESS, kr); |
| 298 CHECK(port != MACH_PORT_NULL); | 285 CHECK(port != MACH_PORT_NULL); |
| 299 | 286 |
| 300 struct SubstitutePortAckSend msg; | 287 struct SubstitutePortAckSend msg; |
| 301 bzero(&msg, sizeof(msg)); | 288 bzero(&msg, sizeof(msg)); |
| 302 msg.header.msgh_size = sizeof(msg); | 289 msg.header.msgh_size = sizeof(msg); |
| 303 msg.header.msgh_remote_port = port; | 290 msg.header.msgh_remote_port = port; |
| 304 msg.header.msgh_bits = MACH_MSGH_BITS_REMOTE(MACH_MSG_TYPE_MOVE_SEND); | 291 msg.header.msgh_bits = MACH_MSGH_BITS_REMOTE(MACH_MSG_TYPE_MOVE_SEND); |
| (...skipping 97 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 402 msg.header.msgh_local_port = port; | 389 msg.header.msgh_local_port = port; |
| 403 kern_return_t kr = mach_msg(&msg.header, MACH_RCV_MSG, 0, | 390 kern_return_t kr = mach_msg(&msg.header, MACH_RCV_MSG, 0, |
| 404 msg.header.msgh_size, port, | 391 msg.header.msgh_size, port, |
| 405 TestTimeouts::tiny_timeout().InMilliseconds(), MACH_PORT_NULL); | 392 TestTimeouts::tiny_timeout().InMilliseconds(), MACH_PORT_NULL); |
| 406 EXPECT_EQ(KERN_SUCCESS, kr); | 393 EXPECT_EQ(KERN_SUCCESS, kr); |
| 407 | 394 |
| 408 EXPECT_EQ(0, strncmp(kSubstituteAck, msg.buf, sizeof(msg.buf))); | 395 EXPECT_EQ(0, strncmp(kSubstituteAck, msg.buf, sizeof(msg.buf))); |
| 409 } | 396 } |
| 410 | 397 |
| 411 MULTIPROCESS_TEST_MAIN(DefaultRuleAllow) { | 398 MULTIPROCESS_TEST_MAIN(DefaultRuleAllow) { |
| 412 InitializeXPCIfRequired(); | |
| 413 | |
| 414 [[NSDistributedNotificationCenter defaultCenter] | 399 [[NSDistributedNotificationCenter defaultCenter] |
| 415 postNotificationName:kTestNotification | 400 postNotificationName:kTestNotification |
| 416 object:[NSString stringWithFormat:@"%d", getpid()]]; | 401 object:[NSString stringWithFormat:@"%d", getpid()]]; |
| 417 | 402 |
| 418 mach_port_t port = MACH_PORT_NULL; | 403 mach_port_t port = MACH_PORT_NULL; |
| 419 CHECK_EQ(BOOTSTRAP_UNKNOWN_SERVICE, bootstrap_look_up(bootstrap_port, | 404 CHECK_EQ(BOOTSTRAP_UNKNOWN_SERVICE, bootstrap_look_up(bootstrap_port, |
| 420 const_cast<char*>(kDefaultRuleTestDeny), &port)); | 405 const_cast<char*>(kDefaultRuleTestDeny), &port)); |
| 421 CHECK(port == MACH_PORT_NULL); | 406 CHECK(port == MACH_PORT_NULL); |
| 422 | 407 |
| 423 CHECK_EQ(KERN_SUCCESS, bootstrap_look_up(bootstrap_port, | 408 CHECK_EQ(KERN_SUCCESS, bootstrap_look_up(bootstrap_port, |
| (...skipping 61 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 485 MACH_PORT_NULL, TestTimeouts::tiny_timeout().InMilliseconds(), | 470 MACH_PORT_NULL, TestTimeouts::tiny_timeout().InMilliseconds(), |
| 486 MACH_PORT_NULL); | 471 MACH_PORT_NULL); |
| 487 EXPECT_EQ(KERN_SUCCESS, kr) << mach_error_string(kr); | 472 EXPECT_EQ(KERN_SUCCESS, kr) << mach_error_string(kr); |
| 488 | 473 |
| 489 int code = 0; | 474 int code = 0; |
| 490 EXPECT_TRUE(process.WaitForExit(&code)); | 475 EXPECT_TRUE(process.WaitForExit(&code)); |
| 491 EXPECT_EQ(0, code); | 476 EXPECT_EQ(0, code); |
| 492 } | 477 } |
| 493 | 478 |
| 494 MULTIPROCESS_TEST_MAIN(ChildOutliveSandbox) { | 479 MULTIPROCESS_TEST_MAIN(ChildOutliveSandbox) { |
| 495 InitializeXPCIfRequired(); | |
| 496 | |
| 497 // Get the synchronization channel. | 480 // Get the synchronization channel. |
| 498 mach_port_t port = MACH_PORT_NULL; | 481 mach_port_t port = MACH_PORT_NULL; |
| 499 CHECK_EQ(KERN_SUCCESS, bootstrap_look_up(bootstrap_port, "sync", &port)); | 482 CHECK_EQ(KERN_SUCCESS, bootstrap_look_up(bootstrap_port, "sync", &port)); |
| 500 | 483 |
| 501 // Create a reply port. | 484 // Create a reply port. |
| 502 mach_port_t reply_port; | 485 mach_port_t reply_port; |
| 503 CHECK_EQ(KERN_SUCCESS, mach_port_allocate(mach_task_self(), | 486 CHECK_EQ(KERN_SUCCESS, mach_port_allocate(mach_task_self(), |
| 504 MACH_PORT_RIGHT_RECEIVE, &reply_port)); | 487 MACH_PORT_RIGHT_RECEIVE, &reply_port)); |
| 505 base::mac::ScopedMachReceiveRight scoped_reply_port(reply_port); | 488 base::mac::ScopedMachReceiveRight scoped_reply_port(reply_port); |
| 506 | 489 |
| (...skipping 24 matching lines...) Expand all Loading... |
| 531 kr = mach_msg_receive(&rcv_msg.header); | 514 kr = mach_msg_receive(&rcv_msg.header); |
| 532 MACH_CHECK(kr == KERN_SUCCESS, kr) << "mach_msg_receive"; | 515 MACH_CHECK(kr == KERN_SUCCESS, kr) << "mach_msg_receive"; |
| 533 | 516 |
| 534 // Try to message the sandbox. | 517 // Try to message the sandbox. |
| 535 bootstrap_look_up(bootstrap_port, "test", &port); | 518 bootstrap_look_up(bootstrap_port, "test", &port); |
| 536 | 519 |
| 537 return 0; | 520 return 0; |
| 538 } | 521 } |
| 539 | 522 |
| 540 } // namespace sandbox | 523 } // namespace sandbox |
| OLD | NEW |