| OLD | NEW | 
|---|
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be | 
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. | 
| 4 | 4 | 
| 5 #include "sandbox/linux/services/credentials.h" | 5 #include "sandbox/linux/services/credentials.h" | 
| 6 | 6 | 
| 7 #include <errno.h> | 7 #include <errno.h> | 
| 8 #include <fcntl.h> | 8 #include <fcntl.h> | 
| 9 #include <stdio.h> | 9 #include <stdio.h> | 
| 10 #include <sys/stat.h> | 10 #include <sys/stat.h> | 
| 11 #include <sys/types.h> | 11 #include <sys/types.h> | 
| 12 #include <unistd.h> | 12 #include <unistd.h> | 
| 13 | 13 | 
| 14 #include "base/file_util.h" | 14 #include "base/file_util.h" | 
| 15 #include "base/files/scoped_file.h" |  | 
| 16 #include "base/logging.h" | 15 #include "base/logging.h" | 
| 17 #include "base/memory/scoped_ptr.h" | 16 #include "base/memory/scoped_ptr.h" | 
| 18 #include "sandbox/linux/tests/unit_tests.h" | 17 #include "sandbox/linux/tests/unit_tests.h" | 
| 19 #include "testing/gtest/include/gtest/gtest.h" | 18 #include "testing/gtest/include/gtest/gtest.h" | 
| 20 | 19 | 
|  | 20 using file_util::ScopedFD; | 
|  | 21 | 
| 21 namespace sandbox { | 22 namespace sandbox { | 
| 22 | 23 | 
| 23 namespace { | 24 namespace { | 
| 24 | 25 | 
| 25 bool DirectoryExists(const char* path) { | 26 bool DirectoryExists(const char* path) { | 
| 26   struct stat dir; | 27   struct stat dir; | 
| 27   errno = 0; | 28   errno = 0; | 
| 28   int ret = stat(path, &dir); | 29   int ret = stat(path, &dir); | 
| 29   return -1 != ret || ENOENT != errno; | 30   return -1 != ret || ENOENT != errno; | 
| 30 } | 31 } | 
| (...skipping 26 matching lines...) Expand all  Loading... | 
| 57   scoped_ptr<Credentials> cred2(new Credentials); | 58   scoped_ptr<Credentials> cred2(new Credentials); | 
| 58 } | 59 } | 
| 59 | 60 | 
| 60 TEST(Credentials, HasOpenDirectory) { | 61 TEST(Credentials, HasOpenDirectory) { | 
| 61   Credentials creds; | 62   Credentials creds; | 
| 62   // No open directory should exist at startup. | 63   // No open directory should exist at startup. | 
| 63   EXPECT_FALSE(creds.HasOpenDirectory(-1)); | 64   EXPECT_FALSE(creds.HasOpenDirectory(-1)); | 
| 64   { | 65   { | 
| 65     // Have a "/dev" file descriptor around. | 66     // Have a "/dev" file descriptor around. | 
| 66     int dev_fd = open("/dev", O_RDONLY | O_DIRECTORY); | 67     int dev_fd = open("/dev", O_RDONLY | O_DIRECTORY); | 
| 67     base::ScopedFD dev_fd_closer(dev_fd); | 68     ScopedFD dev_fd_closer(&dev_fd); | 
| 68     EXPECT_TRUE(creds.HasOpenDirectory(-1)); | 69     EXPECT_TRUE(creds.HasOpenDirectory(-1)); | 
| 69   } | 70   } | 
| 70   EXPECT_FALSE(creds.HasOpenDirectory(-1)); | 71   EXPECT_FALSE(creds.HasOpenDirectory(-1)); | 
| 71 } | 72 } | 
| 72 | 73 | 
| 73 TEST(Credentials, HasOpenDirectoryWithFD) { | 74 TEST(Credentials, HasOpenDirectoryWithFD) { | 
| 74   Credentials creds; | 75   Credentials creds; | 
| 75 | 76 | 
| 76   int proc_fd = open("/proc", O_RDONLY | O_DIRECTORY); | 77   int proc_fd = open("/proc", O_RDONLY | O_DIRECTORY); | 
| 77   base::ScopedFD proc_fd_closer(proc_fd); | 78   ScopedFD proc_fd_closer(&proc_fd); | 
| 78   ASSERT_LE(0, proc_fd); | 79   ASSERT_LE(0, proc_fd); | 
| 79 | 80 | 
| 80   // Don't pass |proc_fd|, an open directory (proc_fd) should | 81   // Don't pass |proc_fd|, an open directory (proc_fd) should | 
| 81   // be detected. | 82   // be detected. | 
| 82   EXPECT_TRUE(creds.HasOpenDirectory(-1)); | 83   EXPECT_TRUE(creds.HasOpenDirectory(-1)); | 
| 83   // Pass |proc_fd| and no open directory should be detected. | 84   // Pass |proc_fd| and no open directory should be detected. | 
| 84   EXPECT_FALSE(creds.HasOpenDirectory(proc_fd)); | 85   EXPECT_FALSE(creds.HasOpenDirectory(proc_fd)); | 
| 85 | 86 | 
| 86   { | 87   { | 
| 87     // Have a "/dev" file descriptor around. | 88     // Have a "/dev" file descriptor around. | 
| 88     int dev_fd = open("/dev", O_RDONLY | O_DIRECTORY); | 89     int dev_fd = open("/dev", O_RDONLY | O_DIRECTORY); | 
| 89     base::ScopedFD dev_fd_closer(dev_fd); | 90     ScopedFD dev_fd_closer(&dev_fd); | 
| 90     EXPECT_TRUE(creds.HasOpenDirectory(proc_fd)); | 91     EXPECT_TRUE(creds.HasOpenDirectory(proc_fd)); | 
| 91   } | 92   } | 
| 92 | 93 | 
| 93   // The "/dev" file descriptor should now be closed, |proc_fd| is the only | 94   // The "/dev" file descriptor should now be closed, |proc_fd| is the only | 
| 94   // directory file descriptor open. | 95   // directory file descriptor open. | 
| 95   EXPECT_FALSE(creds.HasOpenDirectory(proc_fd)); | 96   EXPECT_FALSE(creds.HasOpenDirectory(proc_fd)); | 
| 96 } | 97 } | 
| 97 | 98 | 
| 98 SANDBOX_TEST(Credentials, DropAllCaps) { | 99 SANDBOX_TEST(Credentials, DropAllCaps) { | 
| 99   Credentials creds; | 100   Credentials creds; | 
| (...skipping 115 matching lines...) Expand 10 before | Expand all | Expand 10 after  Loading... | 
| 215 | 216 | 
| 216   // The kernel should now prevent us from regaining capabilities because we | 217   // The kernel should now prevent us from regaining capabilities because we | 
| 217   // are in a chroot. | 218   // are in a chroot. | 
| 218   CHECK(!Credentials::SupportsNewUserNS()); | 219   CHECK(!Credentials::SupportsNewUserNS()); | 
| 219   CHECK(!creds.MoveToNewUserNS()); | 220   CHECK(!creds.MoveToNewUserNS()); | 
| 220 } | 221 } | 
| 221 | 222 | 
| 222 }  // namespace. | 223 }  // namespace. | 
| 223 | 224 | 
| 224 }  // namespace sandbox. | 225 }  // namespace sandbox. | 
| OLD | NEW | 
|---|