OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #import <Cocoa/Cocoa.h> | 5 #import <Cocoa/Cocoa.h> |
6 | 6 |
7 #include "base/file_util.h" | 7 #include "base/file_util.h" |
| 8 #include "base/files/scoped_file.h" |
8 #include "base/logging.h" | 9 #include "base/logging.h" |
9 #include "base/strings/sys_string_conversions.h" | 10 #include "base/strings/sys_string_conversions.h" |
10 #include "content/common/sandbox_mac.h" | 11 #include "content/common/sandbox_mac.h" |
11 #include "content/common/sandbox_mac_unittest_helper.h" | 12 #include "content/common/sandbox_mac_unittest_helper.h" |
12 #include "crypto/nss_util.h" | 13 #include "crypto/nss_util.h" |
13 #include "testing/gtest/include/gtest/gtest.h" | 14 #include "testing/gtest/include/gtest/gtest.h" |
14 | 15 |
15 namespace content { | 16 namespace content { |
16 | 17 |
17 //--------------------- Clipboard Sandboxing ---------------------- | 18 //--------------------- Clipboard Sandboxing ---------------------- |
(...skipping 61 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
79 //--------------------- File Access Sandboxing ---------------------- | 80 //--------------------- File Access Sandboxing ---------------------- |
80 // Test case for checking sandboxing of filesystem apis. | 81 // Test case for checking sandboxing of filesystem apis. |
81 class MacSandboxedFileAccessTestCase : public MacSandboxTestCase { | 82 class MacSandboxedFileAccessTestCase : public MacSandboxTestCase { |
82 public: | 83 public: |
83 virtual bool SandboxedTest() OVERRIDE; | 84 virtual bool SandboxedTest() OVERRIDE; |
84 }; | 85 }; |
85 | 86 |
86 REGISTER_SANDBOX_TEST_CASE(MacSandboxedFileAccessTestCase); | 87 REGISTER_SANDBOX_TEST_CASE(MacSandboxedFileAccessTestCase); |
87 | 88 |
88 bool MacSandboxedFileAccessTestCase::SandboxedTest() { | 89 bool MacSandboxedFileAccessTestCase::SandboxedTest() { |
89 int fdes = open("/etc/passwd", O_RDONLY); | 90 base::ScopedFD fdes(open("/etc/passwd", O_RDONLY)); |
90 file_util::ScopedFD file_closer(&fdes); | 91 return !fdes.is_valid(); |
91 return fdes == -1; | |
92 } | 92 } |
93 | 93 |
94 TEST_F(MacSandboxTest, FileAccess) { | 94 TEST_F(MacSandboxTest, FileAccess) { |
95 EXPECT_TRUE(RunTestInAllSandboxTypes("MacSandboxedFileAccessTestCase", NULL)); | 95 EXPECT_TRUE(RunTestInAllSandboxTypes("MacSandboxedFileAccessTestCase", NULL)); |
96 } | 96 } |
97 | 97 |
98 //--------------------- /dev/urandom Sandboxing ---------------------- | 98 //--------------------- /dev/urandom Sandboxing ---------------------- |
99 // /dev/urandom is available to any sandboxed process. | 99 // /dev/urandom is available to any sandboxed process. |
100 class MacSandboxedUrandomTestCase : public MacSandboxTestCase { | 100 class MacSandboxedUrandomTestCase : public MacSandboxTestCase { |
101 public: | 101 public: |
102 virtual bool SandboxedTest() OVERRIDE; | 102 virtual bool SandboxedTest() OVERRIDE; |
103 }; | 103 }; |
104 | 104 |
105 REGISTER_SANDBOX_TEST_CASE(MacSandboxedUrandomTestCase); | 105 REGISTER_SANDBOX_TEST_CASE(MacSandboxedUrandomTestCase); |
106 | 106 |
107 bool MacSandboxedUrandomTestCase::SandboxedTest() { | 107 bool MacSandboxedUrandomTestCase::SandboxedTest() { |
108 int fdes = open("/dev/urandom", O_RDONLY); | 108 base::ScopedFD fdes(open("/dev/urandom", O_RDONLY)); |
109 file_util::ScopedFD file_closer(&fdes); | |
110 | 109 |
111 // Opening /dev/urandom succeeds under the sandbox. | 110 // Opening /dev/urandom succeeds under the sandbox. |
112 if (fdes == -1) | 111 if (!fdes.is_valid()) |
113 return false; | 112 return false; |
114 | 113 |
115 char buf[16]; | 114 char buf[16]; |
116 int rc = read(fdes, buf, sizeof(buf)); | 115 int rc = read(fdes.get(), buf, sizeof(buf)); |
117 return rc == sizeof(buf); | 116 return rc == sizeof(buf); |
118 } | 117 } |
119 | 118 |
120 TEST_F(MacSandboxTest, UrandomAccess) { | 119 TEST_F(MacSandboxTest, UrandomAccess) { |
121 EXPECT_TRUE(RunTestInAllSandboxTypes("MacSandboxedUrandomTestCase", NULL)); | 120 EXPECT_TRUE(RunTestInAllSandboxTypes("MacSandboxedUrandomTestCase", NULL)); |
122 } | 121 } |
123 | 122 |
124 //--------------------- NSS Sandboxing ---------------------- | 123 //--------------------- NSS Sandboxing ---------------------- |
125 // Test case for checking sandboxing of NSS initialization. | 124 // Test case for checking sandboxing of NSS initialization. |
126 class MacSandboxedNSSTestCase : public MacSandboxTestCase { | 125 class MacSandboxedNSSTestCase : public MacSandboxTestCase { |
127 public: | 126 public: |
128 virtual bool SandboxedTest() OVERRIDE; | 127 virtual bool SandboxedTest() OVERRIDE; |
129 }; | 128 }; |
130 | 129 |
131 REGISTER_SANDBOX_TEST_CASE(MacSandboxedNSSTestCase); | 130 REGISTER_SANDBOX_TEST_CASE(MacSandboxedNSSTestCase); |
132 | 131 |
133 bool MacSandboxedNSSTestCase::SandboxedTest() { | 132 bool MacSandboxedNSSTestCase::SandboxedTest() { |
134 // If NSS cannot read from /dev/urandom, NSS initialization will call abort(), | 133 // If NSS cannot read from /dev/urandom, NSS initialization will call abort(), |
135 // which will cause this test case to fail. | 134 // which will cause this test case to fail. |
136 crypto::ForceNSSNoDBInit(); | 135 crypto::ForceNSSNoDBInit(); |
137 crypto::EnsureNSSInit(); | 136 crypto::EnsureNSSInit(); |
138 return true; | 137 return true; |
139 } | 138 } |
140 | 139 |
141 TEST_F(MacSandboxTest, NSSAccess) { | 140 TEST_F(MacSandboxTest, NSSAccess) { |
142 EXPECT_TRUE(RunTestInAllSandboxTypes("MacSandboxedNSSTestCase", NULL)); | 141 EXPECT_TRUE(RunTestInAllSandboxTypes("MacSandboxedNSSTestCase", NULL)); |
143 } | 142 } |
144 | 143 |
145 } // namespace content | 144 } // namespace content |
OLD | NEW |