OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/mac/bootstrap_sandbox.h" | 5 #include "sandbox/mac/bootstrap_sandbox.h" |
6 | 6 |
7 #include <CoreFoundation/CoreFoundation.h> | 7 #include <CoreFoundation/CoreFoundation.h> |
8 #import <Foundation/Foundation.h> | 8 #import <Foundation/Foundation.h> |
9 #include <mach/mach.h> | 9 #include <mach/mach.h> |
10 #include <servers/bootstrap.h> | 10 #include <servers/bootstrap.h> |
(...skipping 120 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
131 EXPECT_EQ(0, code); | 131 EXPECT_EQ(0, code); |
132 | 132 |
133 [observer waitForNotification]; | 133 [observer waitForNotification]; |
134 EXPECT_EQ(1, [observer receivedCount]); | 134 EXPECT_EQ(1, [observer receivedCount]); |
135 EXPECT_EQ(process.Pid(), [[observer object] intValue]); | 135 EXPECT_EQ(process.Pid(), [[observer object] intValue]); |
136 } | 136 } |
137 | 137 |
138 // Run the test with the sandbox enabled without notifications on the policy | 138 // Run the test with the sandbox enabled without notifications on the policy |
139 // whitelist. | 139 // whitelist. |
140 TEST_F(BootstrapSandboxTest, DistributedNotifications_SandboxDeny) { | 140 TEST_F(BootstrapSandboxTest, DistributedNotifications_SandboxDeny) { |
141 if (base::mac::IsOSSierraOrLater()) { | 141 if (base::mac::IsAtLeastOS10_12()) { |
142 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; | 142 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; |
143 return; | 143 return; |
144 } | 144 } |
145 | 145 |
146 base::scoped_nsobject<DistributedNotificationObserver> observer( | 146 base::scoped_nsobject<DistributedNotificationObserver> observer( |
147 [[DistributedNotificationObserver alloc] init]); | 147 [[DistributedNotificationObserver alloc] init]); |
148 | 148 |
149 sandbox_->RegisterSandboxPolicy(1, BaselinePolicy()); | 149 sandbox_->RegisterSandboxPolicy(1, BaselinePolicy()); |
150 RunChildWithPolicy(1, kNotificationTestMain, NULL); | 150 RunChildWithPolicy(1, kNotificationTestMain, NULL); |
151 | 151 |
152 [observer waitForNotification]; | 152 [observer waitForNotification]; |
153 EXPECT_EQ(0, [observer receivedCount]); | 153 EXPECT_EQ(0, [observer receivedCount]); |
154 EXPECT_EQ(nil, [observer object]); | 154 EXPECT_EQ(nil, [observer object]); |
155 } | 155 } |
156 | 156 |
157 // Run the test with notifications permitted. | 157 // Run the test with notifications permitted. |
158 TEST_F(BootstrapSandboxTest, DistributedNotifications_SandboxAllow) { | 158 TEST_F(BootstrapSandboxTest, DistributedNotifications_SandboxAllow) { |
159 if (base::mac::IsOSSierraOrLater()) { | 159 if (base::mac::IsAtLeastOS10_12()) { |
160 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; | 160 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; |
161 return; | 161 return; |
162 } | 162 } |
163 | 163 |
164 base::scoped_nsobject<DistributedNotificationObserver> observer( | 164 base::scoped_nsobject<DistributedNotificationObserver> observer( |
165 [[DistributedNotificationObserver alloc] init]); | 165 [[DistributedNotificationObserver alloc] init]); |
166 | 166 |
167 BootstrapSandboxPolicy policy(BaselinePolicy()); | 167 BootstrapSandboxPolicy policy(BaselinePolicy()); |
168 // 10.9: | 168 // 10.9: |
169 policy.rules["com.apple.distributed_notifications@Uv3"] = Rule(POLICY_ALLOW); | 169 policy.rules["com.apple.distributed_notifications@Uv3"] = Rule(POLICY_ALLOW); |
(...skipping 14 matching lines...) Expand all Loading... |
184 MULTIPROCESS_TEST_MAIN(PostNotification) { | 184 MULTIPROCESS_TEST_MAIN(PostNotification) { |
185 [[NSDistributedNotificationCenter defaultCenter] | 185 [[NSDistributedNotificationCenter defaultCenter] |
186 postNotificationName:kTestNotification | 186 postNotificationName:kTestNotification |
187 object:[NSString stringWithFormat:@"%d", getpid()]]; | 187 object:[NSString stringWithFormat:@"%d", getpid()]]; |
188 return 0; | 188 return 0; |
189 } | 189 } |
190 | 190 |
191 const char kTestServer[] = "org.chromium.test_bootstrap_server"; | 191 const char kTestServer[] = "org.chromium.test_bootstrap_server"; |
192 | 192 |
193 TEST_F(BootstrapSandboxTest, PolicyDenyError) { | 193 TEST_F(BootstrapSandboxTest, PolicyDenyError) { |
194 if (base::mac::IsOSSierraOrLater()) { | 194 if (base::mac::IsAtLeastOS10_12()) { |
195 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; | 195 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; |
196 return; | 196 return; |
197 } | 197 } |
198 BootstrapSandboxPolicy policy(BaselinePolicy()); | 198 BootstrapSandboxPolicy policy(BaselinePolicy()); |
199 policy.rules[kTestServer] = Rule(POLICY_DENY_ERROR); | 199 policy.rules[kTestServer] = Rule(POLICY_DENY_ERROR); |
200 sandbox_->RegisterSandboxPolicy(1, policy); | 200 sandbox_->RegisterSandboxPolicy(1, policy); |
201 | 201 |
202 RunChildWithPolicy(1, "PolicyDenyError", NULL); | 202 RunChildWithPolicy(1, "PolicyDenyError", NULL); |
203 } | 203 } |
204 | 204 |
205 MULTIPROCESS_TEST_MAIN(PolicyDenyError) { | 205 MULTIPROCESS_TEST_MAIN(PolicyDenyError) { |
206 mach_port_t port = MACH_PORT_NULL; | 206 mach_port_t port = MACH_PORT_NULL; |
207 kern_return_t kr = bootstrap_look_up(bootstrap_port, kTestServer, | 207 kern_return_t kr = bootstrap_look_up(bootstrap_port, kTestServer, |
208 &port); | 208 &port); |
209 CHECK_EQ(BOOTSTRAP_UNKNOWN_SERVICE, kr); | 209 CHECK_EQ(BOOTSTRAP_UNKNOWN_SERVICE, kr); |
210 CHECK(port == MACH_PORT_NULL); | 210 CHECK(port == MACH_PORT_NULL); |
211 | 211 |
212 kr = bootstrap_look_up(bootstrap_port, "org.chromium.some_other_server", | 212 kr = bootstrap_look_up(bootstrap_port, "org.chromium.some_other_server", |
213 &port); | 213 &port); |
214 CHECK_EQ(BOOTSTRAP_UNKNOWN_SERVICE, kr); | 214 CHECK_EQ(BOOTSTRAP_UNKNOWN_SERVICE, kr); |
215 CHECK(port == MACH_PORT_NULL); | 215 CHECK(port == MACH_PORT_NULL); |
216 | 216 |
217 return 0; | 217 return 0; |
218 } | 218 } |
219 | 219 |
220 TEST_F(BootstrapSandboxTest, PolicyDenyDummyPort) { | 220 TEST_F(BootstrapSandboxTest, PolicyDenyDummyPort) { |
221 if (base::mac::IsOSSierraOrLater()) { | 221 if (base::mac::IsAtLeastOS10_12()) { |
222 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; | 222 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; |
223 return; | 223 return; |
224 } | 224 } |
225 BootstrapSandboxPolicy policy(BaselinePolicy()); | 225 BootstrapSandboxPolicy policy(BaselinePolicy()); |
226 policy.rules[kTestServer] = Rule(POLICY_DENY_DUMMY_PORT); | 226 policy.rules[kTestServer] = Rule(POLICY_DENY_DUMMY_PORT); |
227 sandbox_->RegisterSandboxPolicy(1, policy); | 227 sandbox_->RegisterSandboxPolicy(1, policy); |
228 | 228 |
229 RunChildWithPolicy(1, "PolicyDenyDummyPort", NULL); | 229 RunChildWithPolicy(1, "PolicyDenyDummyPort", NULL); |
230 } | 230 } |
231 | 231 |
(...skipping 11 matching lines...) Expand all Loading... |
243 char buf[32]; | 243 char buf[32]; |
244 }; | 244 }; |
245 | 245 |
246 struct SubstitutePortAckRecv : public SubstitutePortAckSend { | 246 struct SubstitutePortAckRecv : public SubstitutePortAckSend { |
247 mach_msg_trailer_t trailer; | 247 mach_msg_trailer_t trailer; |
248 }; | 248 }; |
249 | 249 |
250 const char kSubstituteAck[] = "Hello, this is doge!"; | 250 const char kSubstituteAck[] = "Hello, this is doge!"; |
251 | 251 |
252 TEST_F(BootstrapSandboxTest, PolicySubstitutePort) { | 252 TEST_F(BootstrapSandboxTest, PolicySubstitutePort) { |
253 if (base::mac::IsOSSierraOrLater()) { | 253 if (base::mac::IsAtLeastOS10_12()) { |
254 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; | 254 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; |
255 return; | 255 return; |
256 } | 256 } |
257 | 257 |
258 mach_port_t task = mach_task_self(); | 258 mach_port_t task = mach_task_self(); |
259 | 259 |
260 mach_port_t port; | 260 mach_port_t port; |
261 ASSERT_EQ(KERN_SUCCESS, mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, | 261 ASSERT_EQ(KERN_SUCCESS, mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, |
262 &port)); | 262 &port)); |
263 base::mac::ScopedMachReceiveRight scoped_port(port); | 263 base::mac::ScopedMachReceiveRight scoped_port(port); |
(...skipping 100 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
364 &send_rights)); | 364 &send_rights)); |
365 EXPECT_EQ(2u, send_rights); | 365 EXPECT_EQ(2u, send_rights); |
366 } | 366 } |
367 | 367 |
368 const char kDefaultRuleTestAllow[] = | 368 const char kDefaultRuleTestAllow[] = |
369 "org.chromium.sandbox.test.DefaultRuleAllow"; | 369 "org.chromium.sandbox.test.DefaultRuleAllow"; |
370 const char kDefaultRuleTestDeny[] = | 370 const char kDefaultRuleTestDeny[] = |
371 "org.chromium.sandbox.test.DefaultRuleAllow.Deny"; | 371 "org.chromium.sandbox.test.DefaultRuleAllow.Deny"; |
372 | 372 |
373 TEST_F(BootstrapSandboxTest, DefaultRuleAllow) { | 373 TEST_F(BootstrapSandboxTest, DefaultRuleAllow) { |
374 if (base::mac::IsOSSierraOrLater()) { | 374 if (base::mac::IsAtLeastOS10_12()) { |
375 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; | 375 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; |
376 return; | 376 return; |
377 } | 377 } |
378 | 378 |
379 mach_port_t task = mach_task_self(); | 379 mach_port_t task = mach_task_self(); |
380 | 380 |
381 mach_port_t port; | 381 mach_port_t port; |
382 ASSERT_EQ(KERN_SUCCESS, mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, | 382 ASSERT_EQ(KERN_SUCCESS, mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, |
383 &port)); | 383 &port)); |
384 base::mac::ScopedMachReceiveRight scoped_port_recv(port); | 384 base::mac::ScopedMachReceiveRight scoped_port_recv(port); |
(...skipping 51 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
436 msg.header.msgh_remote_port = port; | 436 msg.header.msgh_remote_port = port; |
437 msg.header.msgh_bits = MACH_MSGH_BITS_REMOTE(MACH_MSG_TYPE_MOVE_SEND); | 437 msg.header.msgh_bits = MACH_MSGH_BITS_REMOTE(MACH_MSG_TYPE_MOVE_SEND); |
438 strncpy(msg.buf, kSubstituteAck, sizeof(msg.buf)); | 438 strncpy(msg.buf, kSubstituteAck, sizeof(msg.buf)); |
439 | 439 |
440 CHECK_EQ(KERN_SUCCESS, mach_msg_send(&msg.header)); | 440 CHECK_EQ(KERN_SUCCESS, mach_msg_send(&msg.header)); |
441 | 441 |
442 return 0; | 442 return 0; |
443 } | 443 } |
444 | 444 |
445 TEST_F(BootstrapSandboxTest, ChildOutliveSandbox) { | 445 TEST_F(BootstrapSandboxTest, ChildOutliveSandbox) { |
446 if (base::mac::IsOSSierraOrLater()) { | 446 if (base::mac::IsAtLeastOS10_12()) { |
447 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; | 447 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; |
448 return; | 448 return; |
449 } | 449 } |
450 | 450 |
451 const int kTestPolicyId = 1; | 451 const int kTestPolicyId = 1; |
452 mach_port_t task = mach_task_self(); | 452 mach_port_t task = mach_task_self(); |
453 | 453 |
454 // Create a server port. | 454 // Create a server port. |
455 mach_port_t port; | 455 mach_port_t port; |
456 ASSERT_EQ(KERN_SUCCESS, mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, | 456 ASSERT_EQ(KERN_SUCCESS, mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, |
(...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
540 kr = mach_msg_receive(&rcv_msg.header); | 540 kr = mach_msg_receive(&rcv_msg.header); |
541 MACH_CHECK(kr == KERN_SUCCESS, kr) << "mach_msg_receive"; | 541 MACH_CHECK(kr == KERN_SUCCESS, kr) << "mach_msg_receive"; |
542 | 542 |
543 // Try to message the sandbox. | 543 // Try to message the sandbox. |
544 bootstrap_look_up(bootstrap_port, "test", &port); | 544 bootstrap_look_up(bootstrap_port, "test", &port); |
545 | 545 |
546 return 0; | 546 return 0; |
547 } | 547 } |
548 | 548 |
549 } // namespace sandbox | 549 } // namespace sandbox |
OLD | NEW |