| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/mac/bootstrap_sandbox.h" | 5 #include "sandbox/mac/bootstrap_sandbox.h" |
| 6 | 6 |
| 7 #include <CoreFoundation/CoreFoundation.h> | 7 #include <CoreFoundation/CoreFoundation.h> |
| 8 #import <Foundation/Foundation.h> | 8 #import <Foundation/Foundation.h> |
| 9 #include <mach/mach.h> | 9 #include <mach/mach.h> |
| 10 #include <servers/bootstrap.h> | 10 #include <servers/bootstrap.h> |
| (...skipping 120 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 131 EXPECT_EQ(0, code); | 131 EXPECT_EQ(0, code); |
| 132 | 132 |
| 133 [observer waitForNotification]; | 133 [observer waitForNotification]; |
| 134 EXPECT_EQ(1, [observer receivedCount]); | 134 EXPECT_EQ(1, [observer receivedCount]); |
| 135 EXPECT_EQ(process.Pid(), [[observer object] intValue]); | 135 EXPECT_EQ(process.Pid(), [[observer object] intValue]); |
| 136 } | 136 } |
| 137 | 137 |
| 138 // Run the test with the sandbox enabled without notifications on the policy | 138 // Run the test with the sandbox enabled without notifications on the policy |
| 139 // whitelist. | 139 // whitelist. |
| 140 TEST_F(BootstrapSandboxTest, DistributedNotifications_SandboxDeny) { | 140 TEST_F(BootstrapSandboxTest, DistributedNotifications_SandboxDeny) { |
| 141 if (base::mac::IsOSSierraOrLater()) { | 141 if (base::mac::IsAtLeastOS10_12()) { |
| 142 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; | 142 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; |
| 143 return; | 143 return; |
| 144 } | 144 } |
| 145 | 145 |
| 146 base::scoped_nsobject<DistributedNotificationObserver> observer( | 146 base::scoped_nsobject<DistributedNotificationObserver> observer( |
| 147 [[DistributedNotificationObserver alloc] init]); | 147 [[DistributedNotificationObserver alloc] init]); |
| 148 | 148 |
| 149 sandbox_->RegisterSandboxPolicy(1, BaselinePolicy()); | 149 sandbox_->RegisterSandboxPolicy(1, BaselinePolicy()); |
| 150 RunChildWithPolicy(1, kNotificationTestMain, NULL); | 150 RunChildWithPolicy(1, kNotificationTestMain, NULL); |
| 151 | 151 |
| 152 [observer waitForNotification]; | 152 [observer waitForNotification]; |
| 153 EXPECT_EQ(0, [observer receivedCount]); | 153 EXPECT_EQ(0, [observer receivedCount]); |
| 154 EXPECT_EQ(nil, [observer object]); | 154 EXPECT_EQ(nil, [observer object]); |
| 155 } | 155 } |
| 156 | 156 |
| 157 // Run the test with notifications permitted. | 157 // Run the test with notifications permitted. |
| 158 TEST_F(BootstrapSandboxTest, DistributedNotifications_SandboxAllow) { | 158 TEST_F(BootstrapSandboxTest, DistributedNotifications_SandboxAllow) { |
| 159 if (base::mac::IsOSSierraOrLater()) { | 159 if (base::mac::IsAtLeastOS10_12()) { |
| 160 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; | 160 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; |
| 161 return; | 161 return; |
| 162 } | 162 } |
| 163 | 163 |
| 164 base::scoped_nsobject<DistributedNotificationObserver> observer( | 164 base::scoped_nsobject<DistributedNotificationObserver> observer( |
| 165 [[DistributedNotificationObserver alloc] init]); | 165 [[DistributedNotificationObserver alloc] init]); |
| 166 | 166 |
| 167 BootstrapSandboxPolicy policy(BaselinePolicy()); | 167 BootstrapSandboxPolicy policy(BaselinePolicy()); |
| 168 // 10.9: | 168 // 10.9: |
| 169 policy.rules["com.apple.distributed_notifications@Uv3"] = Rule(POLICY_ALLOW); | 169 policy.rules["com.apple.distributed_notifications@Uv3"] = Rule(POLICY_ALLOW); |
| (...skipping 14 matching lines...) Expand all Loading... |
| 184 MULTIPROCESS_TEST_MAIN(PostNotification) { | 184 MULTIPROCESS_TEST_MAIN(PostNotification) { |
| 185 [[NSDistributedNotificationCenter defaultCenter] | 185 [[NSDistributedNotificationCenter defaultCenter] |
| 186 postNotificationName:kTestNotification | 186 postNotificationName:kTestNotification |
| 187 object:[NSString stringWithFormat:@"%d", getpid()]]; | 187 object:[NSString stringWithFormat:@"%d", getpid()]]; |
| 188 return 0; | 188 return 0; |
| 189 } | 189 } |
| 190 | 190 |
| 191 const char kTestServer[] = "org.chromium.test_bootstrap_server"; | 191 const char kTestServer[] = "org.chromium.test_bootstrap_server"; |
| 192 | 192 |
| 193 TEST_F(BootstrapSandboxTest, PolicyDenyError) { | 193 TEST_F(BootstrapSandboxTest, PolicyDenyError) { |
| 194 if (base::mac::IsOSSierraOrLater()) { | 194 if (base::mac::IsAtLeastOS10_12()) { |
| 195 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; | 195 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; |
| 196 return; | 196 return; |
| 197 } | 197 } |
| 198 BootstrapSandboxPolicy policy(BaselinePolicy()); | 198 BootstrapSandboxPolicy policy(BaselinePolicy()); |
| 199 policy.rules[kTestServer] = Rule(POLICY_DENY_ERROR); | 199 policy.rules[kTestServer] = Rule(POLICY_DENY_ERROR); |
| 200 sandbox_->RegisterSandboxPolicy(1, policy); | 200 sandbox_->RegisterSandboxPolicy(1, policy); |
| 201 | 201 |
| 202 RunChildWithPolicy(1, "PolicyDenyError", NULL); | 202 RunChildWithPolicy(1, "PolicyDenyError", NULL); |
| 203 } | 203 } |
| 204 | 204 |
| 205 MULTIPROCESS_TEST_MAIN(PolicyDenyError) { | 205 MULTIPROCESS_TEST_MAIN(PolicyDenyError) { |
| 206 mach_port_t port = MACH_PORT_NULL; | 206 mach_port_t port = MACH_PORT_NULL; |
| 207 kern_return_t kr = bootstrap_look_up(bootstrap_port, kTestServer, | 207 kern_return_t kr = bootstrap_look_up(bootstrap_port, kTestServer, |
| 208 &port); | 208 &port); |
| 209 CHECK_EQ(BOOTSTRAP_UNKNOWN_SERVICE, kr); | 209 CHECK_EQ(BOOTSTRAP_UNKNOWN_SERVICE, kr); |
| 210 CHECK(port == MACH_PORT_NULL); | 210 CHECK(port == MACH_PORT_NULL); |
| 211 | 211 |
| 212 kr = bootstrap_look_up(bootstrap_port, "org.chromium.some_other_server", | 212 kr = bootstrap_look_up(bootstrap_port, "org.chromium.some_other_server", |
| 213 &port); | 213 &port); |
| 214 CHECK_EQ(BOOTSTRAP_UNKNOWN_SERVICE, kr); | 214 CHECK_EQ(BOOTSTRAP_UNKNOWN_SERVICE, kr); |
| 215 CHECK(port == MACH_PORT_NULL); | 215 CHECK(port == MACH_PORT_NULL); |
| 216 | 216 |
| 217 return 0; | 217 return 0; |
| 218 } | 218 } |
| 219 | 219 |
| 220 TEST_F(BootstrapSandboxTest, PolicyDenyDummyPort) { | 220 TEST_F(BootstrapSandboxTest, PolicyDenyDummyPort) { |
| 221 if (base::mac::IsOSSierraOrLater()) { | 221 if (base::mac::IsAtLeastOS10_12()) { |
| 222 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; | 222 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; |
| 223 return; | 223 return; |
| 224 } | 224 } |
| 225 BootstrapSandboxPolicy policy(BaselinePolicy()); | 225 BootstrapSandboxPolicy policy(BaselinePolicy()); |
| 226 policy.rules[kTestServer] = Rule(POLICY_DENY_DUMMY_PORT); | 226 policy.rules[kTestServer] = Rule(POLICY_DENY_DUMMY_PORT); |
| 227 sandbox_->RegisterSandboxPolicy(1, policy); | 227 sandbox_->RegisterSandboxPolicy(1, policy); |
| 228 | 228 |
| 229 RunChildWithPolicy(1, "PolicyDenyDummyPort", NULL); | 229 RunChildWithPolicy(1, "PolicyDenyDummyPort", NULL); |
| 230 } | 230 } |
| 231 | 231 |
| (...skipping 11 matching lines...) Expand all Loading... |
| 243 char buf[32]; | 243 char buf[32]; |
| 244 }; | 244 }; |
| 245 | 245 |
| 246 struct SubstitutePortAckRecv : public SubstitutePortAckSend { | 246 struct SubstitutePortAckRecv : public SubstitutePortAckSend { |
| 247 mach_msg_trailer_t trailer; | 247 mach_msg_trailer_t trailer; |
| 248 }; | 248 }; |
| 249 | 249 |
| 250 const char kSubstituteAck[] = "Hello, this is doge!"; | 250 const char kSubstituteAck[] = "Hello, this is doge!"; |
| 251 | 251 |
| 252 TEST_F(BootstrapSandboxTest, PolicySubstitutePort) { | 252 TEST_F(BootstrapSandboxTest, PolicySubstitutePort) { |
| 253 if (base::mac::IsOSSierraOrLater()) { | 253 if (base::mac::IsAtLeastOS10_12()) { |
| 254 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; | 254 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; |
| 255 return; | 255 return; |
| 256 } | 256 } |
| 257 | 257 |
| 258 mach_port_t task = mach_task_self(); | 258 mach_port_t task = mach_task_self(); |
| 259 | 259 |
| 260 mach_port_t port; | 260 mach_port_t port; |
| 261 ASSERT_EQ(KERN_SUCCESS, mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, | 261 ASSERT_EQ(KERN_SUCCESS, mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, |
| 262 &port)); | 262 &port)); |
| 263 base::mac::ScopedMachReceiveRight scoped_port(port); | 263 base::mac::ScopedMachReceiveRight scoped_port(port); |
| (...skipping 100 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 364 &send_rights)); | 364 &send_rights)); |
| 365 EXPECT_EQ(2u, send_rights); | 365 EXPECT_EQ(2u, send_rights); |
| 366 } | 366 } |
| 367 | 367 |
| 368 const char kDefaultRuleTestAllow[] = | 368 const char kDefaultRuleTestAllow[] = |
| 369 "org.chromium.sandbox.test.DefaultRuleAllow"; | 369 "org.chromium.sandbox.test.DefaultRuleAllow"; |
| 370 const char kDefaultRuleTestDeny[] = | 370 const char kDefaultRuleTestDeny[] = |
| 371 "org.chromium.sandbox.test.DefaultRuleAllow.Deny"; | 371 "org.chromium.sandbox.test.DefaultRuleAllow.Deny"; |
| 372 | 372 |
| 373 TEST_F(BootstrapSandboxTest, DefaultRuleAllow) { | 373 TEST_F(BootstrapSandboxTest, DefaultRuleAllow) { |
| 374 if (base::mac::IsOSSierraOrLater()) { | 374 if (base::mac::IsAtLeastOS10_12()) { |
| 375 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; | 375 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; |
| 376 return; | 376 return; |
| 377 } | 377 } |
| 378 | 378 |
| 379 mach_port_t task = mach_task_self(); | 379 mach_port_t task = mach_task_self(); |
| 380 | 380 |
| 381 mach_port_t port; | 381 mach_port_t port; |
| 382 ASSERT_EQ(KERN_SUCCESS, mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, | 382 ASSERT_EQ(KERN_SUCCESS, mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, |
| 383 &port)); | 383 &port)); |
| 384 base::mac::ScopedMachReceiveRight scoped_port_recv(port); | 384 base::mac::ScopedMachReceiveRight scoped_port_recv(port); |
| (...skipping 51 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 436 msg.header.msgh_remote_port = port; | 436 msg.header.msgh_remote_port = port; |
| 437 msg.header.msgh_bits = MACH_MSGH_BITS_REMOTE(MACH_MSG_TYPE_MOVE_SEND); | 437 msg.header.msgh_bits = MACH_MSGH_BITS_REMOTE(MACH_MSG_TYPE_MOVE_SEND); |
| 438 strncpy(msg.buf, kSubstituteAck, sizeof(msg.buf)); | 438 strncpy(msg.buf, kSubstituteAck, sizeof(msg.buf)); |
| 439 | 439 |
| 440 CHECK_EQ(KERN_SUCCESS, mach_msg_send(&msg.header)); | 440 CHECK_EQ(KERN_SUCCESS, mach_msg_send(&msg.header)); |
| 441 | 441 |
| 442 return 0; | 442 return 0; |
| 443 } | 443 } |
| 444 | 444 |
| 445 TEST_F(BootstrapSandboxTest, ChildOutliveSandbox) { | 445 TEST_F(BootstrapSandboxTest, ChildOutliveSandbox) { |
| 446 if (base::mac::IsOSSierraOrLater()) { | 446 if (base::mac::IsAtLeastOS10_12()) { |
| 447 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; | 447 LOG(ERROR) << "BootstrapSandbox does not work on macOS Sierra or later."; |
| 448 return; | 448 return; |
| 449 } | 449 } |
| 450 | 450 |
| 451 const int kTestPolicyId = 1; | 451 const int kTestPolicyId = 1; |
| 452 mach_port_t task = mach_task_self(); | 452 mach_port_t task = mach_task_self(); |
| 453 | 453 |
| 454 // Create a server port. | 454 // Create a server port. |
| 455 mach_port_t port; | 455 mach_port_t port; |
| 456 ASSERT_EQ(KERN_SUCCESS, mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, | 456 ASSERT_EQ(KERN_SUCCESS, mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, |
| (...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 540 kr = mach_msg_receive(&rcv_msg.header); | 540 kr = mach_msg_receive(&rcv_msg.header); |
| 541 MACH_CHECK(kr == KERN_SUCCESS, kr) << "mach_msg_receive"; | 541 MACH_CHECK(kr == KERN_SUCCESS, kr) << "mach_msg_receive"; |
| 542 | 542 |
| 543 // Try to message the sandbox. | 543 // Try to message the sandbox. |
| 544 bootstrap_look_up(bootstrap_port, "test", &port); | 544 bootstrap_look_up(bootstrap_port, "test", &port); |
| 545 | 545 |
| 546 return 0; | 546 return 0; |
| 547 } | 547 } |
| 548 | 548 |
| 549 } // namespace sandbox | 549 } // namespace sandbox |
| OLD | NEW |