| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/services/credentials.h" | 5 #include "sandbox/linux/services/credentials.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <fcntl.h> | 8 #include <fcntl.h> |
| 9 #include <limits.h> | 9 #include <limits.h> |
| 10 #include <pthread.h> | 10 #include <pthread.h> |
| (...skipping 112 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 123 } | 123 } |
| 124 | 124 |
| 125 SANDBOX_TEST(Credentials, NestedUserNS) { | 125 SANDBOX_TEST(Credentials, NestedUserNS) { |
| 126 CHECK(Credentials::DropAllCapabilities()); | 126 CHECK(Credentials::DropAllCapabilities()); |
| 127 // Probably missing kernel support. | 127 // Probably missing kernel support. |
| 128 if (!Credentials::MoveToNewUserNS()) return; | 128 if (!Credentials::MoveToNewUserNS()) return; |
| 129 CHECK(Credentials::DropAllCapabilities()); | 129 CHECK(Credentials::DropAllCapabilities()); |
| 130 // As of 3.12, the kernel has a limit of 32. See create_user_ns(). | 130 // As of 3.12, the kernel has a limit of 32. See create_user_ns(). |
| 131 const int kNestLevel = 10; | 131 const int kNestLevel = 10; |
| 132 for (int i = 0; i < kNestLevel; ++i) { | 132 for (int i = 0; i < kNestLevel; ++i) { |
| 133 CHECK(NewUserNSCycle()) << "Creating new user NS failed at iteration " | 133 // Creating new user NS failed at iteration |i|. |
| 134 << i << "."; | 134 CHECK(NewUserNSCycle()); |
| 135 } | 135 } |
| 136 } | 136 } |
| 137 | 137 |
| 138 // Test the WorkingDirectoryIsRoot() helper. | 138 // Test the WorkingDirectoryIsRoot() helper. |
| 139 SANDBOX_TEST(Credentials, CanDetectRoot) { | 139 SANDBOX_TEST(Credentials, CanDetectRoot) { |
| 140 PCHECK(0 == chdir("/proc/")); | 140 PCHECK(0 == chdir("/proc/")); |
| 141 CHECK(!WorkingDirectoryIsRoot()); | 141 CHECK(!WorkingDirectoryIsRoot()); |
| 142 PCHECK(0 == chdir("/")); | 142 PCHECK(0 == chdir("/")); |
| 143 CHECK(WorkingDirectoryIsRoot()); | 143 CHECK(WorkingDirectoryIsRoot()); |
| 144 } | 144 } |
| (...skipping 118 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 263 action.sa_handler = &SignalHandler; | 263 action.sa_handler = &SignalHandler; |
| 264 PCHECK(sigaction(SIGUSR1, &action, nullptr) == 0); | 264 PCHECK(sigaction(SIGUSR1, &action, nullptr) == 0); |
| 265 | 265 |
| 266 PCHECK(raise(SIGUSR1) == 0); | 266 PCHECK(raise(SIGUSR1) == 0); |
| 267 CHECK_EQ(1, signal_handler_called); | 267 CHECK_EQ(1, signal_handler_called); |
| 268 } | 268 } |
| 269 | 269 |
| 270 } // namespace. | 270 } // namespace. |
| 271 | 271 |
| 272 } // namespace sandbox. | 272 } // namespace sandbox. |
| OLD | NEW |