OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <fcntl.h> | 5 #include <fcntl.h> |
6 #include <stdint.h> | 6 #include <stdint.h> |
7 #include <sys/stat.h> | 7 #include <sys/stat.h> |
8 #include <unistd.h> | 8 #include <unistd.h> |
9 | 9 |
10 #include "base/process/kill.h" | 10 #include "base/process/kill.h" |
(...skipping 14 matching lines...) Expand all Loading... |
25 | 25 |
26 SandboxCompiler compiler(profile); | 26 SandboxCompiler compiler(profile); |
27 | 27 |
28 std::string error; | 28 std::string error; |
29 CHECK(compiler.CompileAndApplyProfile(&error)); | 29 CHECK(compiler.CompileAndApplyProfile(&error)); |
30 | 30 |
31 return 0; | 31 return 0; |
32 } | 32 } |
33 | 33 |
34 TEST_F(SandboxMacCompilerTest, BasicProfileTest) { | 34 TEST_F(SandboxMacCompilerTest, BasicProfileTest) { |
35 base::Process process = SpawnChild("BasicProfileProcess"); | 35 base::SpawnChildResult spawn_child = SpawnChild("BasicProfileProcess"); |
36 ASSERT_TRUE(process.IsValid()); | 36 ASSERT_TRUE(spawn_child.process.IsValid()); |
37 int exit_code = 42; | 37 int exit_code = 42; |
38 EXPECT_TRUE(process.WaitForExitWithTimeout(TestTimeouts::action_max_timeout(), | 38 EXPECT_TRUE(spawn_child.process.WaitForExitWithTimeout( |
39 &exit_code)); | 39 TestTimeouts::action_max_timeout(), &exit_code)); |
40 EXPECT_EQ(exit_code, 0); | 40 EXPECT_EQ(exit_code, 0); |
41 } | 41 } |
42 | 42 |
43 MULTIPROCESS_TEST_MAIN(BasicProfileWithParamProcess) { | 43 MULTIPROCESS_TEST_MAIN(BasicProfileWithParamProcess) { |
44 std::string profile = | 44 std::string profile = |
45 "(version 1)" | 45 "(version 1)" |
46 "(allow file-read* file-write* (literal (param \"DIR\")))"; | 46 "(allow file-read* file-write* (literal (param \"DIR\")))"; |
47 | 47 |
48 SandboxCompiler compiler(profile); | 48 SandboxCompiler compiler(profile); |
49 CHECK(compiler.InsertStringParam("DIR", "/")); | 49 CHECK(compiler.InsertStringParam("DIR", "/")); |
50 | 50 |
51 std::string error; | 51 std::string error; |
52 CHECK(compiler.CompileAndApplyProfile(&error)); | 52 CHECK(compiler.CompileAndApplyProfile(&error)); |
53 | 53 |
54 return 0; | 54 return 0; |
55 } | 55 } |
56 | 56 |
57 TEST_F(SandboxMacCompilerTest, BasicProfileTestWithParam) { | 57 TEST_F(SandboxMacCompilerTest, BasicProfileTestWithParam) { |
58 base::Process process = SpawnChild("BasicProfileWithParamProcess"); | 58 base::SpawnChildResult spawn_child = |
59 ASSERT_TRUE(process.IsValid()); | 59 SpawnChild("BasicProfileWithParamProcess"); |
| 60 ASSERT_TRUE(spawn_child.process.IsValid()); |
60 int exit_code = 42; | 61 int exit_code = 42; |
61 EXPECT_TRUE(process.WaitForExitWithTimeout(TestTimeouts::action_max_timeout(), | 62 EXPECT_TRUE(spawn_child.process.WaitForExitWithTimeout( |
62 &exit_code)); | 63 TestTimeouts::action_max_timeout(), &exit_code)); |
63 EXPECT_EQ(exit_code, 0); | 64 EXPECT_EQ(exit_code, 0); |
64 } | 65 } |
65 | 66 |
66 MULTIPROCESS_TEST_MAIN(ProfileFunctionalProcess) { | 67 MULTIPROCESS_TEST_MAIN(ProfileFunctionalProcess) { |
67 std::string profile = | 68 std::string profile = |
68 "(version 1)" | 69 "(version 1)" |
69 "(debug deny)" | 70 "(debug deny)" |
70 "(allow file-read-data file-read-metadata (literal \"/dev/urandom\"))"; | 71 "(allow file-read-data file-read-metadata (literal \"/dev/urandom\"))"; |
71 | 72 |
72 SandboxCompiler compiler(profile); | 73 SandboxCompiler compiler(profile); |
73 | 74 |
74 std::string error; | 75 std::string error; |
75 CHECK(compiler.CompileAndApplyProfile(&error)); | 76 CHECK(compiler.CompileAndApplyProfile(&error)); |
76 | 77 |
77 // The profile compiled and applied successfully, now try and read 1 byte from | 78 // The profile compiled and applied successfully, now try and read 1 byte from |
78 // /dev/urandom. | 79 // /dev/urandom. |
79 uint8_t byte; | 80 uint8_t byte; |
80 int fd = open("/dev/urandom", O_RDONLY); | 81 int fd = open("/dev/urandom", O_RDONLY); |
81 CHECK_NE(fd, -1); | 82 CHECK_NE(fd, -1); |
82 | 83 |
83 EXPECT_TRUE(read(fd, &byte, sizeof(byte)) == sizeof(byte)); | 84 EXPECT_TRUE(read(fd, &byte, sizeof(byte)) == sizeof(byte)); |
84 | 85 |
85 return 0; | 86 return 0; |
86 } | 87 } |
87 | 88 |
88 TEST_F(SandboxMacCompilerTest, ProfileFunctionalityTest) { | 89 TEST_F(SandboxMacCompilerTest, ProfileFunctionalityTest) { |
89 base::Process process = SpawnChild("ProfileFunctionalProcess"); | 90 base::SpawnChildResult spawn_child = SpawnChild("ProfileFunctionalProcess"); |
90 ASSERT_TRUE(process.IsValid()); | 91 ASSERT_TRUE(spawn_child.process.IsValid()); |
91 int exit_code = 42; | 92 int exit_code = 42; |
92 EXPECT_TRUE(process.WaitForExitWithTimeout(TestTimeouts::action_max_timeout(), | 93 EXPECT_TRUE(spawn_child.process.WaitForExitWithTimeout( |
93 &exit_code)); | 94 TestTimeouts::action_max_timeout(), &exit_code)); |
94 EXPECT_EQ(exit_code, 0); | 95 EXPECT_EQ(exit_code, 0); |
95 } | 96 } |
96 | 97 |
97 MULTIPROCESS_TEST_MAIN(ProfileFunctionalTestWithParamsProcess) { | 98 MULTIPROCESS_TEST_MAIN(ProfileFunctionalTestWithParamsProcess) { |
98 std::string profile = | 99 std::string profile = |
99 "(version 1)" | 100 "(version 1)" |
100 "(debug deny)" | 101 "(debug deny)" |
101 "(if (string=? (param \"ALLOW_FILE\") \"TRUE\")" | 102 "(if (string=? (param \"ALLOW_FILE\") \"TRUE\")" |
102 " (allow file-read-data file-read-metadata (literal (param " | 103 " (allow file-read-data file-read-metadata (literal (param " |
103 "\"URANDOM\"))))"; | 104 "\"URANDOM\"))))"; |
(...skipping 15 matching lines...) Expand all Loading... |
119 EXPECT_TRUE(read(fd, &byte, sizeof(byte)) == sizeof(byte)); | 120 EXPECT_TRUE(read(fd, &byte, sizeof(byte)) == sizeof(byte)); |
120 | 121 |
121 // Make sure the sandbox isn't overly permissive. | 122 // Make sure the sandbox isn't overly permissive. |
122 struct stat st; | 123 struct stat st; |
123 EXPECT_EQ(stat("/", &st), -1); | 124 EXPECT_EQ(stat("/", &st), -1); |
124 | 125 |
125 return 0; | 126 return 0; |
126 } | 127 } |
127 | 128 |
128 TEST_F(SandboxMacCompilerTest, ProfileFunctionalityTestWithParams) { | 129 TEST_F(SandboxMacCompilerTest, ProfileFunctionalityTestWithParams) { |
129 base::Process process = SpawnChild("ProfileFunctionalTestWithParamsProcess"); | 130 base::SpawnChildResult spawn_child = |
130 ASSERT_TRUE(process.IsValid()); | 131 SpawnChild("ProfileFunctionalTestWithParamsProcess"); |
| 132 ASSERT_TRUE(spawn_child.process.IsValid()); |
131 int exit_code = 42; | 133 int exit_code = 42; |
132 EXPECT_TRUE(process.WaitForExitWithTimeout(TestTimeouts::action_max_timeout(), | 134 EXPECT_TRUE(spawn_child.process.WaitForExitWithTimeout( |
133 &exit_code)); | 135 TestTimeouts::action_max_timeout(), &exit_code)); |
134 EXPECT_EQ(exit_code, 0); | 136 EXPECT_EQ(exit_code, 0); |
135 } | 137 } |
136 | 138 |
137 MULTIPROCESS_TEST_MAIN(ProfileFunctionalityTestErrorProcess) { | 139 MULTIPROCESS_TEST_MAIN(ProfileFunctionalityTestErrorProcess) { |
138 std::string profile = "(+ 5 a)"; | 140 std::string profile = "(+ 5 a)"; |
139 | 141 |
140 SandboxCompiler compiler(profile); | 142 SandboxCompiler compiler(profile); |
141 | 143 |
142 // Make sure that this invalid profile results in an error returned. | 144 // Make sure that this invalid profile results in an error returned. |
143 std::string error; | 145 std::string error; |
144 CHECK_EQ(error, ""); | 146 CHECK_EQ(error, ""); |
145 CHECK(!compiler.CompileAndApplyProfile(&error)); | 147 CHECK(!compiler.CompileAndApplyProfile(&error)); |
146 CHECK_NE(error, ""); | 148 CHECK_NE(error, ""); |
147 | 149 |
148 return 0; | 150 return 0; |
149 } | 151 } |
150 | 152 |
151 TEST_F(SandboxMacCompilerTest, ProfileFunctionalityTestError) { | 153 TEST_F(SandboxMacCompilerTest, ProfileFunctionalityTestError) { |
152 base::Process process = SpawnChild("ProfileFunctionalityTestErrorProcess"); | 154 base::SpawnChildResult spawn_child = |
153 ASSERT_TRUE(process.IsValid()); | 155 SpawnChild("ProfileFunctionalityTestErrorProcess"); |
| 156 ASSERT_TRUE(spawn_child.process.IsValid()); |
154 int exit_code = 42; | 157 int exit_code = 42; |
155 EXPECT_TRUE(process.WaitForExitWithTimeout(TestTimeouts::action_max_timeout(), | 158 EXPECT_TRUE(spawn_child.process.WaitForExitWithTimeout( |
156 &exit_code)); | 159 TestTimeouts::action_max_timeout(), &exit_code)); |
157 EXPECT_EQ(exit_code, 0); | 160 EXPECT_EQ(exit_code, 0); |
158 } | 161 } |
159 | 162 |
160 } // namespace sandbox | 163 } // namespace sandbox |
OLD | NEW |