| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <fcntl.h> | 5 #include <fcntl.h> |
| 6 #include <stdint.h> | 6 #include <stdint.h> |
| 7 #include <sys/stat.h> | 7 #include <sys/stat.h> |
| 8 #include <unistd.h> | 8 #include <unistd.h> |
| 9 | 9 |
| 10 #include "base/process/kill.h" | 10 #include "base/process/kill.h" |
| (...skipping 14 matching lines...) Expand all Loading... |
| 25 | 25 |
| 26 SandboxCompiler compiler(profile); | 26 SandboxCompiler compiler(profile); |
| 27 | 27 |
| 28 std::string error; | 28 std::string error; |
| 29 CHECK(compiler.CompileAndApplyProfile(&error)); | 29 CHECK(compiler.CompileAndApplyProfile(&error)); |
| 30 | 30 |
| 31 return 0; | 31 return 0; |
| 32 } | 32 } |
| 33 | 33 |
| 34 TEST_F(SandboxMacCompilerTest, BasicProfileTest) { | 34 TEST_F(SandboxMacCompilerTest, BasicProfileTest) { |
| 35 base::Process process = SpawnChild("BasicProfileProcess"); | 35 base::SpawnChildResult spawn_child = SpawnChild("BasicProfileProcess"); |
| 36 ASSERT_TRUE(process.IsValid()); | 36 ASSERT_TRUE(spawn_child.process.IsValid()); |
| 37 int exit_code = 42; | 37 int exit_code = 42; |
| 38 EXPECT_TRUE(process.WaitForExitWithTimeout(TestTimeouts::action_max_timeout(), | 38 EXPECT_TRUE(spawn_child.process.WaitForExitWithTimeout( |
| 39 &exit_code)); | 39 TestTimeouts::action_max_timeout(), &exit_code)); |
| 40 EXPECT_EQ(exit_code, 0); | 40 EXPECT_EQ(exit_code, 0); |
| 41 } | 41 } |
| 42 | 42 |
| 43 MULTIPROCESS_TEST_MAIN(BasicProfileWithParamProcess) { | 43 MULTIPROCESS_TEST_MAIN(BasicProfileWithParamProcess) { |
| 44 std::string profile = | 44 std::string profile = |
| 45 "(version 1)" | 45 "(version 1)" |
| 46 "(allow file-read* file-write* (literal (param \"DIR\")))"; | 46 "(allow file-read* file-write* (literal (param \"DIR\")))"; |
| 47 | 47 |
| 48 SandboxCompiler compiler(profile); | 48 SandboxCompiler compiler(profile); |
| 49 CHECK(compiler.InsertStringParam("DIR", "/")); | 49 CHECK(compiler.InsertStringParam("DIR", "/")); |
| 50 | 50 |
| 51 std::string error; | 51 std::string error; |
| 52 CHECK(compiler.CompileAndApplyProfile(&error)); | 52 CHECK(compiler.CompileAndApplyProfile(&error)); |
| 53 | 53 |
| 54 return 0; | 54 return 0; |
| 55 } | 55 } |
| 56 | 56 |
| 57 TEST_F(SandboxMacCompilerTest, BasicProfileTestWithParam) { | 57 TEST_F(SandboxMacCompilerTest, BasicProfileTestWithParam) { |
| 58 base::Process process = SpawnChild("BasicProfileWithParamProcess"); | 58 base::SpawnChildResult spawn_child = |
| 59 ASSERT_TRUE(process.IsValid()); | 59 SpawnChild("BasicProfileWithParamProcess"); |
| 60 ASSERT_TRUE(spawn_child.process.IsValid()); |
| 60 int exit_code = 42; | 61 int exit_code = 42; |
| 61 EXPECT_TRUE(process.WaitForExitWithTimeout(TestTimeouts::action_max_timeout(), | 62 EXPECT_TRUE(spawn_child.process.WaitForExitWithTimeout( |
| 62 &exit_code)); | 63 TestTimeouts::action_max_timeout(), &exit_code)); |
| 63 EXPECT_EQ(exit_code, 0); | 64 EXPECT_EQ(exit_code, 0); |
| 64 } | 65 } |
| 65 | 66 |
| 66 MULTIPROCESS_TEST_MAIN(ProfileFunctionalProcess) { | 67 MULTIPROCESS_TEST_MAIN(ProfileFunctionalProcess) { |
| 67 std::string profile = | 68 std::string profile = |
| 68 "(version 1)" | 69 "(version 1)" |
| 69 "(debug deny)" | 70 "(debug deny)" |
| 70 "(allow file-read-data file-read-metadata (literal \"/dev/urandom\"))"; | 71 "(allow file-read-data file-read-metadata (literal \"/dev/urandom\"))"; |
| 71 | 72 |
| 72 SandboxCompiler compiler(profile); | 73 SandboxCompiler compiler(profile); |
| 73 | 74 |
| 74 std::string error; | 75 std::string error; |
| 75 CHECK(compiler.CompileAndApplyProfile(&error)); | 76 CHECK(compiler.CompileAndApplyProfile(&error)); |
| 76 | 77 |
| 77 // The profile compiled and applied successfully, now try and read 1 byte from | 78 // The profile compiled and applied successfully, now try and read 1 byte from |
| 78 // /dev/urandom. | 79 // /dev/urandom. |
| 79 uint8_t byte; | 80 uint8_t byte; |
| 80 int fd = open("/dev/urandom", O_RDONLY); | 81 int fd = open("/dev/urandom", O_RDONLY); |
| 81 CHECK_NE(fd, -1); | 82 CHECK_NE(fd, -1); |
| 82 | 83 |
| 83 EXPECT_TRUE(read(fd, &byte, sizeof(byte)) == sizeof(byte)); | 84 EXPECT_TRUE(read(fd, &byte, sizeof(byte)) == sizeof(byte)); |
| 84 | 85 |
| 85 return 0; | 86 return 0; |
| 86 } | 87 } |
| 87 | 88 |
| 88 TEST_F(SandboxMacCompilerTest, ProfileFunctionalityTest) { | 89 TEST_F(SandboxMacCompilerTest, ProfileFunctionalityTest) { |
| 89 base::Process process = SpawnChild("ProfileFunctionalProcess"); | 90 base::SpawnChildResult spawn_child = SpawnChild("ProfileFunctionalProcess"); |
| 90 ASSERT_TRUE(process.IsValid()); | 91 ASSERT_TRUE(spawn_child.process.IsValid()); |
| 91 int exit_code = 42; | 92 int exit_code = 42; |
| 92 EXPECT_TRUE(process.WaitForExitWithTimeout(TestTimeouts::action_max_timeout(), | 93 EXPECT_TRUE(spawn_child.process.WaitForExitWithTimeout( |
| 93 &exit_code)); | 94 TestTimeouts::action_max_timeout(), &exit_code)); |
| 94 EXPECT_EQ(exit_code, 0); | 95 EXPECT_EQ(exit_code, 0); |
| 95 } | 96 } |
| 96 | 97 |
| 97 MULTIPROCESS_TEST_MAIN(ProfileFunctionalTestWithParamsProcess) { | 98 MULTIPROCESS_TEST_MAIN(ProfileFunctionalTestWithParamsProcess) { |
| 98 std::string profile = | 99 std::string profile = |
| 99 "(version 1)" | 100 "(version 1)" |
| 100 "(debug deny)" | 101 "(debug deny)" |
| 101 "(if (string=? (param \"ALLOW_FILE\") \"TRUE\")" | 102 "(if (string=? (param \"ALLOW_FILE\") \"TRUE\")" |
| 102 " (allow file-read-data file-read-metadata (literal (param " | 103 " (allow file-read-data file-read-metadata (literal (param " |
| 103 "\"URANDOM\"))))"; | 104 "\"URANDOM\"))))"; |
| (...skipping 15 matching lines...) Expand all Loading... |
| 119 EXPECT_TRUE(read(fd, &byte, sizeof(byte)) == sizeof(byte)); | 120 EXPECT_TRUE(read(fd, &byte, sizeof(byte)) == sizeof(byte)); |
| 120 | 121 |
| 121 // Make sure the sandbox isn't overly permissive. | 122 // Make sure the sandbox isn't overly permissive. |
| 122 struct stat st; | 123 struct stat st; |
| 123 EXPECT_EQ(stat("/", &st), -1); | 124 EXPECT_EQ(stat("/", &st), -1); |
| 124 | 125 |
| 125 return 0; | 126 return 0; |
| 126 } | 127 } |
| 127 | 128 |
| 128 TEST_F(SandboxMacCompilerTest, ProfileFunctionalityTestWithParams) { | 129 TEST_F(SandboxMacCompilerTest, ProfileFunctionalityTestWithParams) { |
| 129 base::Process process = SpawnChild("ProfileFunctionalTestWithParamsProcess"); | 130 base::SpawnChildResult spawn_child = |
| 130 ASSERT_TRUE(process.IsValid()); | 131 SpawnChild("ProfileFunctionalTestWithParamsProcess"); |
| 132 ASSERT_TRUE(spawn_child.process.IsValid()); |
| 131 int exit_code = 42; | 133 int exit_code = 42; |
| 132 EXPECT_TRUE(process.WaitForExitWithTimeout(TestTimeouts::action_max_timeout(), | 134 EXPECT_TRUE(spawn_child.process.WaitForExitWithTimeout( |
| 133 &exit_code)); | 135 TestTimeouts::action_max_timeout(), &exit_code)); |
| 134 EXPECT_EQ(exit_code, 0); | 136 EXPECT_EQ(exit_code, 0); |
| 135 } | 137 } |
| 136 | 138 |
| 137 MULTIPROCESS_TEST_MAIN(ProfileFunctionalityTestErrorProcess) { | 139 MULTIPROCESS_TEST_MAIN(ProfileFunctionalityTestErrorProcess) { |
| 138 std::string profile = "(+ 5 a)"; | 140 std::string profile = "(+ 5 a)"; |
| 139 | 141 |
| 140 SandboxCompiler compiler(profile); | 142 SandboxCompiler compiler(profile); |
| 141 | 143 |
| 142 // Make sure that this invalid profile results in an error returned. | 144 // Make sure that this invalid profile results in an error returned. |
| 143 std::string error; | 145 std::string error; |
| 144 CHECK_EQ(error, ""); | 146 CHECK_EQ(error, ""); |
| 145 CHECK(!compiler.CompileAndApplyProfile(&error)); | 147 CHECK(!compiler.CompileAndApplyProfile(&error)); |
| 146 CHECK_NE(error, ""); | 148 CHECK_NE(error, ""); |
| 147 | 149 |
| 148 return 0; | 150 return 0; |
| 149 } | 151 } |
| 150 | 152 |
| 151 TEST_F(SandboxMacCompilerTest, ProfileFunctionalityTestError) { | 153 TEST_F(SandboxMacCompilerTest, ProfileFunctionalityTestError) { |
| 152 base::Process process = SpawnChild("ProfileFunctionalityTestErrorProcess"); | 154 base::SpawnChildResult spawn_child = |
| 153 ASSERT_TRUE(process.IsValid()); | 155 SpawnChild("ProfileFunctionalityTestErrorProcess"); |
| 156 ASSERT_TRUE(spawn_child.process.IsValid()); |
| 154 int exit_code = 42; | 157 int exit_code = 42; |
| 155 EXPECT_TRUE(process.WaitForExitWithTimeout(TestTimeouts::action_max_timeout(), | 158 EXPECT_TRUE(spawn_child.process.WaitForExitWithTimeout( |
| 156 &exit_code)); | 159 TestTimeouts::action_max_timeout(), &exit_code)); |
| 157 EXPECT_EQ(exit_code, 0); | 160 EXPECT_EQ(exit_code, 0); |
| 158 } | 161 } |
| 159 | 162 |
| 160 } // namespace sandbox | 163 } // namespace sandbox |
| OLD | NEW |