Add the SeatbeltExec classes to facilitate the V2 sandbox.

sandbox/mac/sandbox_mac_seatbelt_exec_unittest.cc

+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "sandbox/mac/seatbelt_exec.h"
+
+#include "base/process/kill.h"
+#include "base/test/multiprocess_test.h"
+#include "base/test/test_timeouts.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "testing/multiprocess_func_list.h"
+
+namespace sandbox {
+
+class SeatbeltExecTest : public base::MultiProcessTest {};
+
+MULTIPROCESS_TEST_MAIN(ServerTest) {
+  std::string profile =
+      "(version 1)\n"
+      "(deny default (with no-log))\n"
+      "(define allowed-dir \"ALLOWED_READ_DIR\")\n"
+      "(define executable-path \"EXECUTABLE_PATH\")\n"
+      "(allow process-exec* (path (param executable-path)))\n"
+      "(allow file-read* (path (param executable-path)))\n"
+      "(allow file-read* (subpath (param allowed-dir)))\n";
+
+  SeatbeltExecServer exec_server(-1);
+  std::string exec_path = "/bin/ls";
+  exec_server.AllowProcessExec(exec_path);
+
+  std::string allowed_path = "/Applications";
+  mac::SandboxParams params;
+  google::protobuf::MapPair<std::string, std::string> pair("ALLOWED_READ_DIR",
+                                                           allowed_path);
+  CHECK(params.mutable_params()->insert(pair).second);
+  params.set_policy(profile);
+
+  CHECK(exec_server.ApplySandboxProfile(params) == 0);

[Robert Sesek, 2017/05/10 15:25:28]

CHECK_EQ

[Greg K, 2017/05/11 17:44:14]

Done.

+
+  // Test that the sandbox profile is actually applied.
+  struct stat sb;
+  CHECK(stat(allowed_path.c_str(), &sb) == 0);

[Robert Sesek, 2017/05/10 15:25:28]

CHECK_EQ, and the two lines below

[Greg K, 2017/05/11 17:44:14]

Done.

+  CHECK(stat("/", &sb) == -1);
+  CHECK(stat(exec_path.c_str(), &sb) == 0);
+
+  return 0;
+}
+
+TEST_F(SeatbeltExecTest, ServerTest) {
+  base::SpawnChildResult spawn_child = SpawnChild("ServerTest");
+  ASSERT_TRUE(spawn_child.process.IsValid());
+  int exit_code = 42;
+  EXPECT_TRUE(spawn_child.process.WaitForExitWithTimeout(
+      TestTimeouts::action_max_timeout(), &exit_code));
+  EXPECT_EQ(exit_code, 0);
+}
+
+MULTIPROCESS_TEST_MAIN(ClientTest) {
+  SeatbeltExecClient exec_client;
+
+  CHECK(exec_client.SetBooleanParameter("key1", true));
+  CHECK(!exec_client.SetBooleanParameter("key1", false));
+  CHECK(exec_client.SetBooleanParameter("key2", false));
+  CHECK(exec_client.SetParameter("key3", "value"));
+  CHECK(!exec_client.SetParameter("key3", "value"));
+  exec_client.SetPolicy("(version 1)(deny default)");
+
+  sandbox::mac::SandboxParams params = exec_client.GetParamsForTesting();
+  CHECK(params.params_size() == 3);
+  CHECK(!params.policy().empty());
+
+  return 0;
+}
+
+TEST_F(SeatbeltExecTest, ClientTest) {
+  base::SpawnChildResult spawn_child = SpawnChild("ClientTest");
+  ASSERT_TRUE(spawn_child.process.IsValid());
+  int exit_code = 42;
+  EXPECT_TRUE(spawn_child.process.WaitForExitWithTimeout(
+      TestTimeouts::action_max_timeout(), &exit_code));
+  EXPECT_EQ(exit_code, 0);
+}
+
+}  // namespace sandbox