OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // ASan internally uses some syscalls which non-SFI NaCl disallows. | 5 // ASan internally uses some syscalls which non-SFI NaCl disallows. |
6 // Seccomp-BPF tests die under TSan v2. See http://crbug.com/356588 | 6 // Seccomp-BPF tests die under TSan v2. See http://crbug.com/356588 |
7 #if !defined(ADDRESS_SANITIZER) && !defined(THREAD_SANITIZER) | 7 #if !defined(ADDRESS_SANITIZER) && !defined(THREAD_SANITIZER) |
8 | 8 |
9 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h" | 9 #include "components/nacl/loader/nonsfi/nonsfi_sandbox.h" |
10 | 10 |
(...skipping 13 matching lines...) Expand all Loading... |
24 #include <sys/wait.h> | 24 #include <sys/wait.h> |
25 #include <time.h> | 25 #include <time.h> |
26 #include <unistd.h> | 26 #include <unistd.h> |
27 | 27 |
28 #include "base/bind.h" | 28 #include "base/bind.h" |
29 #include "base/callback.h" | 29 #include "base/callback.h" |
30 #include "base/compiler_specific.h" | 30 #include "base/compiler_specific.h" |
31 #include "base/files/scoped_file.h" | 31 #include "base/files/scoped_file.h" |
32 #include "base/logging.h" | 32 #include "base/logging.h" |
33 #include "base/posix/eintr_wrapper.h" | 33 #include "base/posix/eintr_wrapper.h" |
| 34 #include "base/sys_info.h" |
| 35 #include "base/time/time.h" |
34 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" | 36 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" |
35 #include "sandbox/linux/seccomp-bpf/bpf_tests.h" | 37 #include "sandbox/linux/seccomp-bpf/bpf_tests.h" |
| 38 #include "sandbox/linux/services/linux_syscalls.h" |
36 #include "third_party/lss/linux_syscall_support.h" // for MAKE_PROCESS_CPUCLOCK | 39 #include "third_party/lss/linux_syscall_support.h" // for MAKE_PROCESS_CPUCLOCK |
37 | 40 |
38 namespace { | 41 namespace { |
39 | 42 |
40 void DoPipe(base::ScopedFD* fds) { | 43 void DoPipe(base::ScopedFD* fds) { |
41 int tmp_fds[2]; | 44 int tmp_fds[2]; |
42 BPF_ASSERT_EQ(0, pipe(tmp_fds)); | 45 BPF_ASSERT_EQ(0, pipe(tmp_fds)); |
43 fds[0].reset(tmp_fds[0]); | 46 fds[0].reset(tmp_fds[0]); |
44 fds[1].reset(tmp_fds[1]); | 47 fds[1].reset(tmp_fds[1]); |
45 } | 48 } |
(...skipping 365 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
411 } | 414 } |
412 | 415 |
413 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest, | 416 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest, |
414 clock_gettime_crash_monotonic_raw, | 417 clock_gettime_crash_monotonic_raw, |
415 DEATH_MESSAGE(sandbox::GetErrorMessageContentForTests()), | 418 DEATH_MESSAGE(sandbox::GetErrorMessageContentForTests()), |
416 nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) { | 419 nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) { |
417 struct timespec ts; | 420 struct timespec ts; |
418 clock_gettime(CLOCK_MONOTONIC_RAW, &ts); | 421 clock_gettime(CLOCK_MONOTONIC_RAW, &ts); |
419 } | 422 } |
420 | 423 |
| 424 #if defined(OS_CHROMEOS) |
| 425 |
| 426 // A custom BPF tester delegate to run IsRunningOnChromeOS() before |
| 427 // the sandbox is enabled because we cannot run it with non-SFI BPF |
| 428 // sandbox enabled. |
| 429 class ClockSystemTesterDelegate : public sandbox::BPFTesterDelegate { |
| 430 public: |
| 431 ClockSystemTesterDelegate() |
| 432 : is_running_on_chromeos_(base::SysInfo::IsRunningOnChromeOS()) {} |
| 433 virtual ~ClockSystemTesterDelegate() {} |
| 434 |
| 435 virtual scoped_ptr<sandbox::SandboxBPFPolicy> GetSandboxBPFPolicy() OVERRIDE { |
| 436 return scoped_ptr<sandbox::SandboxBPFPolicy>( |
| 437 new nacl::nonsfi::NaClNonSfiBPFSandboxPolicy()); |
| 438 } |
| 439 virtual void RunTestFunction() OVERRIDE { |
| 440 if (is_running_on_chromeos_) { |
| 441 CheckClock(base::TimeTicks::kClockSystemTrace); |
| 442 } else { |
| 443 struct timespec ts; |
| 444 // kClockSystemTrace is 11, which is CLOCK_THREAD_CPUTIME_ID of |
| 445 // the init process (pid=1). If kernel supports this feature, |
| 446 // this may succeed even if this is not running on Chrome OS. We |
| 447 // just check this clock_gettime call does not crash. |
| 448 clock_gettime(base::TimeTicks::kClockSystemTrace, &ts); |
| 449 } |
| 450 } |
| 451 |
| 452 private: |
| 453 const bool is_running_on_chromeos_; |
| 454 DISALLOW_COPY_AND_ASSIGN(ClockSystemTesterDelegate); |
| 455 }; |
| 456 |
| 457 BPF_TEST_D(BPFTest, BPFTestWithDelegateClass, ClockSystemTesterDelegate); |
| 458 |
| 459 #else |
| 460 |
| 461 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest, |
| 462 clock_gettime_crash_system_trace, |
| 463 DEATH_MESSAGE(sandbox::GetErrorMessageContentForTests()), |
| 464 nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) { |
| 465 struct timespec ts; |
| 466 clock_gettime(base::TimeTicks::kClockSystemTrace, &ts); |
| 467 } |
| 468 |
| 469 #endif // defined(OS_CHROMEOS) |
| 470 |
421 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest, | 471 BPF_DEATH_TEST_C(NaClNonSfiSandboxTest, |
422 clock_gettime_crash_cpu_clock, | 472 clock_gettime_crash_cpu_clock, |
423 DEATH_MESSAGE(sandbox::GetErrorMessageContentForTests()), | 473 DEATH_MESSAGE(sandbox::GetErrorMessageContentForTests()), |
424 nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) { | 474 nacl::nonsfi::NaClNonSfiBPFSandboxPolicy) { |
425 // We can't use clock_getcpuclockid() because it's not implemented in newlib, | 475 // We can't use clock_getcpuclockid() because it's not implemented in newlib, |
426 // and it might not work inside the sandbox anyway. | 476 // and it might not work inside the sandbox anyway. |
427 const pid_t kInitPID = 1; | 477 const pid_t kInitPID = 1; |
428 const clockid_t kInitCPUClockID = | 478 const clockid_t kInitCPUClockID = |
429 MAKE_PROCESS_CPUCLOCK(kInitPID, CPUCLOCK_SCHED); | 479 MAKE_PROCESS_CPUCLOCK(kInitPID, CPUCLOCK_SCHED); |
430 | 480 |
(...skipping 27 matching lines...) Expand all Loading... |
458 RESTRICT_SYSCALL_EPERM_TEST(open); | 508 RESTRICT_SYSCALL_EPERM_TEST(open); |
459 RESTRICT_SYSCALL_EPERM_TEST(ptrace); | 509 RESTRICT_SYSCALL_EPERM_TEST(ptrace); |
460 RESTRICT_SYSCALL_EPERM_TEST(set_robust_list); | 510 RESTRICT_SYSCALL_EPERM_TEST(set_robust_list); |
461 #if defined(__i386__) || defined(__x86_64__) | 511 #if defined(__i386__) || defined(__x86_64__) |
462 RESTRICT_SYSCALL_EPERM_TEST(time); | 512 RESTRICT_SYSCALL_EPERM_TEST(time); |
463 #endif | 513 #endif |
464 | 514 |
465 } // namespace | 515 } // namespace |
466 | 516 |
467 #endif // !ADDRESS_SANITIZER && !THREAD_SANITIZER | 517 #endif // !ADDRESS_SANITIZER && !THREAD_SANITIZER |
OLD | NEW |