OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <errno.h> | 5 #include <errno.h> |
6 #include <fcntl.h> | 6 #include <fcntl.h> |
7 #include <sys/ptrace.h> | 7 #include <sys/ptrace.h> |
8 #include <sys/stat.h> | 8 #include <sys/stat.h> |
9 #include <sys/types.h> | 9 #include <sys/types.h> |
10 #include <unistd.h> | 10 #include <unistd.h> |
(...skipping 111 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
122 // Attempts to enable or disable Yama restrictions. | 122 // Attempts to enable or disable Yama restrictions. |
123 void SetYamaRestrictions(bool enable_restriction) { | 123 void SetYamaRestrictions(bool enable_restriction) { |
124 if (enable_restriction) { | 124 if (enable_restriction) { |
125 Yama::RestrictPtracersToAncestors(); | 125 Yama::RestrictPtracersToAncestors(); |
126 } else { | 126 } else { |
127 Yama::DisableYamaRestrictions(); | 127 Yama::DisableYamaRestrictions(); |
128 } | 128 } |
129 } | 129 } |
130 | 130 |
131 TEST(Yama, RestrictPtraceWorks) { | 131 TEST(Yama, RestrictPtraceWorks) { |
| 132 if (HasLinux32Bug()) |
| 133 return; |
| 134 |
132 ScopedProcess process1(base::Bind(&SetYamaRestrictions, true)); | 135 ScopedProcess process1(base::Bind(&SetYamaRestrictions, true)); |
133 ASSERT_TRUE(process1.WaitForClosureToRun()); | 136 ASSERT_TRUE(process1.WaitForClosureToRun()); |
134 | 137 |
135 if (Yama::IsEnforcing()) { | 138 if (Yama::IsEnforcing()) { |
136 // A sibling process cannot ptrace process1. | 139 // A sibling process cannot ptrace process1. |
137 ASSERT_FALSE(CanSubProcessPtrace(process1.GetPid())); | 140 ASSERT_FALSE(CanSubProcessPtrace(process1.GetPid())); |
138 } | 141 } |
139 | 142 |
140 if (!(Yama::GetStatus() & Yama::STATUS_STRICT_ENFORCING)) { | 143 if (!(Yama::GetStatus() & Yama::STATUS_STRICT_ENFORCING)) { |
141 // However, parent can ptrace process1. | 144 // However, parent can ptrace process1. |
142 ASSERT_TRUE(CanPtrace(process1.GetPid())); | 145 ASSERT_TRUE(CanPtrace(process1.GetPid())); |
143 | 146 |
144 // A sibling can ptrace process2 which disables any Yama protection. | 147 // A sibling can ptrace process2 which disables any Yama protection. |
145 ScopedProcess process2(base::Bind(&SetYamaRestrictions, false)); | 148 ScopedProcess process2(base::Bind(&SetYamaRestrictions, false)); |
146 ASSERT_TRUE(process2.WaitForClosureToRun()); | 149 ASSERT_TRUE(process2.WaitForClosureToRun()); |
147 ASSERT_TRUE(CanSubProcessPtrace(process2.GetPid())); | 150 ASSERT_TRUE(CanSubProcessPtrace(process2.GetPid())); |
148 } | 151 } |
149 } | 152 } |
150 | 153 |
151 void DoNothing() {} | 154 void DoNothing() {} |
152 | 155 |
153 SANDBOX_TEST(Yama, RestrictPtraceIsDefault) { | 156 SANDBOX_TEST(Yama, RestrictPtraceIsDefault) { |
154 if (!Yama::IsPresent()) | 157 if (!Yama::IsPresent() || HasLinux32Bug()) |
155 return; | 158 return; |
156 | 159 |
157 CHECK(Yama::DisableYamaRestrictions()); | 160 CHECK(Yama::DisableYamaRestrictions()); |
158 ScopedProcess process1(base::Bind(&DoNothing)); | 161 ScopedProcess process1(base::Bind(&DoNothing)); |
159 | 162 |
160 if (Yama::IsEnforcing()) { | 163 if (Yama::IsEnforcing()) { |
161 // Check that process1 is protected by Yama, even though it has | 164 // Check that process1 is protected by Yama, even though it has |
162 // been created from a process that disabled Yama. | 165 // been created from a process that disabled Yama. |
163 CHECK(!CanSubProcessPtrace(process1.GetPid())); | 166 CHECK(!CanSubProcessPtrace(process1.GetPid())); |
164 } | 167 } |
165 } | 168 } |
166 | 169 |
167 } // namespace | 170 } // namespace |
168 | 171 |
169 } // namespace sandbox | 172 } // namespace sandbox |
OLD | NEW |