| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <errno.h> | 5 #include <errno.h> |
| 6 #include <fcntl.h> | 6 #include <fcntl.h> |
| 7 #include <sys/ptrace.h> | 7 #include <sys/ptrace.h> |
| 8 #include <sys/stat.h> | 8 #include <sys/stat.h> |
| 9 #include <sys/types.h> | 9 #include <sys/types.h> |
| 10 #include <unistd.h> | 10 #include <unistd.h> |
| 11 | 11 |
| 12 #include "base/bind.h" | 12 #include "base/bind.h" |
| 13 #include "base/compiler_specific.h" | 13 #include "base/compiler_specific.h" |
| 14 #include "base/posix/eintr_wrapper.h" | 14 #include "base/posix/eintr_wrapper.h" |
| 15 #include "sandbox/linux/services/scoped_process.h" | 15 #include "sandbox/linux/services/scoped_process.h" |
| 16 #include "sandbox/linux/services/yama.h" | 16 #include "sandbox/linux/services/yama.h" |
| 17 #include "sandbox/linux/tests/unit_tests.h" | 17 #include "sandbox/linux/tests/unit_tests.h" |
| 18 #include "testing/gtest/include/gtest/gtest.h" | 18 #include "testing/gtest/include/gtest/gtest.h" |
| 19 | 19 |
| 20 namespace sandbox { | 20 namespace sandbox { |
| 21 | 21 |
| 22 namespace { | 22 namespace { |
| 23 | 23 |
| 24 bool HasLinux32Bug() { | |
| 25 #if defined(__i386__) | |
| 26 // On 3.2 kernels, yama doesn't work for 32-bit binaries on 64-bit kernels. | |
| 27 // This is fixed in 3.4. | |
| 28 bool is_kernel_64bit = | |
| 29 base::SysInfo::OperatingSystemArchitecture() == "x86_64"; | |
| 30 bool is_linux = base::SysInfo::OperatingSystemName() == "Linux"; | |
| 31 bool is_3_dot_2 = StartsWithASCII( | |
| 32 base::SysInfo::OperatingSystemVersion(), "3.2", /*case_sensitive=*/false); | |
| 33 if (is_kernel_64bit && is_linux && is_3_dot_2) | |
| 34 return true; | |
| 35 #endif // defined(__i386__) | |
| 36 return false; | |
| 37 } | |
| 38 | |
| 39 bool CanPtrace(pid_t pid) { | 24 bool CanPtrace(pid_t pid) { |
| 40 int ret; | 25 int ret; |
| 41 ret = ptrace(PTRACE_ATTACH, pid, NULL, NULL); | 26 ret = ptrace(PTRACE_ATTACH, pid, NULL, NULL); |
| 42 if (ret == -1) { | 27 if (ret == -1) { |
| 43 CHECK_EQ(EPERM, errno); | 28 CHECK_EQ(EPERM, errno); |
| 44 return false; | 29 return false; |
| 45 } | 30 } |
| 46 // Wait for the process to be stopped so that it can be detached. | 31 // Wait for the process to be stopped so that it can be detached. |
| 47 siginfo_t process_info; | 32 siginfo_t process_info; |
| 48 int wait_ret = HANDLE_EINTR(waitid(P_PID, pid, &process_info, WSTOPPED)); | 33 int wait_ret = HANDLE_EINTR(waitid(P_PID, pid, &process_info, WSTOPPED)); |
| (...skipping 71 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 120 // Attempts to enable or disable Yama restrictions. | 105 // Attempts to enable or disable Yama restrictions. |
| 121 void SetYamaRestrictions(bool enable_restriction) { | 106 void SetYamaRestrictions(bool enable_restriction) { |
| 122 if (enable_restriction) { | 107 if (enable_restriction) { |
| 123 Yama::RestrictPtracersToAncestors(); | 108 Yama::RestrictPtracersToAncestors(); |
| 124 } else { | 109 } else { |
| 125 Yama::DisableYamaRestrictions(); | 110 Yama::DisableYamaRestrictions(); |
| 126 } | 111 } |
| 127 } | 112 } |
| 128 | 113 |
| 129 TEST(Yama, RestrictPtraceWorks) { | 114 TEST(Yama, RestrictPtraceWorks) { |
| 130 if (HasLinux32Bug()) | |
| 131 return; | |
| 132 | |
| 133 ScopedProcess process1(base::Bind(&SetYamaRestrictions, true)); | 115 ScopedProcess process1(base::Bind(&SetYamaRestrictions, true)); |
| 134 ASSERT_TRUE(process1.WaitForClosureToRun()); | 116 ASSERT_TRUE(process1.WaitForClosureToRun()); |
| 135 | 117 |
| 136 if (Yama::IsEnforcing()) { | 118 if (Yama::IsEnforcing()) { |
| 137 // A sibling process cannot ptrace process1. | 119 // A sibling process cannot ptrace process1. |
| 138 ASSERT_FALSE(CanSubProcessPtrace(process1.GetPid())); | 120 ASSERT_FALSE(CanSubProcessPtrace(process1.GetPid())); |
| 139 } | 121 } |
| 140 | 122 |
| 141 if (!(Yama::GetStatus() & Yama::STATUS_STRICT_ENFORCING)) { | 123 if (!(Yama::GetStatus() & Yama::STATUS_STRICT_ENFORCING)) { |
| 142 // However, parent can ptrace process1. | 124 // However, parent can ptrace process1. |
| 143 ASSERT_TRUE(CanPtrace(process1.GetPid())); | 125 ASSERT_TRUE(CanPtrace(process1.GetPid())); |
| 144 | 126 |
| 145 // A sibling can ptrace process2 which disables any Yama protection. | 127 // A sibling can ptrace process2 which disables any Yama protection. |
| 146 ScopedProcess process2(base::Bind(&SetYamaRestrictions, false)); | 128 ScopedProcess process2(base::Bind(&SetYamaRestrictions, false)); |
| 147 ASSERT_TRUE(process2.WaitForClosureToRun()); | 129 ASSERT_TRUE(process2.WaitForClosureToRun()); |
| 148 ASSERT_TRUE(CanSubProcessPtrace(process2.GetPid())); | 130 ASSERT_TRUE(CanSubProcessPtrace(process2.GetPid())); |
| 149 } | 131 } |
| 150 } | 132 } |
| 151 | 133 |
| 152 void DoNothing() {} | 134 void DoNothing() {} |
| 153 | 135 |
| 154 SANDBOX_TEST(Yama, RestrictPtraceIsDefault) { | 136 SANDBOX_TEST(Yama, RestrictPtraceIsDefault) { |
| 155 if (!Yama::IsPresent() || HasLinux32Bug()) | 137 if (!Yama::IsPresent()) |
| 156 return; | 138 return; |
| 157 | 139 |
| 158 CHECK(Yama::DisableYamaRestrictions()); | 140 CHECK(Yama::DisableYamaRestrictions()); |
| 159 ScopedProcess process1(base::Bind(&DoNothing)); | 141 ScopedProcess process1(base::Bind(&DoNothing)); |
| 160 | 142 |
| 161 if (Yama::IsEnforcing()) { | 143 if (Yama::IsEnforcing()) { |
| 162 // Check that process1 is protected by Yama, even though it has | 144 // Check that process1 is protected by Yama, even though it has |
| 163 // been created from a process that disabled Yama. | 145 // been created from a process that disabled Yama. |
| 164 CHECK(!CanSubProcessPtrace(process1.GetPid())); | 146 CHECK(!CanSubProcessPtrace(process1.GetPid())); |
| 165 } | 147 } |
| 166 } | 148 } |
| 167 | 149 |
| 168 } // namespace | 150 } // namespace |
| 169 | 151 |
| 170 } // namespace sandbox | 152 } // namespace sandbox |
| OLD | NEW |