| OLD | NEW | 
|---|
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be | 
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. | 
| 4 | 4 | 
| 5 #import <Cocoa/Cocoa.h> | 5 #import <Cocoa/Cocoa.h> | 
| 6 #include <dirent.h> | 6 #include <dirent.h> | 
| 7 | 7 | 
| 8 extern "C" { | 8 extern "C" { | 
| 9 #include <sandbox.h> | 9 #include <sandbox.h> | 
| 10 } | 10 } | 
| (...skipping 109 matching lines...) Expand 10 before | Expand all | Expand 10 after  Loading... | 
| 120     expected.push_back('^'); | 120     expected.push_back('^'); | 
| 121     for (size_t i = 0; i < in_utf8.length(); ++i) { | 121     for (size_t i = 0; i < in_utf8.length(); ++i) { | 
| 122       expected.push_back('\\'); | 122       expected.push_back('\\'); | 
| 123       expected.push_back(in_utf8[i]); | 123       expected.push_back(in_utf8[i]); | 
| 124     } | 124     } | 
| 125     expected.append(kSandboxEscapeSuffix); | 125     expected.append(kSandboxEscapeSuffix); | 
| 126 | 126 | 
| 127     std::string out; | 127     std::string out; | 
| 128     EXPECT_TRUE(Sandbox::QuoteStringForRegex(in_utf8, &out)); | 128     EXPECT_TRUE(Sandbox::QuoteStringForRegex(in_utf8, &out)); | 
| 129     EXPECT_EQ(expected, out); | 129     EXPECT_EQ(expected, out); | 
|  | 130 | 
| 130   } | 131   } | 
| 131 } | 132 } | 
| 132 | 133 | 
| 133 // A class to handle auto-deleting a directory. | 134 // A class to handle auto-deleting a directory. | 
| 134 struct ScopedDirectoryDelete { | 135 struct ScopedDirectoryDelete { | 
| 135   inline void operator()(base::FilePath* x) const { | 136   inline void operator()(base::FilePath* x) const { | 
| 136     if (x) | 137     if (x) | 
| 137       base::DeleteFile(*x, true); | 138       base::DeleteFile(*x, true); | 
| 138   } | 139   } | 
| 139 }; | 140 }; | 
| (...skipping 30 matching lines...) Expand all  Loading... | 
| 170         std::string(sandbox_dir_cases[i]) + kDeniedSuffix; | 171         std::string(sandbox_dir_cases[i]) + kDeniedSuffix; | 
| 171     base::FilePath sibling_sandbox_dir = tmp_dir.Append( | 172     base::FilePath sibling_sandbox_dir = tmp_dir.Append( | 
| 172                                       sibling_sandbox_dir_name_denied.c_str()); | 173                                       sibling_sandbox_dir_name_denied.c_str()); | 
| 173     ASSERT_TRUE(CreateDirectory(sibling_sandbox_dir)); | 174     ASSERT_TRUE(CreateDirectory(sibling_sandbox_dir)); | 
| 174     ScopedDirectory cleanup_sandbox_sibling(&sibling_sandbox_dir); | 175     ScopedDirectory cleanup_sandbox_sibling(&sibling_sandbox_dir); | 
| 175 | 176 | 
| 176     EXPECT_TRUE(CheckSandbox(sandbox_dir.value())); | 177     EXPECT_TRUE(CheckSandbox(sandbox_dir.value())); | 
| 177   } | 178   } | 
| 178 } | 179 } | 
| 179 | 180 | 
| 180 TEST_F(MacDirAccessSandboxTest, AllowMetadataForPath) { |  | 
| 181   { |  | 
| 182     std::string expected( |  | 
| 183         "(allow file-read-metadata (literal \"/\")(literal \"/System\")" |  | 
| 184         "(literal \"/System/Library\")" |  | 
| 185         "(literal \"/System/Library/Frameworks\"))"); |  | 
| 186     NSString* sandbox_command = Sandbox::AllowMetadataForPath( |  | 
| 187         base::FilePath("/System/Library/Frameworks")); |  | 
| 188     EXPECT_EQ(base::SysNSStringToUTF8(sandbox_command), expected); |  | 
| 189   } |  | 
| 190 } |  | 
| 191 |  | 
| 192 MULTIPROCESS_TEST_MAIN(mac_sandbox_path_access) { | 181 MULTIPROCESS_TEST_MAIN(mac_sandbox_path_access) { | 
| 193   char *sandbox_allowed_dir = getenv(kSandboxAccessPathKey); | 182   char *sandbox_allowed_dir = getenv(kSandboxAccessPathKey); | 
| 194   if (!sandbox_allowed_dir) | 183   if (!sandbox_allowed_dir) | 
| 195     return -1; | 184     return -1; | 
| 196 | 185 | 
| 197   // Build up a sandbox profile that only allows access to a single directory. | 186   // Build up a sandbox profile that only allows access to a single directory. | 
| 198   NSString *sandbox_profile = | 187   NSString *sandbox_profile = | 
| 199       @"(version 1)" \ | 188       @"(version 1)" \ | 
| 200       "(deny default)" \ | 189       "(deny default)" \ | 
| 201       "(allow signal (target self))" \ | 190       "(allow signal (target self))" \ | 
| (...skipping 109 matching lines...) Expand 10 before | Expand all | Expand 10 after  Loading... | 
| 311     PLOG(ERROR) << "Sandbox breach: was able to write (" | 300     PLOG(ERROR) << "Sandbox breach: was able to write (" | 
| 312                 << denied_file2.value() | 301                 << denied_file2.value() | 
| 313                 << ")"; | 302                 << ")"; | 
| 314     return -1; | 303     return -1; | 
| 315   } | 304   } | 
| 316 | 305 | 
| 317   return 0; | 306   return 0; | 
| 318 } | 307 } | 
| 319 | 308 | 
| 320 }  // namespace content | 309 }  // namespace content | 
| OLD | NEW | 
|---|