| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #import <Cocoa/Cocoa.h> | 5 #import <Cocoa/Cocoa.h> |
| 6 #include <dirent.h> | 6 #include <dirent.h> |
| 7 | 7 |
| 8 extern "C" { | 8 extern "C" { |
| 9 #include <sandbox.h> | 9 #include <sandbox.h> |
| 10 } | 10 } |
| (...skipping 109 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 120 expected.push_back('^'); | 120 expected.push_back('^'); |
| 121 for (size_t i = 0; i < in_utf8.length(); ++i) { | 121 for (size_t i = 0; i < in_utf8.length(); ++i) { |
| 122 expected.push_back('\\'); | 122 expected.push_back('\\'); |
| 123 expected.push_back(in_utf8[i]); | 123 expected.push_back(in_utf8[i]); |
| 124 } | 124 } |
| 125 expected.append(kSandboxEscapeSuffix); | 125 expected.append(kSandboxEscapeSuffix); |
| 126 | 126 |
| 127 std::string out; | 127 std::string out; |
| 128 EXPECT_TRUE(Sandbox::QuoteStringForRegex(in_utf8, &out)); | 128 EXPECT_TRUE(Sandbox::QuoteStringForRegex(in_utf8, &out)); |
| 129 EXPECT_EQ(expected, out); | 129 EXPECT_EQ(expected, out); |
| 130 |
| 130 } | 131 } |
| 131 } | 132 } |
| 132 | 133 |
| 133 // A class to handle auto-deleting a directory. | 134 // A class to handle auto-deleting a directory. |
| 134 struct ScopedDirectoryDelete { | 135 struct ScopedDirectoryDelete { |
| 135 inline void operator()(base::FilePath* x) const { | 136 inline void operator()(base::FilePath* x) const { |
| 136 if (x) | 137 if (x) |
| 137 base::DeleteFile(*x, true); | 138 base::DeleteFile(*x, true); |
| 138 } | 139 } |
| 139 }; | 140 }; |
| (...skipping 30 matching lines...) Expand all Loading... |
| 170 std::string(sandbox_dir_cases[i]) + kDeniedSuffix; | 171 std::string(sandbox_dir_cases[i]) + kDeniedSuffix; |
| 171 base::FilePath sibling_sandbox_dir = tmp_dir.Append( | 172 base::FilePath sibling_sandbox_dir = tmp_dir.Append( |
| 172 sibling_sandbox_dir_name_denied.c_str()); | 173 sibling_sandbox_dir_name_denied.c_str()); |
| 173 ASSERT_TRUE(CreateDirectory(sibling_sandbox_dir)); | 174 ASSERT_TRUE(CreateDirectory(sibling_sandbox_dir)); |
| 174 ScopedDirectory cleanup_sandbox_sibling(&sibling_sandbox_dir); | 175 ScopedDirectory cleanup_sandbox_sibling(&sibling_sandbox_dir); |
| 175 | 176 |
| 176 EXPECT_TRUE(CheckSandbox(sandbox_dir.value())); | 177 EXPECT_TRUE(CheckSandbox(sandbox_dir.value())); |
| 177 } | 178 } |
| 178 } | 179 } |
| 179 | 180 |
| 180 TEST_F(MacDirAccessSandboxTest, AllowMetadataForPath) { | |
| 181 { | |
| 182 std::string expected( | |
| 183 "(allow file-read-metadata (literal \"/\")(literal \"/System\")" | |
| 184 "(literal \"/System/Library\")" | |
| 185 "(literal \"/System/Library/Frameworks\"))"); | |
| 186 NSString* sandbox_command = Sandbox::AllowMetadataForPath( | |
| 187 base::FilePath("/System/Library/Frameworks")); | |
| 188 EXPECT_EQ(base::SysNSStringToUTF8(sandbox_command), expected); | |
| 189 } | |
| 190 } | |
| 191 | |
| 192 MULTIPROCESS_TEST_MAIN(mac_sandbox_path_access) { | 181 MULTIPROCESS_TEST_MAIN(mac_sandbox_path_access) { |
| 193 char *sandbox_allowed_dir = getenv(kSandboxAccessPathKey); | 182 char *sandbox_allowed_dir = getenv(kSandboxAccessPathKey); |
| 194 if (!sandbox_allowed_dir) | 183 if (!sandbox_allowed_dir) |
| 195 return -1; | 184 return -1; |
| 196 | 185 |
| 197 // Build up a sandbox profile that only allows access to a single directory. | 186 // Build up a sandbox profile that only allows access to a single directory. |
| 198 NSString *sandbox_profile = | 187 NSString *sandbox_profile = |
| 199 @"(version 1)" \ | 188 @"(version 1)" \ |
| 200 "(deny default)" \ | 189 "(deny default)" \ |
| 201 "(allow signal (target self))" \ | 190 "(allow signal (target self))" \ |
| (...skipping 109 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 311 PLOG(ERROR) << "Sandbox breach: was able to write (" | 300 PLOG(ERROR) << "Sandbox breach: was able to write (" |
| 312 << denied_file2.value() | 301 << denied_file2.value() |
| 313 << ")"; | 302 << ")"; |
| 314 return -1; | 303 return -1; |
| 315 } | 304 } |
| 316 | 305 |
| 317 return 0; | 306 return 0; |
| 318 } | 307 } |
| 319 | 308 |
| 320 } // namespace content | 309 } // namespace content |
| OLD | NEW |