OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/services/credentials.h" | 5 #include "sandbox/linux/services/credentials.h" |
6 | 6 |
| 7 #include <errno.h> |
| 8 #include <unistd.h> |
| 9 |
7 #include "base/logging.h" | 10 #include "base/logging.h" |
8 #include "base/memory/scoped_ptr.h" | 11 #include "base/memory/scoped_ptr.h" |
9 #include "sandbox/linux/tests/unit_tests.h" | 12 #include "sandbox/linux/tests/unit_tests.h" |
10 #include "testing/gtest/include/gtest/gtest.h" | 13 #include "testing/gtest/include/gtest/gtest.h" |
11 | 14 |
12 namespace sandbox { | 15 namespace sandbox { |
13 | 16 |
| 17 namespace { |
| 18 |
| 19 bool DirectoryExists(const char* path) { |
| 20 struct stat dir; |
| 21 errno = 0; |
| 22 int ret = stat(path, &dir); |
| 23 return -1 != ret || ENOENT != errno; |
| 24 } |
| 25 |
| 26 bool WorkingDirectoryIsRoot() { |
| 27 char current_dir[PATH_MAX]; |
| 28 char* cwd = getcwd(current_dir, sizeof(current_dir)); |
| 29 PCHECK(cwd); |
| 30 if (strcmp("/", cwd)) return false; |
| 31 |
| 32 // The current directory is the root. Add a few paranoid checks. |
| 33 struct stat current; |
| 34 CHECK_EQ(0, stat(".", ¤t)); |
| 35 struct stat parrent; |
| 36 CHECK_EQ(0, stat("..", &parrent)); |
| 37 CHECK_EQ(current.st_dev, parrent.st_dev); |
| 38 CHECK_EQ(current.st_ino, parrent.st_ino); |
| 39 CHECK_EQ(current.st_mode, parrent.st_mode); |
| 40 CHECK_EQ(current.st_uid, parrent.st_uid); |
| 41 CHECK_EQ(current.st_gid, parrent.st_gid); |
| 42 return true; |
| 43 } |
| 44 |
14 // Give dynamic tools a simple thing to test. | 45 // Give dynamic tools a simple thing to test. |
15 TEST(Credentials, CreateAndDestroy) { | 46 TEST(Credentials, CreateAndDestroy) { |
16 { | 47 { |
17 Credentials cred1; | 48 Credentials cred1; |
18 (void) cred1; | 49 (void) cred1; |
19 } | 50 } |
20 scoped_ptr<Credentials> cred2(new Credentials); | 51 scoped_ptr<Credentials> cred2(new Credentials); |
21 } | 52 } |
22 | 53 |
23 SANDBOX_TEST(Credentials, DropAllCaps) { | 54 SANDBOX_TEST(Credentials, DropAllCaps) { |
24 Credentials creds; | 55 Credentials creds; |
25 creds.DropAllCapabilities(); | 56 CHECK(creds.DropAllCapabilities()); |
26 SANDBOX_ASSERT(!creds.HasAnyCapability()); | 57 CHECK(!creds.HasAnyCapability()); |
27 } | 58 } |
28 | 59 |
29 SANDBOX_TEST(Credentials, GetCurrentCapString) { | 60 SANDBOX_TEST(Credentials, GetCurrentCapString) { |
30 Credentials creds; | 61 Credentials creds; |
31 creds.DropAllCapabilities(); | 62 CHECK(creds.DropAllCapabilities()); |
32 const char kNoCapabilityText[] = "="; | 63 const char kNoCapabilityText[] = "="; |
33 SANDBOX_ASSERT(*creds.GetCurrentCapString() == kNoCapabilityText); | 64 CHECK(*creds.GetCurrentCapString() == kNoCapabilityText); |
34 } | 65 } |
35 | 66 |
| 67 SANDBOX_TEST(Credentials, MoveToNewUserNS) { |
| 68 Credentials creds; |
| 69 creds.DropAllCapabilities(); |
| 70 bool userns_supported = creds.MoveToNewUserNS(); |
| 71 printf("Unprivileged CLONE_NEWUSER supported: %s\n", |
| 72 userns_supported ? "true." : "false."); |
| 73 if (!userns_supported) { |
| 74 printf("This kernel does not support unprivileged namespaces. " |
| 75 "USERNS tests will all pass.\n"); |
| 76 return; |
| 77 } |
| 78 CHECK(creds.HasAnyCapability()); |
| 79 creds.DropAllCapabilities(); |
| 80 CHECK(!creds.HasAnyCapability()); |
| 81 } |
| 82 |
| 83 SANDBOX_TEST(Credentials, UidIsPreserved) { |
| 84 Credentials creds; |
| 85 creds.DropAllCapabilities(); |
| 86 uid_t old_ruid, old_euid, old_suid; |
| 87 gid_t old_rgid, old_egid, old_sgid; |
| 88 PCHECK(0 == getresuid(&old_ruid, &old_euid, &old_suid)); |
| 89 PCHECK(0 == getresgid(&old_rgid, &old_egid, &old_sgid)); |
| 90 // Probably missing kernel support. |
| 91 if (!creds.MoveToNewUserNS()) return; |
| 92 uid_t new_ruid, new_euid, new_suid; |
| 93 PCHECK(0 == getresuid(&new_ruid, &new_euid, &new_suid)); |
| 94 CHECK(old_ruid == new_ruid); |
| 95 CHECK(old_euid == new_euid); |
| 96 CHECK(old_suid == new_suid); |
| 97 |
| 98 gid_t new_rgid, new_egid, new_sgid; |
| 99 PCHECK(0 == getresgid(&new_rgid, &new_egid, &new_sgid)); |
| 100 CHECK(old_rgid == new_rgid); |
| 101 CHECK(old_egid == new_egid); |
| 102 CHECK(old_sgid == new_sgid); |
| 103 } |
| 104 |
| 105 bool NewUserNSCycle(Credentials* creds) { |
| 106 DCHECK(creds); |
| 107 if (!creds->MoveToNewUserNS() || |
| 108 !creds->HasAnyCapability() || |
| 109 !creds->DropAllCapabilities() || |
| 110 creds->HasAnyCapability()) { |
| 111 return false; |
| 112 } |
| 113 return true; |
| 114 } |
| 115 |
| 116 SANDBOX_TEST(Credentials, NestedUserNS) { |
| 117 Credentials creds; |
| 118 CHECK(creds.DropAllCapabilities()); |
| 119 // Probably missing kernel support. |
| 120 if (!creds.MoveToNewUserNS()) return; |
| 121 creds.DropAllCapabilities(); |
| 122 // As of 3.12, the kernel has a limit of 32. See create_user_ns(). |
| 123 const int kNestLevel = 10; |
| 124 for (int i = 0; i < kNestLevel; ++i) { |
| 125 CHECK(NewUserNSCycle(&creds)) << "Creating new user NS failed at iteration " |
| 126 << i << "."; |
| 127 } |
| 128 } |
| 129 |
| 130 // Test the WorkingDirectoryIsRoot() helper. |
| 131 TEST(Credentials, CanDetectRoot) { |
| 132 ASSERT_EQ(0, chdir("/proc/")); |
| 133 ASSERT_FALSE(WorkingDirectoryIsRoot()); |
| 134 ASSERT_EQ(0, chdir("/")); |
| 135 ASSERT_TRUE(WorkingDirectoryIsRoot()); |
| 136 } |
| 137 |
| 138 SANDBOX_TEST(Credentials, DropFileSystemAccessIsSafe) { |
| 139 Credentials creds; |
| 140 CHECK(creds.DropAllCapabilities()); |
| 141 // Probably missing kernel support. |
| 142 if (!creds.MoveToNewUserNS()) return; |
| 143 CHECK(creds.DropFileSystemAccess()); |
| 144 CHECK(!DirectoryExists("/proc")); |
| 145 CHECK(WorkingDirectoryIsRoot()); |
| 146 // We want the chroot to never have a subdirectory. A subdirectory |
| 147 // could allow a chroot escape. |
| 148 CHECK_NE(0, mkdir("/test", 0700)); |
| 149 } |
| 150 |
| 151 // Check that after dropping filesystem access and dropping privileges |
| 152 // it is not possible to regain capabilities. |
| 153 SANDBOX_TEST(Credentials, CannotRegainPrivileges) { |
| 154 Credentials creds; |
| 155 CHECK(creds.DropAllCapabilities()); |
| 156 // Probably missing kernel support. |
| 157 if (!creds.MoveToNewUserNS()) return; |
| 158 CHECK(creds.DropFileSystemAccess()); |
| 159 CHECK(creds.DropAllCapabilities()); |
| 160 |
| 161 // The kernel should now prevent us from regaining capabilities because we |
| 162 // are in a chroot. |
| 163 CHECK(!creds.MoveToNewUserNS()); |
| 164 } |
| 165 |
| 166 } // namespace. |
| 167 |
36 } // namespace sandbox. | 168 } // namespace sandbox. |
OLD | NEW |