OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <linux/futex.h> | 8 #include <linux/futex.h> |
9 #include <sched.h> | 9 #include <sched.h> |
10 #include <signal.h> | 10 #include <signal.h> |
(...skipping 10 matching lines...) Expand all Loading... |
21 | 21 |
22 #include "base/files/scoped_file.h" | 22 #include "base/files/scoped_file.h" |
23 #include "base/macros.h" | 23 #include "base/macros.h" |
24 #include "base/posix/eintr_wrapper.h" | 24 #include "base/posix/eintr_wrapper.h" |
25 #include "base/threading/thread.h" | 25 #include "base/threading/thread.h" |
26 #include "build/build_config.h" | 26 #include "build/build_config.h" |
27 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" | 27 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" |
28 #include "sandbox/linux/seccomp-bpf/bpf_tests.h" | 28 #include "sandbox/linux/seccomp-bpf/bpf_tests.h" |
29 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 29 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
30 #include "sandbox/linux/seccomp-bpf/syscall.h" | 30 #include "sandbox/linux/seccomp-bpf/syscall.h" |
| 31 #include "sandbox/linux/services/android_futex.h" |
31 #include "sandbox/linux/services/linux_syscalls.h" | 32 #include "sandbox/linux/services/linux_syscalls.h" |
32 #include "sandbox/linux/services/thread_helpers.h" | 33 #include "sandbox/linux/services/thread_helpers.h" |
33 #include "sandbox/linux/tests/unit_tests.h" | 34 #include "sandbox/linux/tests/unit_tests.h" |
34 | 35 |
35 namespace sandbox { | 36 namespace sandbox { |
36 | 37 |
37 namespace { | 38 namespace { |
38 | 39 |
39 // |pid| is the return value of a fork()-like call. This | 40 // |pid| is the return value of a fork()-like call. This |
40 // makes sure that if fork() succeeded the child exits | 41 // makes sure that if fork() succeeded the child exits |
(...skipping 208 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
249 TEST_BASELINE_SIGSYS(__NR_sysinfo); | 250 TEST_BASELINE_SIGSYS(__NR_sysinfo); |
250 TEST_BASELINE_SIGSYS(__NR_syslog); | 251 TEST_BASELINE_SIGSYS(__NR_syslog); |
251 TEST_BASELINE_SIGSYS(__NR_timer_create); | 252 TEST_BASELINE_SIGSYS(__NR_timer_create); |
252 | 253 |
253 #if !defined(__aarch64__) | 254 #if !defined(__aarch64__) |
254 TEST_BASELINE_SIGSYS(__NR_eventfd); | 255 TEST_BASELINE_SIGSYS(__NR_eventfd); |
255 TEST_BASELINE_SIGSYS(__NR_inotify_init); | 256 TEST_BASELINE_SIGSYS(__NR_inotify_init); |
256 TEST_BASELINE_SIGSYS(__NR_vserver); | 257 TEST_BASELINE_SIGSYS(__NR_vserver); |
257 #endif | 258 #endif |
258 | 259 |
259 #if !defined(OS_ANDROID) | |
260 BPF_DEATH_TEST_C(BaselinePolicy, | 260 BPF_DEATH_TEST_C(BaselinePolicy, |
261 FutexWithRequeuePriorityInheritence, | 261 FutexWithRequeuePriorityInheritence, |
262 DEATH_MESSAGE(GetFutexErrorMessageContentForTests()), | 262 DEATH_SEGV_MESSAGE(GetFutexErrorMessageContentForTests()), |
263 BaselinePolicy) { | 263 BaselinePolicy) { |
264 syscall(__NR_futex, NULL, FUTEX_CMP_REQUEUE_PI, 0, NULL, NULL, 0); | 264 syscall(__NR_futex, NULL, FUTEX_CMP_REQUEUE_PI, 0, NULL, NULL, 0); |
265 _exit(1); | 265 _exit(1); |
266 } | 266 } |
267 | 267 |
268 BPF_DEATH_TEST_C(BaselinePolicy, | 268 BPF_DEATH_TEST_C(BaselinePolicy, |
269 FutexWithRequeuePriorityInheritencePrivate, | 269 FutexWithRequeuePriorityInheritencePrivate, |
270 DEATH_MESSAGE(GetFutexErrorMessageContentForTests()), | 270 DEATH_SEGV_MESSAGE(GetFutexErrorMessageContentForTests()), |
271 BaselinePolicy) { | 271 BaselinePolicy) { |
272 syscall(__NR_futex, NULL, FUTEX_CMP_REQUEUE_PI_PRIVATE, 0, NULL, NULL, 0); | 272 syscall(__NR_futex, NULL, FUTEX_CMP_REQUEUE_PI_PRIVATE, 0, NULL, NULL, 0); |
273 _exit(1); | 273 _exit(1); |
274 } | 274 } |
275 | 275 |
276 BPF_DEATH_TEST_C(BaselinePolicy, | 276 BPF_DEATH_TEST_C(BaselinePolicy, |
277 FutexWithUnlockPIPrivate, | 277 FutexWithUnlockPIPrivate, |
278 DEATH_MESSAGE(GetFutexErrorMessageContentForTests()), | 278 DEATH_SEGV_MESSAGE(GetFutexErrorMessageContentForTests()), |
279 BaselinePolicy) { | 279 BaselinePolicy) { |
280 syscall(__NR_futex, NULL, FUTEX_UNLOCK_PI_PRIVATE, 0, NULL, NULL, 0); | 280 syscall(__NR_futex, NULL, FUTEX_UNLOCK_PI_PRIVATE, 0, NULL, NULL, 0); |
281 _exit(1); | 281 _exit(1); |
282 } | 282 } |
283 #endif // !defined(OS_ANDROID) | |
284 | 283 |
285 BPF_TEST_C(BaselinePolicy, PrctlDumpable, BaselinePolicy) { | 284 BPF_TEST_C(BaselinePolicy, PrctlDumpable, BaselinePolicy) { |
286 const int is_dumpable = prctl(PR_GET_DUMPABLE, 0, 0, 0, 0); | 285 const int is_dumpable = prctl(PR_GET_DUMPABLE, 0, 0, 0, 0); |
287 BPF_ASSERT(is_dumpable == 1 || is_dumpable == 0); | 286 BPF_ASSERT(is_dumpable == 1 || is_dumpable == 0); |
288 const int prctl_ret = prctl(PR_SET_DUMPABLE, is_dumpable, 0, 0, 0, 0); | 287 const int prctl_ret = prctl(PR_SET_DUMPABLE, is_dumpable, 0, 0, 0, 0); |
289 BPF_ASSERT_EQ(0, prctl_ret); | 288 BPF_ASSERT_EQ(0, prctl_ret); |
290 } | 289 } |
291 | 290 |
292 // Workaround incomplete Android headers. | 291 // Workaround incomplete Android headers. |
293 #if !defined(PR_CAPBSET_READ) | 292 #if !defined(PR_CAPBSET_READ) |
(...skipping 39 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
333 GetPrioritySigsys, | 332 GetPrioritySigsys, |
334 DEATH_SEGV_MESSAGE(GetErrorMessageContentForTests()), | 333 DEATH_SEGV_MESSAGE(GetErrorMessageContentForTests()), |
335 BaselinePolicy) { | 334 BaselinePolicy) { |
336 getpriority(PRIO_USER, 0); | 335 getpriority(PRIO_USER, 0); |
337 _exit(1); | 336 _exit(1); |
338 } | 337 } |
339 | 338 |
340 } // namespace | 339 } // namespace |
341 | 340 |
342 } // namespace sandbox | 341 } // namespace sandbox |
OLD | NEW |