| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" |
| 6 | 6 |
| 7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <linux/futex.h> | 8 #include <linux/futex.h> |
| 9 #include <sched.h> | 9 #include <sched.h> |
| 10 #include <signal.h> | 10 #include <signal.h> |
| (...skipping 10 matching lines...) Expand all Loading... |
| 21 | 21 |
| 22 #include "base/files/scoped_file.h" | 22 #include "base/files/scoped_file.h" |
| 23 #include "base/macros.h" | 23 #include "base/macros.h" |
| 24 #include "base/posix/eintr_wrapper.h" | 24 #include "base/posix/eintr_wrapper.h" |
| 25 #include "base/threading/thread.h" | 25 #include "base/threading/thread.h" |
| 26 #include "build/build_config.h" | 26 #include "build/build_config.h" |
| 27 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" | 27 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h" |
| 28 #include "sandbox/linux/seccomp-bpf/bpf_tests.h" | 28 #include "sandbox/linux/seccomp-bpf/bpf_tests.h" |
| 29 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 29 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
| 30 #include "sandbox/linux/seccomp-bpf/syscall.h" | 30 #include "sandbox/linux/seccomp-bpf/syscall.h" |
| 31 #include "sandbox/linux/services/android_futex.h" |
| 31 #include "sandbox/linux/services/linux_syscalls.h" | 32 #include "sandbox/linux/services/linux_syscalls.h" |
| 32 #include "sandbox/linux/services/thread_helpers.h" | 33 #include "sandbox/linux/services/thread_helpers.h" |
| 33 #include "sandbox/linux/tests/unit_tests.h" | 34 #include "sandbox/linux/tests/unit_tests.h" |
| 34 | 35 |
| 35 namespace sandbox { | 36 namespace sandbox { |
| 36 | 37 |
| 37 namespace { | 38 namespace { |
| 38 | 39 |
| 39 // |pid| is the return value of a fork()-like call. This | 40 // |pid| is the return value of a fork()-like call. This |
| 40 // makes sure that if fork() succeeded the child exits | 41 // makes sure that if fork() succeeded the child exits |
| (...skipping 208 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 249 TEST_BASELINE_SIGSYS(__NR_sysinfo); | 250 TEST_BASELINE_SIGSYS(__NR_sysinfo); |
| 250 TEST_BASELINE_SIGSYS(__NR_syslog); | 251 TEST_BASELINE_SIGSYS(__NR_syslog); |
| 251 TEST_BASELINE_SIGSYS(__NR_timer_create); | 252 TEST_BASELINE_SIGSYS(__NR_timer_create); |
| 252 | 253 |
| 253 #if !defined(__aarch64__) | 254 #if !defined(__aarch64__) |
| 254 TEST_BASELINE_SIGSYS(__NR_eventfd); | 255 TEST_BASELINE_SIGSYS(__NR_eventfd); |
| 255 TEST_BASELINE_SIGSYS(__NR_inotify_init); | 256 TEST_BASELINE_SIGSYS(__NR_inotify_init); |
| 256 TEST_BASELINE_SIGSYS(__NR_vserver); | 257 TEST_BASELINE_SIGSYS(__NR_vserver); |
| 257 #endif | 258 #endif |
| 258 | 259 |
| 259 #if !defined(OS_ANDROID) | |
| 260 BPF_DEATH_TEST_C(BaselinePolicy, | 260 BPF_DEATH_TEST_C(BaselinePolicy, |
| 261 FutexWithRequeuePriorityInheritence, | 261 FutexWithRequeuePriorityInheritence, |
| 262 DEATH_MESSAGE(GetFutexErrorMessageContentForTests()), | 262 DEATH_SEGV_MESSAGE(GetFutexErrorMessageContentForTests()), |
| 263 BaselinePolicy) { | 263 BaselinePolicy) { |
| 264 syscall(__NR_futex, NULL, FUTEX_CMP_REQUEUE_PI, 0, NULL, NULL, 0); | 264 syscall(__NR_futex, NULL, FUTEX_CMP_REQUEUE_PI, 0, NULL, NULL, 0); |
| 265 _exit(1); | 265 _exit(1); |
| 266 } | 266 } |
| 267 | 267 |
| 268 BPF_DEATH_TEST_C(BaselinePolicy, | 268 BPF_DEATH_TEST_C(BaselinePolicy, |
| 269 FutexWithRequeuePriorityInheritencePrivate, | 269 FutexWithRequeuePriorityInheritencePrivate, |
| 270 DEATH_MESSAGE(GetFutexErrorMessageContentForTests()), | 270 DEATH_SEGV_MESSAGE(GetFutexErrorMessageContentForTests()), |
| 271 BaselinePolicy) { | 271 BaselinePolicy) { |
| 272 syscall(__NR_futex, NULL, FUTEX_CMP_REQUEUE_PI_PRIVATE, 0, NULL, NULL, 0); | 272 syscall(__NR_futex, NULL, FUTEX_CMP_REQUEUE_PI_PRIVATE, 0, NULL, NULL, 0); |
| 273 _exit(1); | 273 _exit(1); |
| 274 } | 274 } |
| 275 | 275 |
| 276 BPF_DEATH_TEST_C(BaselinePolicy, | 276 BPF_DEATH_TEST_C(BaselinePolicy, |
| 277 FutexWithUnlockPIPrivate, | 277 FutexWithUnlockPIPrivate, |
| 278 DEATH_MESSAGE(GetFutexErrorMessageContentForTests()), | 278 DEATH_SEGV_MESSAGE(GetFutexErrorMessageContentForTests()), |
| 279 BaselinePolicy) { | 279 BaselinePolicy) { |
| 280 syscall(__NR_futex, NULL, FUTEX_UNLOCK_PI_PRIVATE, 0, NULL, NULL, 0); | 280 syscall(__NR_futex, NULL, FUTEX_UNLOCK_PI_PRIVATE, 0, NULL, NULL, 0); |
| 281 _exit(1); | 281 _exit(1); |
| 282 } | 282 } |
| 283 #endif // !defined(OS_ANDROID) | |
| 284 | 283 |
| 285 BPF_TEST_C(BaselinePolicy, PrctlDumpable, BaselinePolicy) { | 284 BPF_TEST_C(BaselinePolicy, PrctlDumpable, BaselinePolicy) { |
| 286 const int is_dumpable = prctl(PR_GET_DUMPABLE, 0, 0, 0, 0); | 285 const int is_dumpable = prctl(PR_GET_DUMPABLE, 0, 0, 0, 0); |
| 287 BPF_ASSERT(is_dumpable == 1 || is_dumpable == 0); | 286 BPF_ASSERT(is_dumpable == 1 || is_dumpable == 0); |
| 288 const int prctl_ret = prctl(PR_SET_DUMPABLE, is_dumpable, 0, 0, 0, 0); | 287 const int prctl_ret = prctl(PR_SET_DUMPABLE, is_dumpable, 0, 0, 0, 0); |
| 289 BPF_ASSERT_EQ(0, prctl_ret); | 288 BPF_ASSERT_EQ(0, prctl_ret); |
| 290 } | 289 } |
| 291 | 290 |
| 292 // Workaround incomplete Android headers. | 291 // Workaround incomplete Android headers. |
| 293 #if !defined(PR_CAPBSET_READ) | 292 #if !defined(PR_CAPBSET_READ) |
| (...skipping 39 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 333 GetPrioritySigsys, | 332 GetPrioritySigsys, |
| 334 DEATH_SEGV_MESSAGE(GetErrorMessageContentForTests()), | 333 DEATH_SEGV_MESSAGE(GetErrorMessageContentForTests()), |
| 335 BaselinePolicy) { | 334 BaselinePolicy) { |
| 336 getpriority(PRIO_USER, 0); | 335 getpriority(PRIO_USER, 0); |
| 337 _exit(1); | 336 _exit(1); |
| 338 } | 337 } |
| 339 | 338 |
| 340 } // namespace | 339 } // namespace |
| 341 | 340 |
| 342 } // namespace sandbox | 341 } // namespace sandbox |
| OLD | NEW |