sandbox: Extend BrokerPolicy to support file creation

sandbox/linux/bpf_dsl/bpf_dsl_more_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <pthread.h>
 #include <sched.h>
@@ skipping 23 matching lines @@
 #include "build/build_config.h"
 #include "sandbox/linux/bpf_dsl/policy.h"
 #include "sandbox/linux/seccomp-bpf/bpf_tests.h"
 #include "sandbox/linux/seccomp-bpf/die.h"
 #include "sandbox/linux/seccomp-bpf/errorcode.h"
 #include "sandbox/linux/seccomp-bpf/linux_seccomp.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
 #include "sandbox/linux/seccomp-bpf/syscall.h"
 #include "sandbox/linux/seccomp-bpf/trap.h"
 #include "sandbox/linux/services/linux_syscalls.h"
 #include "sandbox/linux/syscall_broker/broker_process.h"

[Jorge Lucangeli Obes, 2014/11/20 21:03:00]

Do you need to include "broker_file_permission.h" here?

[leecam, 2014/11/20 21:46:20]

Done.

 #include "sandbox/linux/tests/scoped_temporary_file.h"
 #include "sandbox/linux/tests/unit_tests.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 // Workaround for Android's prctl.h file.
 #ifndef PR_GET_ENDIAN
 #define PR_GET_ENDIAN 19
 #endif
 #ifndef PR_CAPBSET_READ
 #define PR_CAPBSET_READ 23
@@ skipping 693 matching lines @@
 
 bool NoOpCallback() {
   return true;
 }
 
 // Test a trap handler that makes use of a broker process to open().
 
 class InitializedOpenBroker {
  public:
   InitializedOpenBroker() : initialized_(false) {
-    std::vector<std::string> allowed_files;
-    allowed_files.push_back("/proc/allowed");
-    allowed_files.push_back("/proc/cpuinfo");
+    std::vector<syscall_broker::BrokerFilePermission> permissions;
+    permissions.push_back(
+        syscall_broker::BrokerFilePermission::ReadOnly("/proc/allowed"));
+    permissions.push_back(
+        syscall_broker::BrokerFilePermission::ReadOnly("/proc/cpuinfo"));
 
-    broker_process_.reset(new syscall_broker::BrokerProcess(
-        EPERM, allowed_files, std::vector<std::string>()));
+    broker_process_.reset(
+        new syscall_broker::BrokerProcess(EPERM, permissions));
     BPF_ASSERT(broker_process() != NULL);
     BPF_ASSERT(broker_process_->Init(base::Bind(&NoOpCallback)));
 
     initialized_ = true;
   }
   bool initialized() { return initialized_; }
   class syscall_broker::BrokerProcess* broker_process() {
     return broker_process_.get();
   }
 
@@ skipping 1619 matching lines @@
   BPF_ASSERT_EQ(ENOSYS, errno);
 
   BPF_ASSERT_EQ(-1, syscall(__NR_setgid, 300));
   BPF_ASSERT_EQ(EPERM, errno);
 }
 
 }  // namespace
 
 }  // namespace bpf_dsl
 }  // namespace sandbox