sandbox: Extend BrokerPolicy to support file creation

sandbox/linux/bpf_dsl/bpf_dsl_more_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <pthread.h>
 #include <sched.h>
@@ skipping 38 matching lines @@
 // Workaround for Android's prctl.h file.
 #ifndef PR_GET_ENDIAN
 #define PR_GET_ENDIAN 19
 #endif
 #ifndef PR_CAPBSET_READ
 #define PR_CAPBSET_READ 23
 #define PR_CAPBSET_DROP 24
 #endif
 
 namespace sandbox {
+using syscall_broker::BrokerPermission;
 namespace bpf_dsl {
 
 namespace {
 
 const int kExpectedReturnValue = 42;
 const char kSandboxDebuggingEnv[] = "CHROME_SANDBOX_DEBUGGING";
 
 // Set the global environment to allow the use of UnsafeTrap() policies.
 void EnableUnsafeTraps() {
   // The use of UnsafeTrap() causes us to print a warning message. This is
@@ skipping 679 matching lines @@
 
 bool NoOpCallback() {
   return true;
 }
 
 // Test a trap handler that makes use of a broker process to open().
 
 class InitializedOpenBroker {
  public:
   InitializedOpenBroker() : initialized_(false) {
-    std::vector<std::string> allowed_files;
-    allowed_files.push_back("/proc/allowed");
-    allowed_files.push_back("/proc/cpuinfo");
+    std::vector<syscall_broker::BrokerPermission> permissions;
+    permissions.push_back(BROKER_PERM_READ_ONLY("/proc/allowed"));
+    permissions.push_back(BROKER_PERM_READ_ONLY("/proc/cpuinfo"));
 
-    broker_process_.reset(
-        new BrokerProcess(EPERM, allowed_files, std::vector<std::string>()));
+    broker_process_.reset(new BrokerProcess(EPERM, permissions));
     BPF_ASSERT(broker_process() != NULL);
     BPF_ASSERT(broker_process_->Init(base::Bind(&NoOpCallback)));
 
     initialized_ = true;
   }
   bool initialized() { return initialized_; }
   class BrokerProcess* broker_process() { return broker_process_.get(); }
 
  private:
   bool initialized_;
@@ skipping 1616 matching lines @@
   BPF_ASSERT_EQ(ENOSYS, errno);
 
   BPF_ASSERT_EQ(-1, syscall(__NR_setgid, 300));
   BPF_ASSERT_EQ(EPERM, errno);
 }
 
 }  // namespace
 
 }  // namespace bpf_dsl
 }  // namespace sandbox