| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <sched.h> | 5 #include <sched.h> |
| 6 #include <stdio.h> | 6 #include <stdio.h> |
| 7 #include <string.h> | 7 #include <string.h> |
| 8 #include <sys/socket.h> | 8 #include <sys/socket.h> |
| 9 #include <sys/syscall.h> | 9 #include <sys/syscall.h> |
| 10 #include <sys/wait.h> | 10 #include <sys/wait.h> |
| 11 #include <unistd.h> | 11 #include <unistd.h> |
| 12 | 12 |
| 13 #include <vector> | 13 #include <vector> |
| 14 | 14 |
| 15 #include "base/files/scoped_file.h" | 15 #include "base/files/scoped_file.h" |
| 16 #include "base/logging.h" | 16 #include "base/logging.h" |
| 17 #include "base/memory/scoped_vector.h" | 17 #include "base/memory/scoped_vector.h" |
| 18 #include "base/posix/eintr_wrapper.h" | 18 #include "base/posix/eintr_wrapper.h" |
| 19 #include "base/posix/unix_domain_socket_linux.h" | 19 #include "base/posix/unix_domain_socket_linux.h" |
| 20 #include "base/process/process_handle.h" | 20 #include "base/process/process_handle.h" |
| 21 #include "sandbox/linux/services/syscall_wrappers.h" |
| 21 #include "sandbox/linux/tests/unit_tests.h" | 22 #include "sandbox/linux/tests/unit_tests.h" |
| 22 | 23 |
| 23 // Additional tests for base's UnixDomainSocket to make sure it behaves | 24 // Additional tests for base's UnixDomainSocket to make sure it behaves |
| 24 // correctly in the presence of sandboxing functionality (e.g., receiving | 25 // correctly in the presence of sandboxing functionality (e.g., receiving |
| 25 // PIDs across namespaces). | 26 // PIDs across namespaces). |
| 26 | 27 |
| 27 namespace sandbox { | 28 namespace sandbox { |
| 28 | 29 |
| 29 namespace { | 30 namespace { |
| 30 | 31 |
| (...skipping 106 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 137 SANDBOX_TEST(UnixDomainSocketTest, Namespace) { | 138 SANDBOX_TEST(UnixDomainSocketTest, Namespace) { |
| 138 FakeRoot(); | 139 FakeRoot(); |
| 139 | 140 |
| 140 int fds[2]; | 141 int fds[2]; |
| 141 CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds)); | 142 CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds)); |
| 142 base::ScopedFD recv_sock(fds[0]); | 143 base::ScopedFD recv_sock(fds[0]); |
| 143 base::ScopedFD send_sock(fds[1]); | 144 base::ScopedFD send_sock(fds[1]); |
| 144 | 145 |
| 145 CHECK(UnixDomainSocket::EnableReceiveProcessId(recv_sock.get())); | 146 CHECK(UnixDomainSocket::EnableReceiveProcessId(recv_sock.get())); |
| 146 | 147 |
| 147 const pid_t pid = syscall(__NR_clone, CLONE_NEWPID | SIGCHLD, 0, 0, 0); | 148 const pid_t pid = sys_clone(CLONE_NEWPID | SIGCHLD, 0, 0, 0, 0); |
| 148 CHECK_NE(-1, pid); | 149 CHECK_NE(-1, pid); |
| 149 if (pid == 0) { | 150 if (pid == 0) { |
| 150 // Child process. | 151 // Child process. |
| 151 recv_sock.reset(); | 152 recv_sock.reset(); |
| 152 | 153 |
| 153 // Check that we think we're pid 1 in our new namespace. | 154 // Check that we think we're pid 1 in our new namespace. |
| 154 CHECK_EQ(1, syscall(__NR_getpid)); | 155 CHECK_EQ(1, sys_getpid()); |
| 155 | 156 |
| 156 SendHello(send_sock.get()); | 157 SendHello(send_sock.get()); |
| 157 _exit(0); | 158 _exit(0); |
| 158 } | 159 } |
| 159 | 160 |
| 160 // Parent process. | 161 // Parent process. |
| 161 send_sock.reset(); | 162 send_sock.reset(); |
| 162 | 163 |
| 163 base::ProcessId sender_pid; | 164 base::ProcessId sender_pid; |
| 164 RecvHello(recv_sock.get(), &sender_pid); | 165 RecvHello(recv_sock.get(), &sender_pid); |
| 165 CHECK_EQ(pid, sender_pid); | 166 CHECK_EQ(pid, sender_pid); |
| 166 | 167 |
| 167 WaitForExit(pid); | 168 WaitForExit(pid); |
| 168 } | 169 } |
| 169 | 170 |
| 170 // Again similar to Fork, but now with nested PID namespaces. | 171 // Again similar to Fork, but now with nested PID namespaces. |
| 171 SANDBOX_TEST(UnixDomainSocketTest, DoubleNamespace) { | 172 SANDBOX_TEST(UnixDomainSocketTest, DoubleNamespace) { |
| 172 FakeRoot(); | 173 FakeRoot(); |
| 173 | 174 |
| 174 int fds[2]; | 175 int fds[2]; |
| 175 CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds)); | 176 CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds)); |
| 176 base::ScopedFD recv_sock(fds[0]); | 177 base::ScopedFD recv_sock(fds[0]); |
| 177 base::ScopedFD send_sock(fds[1]); | 178 base::ScopedFD send_sock(fds[1]); |
| 178 | 179 |
| 179 CHECK(UnixDomainSocket::EnableReceiveProcessId(recv_sock.get())); | 180 CHECK(UnixDomainSocket::EnableReceiveProcessId(recv_sock.get())); |
| 180 | 181 |
| 181 const pid_t pid = syscall(__NR_clone, CLONE_NEWPID | SIGCHLD, 0, 0, 0); | 182 const pid_t pid = sys_clone(CLONE_NEWPID | SIGCHLD, 0, 0, 0, 0); |
| 182 CHECK_NE(-1, pid); | 183 CHECK_NE(-1, pid); |
| 183 if (pid == 0) { | 184 if (pid == 0) { |
| 184 // Child process. | 185 // Child process. |
| 185 recv_sock.reset(); | 186 recv_sock.reset(); |
| 186 | 187 |
| 187 const pid_t pid2 = syscall(__NR_clone, CLONE_NEWPID | SIGCHLD, 0, 0, 0); | 188 const pid_t pid2 = sys_clone(CLONE_NEWPID | SIGCHLD, 0, 0, 0, 0); |
| 188 CHECK_NE(-1, pid2); | 189 CHECK_NE(-1, pid2); |
| 189 | 190 |
| 190 if (pid2 != 0) { | 191 if (pid2 != 0) { |
| 191 // Wait for grandchild to run to completion; see comments below. | 192 // Wait for grandchild to run to completion; see comments below. |
| 192 WaitForExit(pid2); | 193 WaitForExit(pid2); |
| 193 | 194 |
| 194 // Fallthrough once grandchild has sent its hello and exited. | 195 // Fallthrough once grandchild has sent its hello and exited. |
| 195 } | 196 } |
| 196 | 197 |
| 197 // Check that we think we're pid 1. | 198 // Check that we think we're pid 1. |
| 198 CHECK_EQ(1, syscall(__NR_getpid)); | 199 CHECK_EQ(1, sys_getpid()); |
| 199 | 200 |
| 200 SendHello(send_sock.get()); | 201 SendHello(send_sock.get()); |
| 201 _exit(0); | 202 _exit(0); |
| 202 } | 203 } |
| 203 | 204 |
| 204 // Parent process. | 205 // Parent process. |
| 205 send_sock.reset(); | 206 send_sock.reset(); |
| 206 | 207 |
| 207 // We have two messages to receive: first from the grand-child, | 208 // We have two messages to receive: first from the grand-child, |
| 208 // then from the child. | 209 // then from the child. |
| (...skipping 28 matching lines...) Expand all Loading... |
| 237 SANDBOX_TEST(UnixDomainSocketTest, ImpossiblePid) { | 238 SANDBOX_TEST(UnixDomainSocketTest, ImpossiblePid) { |
| 238 FakeRoot(); | 239 FakeRoot(); |
| 239 | 240 |
| 240 int fds[2]; | 241 int fds[2]; |
| 241 CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds)); | 242 CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds)); |
| 242 base::ScopedFD send_sock(fds[0]); | 243 base::ScopedFD send_sock(fds[0]); |
| 243 base::ScopedFD recv_sock(fds[1]); | 244 base::ScopedFD recv_sock(fds[1]); |
| 244 | 245 |
| 245 CHECK(UnixDomainSocket::EnableReceiveProcessId(recv_sock.get())); | 246 CHECK(UnixDomainSocket::EnableReceiveProcessId(recv_sock.get())); |
| 246 | 247 |
| 247 const pid_t pid = syscall(__NR_clone, CLONE_NEWPID | SIGCHLD, 0, 0, 0); | 248 const pid_t pid = sys_clone(CLONE_NEWPID | SIGCHLD, 0, 0, 0, 0); |
| 248 CHECK_NE(-1, pid); | 249 CHECK_NE(-1, pid); |
| 249 if (pid == 0) { | 250 if (pid == 0) { |
| 250 // Child process. | 251 // Child process. |
| 251 send_sock.reset(); | 252 send_sock.reset(); |
| 252 | 253 |
| 253 base::ProcessId sender_pid; | 254 base::ProcessId sender_pid; |
| 254 RecvHello(recv_sock.get(), &sender_pid); | 255 RecvHello(recv_sock.get(), &sender_pid); |
| 255 CHECK_EQ(0, sender_pid); | 256 CHECK_EQ(0, sender_pid); |
| 256 _exit(0); | 257 _exit(0); |
| 257 } | 258 } |
| 258 | 259 |
| 259 // Parent process. | 260 // Parent process. |
| 260 recv_sock.reset(); | 261 recv_sock.reset(); |
| 261 SendHello(send_sock.get()); | 262 SendHello(send_sock.get()); |
| 262 WaitForExit(pid); | 263 WaitForExit(pid); |
| 263 } | 264 } |
| 264 | 265 |
| 265 } // namespace | 266 } // namespace |
| 266 | 267 |
| 267 } // namespace sandbox | 268 } // namespace sandbox |
| OLD | NEW |