OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <sched.h> | 5 #include <sched.h> |
6 #include <stdio.h> | 6 #include <stdio.h> |
7 #include <string.h> | 7 #include <string.h> |
8 #include <sys/socket.h> | 8 #include <sys/socket.h> |
9 #include <sys/syscall.h> | 9 #include <sys/syscall.h> |
10 #include <sys/wait.h> | 10 #include <sys/wait.h> |
11 #include <unistd.h> | 11 #include <unistd.h> |
12 | 12 |
13 #include <vector> | 13 #include <vector> |
14 | 14 |
15 #include "base/files/scoped_file.h" | 15 #include "base/files/scoped_file.h" |
16 #include "base/logging.h" | 16 #include "base/logging.h" |
17 #include "base/memory/scoped_vector.h" | 17 #include "base/memory/scoped_vector.h" |
18 #include "base/posix/eintr_wrapper.h" | 18 #include "base/posix/eintr_wrapper.h" |
19 #include "base/posix/unix_domain_socket_linux.h" | 19 #include "base/posix/unix_domain_socket_linux.h" |
20 #include "base/process/process_handle.h" | 20 #include "base/process/process_handle.h" |
| 21 #include "sandbox/linux/services/syscall_wrappers.h" |
21 #include "sandbox/linux/tests/unit_tests.h" | 22 #include "sandbox/linux/tests/unit_tests.h" |
22 | 23 |
23 // Additional tests for base's UnixDomainSocket to make sure it behaves | 24 // Additional tests for base's UnixDomainSocket to make sure it behaves |
24 // correctly in the presence of sandboxing functionality (e.g., receiving | 25 // correctly in the presence of sandboxing functionality (e.g., receiving |
25 // PIDs across namespaces). | 26 // PIDs across namespaces). |
26 | 27 |
27 namespace sandbox { | 28 namespace sandbox { |
28 | 29 |
29 namespace { | 30 namespace { |
30 | 31 |
(...skipping 106 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
137 SANDBOX_TEST(UnixDomainSocketTest, Namespace) { | 138 SANDBOX_TEST(UnixDomainSocketTest, Namespace) { |
138 FakeRoot(); | 139 FakeRoot(); |
139 | 140 |
140 int fds[2]; | 141 int fds[2]; |
141 CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds)); | 142 CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds)); |
142 base::ScopedFD recv_sock(fds[0]); | 143 base::ScopedFD recv_sock(fds[0]); |
143 base::ScopedFD send_sock(fds[1]); | 144 base::ScopedFD send_sock(fds[1]); |
144 | 145 |
145 CHECK(UnixDomainSocket::EnableReceiveProcessId(recv_sock.get())); | 146 CHECK(UnixDomainSocket::EnableReceiveProcessId(recv_sock.get())); |
146 | 147 |
147 const pid_t pid = syscall(__NR_clone, CLONE_NEWPID | SIGCHLD, 0, 0, 0); | 148 const pid_t pid = sys_clone(CLONE_NEWPID | SIGCHLD, 0, 0, 0, 0); |
148 CHECK_NE(-1, pid); | 149 CHECK_NE(-1, pid); |
149 if (pid == 0) { | 150 if (pid == 0) { |
150 // Child process. | 151 // Child process. |
151 recv_sock.reset(); | 152 recv_sock.reset(); |
152 | 153 |
153 // Check that we think we're pid 1 in our new namespace. | 154 // Check that we think we're pid 1 in our new namespace. |
154 CHECK_EQ(1, syscall(__NR_getpid)); | 155 CHECK_EQ(1, sys_getpid()); |
155 | 156 |
156 SendHello(send_sock.get()); | 157 SendHello(send_sock.get()); |
157 _exit(0); | 158 _exit(0); |
158 } | 159 } |
159 | 160 |
160 // Parent process. | 161 // Parent process. |
161 send_sock.reset(); | 162 send_sock.reset(); |
162 | 163 |
163 base::ProcessId sender_pid; | 164 base::ProcessId sender_pid; |
164 RecvHello(recv_sock.get(), &sender_pid); | 165 RecvHello(recv_sock.get(), &sender_pid); |
165 CHECK_EQ(pid, sender_pid); | 166 CHECK_EQ(pid, sender_pid); |
166 | 167 |
167 WaitForExit(pid); | 168 WaitForExit(pid); |
168 } | 169 } |
169 | 170 |
170 // Again similar to Fork, but now with nested PID namespaces. | 171 // Again similar to Fork, but now with nested PID namespaces. |
171 SANDBOX_TEST(UnixDomainSocketTest, DoubleNamespace) { | 172 SANDBOX_TEST(UnixDomainSocketTest, DoubleNamespace) { |
172 FakeRoot(); | 173 FakeRoot(); |
173 | 174 |
174 int fds[2]; | 175 int fds[2]; |
175 CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds)); | 176 CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds)); |
176 base::ScopedFD recv_sock(fds[0]); | 177 base::ScopedFD recv_sock(fds[0]); |
177 base::ScopedFD send_sock(fds[1]); | 178 base::ScopedFD send_sock(fds[1]); |
178 | 179 |
179 CHECK(UnixDomainSocket::EnableReceiveProcessId(recv_sock.get())); | 180 CHECK(UnixDomainSocket::EnableReceiveProcessId(recv_sock.get())); |
180 | 181 |
181 const pid_t pid = syscall(__NR_clone, CLONE_NEWPID | SIGCHLD, 0, 0, 0); | 182 const pid_t pid = sys_clone(CLONE_NEWPID | SIGCHLD, 0, 0, 0, 0); |
182 CHECK_NE(-1, pid); | 183 CHECK_NE(-1, pid); |
183 if (pid == 0) { | 184 if (pid == 0) { |
184 // Child process. | 185 // Child process. |
185 recv_sock.reset(); | 186 recv_sock.reset(); |
186 | 187 |
187 const pid_t pid2 = syscall(__NR_clone, CLONE_NEWPID | SIGCHLD, 0, 0, 0); | 188 const pid_t pid2 = sys_clone(CLONE_NEWPID | SIGCHLD, 0, 0, 0, 0); |
188 CHECK_NE(-1, pid2); | 189 CHECK_NE(-1, pid2); |
189 | 190 |
190 if (pid2 != 0) { | 191 if (pid2 != 0) { |
191 // Wait for grandchild to run to completion; see comments below. | 192 // Wait for grandchild to run to completion; see comments below. |
192 WaitForExit(pid2); | 193 WaitForExit(pid2); |
193 | 194 |
194 // Fallthrough once grandchild has sent its hello and exited. | 195 // Fallthrough once grandchild has sent its hello and exited. |
195 } | 196 } |
196 | 197 |
197 // Check that we think we're pid 1. | 198 // Check that we think we're pid 1. |
198 CHECK_EQ(1, syscall(__NR_getpid)); | 199 CHECK_EQ(1, sys_getpid()); |
199 | 200 |
200 SendHello(send_sock.get()); | 201 SendHello(send_sock.get()); |
201 _exit(0); | 202 _exit(0); |
202 } | 203 } |
203 | 204 |
204 // Parent process. | 205 // Parent process. |
205 send_sock.reset(); | 206 send_sock.reset(); |
206 | 207 |
207 // We have two messages to receive: first from the grand-child, | 208 // We have two messages to receive: first from the grand-child, |
208 // then from the child. | 209 // then from the child. |
(...skipping 28 matching lines...) Expand all Loading... |
237 SANDBOX_TEST(UnixDomainSocketTest, ImpossiblePid) { | 238 SANDBOX_TEST(UnixDomainSocketTest, ImpossiblePid) { |
238 FakeRoot(); | 239 FakeRoot(); |
239 | 240 |
240 int fds[2]; | 241 int fds[2]; |
241 CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds)); | 242 CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds)); |
242 base::ScopedFD send_sock(fds[0]); | 243 base::ScopedFD send_sock(fds[0]); |
243 base::ScopedFD recv_sock(fds[1]); | 244 base::ScopedFD recv_sock(fds[1]); |
244 | 245 |
245 CHECK(UnixDomainSocket::EnableReceiveProcessId(recv_sock.get())); | 246 CHECK(UnixDomainSocket::EnableReceiveProcessId(recv_sock.get())); |
246 | 247 |
247 const pid_t pid = syscall(__NR_clone, CLONE_NEWPID | SIGCHLD, 0, 0, 0); | 248 const pid_t pid = sys_clone(CLONE_NEWPID | SIGCHLD, 0, 0, 0, 0); |
248 CHECK_NE(-1, pid); | 249 CHECK_NE(-1, pid); |
249 if (pid == 0) { | 250 if (pid == 0) { |
250 // Child process. | 251 // Child process. |
251 send_sock.reset(); | 252 send_sock.reset(); |
252 | 253 |
253 base::ProcessId sender_pid; | 254 base::ProcessId sender_pid; |
254 RecvHello(recv_sock.get(), &sender_pid); | 255 RecvHello(recv_sock.get(), &sender_pid); |
255 CHECK_EQ(0, sender_pid); | 256 CHECK_EQ(0, sender_pid); |
256 _exit(0); | 257 _exit(0); |
257 } | 258 } |
258 | 259 |
259 // Parent process. | 260 // Parent process. |
260 recv_sock.reset(); | 261 recv_sock.reset(); |
261 SendHello(send_sock.get()); | 262 SendHello(send_sock.get()); |
262 WaitForExit(pid); | 263 WaitForExit(pid); |
263 } | 264 } |
264 | 265 |
265 } // namespace | 266 } // namespace |
266 | 267 |
267 } // namespace sandbox | 268 } // namespace sandbox |
OLD | NEW |