Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(826)

Unified Diff: sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc

Issue 754433003: Update from https://crrev.com/305340 (Closed) Base URL: git@github.com:domokit/mojo.git@master
Patch Set: Created 6 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc
diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc
index 83e848976b3a7a5b29c84289a07382c6222d315d..264ee4d020b79d4cbd8b5a7daf2a72901a823382 100644
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc
@@ -6,7 +6,9 @@
#include <errno.h>
#include <sched.h>
+#include <sys/resource.h>
#include <sys/syscall.h>
+#include <sys/types.h>
#include <time.h>
#include <unistd.h>
@@ -23,6 +25,7 @@
#include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
#include "sandbox/linux/seccomp-bpf/syscall.h"
#include "sandbox/linux/services/linux_syscalls.h"
+#include "sandbox/linux/services/syscall_wrappers.h"
#include "sandbox/linux/tests/unit_tests.h"
#if !defined(OS_ANDROID)
@@ -163,7 +166,7 @@ void CheckSchedGetParam(pid_t pid, struct sched_param* param) {
void SchedGetParamThread(base::WaitableEvent* thread_run) {
const pid_t pid = getpid();
- const pid_t tid = syscall(__NR_gettid);
+ const pid_t tid = sys_gettid();
BPF_ASSERT_NE(pid, tid);
struct sched_param current_pid_param;
@@ -208,6 +211,35 @@ BPF_DEATH_TEST_C(ParameterRestrictions,
sched_getparam(kInitPID, &param);
}
+class RestrictPrlimit64Policy : public bpf_dsl::Policy {
+ public:
+ RestrictPrlimit64Policy() {}
+ ~RestrictPrlimit64Policy() override {}
+
+ ResultExpr EvaluateSyscall(int sysno) const override {
+ switch (sysno) {
+ case __NR_prlimit64:
+ return RestrictPrlimit64(getpid());
+ default:
+ return Allow();
+ }
+ }
+};
+
+BPF_TEST_C(ParameterRestrictions, prlimit64_allowed, RestrictPrlimit64Policy) {
+ BPF_ASSERT_EQ(0, syscall(__NR_prlimit64, 0, RLIMIT_AS, NULL, NULL));
+ BPF_ASSERT_EQ(0, syscall(__NR_prlimit64, getpid(), RLIMIT_AS, NULL, NULL));
+}
+
+BPF_DEATH_TEST_C(ParameterRestrictions,
+ prlimit64_crash_not_self,
+ DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
+ RestrictPrlimit64Policy) {
+ const pid_t kInitPID = 1;
+ BPF_ASSERT_NE(kInitPID, getpid());
+ syscall(__NR_prlimit64, kInitPID, RLIMIT_AS, NULL, NULL);
+}
+
} // namespace
} // namespace sandbox
« no previous file with comments | « sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc ('k') | sandbox/linux/seccomp-bpf/basicblock.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698