Move a couple of utility functions to a new namespace_utils class.

sandbox/linux/services/namespace_utils_unittest.cc

Index: sandbox/linux/services/namespace_utils_unittest.cc
diff --git a/sandbox/linux/services/namespace_utils_unittest.cc b/sandbox/linux/services/namespace_utils_unittest.cc
new file mode 100644
index 0000000000000000000000000000000000000000..8ec49a79f7582f587663f0fa37569dd0ee16c205
--- /dev/null
+++ b/sandbox/linux/services/namespace_utils_unittest.cc
@@ -0,0 +1,63 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.

[jln (very slow on Chromium), 2015/01/27 00:06:44]

New file, so 2015 and no '(c)'

[rickyz (no longer on Chrome), 2015/01/27 01:08:04]

Done.

+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "sandbox/linux/services/namespace_utils.h"
+
+#include <errno.h>
+#include <sched.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+
+#include "base/posix/eintr_wrapper.h"
+#include "base/process/launch.h"
+#include "sandbox/linux/services/credentials.h"
+#include "sandbox/linux/tests/unit_tests.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace sandbox {
+
+namespace {
+
+SANDBOX_TEST(NamespaceUtils, KernelSupportsUnprivilegedNamespace) {
+  const bool can_create_user_ns = Credentials::CanCreateProcessInNewUserNS();
+  const bool supports_user_ns =
+      NamespaceUtils::KernelSupportsUnprivilegedNamespace(CLONE_NEWUSER);
+  // can_create_user_ns implies supports_user_ns, but the converse is not
+  // necessarily true, as creating a user namespace can fail for various
+  // reasons.
+  if (can_create_user_ns) {
+    EXPECT_TRUE(supports_user_ns);

[jln (very slow on Chromium), 2015/01/27 00:06:44]

SANDBOX_ASSERT in this SANDBOX_TEST.

[rickyz (no longer on Chrome), 2015/01/27 01:08:03]

Done.

+  }
+}
+
+SANDBOX_TEST(NamespaceUtils, WriteToIdMapFile) {
+  if (!Credentials::CanCreateProcessInNewUserNS()) {
+    return;
+  }
+
+  pid_t pid = base::ForkWithFlags(CLONE_NEWUSER, nullptr, nullptr);
+  ASSERT_NE(-1, pid);
+
+  uid_t uid = getuid();

[jln (very slow on Chromium), 2015/01/27 00:06:44]

const

[rickyz (no longer on Chrome), 2015/01/27 01:08:03]

Done.

+  gid_t gid = getgid();

[jln (very slow on Chromium), 2015/01/27 00:06:44]

const

[rickyz (no longer on Chrome), 2015/01/27 01:08:04]

Done.

+  if (pid == 0) {
+    EXPECT_NE(uid, getuid());

[jln (very slow on Chromium), 2015/01/27 00:06:44]

You're in a child, it needs to _exit() and not exit().

You need to use CHECK()or RAW_CHECK here.

[rickyz (no longer on Chrome), 2015/01/27 01:08:03]

Gah, I keep forgetting this, sorry

+    NamespaceUtils::WriteToIdMapFile("/proc/self/uid_map", uid);
+    EXPECT_EQ(uid, getuid());
+
+    EXPECT_NE(gid, getgid());
+    NamespaceUtils::WriteToIdMapFile("/proc/self/gid_map", gid);
+    EXPECT_EQ(gid, getgid());
+
+    _exit(0);
+  }
+
+  int status;
+  EXPECT_EQ(pid, HANDLE_EINTR(waitpid(pid, &status, 0)));

[jln (very slow on Chromium), 2015/01/27 00:06:44]

This is a SANDBOX_TEST so use SANDBOX_ASSERT_EQ() (best) or CHECK* macros.

[rickyz (no longer on Chrome), 2015/01/27 01:08:03]

Nice catch with the asserts - using the right asserts revealed obvious bugs that
were horribly breaking this test.

+  EXPECT_EQ(0, status);
+}
+
+}  // namespace.
+
+}  // namespace sandbox.