OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/services/credentials.h" | 5 #include "sandbox/linux/services/credentials.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
| 8 #include <fcntl.h> |
8 #include <stdio.h> | 9 #include <stdio.h> |
| 10 #include <sys/stat.h> |
| 11 #include <sys/types.h> |
9 #include <unistd.h> | 12 #include <unistd.h> |
10 | 13 |
| 14 #include "base/file_util.h" |
11 #include "base/logging.h" | 15 #include "base/logging.h" |
12 #include "base/memory/scoped_ptr.h" | 16 #include "base/memory/scoped_ptr.h" |
13 #include "sandbox/linux/tests/unit_tests.h" | 17 #include "sandbox/linux/tests/unit_tests.h" |
14 #include "testing/gtest/include/gtest/gtest.h" | 18 #include "testing/gtest/include/gtest/gtest.h" |
15 | 19 |
| 20 using file_util::ScopedFD; |
| 21 |
16 namespace sandbox { | 22 namespace sandbox { |
17 | 23 |
18 namespace { | 24 namespace { |
19 | 25 |
20 bool DirectoryExists(const char* path) { | 26 bool DirectoryExists(const char* path) { |
21 struct stat dir; | 27 struct stat dir; |
22 errno = 0; | 28 errno = 0; |
23 int ret = stat(path, &dir); | 29 int ret = stat(path, &dir); |
24 return -1 != ret || ENOENT != errno; | 30 return -1 != ret || ENOENT != errno; |
25 } | 31 } |
(...skipping 19 matching lines...) Expand all Loading... |
45 | 51 |
46 // Give dynamic tools a simple thing to test. | 52 // Give dynamic tools a simple thing to test. |
47 TEST(Credentials, CreateAndDestroy) { | 53 TEST(Credentials, CreateAndDestroy) { |
48 { | 54 { |
49 Credentials cred1; | 55 Credentials cred1; |
50 (void) cred1; | 56 (void) cred1; |
51 } | 57 } |
52 scoped_ptr<Credentials> cred2(new Credentials); | 58 scoped_ptr<Credentials> cred2(new Credentials); |
53 } | 59 } |
54 | 60 |
| 61 TEST(Credentials, HasOpenDirectory) { |
| 62 Credentials creds; |
| 63 // No open directory should exist at startup. |
| 64 EXPECT_FALSE(creds.HasOpenDirectory(-1)); |
| 65 { |
| 66 // Have a "/dev" file descriptor around. |
| 67 int dev_fd = open("/dev", O_RDONLY | O_DIRECTORY); |
| 68 ScopedFD dev_fd_closer(&dev_fd); |
| 69 EXPECT_TRUE(creds.HasOpenDirectory(-1)); |
| 70 } |
| 71 EXPECT_FALSE(creds.HasOpenDirectory(-1)); |
| 72 } |
| 73 |
| 74 TEST(Credentials, HasOpenDirectoryWithFD) { |
| 75 Credentials creds; |
| 76 |
| 77 int proc_fd = open("/proc", O_RDONLY | O_DIRECTORY); |
| 78 ScopedFD proc_fd_closer(&proc_fd); |
| 79 ASSERT_LE(0, proc_fd); |
| 80 |
| 81 // Don't pass |proc_fd|, an open directory (proc_fd) should |
| 82 // be detected. |
| 83 EXPECT_TRUE(creds.HasOpenDirectory(-1)); |
| 84 // Pass |proc_fd| and no open directory should be detected. |
| 85 EXPECT_FALSE(creds.HasOpenDirectory(proc_fd)); |
| 86 |
| 87 { |
| 88 // Have a "/dev" file descriptor around. |
| 89 int dev_fd = open("/dev", O_RDONLY | O_DIRECTORY); |
| 90 ScopedFD dev_fd_closer(&dev_fd); |
| 91 EXPECT_TRUE(creds.HasOpenDirectory(proc_fd)); |
| 92 } |
| 93 |
| 94 // The "/dev" file descriptor should now be closed, |proc_fd| is the only |
| 95 // directory file descriptor open. |
| 96 EXPECT_FALSE(creds.HasOpenDirectory(proc_fd)); |
| 97 } |
| 98 |
55 SANDBOX_TEST(Credentials, DropAllCaps) { | 99 SANDBOX_TEST(Credentials, DropAllCaps) { |
56 Credentials creds; | 100 Credentials creds; |
57 CHECK(creds.DropAllCapabilities()); | 101 CHECK(creds.DropAllCapabilities()); |
58 CHECK(!creds.HasAnyCapability()); | 102 CHECK(!creds.HasAnyCapability()); |
59 } | 103 } |
60 | 104 |
61 SANDBOX_TEST(Credentials, GetCurrentCapString) { | 105 SANDBOX_TEST(Credentials, GetCurrentCapString) { |
62 Credentials creds; | 106 Credentials creds; |
63 CHECK(creds.DropAllCapabilities()); | 107 CHECK(creds.DropAllCapabilities()); |
64 const char kNoCapabilityText[] = "="; | 108 const char kNoCapabilityText[] = "="; |
(...skipping 97 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
162 CHECK(creds.DropAllCapabilities()); | 206 CHECK(creds.DropAllCapabilities()); |
163 | 207 |
164 // The kernel should now prevent us from regaining capabilities because we | 208 // The kernel should now prevent us from regaining capabilities because we |
165 // are in a chroot. | 209 // are in a chroot. |
166 CHECK(!creds.MoveToNewUserNS()); | 210 CHECK(!creds.MoveToNewUserNS()); |
167 } | 211 } |
168 | 212 |
169 } // namespace. | 213 } // namespace. |
170 | 214 |
171 } // namespace sandbox. | 215 } // namespace sandbox. |
OLD | NEW |