OLD | NEW |
---|---|
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/services/namespace_sandbox.h" | 5 #include "sandbox/linux/services/namespace_sandbox.h" |
6 | 6 |
7 #include <sys/types.h> | 7 #include <sys/types.h> |
8 #include <sys/wait.h> | 8 #include <sys/wait.h> |
9 #include <unistd.h> | 9 #include <unistd.h> |
10 | 10 |
(...skipping 100 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
111 int exit_code = kDummyExitCode; | 111 int exit_code = kDummyExitCode; |
112 CHECK(process.WaitForExit(&exit_code)); | 112 CHECK(process.WaitForExit(&exit_code)); |
113 CHECK_EQ(0, exit_code); | 113 CHECK_EQ(0, exit_code); |
114 return 0; | 114 return 0; |
115 } | 115 } |
116 | 116 |
117 TEST_F(NamespaceSandboxTest, NestedNamespaceSandbox) { | 117 TEST_F(NamespaceSandboxTest, NestedNamespaceSandbox) { |
118 TestProc("NestedNamespaceSandbox"); | 118 TestProc("NestedNamespaceSandbox"); |
119 } | 119 } |
120 | 120 |
121 const int kNormalExitCode = 0; | |
122 const int kSignalTerminationExitCode = 255; | |
123 | |
124 SANDBOX_TEST(ForkInNewPidNamespace, BasicUsage) { | |
125 if (!Credentials::CanCreateProcessInNewUserNS()) { | |
126 return; | |
127 } | |
128 | |
129 CHECK(sandbox::Credentials::MoveToNewUserNS()); | |
130 const pid_t pid = NamespaceSandbox::ForkInNewPidNamespace(true); | |
131 CHECK_GE(pid, 0); | |
132 | |
133 if (pid == 0) { | |
134 CHECK_EQ(1, getpid()); | |
jln (very slow on Chromium)
2015/03/25 23:47:50
I don't like the implicit dependency on kNormalExi
rickyz (no longer on Chrome)
2015/03/26 00:09:37
Sure, I added the test (and found out in the proce
jln (very slow on Chromium)
2015/03/26 00:49:47
Indeed, but that's a SANDBOX_TEST feature FYI :)
| |
135 CHECK(!Credentials::HasAnyCapability()); | |
136 _exit(kNormalExitCode); | |
137 } | |
138 | |
139 int status; | |
140 PCHECK(waitpid(pid, &status, 0) == pid); | |
141 CHECK(WIFEXITED(status)); | |
142 CHECK_EQ(kNormalExitCode, WEXITSTATUS(status)); | |
143 } | |
144 | |
145 SANDBOX_TEST(ForkInNewPidNamespace, ExitWithSignal) { | |
146 if (!Credentials::CanCreateProcessInNewUserNS()) { | |
147 return; | |
148 } | |
149 | |
150 CHECK(sandbox::Credentials::MoveToNewUserNS()); | |
151 const pid_t pid = NamespaceSandbox::ForkInNewPidNamespace(true); | |
jln (very slow on Chromium)
2015/03/25 23:47:50
/* drop_capabilities_in_child */
rickyz (no longer on Chrome)
2015/03/26 00:09:37
Done.
| |
152 CHECK_GE(pid, 0); | |
153 | |
154 if (pid == 0) { | |
155 CHECK_EQ(1, getpid()); | |
156 CHECK(!Credentials::HasAnyCapability()); | |
157 NamespaceSandbox::InstallTerminationSignalHandler( | |
158 SIGTERM, kSignalTerminationExitCode); | |
159 while (true) { | |
160 raise(SIGTERM); | |
161 } | |
162 } | |
163 | |
164 int status; | |
165 PCHECK(waitpid(pid, &status, 0) == pid); | |
166 CHECK(WIFEXITED(status)); | |
167 CHECK_EQ(kSignalTerminationExitCode, WEXITSTATUS(status)); | |
168 } | |
169 | |
121 } // namespace | 170 } // namespace |
122 | 171 |
123 } // namespace sandbox | 172 } // namespace sandbox |
OLD | NEW |