OLD | NEW |
---|---|
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/services/namespace_sandbox.h" | 5 #include "sandbox/linux/services/namespace_sandbox.h" |
6 | 6 |
7 #include <signal.h> | |
7 #include <sys/types.h> | 8 #include <sys/types.h> |
8 #include <sys/wait.h> | 9 #include <sys/wait.h> |
9 #include <unistd.h> | 10 #include <unistd.h> |
10 | 11 |
11 #include <string> | 12 #include <string> |
12 #include <utility> | 13 #include <utility> |
13 | 14 |
14 #include "base/command_line.h" | 15 #include "base/command_line.h" |
15 #include "base/files/file_enumerator.h" | 16 #include "base/files/file_enumerator.h" |
16 #include "base/files/file_path.h" | 17 #include "base/files/file_path.h" |
(...skipping 94 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
111 int exit_code = kDummyExitCode; | 112 int exit_code = kDummyExitCode; |
112 CHECK(process.WaitForExit(&exit_code)); | 113 CHECK(process.WaitForExit(&exit_code)); |
113 CHECK_EQ(0, exit_code); | 114 CHECK_EQ(0, exit_code); |
114 return 0; | 115 return 0; |
115 } | 116 } |
116 | 117 |
117 TEST_F(NamespaceSandboxTest, NestedNamespaceSandbox) { | 118 TEST_F(NamespaceSandboxTest, NestedNamespaceSandbox) { |
118 TestProc("NestedNamespaceSandbox"); | 119 TestProc("NestedNamespaceSandbox"); |
119 } | 120 } |
120 | 121 |
122 const int kNormalExitCode = 0; | |
123 const int kSignalTerminationExitCode = 255; | |
124 | |
125 // Ensure that CHECK(false) is distinguishable from _exit(kNormalExitCode). | |
126 // Allowing noise since CHECK(false) will write a stack trace to stderr. | |
127 SANDBOX_TEST_ALLOW_NOISE(ForkInNewPidNamespace, CheckDoesNotReturnZero) { | |
128 if (!Credentials::CanCreateProcessInNewUserNS()) { | |
jln (very slow on Chromium)
2015/03/26 22:01:34
I don't think you need any of this here.
Also can
rickyz (no longer on Chrome)
2015/03/27 21:08:03
I kept the user namespace stuff in order to test t
| |
129 return; | |
130 } | |
131 | |
132 CHECK(sandbox::Credentials::MoveToNewUserNS()); | |
133 const pid_t pid = NamespaceSandbox::ForkInNewPidNamespace( | |
134 /*drop_capabilities_in_child=*/true); | |
135 CHECK_GE(pid, 0); | |
136 | |
137 if (pid == 0) { | |
138 CHECK(false); | |
139 _exit(kNormalExitCode); | |
140 } | |
141 | |
142 int status; | |
143 PCHECK(waitpid(pid, &status, 0) == pid); | |
144 if (WIFEXITED(status)) { | |
145 CHECK_NE(kNormalExitCode, WEXITSTATUS(status)); | |
146 } | |
147 } | |
148 | |
149 SANDBOX_TEST(ForkInNewPidNamespace, BasicUsage) { | |
150 if (!Credentials::CanCreateProcessInNewUserNS()) { | |
151 return; | |
152 } | |
153 | |
154 CHECK(sandbox::Credentials::MoveToNewUserNS()); | |
155 const pid_t pid = NamespaceSandbox::ForkInNewPidNamespace( | |
156 /*drop_capabilities_in_child=*/true); | |
157 CHECK_GE(pid, 0); | |
158 | |
159 if (pid == 0) { | |
160 CHECK_EQ(1, getpid()); | |
161 CHECK(!Credentials::HasAnyCapability()); | |
162 _exit(kNormalExitCode); | |
163 } | |
164 | |
165 int status; | |
166 PCHECK(waitpid(pid, &status, 0) == pid); | |
167 CHECK(WIFEXITED(status)); | |
168 CHECK_EQ(kNormalExitCode, WEXITSTATUS(status)); | |
169 } | |
170 | |
171 SANDBOX_TEST(ForkInNewPidNamespace, ExitWithSignal) { | |
172 if (!Credentials::CanCreateProcessInNewUserNS()) { | |
173 return; | |
174 } | |
175 | |
176 CHECK(sandbox::Credentials::MoveToNewUserNS()); | |
177 const pid_t pid = NamespaceSandbox::ForkInNewPidNamespace( | |
178 /*drop_capabilities_in_child=*/true); | |
179 CHECK_GE(pid, 0); | |
180 | |
181 if (pid == 0) { | |
182 CHECK_EQ(1, getpid()); | |
183 CHECK(!Credentials::HasAnyCapability()); | |
184 CHECK(NamespaceSandbox::InstallTerminationSignalHandler( | |
185 SIGTERM, kSignalTerminationExitCode, false)); | |
186 while (true) { | |
187 raise(SIGTERM); | |
188 } | |
189 } | |
190 | |
191 int status; | |
192 PCHECK(waitpid(pid, &status, 0) == pid); | |
193 CHECK(WIFEXITED(status)); | |
194 CHECK_EQ(kSignalTerminationExitCode, WEXITSTATUS(status)); | |
195 } | |
196 | |
197 volatile sig_atomic_t signal_handler_called; | |
198 void ExitSuccessfully(int sig) { | |
199 signal_handler_called = 1; | |
200 } | |
201 | |
202 SANDBOX_TEST(InstallTerminationSignalHandler, DoesNotOverrideExistingHandlers) { | |
203 struct sigaction action; | |
jln (very slow on Chromium)
2015/03/26 22:01:34
struct sigaction action = {};
rickyz (no longer on Chrome)
2015/03/27 21:08:03
Done.
| |
204 memset(&action, 0, sizeof(action)); | |
205 action.sa_handler = &ExitSuccessfully; | |
206 PCHECK(sigaction(SIGUSR1, &action, nullptr) == 0); | |
207 | |
208 NamespaceSandbox::InstallDefaultTerminationSignalHandlers(); | |
209 CHECK(!NamespaceSandbox::InstallTerminationSignalHandler( | |
210 SIGUSR1, kSignalTerminationExitCode, | |
211 /*override_existing_handler=*/false)); | |
212 | |
213 raise(SIGUSR1); | |
214 CHECK_EQ(1, signal_handler_called); | |
215 } | |
216 | |
121 } // namespace | 217 } // namespace |
122 | 218 |
123 } // namespace sandbox | 219 } // namespace sandbox |
OLD | NEW |