Index: sandbox/linux/services/namespace_sandbox_unittest.cc |
diff --git a/sandbox/linux/services/namespace_sandbox_unittest.cc b/sandbox/linux/services/namespace_sandbox_unittest.cc |
index 8bb0bff83b7027d86d8b8e08ae82e0ea7ddd8c5a..4c6ea5b6e3d47c12d04ea8ce3e72ac8a1f4b4bb3 100644 |
--- a/sandbox/linux/services/namespace_sandbox_unittest.cc |
+++ b/sandbox/linux/services/namespace_sandbox_unittest.cc |
@@ -4,6 +4,7 @@ |
#include "sandbox/linux/services/namespace_sandbox.h" |
+#include <signal.h> |
#include <sys/types.h> |
#include <sys/wait.h> |
#include <unistd.h> |
@@ -118,6 +119,101 @@ TEST_F(NamespaceSandboxTest, NestedNamespaceSandbox) { |
TestProc("NestedNamespaceSandbox"); |
} |
+const int kNormalExitCode = 0; |
+const int kSignalTerminationExitCode = 255; |
+ |
+// Ensure that CHECK(false) is distinguishable from _exit(kNormalExitCode). |
+// Allowing noise since CHECK(false) will write a stack trace to stderr. |
+SANDBOX_TEST_ALLOW_NOISE(ForkInNewPidNamespace, CheckDoesNotReturnZero) { |
+ if (!Credentials::CanCreateProcessInNewUserNS()) { |
jln (very slow on Chromium)
2015/03/26 22:01:34
I don't think you need any of this here.
Also can
rickyz (no longer on Chrome)
2015/03/27 21:08:03
I kept the user namespace stuff in order to test t
|
+ return; |
+ } |
+ |
+ CHECK(sandbox::Credentials::MoveToNewUserNS()); |
+ const pid_t pid = NamespaceSandbox::ForkInNewPidNamespace( |
+ /*drop_capabilities_in_child=*/true); |
+ CHECK_GE(pid, 0); |
+ |
+ if (pid == 0) { |
+ CHECK(false); |
+ _exit(kNormalExitCode); |
+ } |
+ |
+ int status; |
+ PCHECK(waitpid(pid, &status, 0) == pid); |
+ if (WIFEXITED(status)) { |
+ CHECK_NE(kNormalExitCode, WEXITSTATUS(status)); |
+ } |
+} |
+ |
+SANDBOX_TEST(ForkInNewPidNamespace, BasicUsage) { |
+ if (!Credentials::CanCreateProcessInNewUserNS()) { |
+ return; |
+ } |
+ |
+ CHECK(sandbox::Credentials::MoveToNewUserNS()); |
+ const pid_t pid = NamespaceSandbox::ForkInNewPidNamespace( |
+ /*drop_capabilities_in_child=*/true); |
+ CHECK_GE(pid, 0); |
+ |
+ if (pid == 0) { |
+ CHECK_EQ(1, getpid()); |
+ CHECK(!Credentials::HasAnyCapability()); |
+ _exit(kNormalExitCode); |
+ } |
+ |
+ int status; |
+ PCHECK(waitpid(pid, &status, 0) == pid); |
+ CHECK(WIFEXITED(status)); |
+ CHECK_EQ(kNormalExitCode, WEXITSTATUS(status)); |
+} |
+ |
+SANDBOX_TEST(ForkInNewPidNamespace, ExitWithSignal) { |
+ if (!Credentials::CanCreateProcessInNewUserNS()) { |
+ return; |
+ } |
+ |
+ CHECK(sandbox::Credentials::MoveToNewUserNS()); |
+ const pid_t pid = NamespaceSandbox::ForkInNewPidNamespace( |
+ /*drop_capabilities_in_child=*/true); |
+ CHECK_GE(pid, 0); |
+ |
+ if (pid == 0) { |
+ CHECK_EQ(1, getpid()); |
+ CHECK(!Credentials::HasAnyCapability()); |
+ CHECK(NamespaceSandbox::InstallTerminationSignalHandler( |
+ SIGTERM, kSignalTerminationExitCode, false)); |
+ while (true) { |
+ raise(SIGTERM); |
+ } |
+ } |
+ |
+ int status; |
+ PCHECK(waitpid(pid, &status, 0) == pid); |
+ CHECK(WIFEXITED(status)); |
+ CHECK_EQ(kSignalTerminationExitCode, WEXITSTATUS(status)); |
+} |
+ |
+volatile sig_atomic_t signal_handler_called; |
+void ExitSuccessfully(int sig) { |
+ signal_handler_called = 1; |
+} |
+ |
+SANDBOX_TEST(InstallTerminationSignalHandler, DoesNotOverrideExistingHandlers) { |
+ struct sigaction action; |
jln (very slow on Chromium)
2015/03/26 22:01:34
struct sigaction action = {};
rickyz (no longer on Chrome)
2015/03/27 21:08:03
Done.
|
+ memset(&action, 0, sizeof(action)); |
+ action.sa_handler = &ExitSuccessfully; |
+ PCHECK(sigaction(SIGUSR1, &action, nullptr) == 0); |
+ |
+ NamespaceSandbox::InstallDefaultTerminationSignalHandlers(); |
+ CHECK(!NamespaceSandbox::InstallTerminationSignalHandler( |
+ SIGUSR1, kSignalTerminationExitCode, |
+ /*override_existing_handler=*/false)); |
+ |
+ raise(SIGUSR1); |
+ CHECK_EQ(1, signal_handler_called); |
+} |
+ |
} // namespace |
} // namespace sandbox |