Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(487)

Side by Side Diff: sandbox/linux/services/namespace_sandbox_unittest.cc

Issue 881733002: Add namespace sandbox class. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Nested namespace sandboxes aren't supported. Created 5 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
(Empty)
1 // Copyright 2015 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "sandbox/linux/services/namespace_sandbox.h"
6
7 #include <sys/types.h>
8 #include <sys/wait.h>
9 #include <unistd.h>
10
11 #include <string>
12
13 #include "base/command_line.h"
14 #include "base/files/file_enumerator.h"
15 #include "base/files/file_path.h"
16 #include "base/logging.h"
17 #include "base/memory/scoped_ptr.h"
18 #include "base/process/launch.h"
19 #include "base/process/process.h"
20 #include "base/test/multiprocess_test.h"
21 #include "sandbox/linux/services/credentials.h"
22 #include "sandbox/linux/services/namespace_utils.h"
23 #include "sandbox/linux/tests/unit_tests.h"
24 #include "testing/gtest/include/gtest/gtest.h"
25 #include "testing/multiprocess_func_list.h"
26
27 namespace sandbox {
28
29 namespace {
30
31 bool RootDirectoryIsEmpty() {
32 base::FilePath root("/");
33 int file_type =
34 base::FileEnumerator::DIRECTORIES | base::FileEnumerator::FILES;
35 base::FileEnumerator enumerator_before(root, false, file_type);
36 return enumerator_before.Next().empty();
37 }
38
39 class NamespaceSandboxTest : public base::MultiProcessTest {
40 public:
41 void TestProc(const std::string& procname) {
42 if (!Credentials::CanCreateProcessInNewUserNS()) {
43 return;
44 }
45
46 NamespaceSandbox namespace_sandbox;
47 namespace_sandbox.AddFdMapping(STDOUT_FILENO, STDOUT_FILENO);
48 namespace_sandbox.AddFdMapping(STDERR_FILENO, STDERR_FILENO);
49 base::Process process = namespace_sandbox.Launch(MakeCmdLine(procname));
50 ASSERT_TRUE(process.IsValid());
51
52 const int kDummyExitCode = 42;
53 int exit_code = kDummyExitCode;
54 EXPECT_TRUE(process.WaitForExit(&exit_code));
55 EXPECT_EQ(0, exit_code);
56 }
57 };
58
59 MULTIPROCESS_TEST_MAIN(SimpleChildProcess) {
60 scoped_ptr<base::Environment> env(base::Environment::Create());
61 bool in_user_ns = NamespaceSandbox::InNewUserNamespace();
62 bool in_pid_ns = NamespaceSandbox::InNewPidNamespace();
63 bool in_net_ns = NamespaceSandbox::InNewNetNamespace();
64 CHECK(in_user_ns);
65 CHECK_EQ(in_pid_ns,
66 NamespaceUtils::KernelSupportsUnprivilegedNamespace(CLONE_NEWPID));
67 CHECK_EQ(in_net_ns,
68 NamespaceUtils::KernelSupportsUnprivilegedNamespace(CLONE_NEWNET));
69 if (in_pid_ns) {
70 CHECK_EQ(1, getpid());
71 }
72 return 0;
73 }
74
75 TEST_F(NamespaceSandboxTest, BasicUsage) {
76 TestProc("SimpleChildProcess");
77 }
78
79 MULTIPROCESS_TEST_MAIN(ChrootMe) {
80 CHECK(!RootDirectoryIsEmpty());
81 CHECK(sandbox::Credentials::MoveToNewUserNS());
82 CHECK(sandbox::Credentials::DropFileSystemAccess());
83 CHECK(RootDirectoryIsEmpty());
84 return 0;
85 }
86
87 TEST_F(NamespaceSandboxTest, ChrootAndDropCapabilities) {
88 TestProc("ChrootMe");
89 }
90
91 } // namespace
92
93 } // namespace sandbox
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698