Use multiline attribute to check for IA2_STATE_MULTILINE.
[chromium-blink-merge.git] / sandbox / linux / seccomp-bpf-helpers / syscall_parameters_restrictions_unittests.cc
blobe653b8a0c6d373cf722696725072dd44c70dadda
1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
7 #include <errno.h>
8 #include <sched.h>
9 #include <sys/resource.h>
10 #include <sys/syscall.h>
11 #include <sys/types.h>
12 #include <time.h>
13 #include <unistd.h>
15 #include "base/bind.h"
16 #include "base/synchronization/waitable_event.h"
17 #include "base/sys_info.h"
18 #include "base/threading/thread.h"
19 #include "base/time/time.h"
20 #include "build/build_config.h"
21 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
22 #include "sandbox/linux/bpf_dsl/policy.h"
23 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
24 #include "sandbox/linux/seccomp-bpf/bpf_tests.h"
25 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
26 #include "sandbox/linux/seccomp-bpf/syscall.h"
27 #include "sandbox/linux/services/syscall_wrappers.h"
28 #include "sandbox/linux/system_headers/linux_syscalls.h"
29 #include "sandbox/linux/tests/unit_tests.h"
31 #if !defined(OS_ANDROID)
32 #include "third_party/lss/linux_syscall_support.h" // for MAKE_PROCESS_CPUCLOCK
33 #endif
35 namespace sandbox {
37 namespace {
39 // NOTE: most of the parameter restrictions are tested in
40 // baseline_policy_unittest.cc as a more end-to-end test.
42 using sandbox::bpf_dsl::Allow;
43 using sandbox::bpf_dsl::ResultExpr;
45 class RestrictClockIdPolicy : public bpf_dsl::Policy {
46 public:
47 RestrictClockIdPolicy() {}
48 ~RestrictClockIdPolicy() override {}
50 ResultExpr EvaluateSyscall(int sysno) const override {
51 switch (sysno) {
52 case __NR_clock_gettime:
53 case __NR_clock_getres:
54 return RestrictClockID();
55 default:
56 return Allow();
61 void CheckClock(clockid_t clockid) {
62 struct timespec ts;
63 ts.tv_sec = ts.tv_nsec = -1;
64 BPF_ASSERT_EQ(0, clock_gettime(clockid, &ts));
65 BPF_ASSERT_LE(0, ts.tv_sec);
66 BPF_ASSERT_LE(0, ts.tv_nsec);
69 BPF_TEST_C(ParameterRestrictions,
70 clock_gettime_allowed,
71 RestrictClockIdPolicy) {
72 CheckClock(CLOCK_MONOTONIC);
73 CheckClock(CLOCK_PROCESS_CPUTIME_ID);
74 CheckClock(CLOCK_REALTIME);
75 CheckClock(CLOCK_THREAD_CPUTIME_ID);
78 BPF_DEATH_TEST_C(ParameterRestrictions,
79 clock_gettime_crash_monotonic_raw,
80 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
81 RestrictClockIdPolicy) {
82 struct timespec ts;
83 clock_gettime(CLOCK_MONOTONIC_RAW, &ts);
86 #if defined(OS_CHROMEOS)
88 // A custom BPF tester delegate to run IsRunningOnChromeOS() before
89 // the sandbox is enabled because we cannot run it with non-SFI BPF
90 // sandbox enabled.
91 class ClockSystemTesterDelegate : public sandbox::BPFTesterDelegate {
92 public:
93 ClockSystemTesterDelegate()
94 : is_running_on_chromeos_(base::SysInfo::IsRunningOnChromeOS()) {}
95 ~ClockSystemTesterDelegate() override {}
97 scoped_ptr<sandbox::bpf_dsl::Policy> GetSandboxBPFPolicy() override {
98 return scoped_ptr<sandbox::bpf_dsl::Policy>(new RestrictClockIdPolicy());
100 void RunTestFunction() override {
101 if (is_running_on_chromeos_) {
102 CheckClock(base::TimeTicks::kClockSystemTrace);
103 } else {
104 struct timespec ts;
105 // kClockSystemTrace is 11, which is CLOCK_THREAD_CPUTIME_ID of
106 // the init process (pid=1). If kernel supports this feature,
107 // this may succeed even if this is not running on Chrome OS. We
108 // just check this clock_gettime call does not crash.
109 clock_gettime(base::TimeTicks::kClockSystemTrace, &ts);
113 private:
114 const bool is_running_on_chromeos_;
115 DISALLOW_COPY_AND_ASSIGN(ClockSystemTesterDelegate);
118 BPF_TEST_D(BPFTest, BPFTestWithDelegateClass, ClockSystemTesterDelegate);
120 #elif defined(OS_LINUX)
122 BPF_DEATH_TEST_C(ParameterRestrictions,
123 clock_gettime_crash_system_trace,
124 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
125 RestrictClockIdPolicy) {
126 struct timespec ts;
127 clock_gettime(base::TimeTicks::kClockSystemTrace, &ts);
130 #endif // defined(OS_CHROMEOS)
132 #if !defined(OS_ANDROID)
133 BPF_DEATH_TEST_C(ParameterRestrictions,
134 clock_gettime_crash_cpu_clock,
135 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
136 RestrictClockIdPolicy) {
137 // We can't use clock_getcpuclockid() because it's not implemented in newlib,
138 // and it might not work inside the sandbox anyway.
139 const pid_t kInitPID = 1;
140 const clockid_t kInitCPUClockID =
141 MAKE_PROCESS_CPUCLOCK(kInitPID, CPUCLOCK_SCHED);
143 struct timespec ts;
144 clock_gettime(kInitCPUClockID, &ts);
146 #endif // !defined(OS_ANDROID)
148 class RestrictSchedPolicy : public bpf_dsl::Policy {
149 public:
150 RestrictSchedPolicy() {}
151 ~RestrictSchedPolicy() override {}
153 ResultExpr EvaluateSyscall(int sysno) const override {
154 switch (sysno) {
155 case __NR_sched_getparam:
156 return RestrictSchedTarget(getpid(), sysno);
157 default:
158 return Allow();
163 void CheckSchedGetParam(pid_t pid, struct sched_param* param) {
164 BPF_ASSERT_EQ(0, sched_getparam(pid, param));
167 void SchedGetParamThread(base::WaitableEvent* thread_run) {
168 const pid_t pid = getpid();
169 const pid_t tid = sys_gettid();
170 BPF_ASSERT_NE(pid, tid);
172 struct sched_param current_pid_param;
173 CheckSchedGetParam(pid, &current_pid_param);
175 struct sched_param zero_param;
176 CheckSchedGetParam(0, &zero_param);
178 struct sched_param tid_param;
179 CheckSchedGetParam(tid, &tid_param);
181 BPF_ASSERT_EQ(zero_param.sched_priority, tid_param.sched_priority);
183 // Verify that the SIGSYS handler sets errno properly.
184 errno = 0;
185 BPF_ASSERT_EQ(-1, sched_getparam(tid, NULL));
186 BPF_ASSERT_EQ(EINVAL, errno);
188 thread_run->Signal();
191 BPF_TEST_C(ParameterRestrictions,
192 sched_getparam_allowed,
193 RestrictSchedPolicy) {
194 base::WaitableEvent thread_run(true, false);
195 // Run the actual test in a new thread so that the current pid and tid are
196 // different.
197 base::Thread getparam_thread("sched_getparam_thread");
198 BPF_ASSERT(getparam_thread.Start());
199 getparam_thread.message_loop()->PostTask(
200 FROM_HERE, base::Bind(&SchedGetParamThread, &thread_run));
201 BPF_ASSERT(thread_run.TimedWait(base::TimeDelta::FromMilliseconds(5000)));
202 getparam_thread.Stop();
205 BPF_DEATH_TEST_C(ParameterRestrictions,
206 sched_getparam_crash_non_zero,
207 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
208 RestrictSchedPolicy) {
209 const pid_t kInitPID = 1;
210 struct sched_param param;
211 sched_getparam(kInitPID, &param);
214 class RestrictPrlimit64Policy : public bpf_dsl::Policy {
215 public:
216 RestrictPrlimit64Policy() {}
217 ~RestrictPrlimit64Policy() override {}
219 ResultExpr EvaluateSyscall(int sysno) const override {
220 switch (sysno) {
221 case __NR_prlimit64:
222 return RestrictPrlimit64(getpid());
223 default:
224 return Allow();
229 BPF_TEST_C(ParameterRestrictions, prlimit64_allowed, RestrictPrlimit64Policy) {
230 BPF_ASSERT_EQ(0, sys_prlimit64(0, RLIMIT_AS, NULL, NULL));
231 BPF_ASSERT_EQ(0, sys_prlimit64(getpid(), RLIMIT_AS, NULL, NULL));
234 BPF_DEATH_TEST_C(ParameterRestrictions,
235 prlimit64_crash_not_self,
236 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
237 RestrictPrlimit64Policy) {
238 const pid_t kInitPID = 1;
239 BPF_ASSERT_NE(kInitPID, getpid());
240 sys_prlimit64(kInitPID, RLIMIT_AS, NULL, NULL);
243 class RestrictGetrusagePolicy : public bpf_dsl::Policy {
244 public:
245 RestrictGetrusagePolicy() {}
246 ~RestrictGetrusagePolicy() override {}
248 ResultExpr EvaluateSyscall(int sysno) const override {
249 switch (sysno) {
250 case __NR_getrusage:
251 return RestrictGetrusage();
252 default:
253 return Allow();
258 BPF_TEST_C(ParameterRestrictions, getrusage_allowed, RestrictGetrusagePolicy) {
259 struct rusage usage;
260 BPF_ASSERT_EQ(0, getrusage(RUSAGE_SELF, &usage));
263 BPF_DEATH_TEST_C(ParameterRestrictions,
264 getrusage_crash_not_self,
265 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
266 RestrictGetrusagePolicy) {
267 struct rusage usage;
268 getrusage(RUSAGE_CHILDREN, &usage);
271 } // namespace
273 } // namespace sandbox