sandbox/linux/seccomp-bpf/sandbox_bpf_test_runner.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_test_runner.h"
   6
   7 #include <fcntl.h>
   8
   9 #include "base/logging.h"
  10 #include "base/memory/scoped_ptr.h"
  11 #include "sandbox/linux/bpf_dsl/policy.h"
  12 #include "sandbox/linux/seccomp-bpf/die.h"
  13 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
  14 #include "sandbox/linux/system_headers/linux_filter.h"
  15 #include "sandbox/linux/tests/unit_tests.h"
  16
  17 namespace sandbox {
  18
  19 SandboxBPFTestRunner::SandboxBPFTestRunner(
  20     BPFTesterDelegate* bpf_tester_delegate)
  21     : bpf_tester_delegate_(bpf_tester_delegate) {
  22 }
  23
  24 SandboxBPFTestRunner::~SandboxBPFTestRunner() {
  25 }
  26
  27 void SandboxBPFTestRunner::Run() {
  28   DCHECK(bpf_tester_delegate_);
  29   sandbox::Die::EnableSimpleExit();
  30
  31   scoped_ptr<bpf_dsl::Policy> policy =
  32       bpf_tester_delegate_->GetSandboxBPFPolicy();
  33
  34   if (sandbox::SandboxBPF::SupportsSeccompSandbox(
  35           SandboxBPF::SeccompLevel::SINGLE_THREADED)) {
  36     // Initialize and then start the sandbox with our custom policy
  37     sandbox::SandboxBPF sandbox(policy.release());
  38     SANDBOX_ASSERT(sandbox.StartSandbox(
  39         sandbox::SandboxBPF::SeccompLevel::SINGLE_THREADED));
  40
  41     // Run the actual test.
  42     bpf_tester_delegate_->RunTestFunction();
  43   } else {
  44     printf("This BPF test is not fully running in this configuration!\n");
  45     // Android and Valgrind are the only configurations where we accept not
  46     // having kernel BPF support.
  47     if (!IsAndroid() && !IsRunningOnValgrind()) {
  48       const bool seccomp_bpf_is_supported = false;
  49       SANDBOX_ASSERT(seccomp_bpf_is_supported);
  50     }
  51     // Call the compiler and verify the policy. That's the least we can do,
  52     // if we don't have kernel support.
  53     sandbox::SandboxBPF sandbox(policy.release());
  54     sandbox.AssembleFilter(true /* force_verification */);
  55     sandbox::UnitTests::IgnoreThisTest();
  56   }
  57 }
  58
  59 bool SandboxBPFTestRunner::ShouldCheckForLeaks() const {
  60   // LSAN requires being able to use ptrace() and other system calls that could
  61   // be denied.
  62   return false;
  63 }
  64
  65 }  // namespace sandbox