1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_test_runner.h"
9 #include "base/logging.h"
10 #include "base/memory/scoped_ptr.h"
11 #include "sandbox/linux/bpf_dsl/policy.h"
12 #include "sandbox/linux/seccomp-bpf/die.h"
13 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
14 #include "sandbox/linux/system_headers/linux_filter.h"
15 #include "sandbox/linux/tests/unit_tests.h"
19 SandboxBPFTestRunner::SandboxBPFTestRunner(
20 BPFTesterDelegate
* bpf_tester_delegate
)
21 : bpf_tester_delegate_(bpf_tester_delegate
) {
24 SandboxBPFTestRunner::~SandboxBPFTestRunner() {
27 void SandboxBPFTestRunner::Run() {
28 DCHECK(bpf_tester_delegate_
);
29 sandbox::Die::EnableSimpleExit();
31 scoped_ptr
<bpf_dsl::Policy
> policy
=
32 bpf_tester_delegate_
->GetSandboxBPFPolicy();
34 if (sandbox::SandboxBPF::SupportsSeccompSandbox(
35 SandboxBPF::SeccompLevel::SINGLE_THREADED
)) {
36 // Initialize and then start the sandbox with our custom policy
37 sandbox::SandboxBPF
sandbox(policy
.release());
38 SANDBOX_ASSERT(sandbox
.StartSandbox(
39 sandbox::SandboxBPF::SeccompLevel::SINGLE_THREADED
));
41 // Run the actual test.
42 bpf_tester_delegate_
->RunTestFunction();
44 printf("This BPF test is not fully running in this configuration!\n");
45 // Android and Valgrind are the only configurations where we accept not
46 // having kernel BPF support.
47 if (!IsAndroid() && !IsRunningOnValgrind()) {
48 const bool seccomp_bpf_is_supported
= false;
49 SANDBOX_ASSERT(seccomp_bpf_is_supported
);
51 // Call the compiler and verify the policy. That's the least we can do,
52 // if we don't have kernel support.
53 sandbox::SandboxBPF
sandbox(policy
.release());
54 sandbox
.AssembleFilter(true /* force_verification */);
55 sandbox::UnitTests::IgnoreThisTest();
59 bool SandboxBPFTestRunner::ShouldCheckForLeaks() const {
60 // LSAN requires being able to use ptrace() and other system calls that could
65 } // namespace sandbox