sandbox/linux/services/namespace_sandbox_unittest.cc

   1 // Copyright 2015 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/linux/services/namespace_sandbox.h"
   6
   7 #include <signal.h>
   8 #include <sys/types.h>
   9 #include <sys/wait.h>
  10 #include <unistd.h>
  11
  12 #include <string>
  13 #include <utility>
  14
  15 #include "base/command_line.h"
  16 #include "base/files/file_enumerator.h"
  17 #include "base/files/file_path.h"
  18 #include "base/logging.h"
  19 #include "base/memory/scoped_ptr.h"
  20 #include "base/process/launch.h"
  21 #include "base/process/process.h"
  22 #include "base/test/multiprocess_test.h"
  23 #include "sandbox/linux/services/credentials.h"
  24 #include "sandbox/linux/services/namespace_utils.h"
  25 #include "sandbox/linux/services/proc_util.h"
  26 #include "sandbox/linux/tests/unit_tests.h"
  27 #include "testing/gtest/include/gtest/gtest.h"
  28 #include "testing/multiprocess_func_list.h"
  29
  30 namespace sandbox {
  31
  32 namespace {
  33
  34 bool RootDirectoryIsEmpty() {
  35   base::FilePath root("/");
  36   int file_type =
  37       base::FileEnumerator::DIRECTORIES | base::FileEnumerator::FILES;
  38   base::FileEnumerator enumerator_before(root, false, file_type);
  39   return enumerator_before.Next().empty();
  40 }
  41
  42 class NamespaceSandboxTest : public base::MultiProcessTest {
  43  public:
  44   void TestProc(const std::string& procname) {
  45     if (!Credentials::CanCreateProcessInNewUserNS()) {
  46       return;
  47     }
  48
  49     base::FileHandleMappingVector fds_to_remap = {
  50         std::make_pair(STDOUT_FILENO, STDOUT_FILENO),
  51         std::make_pair(STDERR_FILENO, STDERR_FILENO),
  52     };
  53     base::LaunchOptions launch_options;
  54     launch_options.fds_to_remap = &fds_to_remap;
  55
  56     base::Process process =
  57         NamespaceSandbox::LaunchProcess(MakeCmdLine(procname), launch_options);
  58     ASSERT_TRUE(process.IsValid());
  59
  60     const int kDummyExitCode = 42;
  61     int exit_code = kDummyExitCode;
  62     EXPECT_TRUE(process.WaitForExit(&exit_code));
  63     EXPECT_EQ(0, exit_code);
  64   }
  65 };
  66
  67 MULTIPROCESS_TEST_MAIN(SimpleChildProcess) {
  68   scoped_ptr<base::Environment> env(base::Environment::Create());
  69   bool in_user_ns = NamespaceSandbox::InNewUserNamespace();
  70   bool in_pid_ns = NamespaceSandbox::InNewPidNamespace();
  71   bool in_net_ns = NamespaceSandbox::InNewNetNamespace();
  72   CHECK(in_user_ns);
  73   CHECK_EQ(in_pid_ns,
  74            NamespaceUtils::KernelSupportsUnprivilegedNamespace(CLONE_NEWPID));
  75   CHECK_EQ(in_net_ns,
  76            NamespaceUtils::KernelSupportsUnprivilegedNamespace(CLONE_NEWNET));
  77   if (in_pid_ns) {
  78     CHECK_EQ(1, getpid());
  79   }
  80   return 0;
  81 }
  82
  83 TEST_F(NamespaceSandboxTest, BasicUsage) {
  84   TestProc("SimpleChildProcess");
  85 }
  86
  87 MULTIPROCESS_TEST_MAIN(ChrootMe) {
  88   CHECK(!RootDirectoryIsEmpty());
  89   CHECK(sandbox::Credentials::MoveToNewUserNS());
  90   CHECK(sandbox::Credentials::DropFileSystemAccess(ProcUtil::OpenProc().get()));
  91   CHECK(RootDirectoryIsEmpty());
  92   return 0;
  93 }
  94
  95 // Temporarily disabled on ASAN due to crbug.com/451603.
  96 TEST_F(NamespaceSandboxTest, DISABLE_ON_ASAN(ChrootAndDropCapabilities)) {
  97   TestProc("ChrootMe");
  98 }
  99
 100 MULTIPROCESS_TEST_MAIN(NestedNamespaceSandbox) {
 101   base::FileHandleMappingVector fds_to_remap = {
 102       std::make_pair(STDOUT_FILENO, STDOUT_FILENO),
 103       std::make_pair(STDERR_FILENO, STDERR_FILENO),
 104   };
 105   base::LaunchOptions launch_options;
 106   launch_options.fds_to_remap = &fds_to_remap;
 107   base::Process process = NamespaceSandbox::LaunchProcess(
 108       base::CommandLine(base::FilePath("/bin/true")), launch_options);
 109   CHECK(process.IsValid());
 110
 111   const int kDummyExitCode = 42;
 112   int exit_code = kDummyExitCode;
 113   CHECK(process.WaitForExit(&exit_code));
 114   CHECK_EQ(0, exit_code);
 115   return 0;
 116 }
 117
 118 TEST_F(NamespaceSandboxTest, NestedNamespaceSandbox) {
 119   TestProc("NestedNamespaceSandbox");
 120 }
 121
 122 const int kNormalExitCode = 0;
 123 const int kSignalTerminationExitCode = 255;
 124
 125 // Ensure that CHECK(false) is distinguishable from _exit(kNormalExitCode).
 126 // Allowing noise since CHECK(false) will write a stack trace to stderr.
 127 SANDBOX_TEST_ALLOW_NOISE(ForkInNewPidNamespace, CheckDoesNotReturnZero) {
 128   if (!Credentials::CanCreateProcessInNewUserNS()) {
 129     return;
 130   }
 131
 132   CHECK(sandbox::Credentials::MoveToNewUserNS());
 133   const pid_t pid = NamespaceSandbox::ForkInNewPidNamespace(
 134       /*drop_capabilities_in_child=*/true);
 135   CHECK_GE(pid, 0);
 136
 137   if (pid == 0) {
 138     CHECK(false);
 139     _exit(kNormalExitCode);
 140   }
 141
 142   int status;
 143   PCHECK(waitpid(pid, &status, 0) == pid);
 144   if (WIFEXITED(status)) {
 145     CHECK_NE(kNormalExitCode, WEXITSTATUS(status));
 146   }
 147 }
 148
 149 SANDBOX_TEST(ForkInNewPidNamespace, BasicUsage) {
 150   if (!Credentials::CanCreateProcessInNewUserNS()) {
 151     return;
 152   }
 153
 154   CHECK(sandbox::Credentials::MoveToNewUserNS());
 155   const pid_t pid = NamespaceSandbox::ForkInNewPidNamespace(
 156       /*drop_capabilities_in_child=*/true);
 157   CHECK_GE(pid, 0);
 158
 159   if (pid == 0) {
 160     CHECK_EQ(1, getpid());
 161     CHECK(!Credentials::HasAnyCapability());
 162     _exit(kNormalExitCode);
 163   }
 164
 165   int status;
 166   PCHECK(waitpid(pid, &status, 0) == pid);
 167   CHECK(WIFEXITED(status));
 168   CHECK_EQ(kNormalExitCode, WEXITSTATUS(status));
 169 }
 170
 171 SANDBOX_TEST(ForkInNewPidNamespace, ExitWithSignal) {
 172   if (!Credentials::CanCreateProcessInNewUserNS()) {
 173     return;
 174   }
 175
 176   CHECK(sandbox::Credentials::MoveToNewUserNS());
 177   const pid_t pid = NamespaceSandbox::ForkInNewPidNamespace(
 178       /*drop_capabilities_in_child=*/true);
 179   CHECK_GE(pid, 0);
 180
 181   if (pid == 0) {
 182     CHECK_EQ(1, getpid());
 183     CHECK(!Credentials::HasAnyCapability());
 184     CHECK(NamespaceSandbox::InstallTerminationSignalHandler(
 185         SIGTERM, kSignalTerminationExitCode));
 186     while (true) {
 187       raise(SIGTERM);
 188     }
 189   }
 190
 191   int status;
 192   PCHECK(waitpid(pid, &status, 0) == pid);
 193   CHECK(WIFEXITED(status));
 194   CHECK_EQ(kSignalTerminationExitCode, WEXITSTATUS(status));
 195 }
 196
 197 volatile sig_atomic_t signal_handler_called;
 198 void ExitSuccessfully(int sig) {
 199   signal_handler_called = 1;
 200 }
 201
 202 SANDBOX_TEST(InstallTerminationSignalHandler, DoesNotOverrideExistingHandlers) {
 203   struct sigaction action = {};
 204   action.sa_handler = &ExitSuccessfully;
 205   PCHECK(sigaction(SIGUSR1, &action, nullptr) == 0);
 206
 207   NamespaceSandbox::InstallDefaultTerminationSignalHandlers();
 208   CHECK(!NamespaceSandbox::InstallTerminationSignalHandler(
 209             SIGUSR1, kSignalTerminationExitCode));
 210
 211   raise(SIGUSR1);
 212   CHECK_EQ(1, signal_handler_called);
 213 }
 214
 215 }  // namespace
 216
 217 }  // namespace sandbox