sandbox/linux/services/namespace_sandbox_unittest.cc

   1 // Copyright 2015 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/linux/services/namespace_sandbox.h"
   6
   7 #include <sys/types.h>
   8 #include <sys/wait.h>
   9 #include <unistd.h>
  10
  11 #include <string>
  12 #include <utility>
  13
  14 #include "base/command_line.h"
  15 #include "base/files/file_enumerator.h"
  16 #include "base/files/file_path.h"
  17 #include "base/logging.h"
  18 #include "base/memory/scoped_ptr.h"
  19 #include "base/process/launch.h"
  20 #include "base/process/process.h"
  21 #include "base/test/multiprocess_test.h"
  22 #include "sandbox/linux/services/credentials.h"
  23 #include "sandbox/linux/services/namespace_utils.h"
  24 #include "sandbox/linux/tests/unit_tests.h"
  25 #include "testing/gtest/include/gtest/gtest.h"
  26 #include "testing/multiprocess_func_list.h"
  27
  28 namespace sandbox {
  29
  30 namespace {
  31
  32 bool RootDirectoryIsEmpty() {
  33   base::FilePath root("/");
  34   int file_type =
  35       base::FileEnumerator::DIRECTORIES | base::FileEnumerator::FILES;
  36   base::FileEnumerator enumerator_before(root, false, file_type);
  37   return enumerator_before.Next().empty();
  38 }
  39
  40 class NamespaceSandboxTest : public base::MultiProcessTest {
  41  public:
  42   void TestProc(const std::string& procname) {
  43     if (!Credentials::CanCreateProcessInNewUserNS()) {
  44       return;
  45     }
  46
  47     base::FileHandleMappingVector fds_to_remap = {
  48         std::make_pair(STDOUT_FILENO, STDOUT_FILENO),
  49         std::make_pair(STDERR_FILENO, STDERR_FILENO),
  50     };
  51     base::LaunchOptions launch_options;
  52     launch_options.fds_to_remap = &fds_to_remap;
  53
  54     base::Process process =
  55         NamespaceSandbox::LaunchProcess(MakeCmdLine(procname), launch_options);
  56     ASSERT_TRUE(process.IsValid());
  57
  58     const int kDummyExitCode = 42;
  59     int exit_code = kDummyExitCode;
  60     EXPECT_TRUE(process.WaitForExit(&exit_code));
  61     EXPECT_EQ(0, exit_code);
  62   }
  63 };
  64
  65 MULTIPROCESS_TEST_MAIN(SimpleChildProcess) {
  66   scoped_ptr<base::Environment> env(base::Environment::Create());
  67   bool in_user_ns = NamespaceSandbox::InNewUserNamespace();
  68   bool in_pid_ns = NamespaceSandbox::InNewPidNamespace();
  69   bool in_net_ns = NamespaceSandbox::InNewNetNamespace();
  70   CHECK(in_user_ns);
  71   CHECK_EQ(in_pid_ns,
  72            NamespaceUtils::KernelSupportsUnprivilegedNamespace(CLONE_NEWPID));
  73   CHECK_EQ(in_net_ns,
  74            NamespaceUtils::KernelSupportsUnprivilegedNamespace(CLONE_NEWNET));
  75   if (in_pid_ns) {
  76     CHECK_EQ(1, getpid());
  77   }
  78   return 0;
  79 }
  80
  81 TEST_F(NamespaceSandboxTest, BasicUsage) {
  82   TestProc("SimpleChildProcess");
  83 }
  84
  85 MULTIPROCESS_TEST_MAIN(ChrootMe) {
  86   CHECK(!RootDirectoryIsEmpty());
  87   CHECK(sandbox::Credentials::MoveToNewUserNS());
  88   CHECK(sandbox::Credentials::DropFileSystemAccess());
  89   CHECK(RootDirectoryIsEmpty());
  90   return 0;
  91 }
  92
  93 // Temporarily disabled on ASAN due to crbug.com/451603.
  94 TEST_F(NamespaceSandboxTest, DISABLE_ON_ASAN(ChrootAndDropCapabilities)) {
  95   TestProc("ChrootMe");
  96 }
  97
  98 MULTIPROCESS_TEST_MAIN(NestedNamespaceSandbox) {
  99   base::FileHandleMappingVector fds_to_remap = {
 100       std::make_pair(STDOUT_FILENO, STDOUT_FILENO),
 101       std::make_pair(STDERR_FILENO, STDERR_FILENO),
 102   };
 103   base::LaunchOptions launch_options;
 104   launch_options.fds_to_remap = &fds_to_remap;
 105   base::Process process = NamespaceSandbox::LaunchProcess(
 106       base::CommandLine(base::FilePath("/bin/true")), launch_options);
 107   CHECK(process.IsValid());
 108
 109   const int kDummyExitCode = 42;
 110   int exit_code = kDummyExitCode;
 111   CHECK(process.WaitForExit(&exit_code));
 112   CHECK_EQ(0, exit_code);
 113   return 0;
 114 }
 115
 116 TEST_F(NamespaceSandboxTest, NestedNamespaceSandbox) {
 117   TestProc("NestedNamespaceSandbox");
 118 }
 119
 120 }  // namespace
 121
 122 }  // namespace sandbox