sandbox/linux/services/unix_domain_socket_unittest.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <sched.h>
   6 #include <stdio.h>
   7 #include <string.h>
   8 #include <sys/socket.h>
   9 #include <sys/syscall.h>
  10 #include <sys/wait.h>
  11 #include <unistd.h>
  12
  13 #include <vector>
  14
  15 #include "base/files/scoped_file.h"
  16 #include "base/logging.h"
  17 #include "base/memory/scoped_vector.h"
  18 #include "base/posix/eintr_wrapper.h"
  19 #include "base/posix/unix_domain_socket_linux.h"
  20 #include "base/process/process_handle.h"
  21 #include "sandbox/linux/services/syscall_wrappers.h"
  22 #include "sandbox/linux/tests/unit_tests.h"
  23
  24 // Additional tests for base's UnixDomainSocket to make sure it behaves
  25 // correctly in the presence of sandboxing functionality (e.g., receiving
  26 // PIDs across namespaces).
  27
  28 namespace sandbox {
  29
  30 namespace {
  31
  32 const char kHello[] = "hello";
  33
  34 // If the calling process isn't root, then try using unshare(CLONE_NEWUSER)
  35 // to fake it.
  36 void FakeRoot() {
  37   // If we're already root, then allow test to proceed.
  38   if (geteuid() == 0)
  39     return;
  40
  41   // Otherwise hope the kernel supports unprivileged namespaces.
  42   if (unshare(CLONE_NEWUSER) == 0)
  43     return;
  44
  45   printf("Permission to use CLONE_NEWPID missing; skipping test.\n");
  46   UnitTests::IgnoreThisTest();
  47 }
  48
  49 void WaitForExit(pid_t pid) {
  50   int status;
  51   CHECK_EQ(pid, HANDLE_EINTR(waitpid(pid, &status, 0)));
  52   CHECK(WIFEXITED(status));
  53   CHECK_EQ(0, WEXITSTATUS(status));
  54 }
  55
  56 base::ProcessId GetParentProcessId(base::ProcessId pid) {
  57   // base::GetParentProcessId() is defined as taking a ProcessHandle instead of
  58   // a ProcessId, even though it's a POSIX-only function and IDs and Handles
  59   // are both simply pid_t on POSIX... :/
  60   base::ProcessHandle handle;
  61   CHECK(base::OpenProcessHandle(pid, &handle));
  62   base::ProcessId ret = base::GetParentProcessId(pid);
  63   base::CloseProcessHandle(handle);
  64   return ret;
  65 }
  66
  67 // SendHello sends a "hello" to socket fd, and then blocks until the recipient
  68 // acknowledges it by calling RecvHello.
  69 void SendHello(int fd) {
  70   int pipe_fds[2];
  71   CHECK_EQ(0, pipe(pipe_fds));
  72   base::ScopedFD read_pipe(pipe_fds[0]);
  73   base::ScopedFD write_pipe(pipe_fds[1]);
  74
  75   std::vector<int> send_fds;
  76   send_fds.push_back(write_pipe.get());
  77   CHECK(UnixDomainSocket::SendMsg(fd, kHello, sizeof(kHello), send_fds));
  78
  79   write_pipe.reset();
  80
  81   // Block until receiver closes their end of the pipe.
  82   char ch;
  83   CHECK_EQ(0, HANDLE_EINTR(read(read_pipe.get(), &ch, 1)));
  84 }
  85
  86 // RecvHello receives and acknowledges a "hello" on socket fd, and returns the
  87 // process ID of the sender in sender_pid.  Optionally, write_pipe can be used
  88 // to return a file descriptor, and the acknowledgement will be delayed until
  89 // the descriptor is closed.
  90 // (Implementation details: SendHello allocates a new pipe, sends us the writing
  91 // end alongside the "hello" message, and then blocks until we close the writing
  92 // end of the pipe.)
  93 void RecvHello(int fd,
  94                base::ProcessId* sender_pid,
  95                base::ScopedFD* write_pipe = NULL) {
  96   // Extra receiving buffer space to make sure we really received only
  97   // sizeof(kHello) bytes and it wasn't just truncated to fit the buffer.
  98   char buf[sizeof(kHello) + 1];
  99   ScopedVector<base::ScopedFD> message_fds;
 100   ssize_t n = UnixDomainSocket::RecvMsgWithPid(
 101       fd, buf, sizeof(buf), &message_fds, sender_pid);
 102   CHECK_EQ(sizeof(kHello), static_cast<size_t>(n));
 103   CHECK_EQ(0, memcmp(buf, kHello, sizeof(kHello)));
 104   CHECK_EQ(1U, message_fds.size());
 105   if (write_pipe)
 106     write_pipe->swap(*message_fds[0]);
 107 }
 108
 109 // Check that receiving PIDs works across a fork().
 110 SANDBOX_TEST(UnixDomainSocketTest, Fork) {
 111   int fds[2];
 112   CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds));
 113   base::ScopedFD recv_sock(fds[0]);
 114   base::ScopedFD send_sock(fds[1]);
 115
 116   CHECK(UnixDomainSocket::EnableReceiveProcessId(recv_sock.get()));
 117
 118   const pid_t pid = fork();
 119   CHECK_NE(-1, pid);
 120   if (pid == 0) {
 121     // Child process.
 122     recv_sock.reset();
 123     SendHello(send_sock.get());
 124     _exit(0);
 125   }
 126
 127   // Parent process.
 128   send_sock.reset();
 129
 130   base::ProcessId sender_pid;
 131   RecvHello(recv_sock.get(), &sender_pid);
 132   CHECK_EQ(pid, sender_pid);
 133
 134   WaitForExit(pid);
 135 }
 136
 137 // Similar to Fork above, but forking the child into a new pid namespace.
 138 SANDBOX_TEST(UnixDomainSocketTest, Namespace) {
 139   FakeRoot();
 140
 141   int fds[2];
 142   CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds));
 143   base::ScopedFD recv_sock(fds[0]);
 144   base::ScopedFD send_sock(fds[1]);
 145
 146   CHECK(UnixDomainSocket::EnableReceiveProcessId(recv_sock.get()));
 147
 148   const pid_t pid = sys_clone(CLONE_NEWPID | SIGCHLD, 0, 0, 0, 0);
 149   CHECK_NE(-1, pid);
 150   if (pid == 0) {
 151     // Child process.
 152     recv_sock.reset();
 153
 154     // Check that we think we're pid 1 in our new namespace.
 155     CHECK_EQ(1, sys_getpid());
 156
 157     SendHello(send_sock.get());
 158     _exit(0);
 159   }
 160
 161   // Parent process.
 162   send_sock.reset();
 163
 164   base::ProcessId sender_pid;
 165   RecvHello(recv_sock.get(), &sender_pid);
 166   CHECK_EQ(pid, sender_pid);
 167
 168   WaitForExit(pid);
 169 }
 170
 171 // Again similar to Fork, but now with nested PID namespaces.
 172 SANDBOX_TEST(UnixDomainSocketTest, DoubleNamespace) {
 173   FakeRoot();
 174
 175   int fds[2];
 176   CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds));
 177   base::ScopedFD recv_sock(fds[0]);
 178   base::ScopedFD send_sock(fds[1]);
 179
 180   CHECK(UnixDomainSocket::EnableReceiveProcessId(recv_sock.get()));
 181
 182   const pid_t pid = sys_clone(CLONE_NEWPID | SIGCHLD, 0, 0, 0, 0);
 183   CHECK_NE(-1, pid);
 184   if (pid == 0) {
 185     // Child process.
 186     recv_sock.reset();
 187
 188     const pid_t pid2 = sys_clone(CLONE_NEWPID | SIGCHLD, 0, 0, 0, 0);
 189     CHECK_NE(-1, pid2);
 190
 191     if (pid2 != 0) {
 192       // Wait for grandchild to run to completion; see comments below.
 193       WaitForExit(pid2);
 194
 195       // Fallthrough once grandchild has sent its hello and exited.
 196     }
 197
 198     // Check that we think we're pid 1.
 199     CHECK_EQ(1, sys_getpid());
 200
 201     SendHello(send_sock.get());
 202     _exit(0);
 203   }
 204
 205   // Parent process.
 206   send_sock.reset();
 207
 208   // We have two messages to receive: first from the grand-child,
 209   // then from the child.
 210   for (unsigned iteration = 0; iteration < 2; ++iteration) {
 211     base::ProcessId sender_pid;
 212     base::ScopedFD pipe_fd;
 213     RecvHello(recv_sock.get(), &sender_pid, &pipe_fd);
 214
 215     // We need our child and grandchild processes to both be alive for
 216     // GetParentProcessId() to return a valid pid, hence the pipe trickery.
 217     // (On the first iteration, grandchild is blocked reading from the pipe
 218     // until we close it, and child is blocked waiting for grandchild to exit.)
 219     switch (iteration) {
 220       case 0:  // Grandchild's message
 221         // Check that sender_pid refers to our grandchild by checking that pid
 222         // (our child) is its parent.
 223         CHECK_EQ(pid, GetParentProcessId(sender_pid));
 224         break;
 225       case 1:  // Child's message
 226         CHECK_EQ(pid, sender_pid);
 227         break;
 228       default:
 229         NOTREACHED();
 230     }
 231   }
 232
 233   WaitForExit(pid);
 234 }
 235
 236 // Tests that GetPeerPid() returns 0 if the peer does not exist in caller's
 237 // namespace.
 238 SANDBOX_TEST(UnixDomainSocketTest, ImpossiblePid) {
 239   FakeRoot();
 240
 241   int fds[2];
 242   CHECK_EQ(0, socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds));
 243   base::ScopedFD send_sock(fds[0]);
 244   base::ScopedFD recv_sock(fds[1]);
 245
 246   CHECK(UnixDomainSocket::EnableReceiveProcessId(recv_sock.get()));
 247
 248   const pid_t pid = sys_clone(CLONE_NEWPID | SIGCHLD, 0, 0, 0, 0);
 249   CHECK_NE(-1, pid);
 250   if (pid == 0) {
 251     // Child process.
 252     send_sock.reset();
 253
 254     base::ProcessId sender_pid;
 255     RecvHello(recv_sock.get(), &sender_pid);
 256     CHECK_EQ(0, sender_pid);
 257     _exit(0);
 258   }
 259
 260   // Parent process.
 261   recv_sock.reset();
 262   SendHello(send_sock.get());
 263   WaitForExit(pid);
 264 }
 265
 266 }  // namespace
 267
 268 }  // namespace sandbox