123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384 |
- // Copyright 2017 The Chromium Authors. All rights reserved.
- // Use of this source code is governed by a BSD-style license that can be
- // found in the LICENSE file.
- #include "sandbox/mac/seatbelt_exec.h"
- #include "base/process/kill.h"
- #include "base/test/multiprocess_test.h"
- #include "base/test/test_timeouts.h"
- #include "testing/gtest/include/gtest/gtest.h"
- #include "testing/multiprocess_func_list.h"
- namespace sandbox {
- class SeatbeltExecTest : public base::MultiProcessTest {};
- MULTIPROCESS_TEST_MAIN(ServerTest) {
- std::string profile =
- "(version 1)\n"
- "(deny default (with no-log))\n"
- "(define allowed-dir \"ALLOWED_READ_DIR\")\n"
- "(define executable-path \"EXECUTABLE_PATH\")\n"
- "(allow process-exec (literal (param executable-path)))\n"
- "(allow file-read* (literal (param executable-path)))\n"
- "(allow file-read* (subpath (param allowed-dir)))\n";
- SeatbeltExecServer exec_server(-1);
- std::string exec_path = "/bin/ls";
- std::string allowed_path = "/Applications";
- mac::SandboxPolicy policy;
- google::protobuf::MapPair<std::string, std::string> allowed_pair(
- "ALLOWED_READ_DIR", allowed_path);
- CHECK(policy.mutable_params()->insert(allowed_pair).second);
- policy.set_profile(profile);
- CHECK(exec_server.SetParameter("EXECUTABLE_PATH", exec_path));
- CHECK(exec_server.ApplySandboxProfile(policy));
- // Test that the sandbox profile is actually applied.
- struct stat sb;
- CHECK_EQ(0, stat(allowed_path.c_str(), &sb));
- CHECK_EQ(-1, stat("/", &sb));
- CHECK_EQ(0, stat(exec_path.c_str(), &sb));
- return 0;
- }
- TEST_F(SeatbeltExecTest, ServerTest) {
- base::Process process = SpawnChild("ServerTest");
- ASSERT_TRUE(process.IsValid());
- int exit_code = 42;
- EXPECT_TRUE(process.WaitForExitWithTimeout(TestTimeouts::action_max_timeout(),
- &exit_code));
- EXPECT_EQ(exit_code, 0);
- }
- MULTIPROCESS_TEST_MAIN(ClientTest) {
- SeatbeltExecClient exec_client;
- CHECK(exec_client.SetBooleanParameter("key1", true));
- CHECK(!exec_client.SetBooleanParameter("key1", false));
- CHECK(exec_client.SetBooleanParameter("key2", false));
- CHECK(exec_client.SetParameter("key3", "value"));
- CHECK(!exec_client.SetParameter("key3", "value"));
- exec_client.SetProfile("(version 1)(deny default)");
- mac::SandboxPolicy policy = exec_client.GetPolicyForTesting();
- CHECK(policy.params_size() == 3);
- CHECK(!policy.profile().empty());
- return 0;
- }
- TEST_F(SeatbeltExecTest, ClientTest) {
- base::Process process = SpawnChild("ClientTest");
- ASSERT_TRUE(process.IsValid());
- int exit_code = 42;
- EXPECT_TRUE(process.WaitForExitWithTimeout(TestTimeouts::action_max_timeout(),
- &exit_code));
- EXPECT_EQ(exit_code, 0);
- }
- } // namespace sandbox
|