sandbox_mac_seatbelt_exec_unittest.cc 2.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/mac/seatbelt_exec.h"
  5. #include "base/process/kill.h"
  6. #include "base/test/multiprocess_test.h"
  7. #include "base/test/test_timeouts.h"
  8. #include "testing/gtest/include/gtest/gtest.h"
  9. #include "testing/multiprocess_func_list.h"
  10. namespace sandbox {
  11. class SeatbeltExecTest : public base::MultiProcessTest {};
  12. MULTIPROCESS_TEST_MAIN(ServerTest) {
  13. std::string profile =
  14. "(version 1)\n"
  15. "(deny default (with no-log))\n"
  16. "(define allowed-dir \"ALLOWED_READ_DIR\")\n"
  17. "(define executable-path \"EXECUTABLE_PATH\")\n"
  18. "(allow process-exec (literal (param executable-path)))\n"
  19. "(allow file-read* (literal (param executable-path)))\n"
  20. "(allow file-read* (subpath (param allowed-dir)))\n";
  21. SeatbeltExecServer exec_server(-1);
  22. std::string exec_path = "/bin/ls";
  23. std::string allowed_path = "/Applications";
  24. mac::SandboxPolicy policy;
  25. google::protobuf::MapPair<std::string, std::string> allowed_pair(
  26. "ALLOWED_READ_DIR", allowed_path);
  27. CHECK(policy.mutable_params()->insert(allowed_pair).second);
  28. policy.set_profile(profile);
  29. CHECK(exec_server.SetParameter("EXECUTABLE_PATH", exec_path));
  30. CHECK(exec_server.ApplySandboxProfile(policy));
  31. // Test that the sandbox profile is actually applied.
  32. struct stat sb;
  33. CHECK_EQ(0, stat(allowed_path.c_str(), &sb));
  34. CHECK_EQ(-1, stat("/", &sb));
  35. CHECK_EQ(0, stat(exec_path.c_str(), &sb));
  36. return 0;
  37. }
  38. TEST_F(SeatbeltExecTest, ServerTest) {
  39. base::Process process = SpawnChild("ServerTest");
  40. ASSERT_TRUE(process.IsValid());
  41. int exit_code = 42;
  42. EXPECT_TRUE(process.WaitForExitWithTimeout(TestTimeouts::action_max_timeout(),
  43. &exit_code));
  44. EXPECT_EQ(exit_code, 0);
  45. }
  46. MULTIPROCESS_TEST_MAIN(ClientTest) {
  47. SeatbeltExecClient exec_client;
  48. CHECK(exec_client.SetBooleanParameter("key1", true));
  49. CHECK(!exec_client.SetBooleanParameter("key1", false));
  50. CHECK(exec_client.SetBooleanParameter("key2", false));
  51. CHECK(exec_client.SetParameter("key3", "value"));
  52. CHECK(!exec_client.SetParameter("key3", "value"));
  53. exec_client.SetProfile("(version 1)(deny default)");
  54. mac::SandboxPolicy policy = exec_client.GetPolicyForTesting();
  55. CHECK(policy.params_size() == 3);
  56. CHECK(!policy.profile().empty());
  57. return 0;
  58. }
  59. TEST_F(SeatbeltExecTest, ClientTest) {
  60. base::Process process = SpawnChild("ClientTest");
  61. ASSERT_TRUE(process.IsValid());
  62. int exit_code = 42;
  63. EXPECT_TRUE(process.WaitForExitWithTimeout(TestTimeouts::action_max_timeout(),
  64. &exit_code));
  65. EXPECT_EQ(exit_code, 0);
  66. }
  67. } // namespace sandbox