bpf_tests.h revision c2e0dbddbe15c98d52c4786dac06cb8952a8ae6d 
1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#ifndef SANDBOX_LINUX_SECCOMP_BPF_BPF_TESTS_H__
6#define SANDBOX_LINUX_SECCOMP_BPF_BPF_TESTS_H__
7
8#include <fcntl.h>
9#include <sys/stat.h>
10#include <sys/types.h>
11
12#include "base/third_party/valgrind/valgrind.h"
13#include "build/build_config.h"
14#include "sandbox/linux/tests/unit_tests.h"
15#include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
16
17
18namespace sandbox {
19
20// A BPF_DEATH_TEST is just the same as a BPF_TEST, but it assumes that the
21// test will fail with a particular known error condition. Use the DEATH_XXX()
22// macros from unit_tests.h to specify the expected error condition.
23#define BPF_DEATH_TEST(test_case_name, test_name, death, policy, aux...)      \
24  void BPF_TEST_##test_name(sandbox::BpfTests<aux>::AuxType& BPF_AUX);        \
25  TEST(test_case_name, test_name) {                                           \
26    sandbox::BpfTests<aux>::TestArgs arg(BPF_TEST_##test_name, policy);       \
27    sandbox::BpfTests<aux>::RunTestInProcess(                                 \
28                                   sandbox::BpfTests<aux>::TestWrapper, &arg, \
29                                   death);                                    \
30  }                                                                           \
31  void BPF_TEST_##test_name(sandbox::BpfTests<aux>::AuxType& BPF_AUX)
32
33// BPF_TEST() is a special version of SANDBOX_TEST(). It turns into a no-op,
34// if the host does not have kernel support for running BPF filters.
35// Also, it takes advantage of the Die class to avoid calling LOG(FATAL), from
36// inside our tests, as we don't need or even want all the error handling that
37// LOG(FATAL) would do.
38// BPF_TEST() takes a C++ data type as an optional fourth parameter. If
39// present, this sets up a variable that can be accessed as "BPF_AUX". This
40// variable will be passed as an argument to the "policy" function. Policies
41// would typically use it as an argument to Sandbox::Trap(), if they want to
42// communicate data between the BPF_TEST() and a Trap() function.
43#define BPF_TEST(test_case_name, test_name, policy, aux...)                   \
44  BPF_DEATH_TEST(test_case_name, test_name, DEATH_SUCCESS(), policy, aux)
45
46
47// Assertions are handled exactly the same as with a normal SANDBOX_TEST()
48#define BPF_ASSERT SANDBOX_ASSERT
49
50
51// The "Aux" type is optional. We use an "empty" type by default, so that if
52// the caller doesn't provide any type, all the BPF_AUX related data compiles
53// to nothing.
54template<class Aux = int[0]>
55class BpfTests : public UnitTests {
56 public:
57  typedef Aux AuxType;
58
59  class TestArgs {
60   public:
61    TestArgs(void (*t)(AuxType&), playground2::Sandbox::EvaluateSyscall p)
62        : test_(t),
63          policy_(p),
64          aux_() {
65    }
66
67    void (*test() const)(AuxType&) { return test_; }
68    playground2::Sandbox::EvaluateSyscall policy() const { return policy_; }
69
70   private:
71    friend class BpfTests;
72
73    void (*test_)(AuxType&);
74    playground2::Sandbox::EvaluateSyscall policy_;
75    AuxType aux_;
76  };
77
78  static void TestWrapper(void *void_arg) {
79    TestArgs *arg = reinterpret_cast<TestArgs *>(void_arg);
80    playground2::Die::EnableSimpleExit();
81    if (playground2::Sandbox::SupportsSeccompSandbox(-1) ==
82        playground2::Sandbox::STATUS_AVAILABLE) {
83      // Ensure the the sandbox is actually available at this time
84      int proc_fd;
85      BPF_ASSERT((proc_fd = open("/proc", O_RDONLY|O_DIRECTORY)) >= 0);
86      BPF_ASSERT(playground2::Sandbox::SupportsSeccompSandbox(proc_fd) ==
87                 playground2::Sandbox::STATUS_AVAILABLE);
88
89      // Initialize and then start the sandbox with our custom policy
90      playground2::Sandbox sandbox;
91      sandbox.set_proc_fd(proc_fd);
92      sandbox.SetSandboxPolicy(arg->policy(), &arg->aux_);
93      sandbox.Sandbox::StartSandbox();
94
95      arg->test()(arg->aux_);
96    } else {
97      // Only Android should be in the case where kernel support is not always
98      // available. Valgrind instrumentation will also prevent our tests from
99      // working.
100#if !defined(OS_ANDROID) && !defined(RUNNING_ON_VALGRIND)
101      const bool seccomp_bpf_is_supported = false;
102      BPF_ASSERT(seccomp_bpf_is_supported);
103#endif  // !defined(OS_ANDROID) && !defined(RUNNING_ON_VALGRIND)
104      // Call the compiler and verify the policy. That's the least we can do,
105      // if we don't have kernel support.
106      playground2::Sandbox sandbox;
107      sandbox.SetSandboxPolicy(arg->policy(), &arg->aux_);
108      playground2::Sandbox::Program *program =
109          sandbox.AssembleFilter(true /* force_verification */);
110      delete program;
111      sandbox::UnitTests::IgnoreThisTest();
112    }
113  }
114
115 private:
116  DISALLOW_IMPLICIT_CONSTRUCTORS(BpfTests);
117};
118
119}  // namespace
120
121#endif  // SANDBOX_LINUX_SECCOMP_BPF_BPF_TESTS_H__
122