15d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)// Copyright (c) 2012 The Chromium Authors. All rights reserved. 25821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Use of this source code is governed by a BSD-style license that can be 35821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// found in the LICENSE file. 45821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 55d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "base/environment.h" 65d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "base/logging.h" 75d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "base/memory/scoped_ptr.h" 85d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "base/strings/string_number_conversions.h" 95d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "sandbox/linux/suid/client/setuid_sandbox_client.h" 105d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "sandbox/linux/suid/common/sandbox.h" 115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "testing/gtest/include/gtest/gtest.h" 125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)namespace sandbox { 145d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 155d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)TEST(SetuidSandboxClient, SetupLaunchEnvironment) { 165d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) const char kTestValue[] = "This is a test"; 175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) scoped_ptr<base::Environment> env(base::Environment::Create()); 185d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) EXPECT_TRUE(env != NULL); 195d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string saved_ld_preload; 215d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) bool environment_had_ld_preload; 225d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // First, back-up the real LD_PRELOAD if any. 235d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) environment_had_ld_preload = env->GetVar("LD_PRELOAD", &saved_ld_preload); 245d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // Setup environment variables to save or not save. 255d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) EXPECT_TRUE(env->SetVar("LD_PRELOAD", kTestValue)); 265d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) EXPECT_TRUE(env->UnSetVar("LD_ORIGIN_PATH")); 275d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) scoped_ptr<SetuidSandboxClient> 295d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) sandbox_client(SetuidSandboxClient::Create()); 305d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) EXPECT_TRUE(sandbox_client != NULL); 315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Make sure the environment is clean. 335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) EXPECT_TRUE(env->UnSetVar(kSandboxEnvironmentApiRequest)); 345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) EXPECT_TRUE(env->UnSetVar(kSandboxEnvironmentApiProvides)); 355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) sandbox_client->SetupLaunchEnvironment(); 375d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Check if the requested API environment was set. 395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string api_request; 405d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) EXPECT_TRUE(env->GetVar(kSandboxEnvironmentApiRequest, &api_request)); 415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int api_request_num; 425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) EXPECT_TRUE(base::StringToInt(api_request, &api_request_num)); 435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) EXPECT_EQ(api_request_num, kSUIDSandboxApiNumber); 445d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 45116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch // Now check if LD_PRELOAD was saved to SANDBOX_LD_PRELOAD. 46116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch std::string sandbox_ld_preload; 47116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch EXPECT_TRUE(env->GetVar("SANDBOX_LD_PRELOAD", &sandbox_ld_preload)); 48116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch EXPECT_EQ(sandbox_ld_preload, kTestValue); 49116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 50116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch // Check that LD_ORIGIN_PATH was not saved. 51116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch EXPECT_FALSE(env->HasVar("SANDBOX_LD_ORIGIN_PATH")); 52116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 53116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch // We should not forget to restore LD_PRELOAD at the end, or this environment 54116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch // variable will affect the next running tests! 55116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch if (environment_had_ld_preload) { 56116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch EXPECT_TRUE(env->SetVar("LD_PRELOAD", saved_ld_preload)); 575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) EXPECT_TRUE(env->UnSetVar("LD_PRELOAD")); 59 } 60} 61 62TEST(SetuidSandboxClient, SandboxedClientAPI) { 63 scoped_ptr<base::Environment> env(base::Environment::Create()); 64 EXPECT_TRUE(env != NULL); 65 66 scoped_ptr<SetuidSandboxClient> 67 sandbox_client(SetuidSandboxClient::Create()); 68 EXPECT_TRUE(sandbox_client != NULL); 69 70 // Set-up a fake environment as if we went through the setuid sandbox. 71 EXPECT_TRUE(env->SetVar(kSandboxEnvironmentApiProvides, 72 base::IntToString(kSUIDSandboxApiNumber))); 73 EXPECT_TRUE(env->SetVar(kSandboxDescriptorEnvironmentVarName, "1")); 74 EXPECT_TRUE(env->SetVar(kSandboxPIDNSEnvironmentVarName, "1")); 75 EXPECT_TRUE(env->UnSetVar(kSandboxNETNSEnvironmentVarName)); 76 77 // Check the API. 78 EXPECT_TRUE(sandbox_client->IsSuidSandboxUpToDate()); 79 EXPECT_TRUE(sandbox_client->IsSuidSandboxChild()); 80 EXPECT_TRUE(sandbox_client->IsInNewPIDNamespace()); 81 EXPECT_FALSE(sandbox_client->IsInNewNETNamespace()); 82 83 // Forge an incorrect API version and check. 84 EXPECT_TRUE(env->SetVar(kSandboxEnvironmentApiProvides, 85 base::IntToString(kSUIDSandboxApiNumber + 1))); 86 EXPECT_FALSE(sandbox_client->IsSuidSandboxUpToDate()); 87 // We didn't go through the actual sandboxing mechanism as it is 88 // very hard in a unit test. 89 EXPECT_FALSE(sandbox_client->IsSandboxed()); 90} 91 92// This test doesn't accomplish much, but will make sure that analysis tools 93// will run this codepath. 94TEST(SetuidSandboxClient, GetSandboxBinaryPath) { 95 scoped_ptr<SetuidSandboxClient> setuid_sandbox_client( 96 SetuidSandboxClient::Create()); 97 ignore_result(setuid_sandbox_client->GetSandboxBinaryPath()); 98} 99 100} // namespace sandbox 101 102