sandboxed-api/sandboxed_api/sandbox2/mounts_test.cc
Sandboxed API Team f29a5a81ed Print final FS mounts in sandboxee's chroot
After all requested filesystem mounts are fully mounted under a sandboxee's virtual chroot, print a list of the outside paths and a list of the inside chroot paths that the outside paths are mapped to. This provides a valuable insight while debugging sandboxed binaries.

PiperOrigin-RevId: 247130923
Change-Id: I42b4b3db68d826587c0fe8127aabbead38bc6f20
2019-05-07 18:30:13 -07:00

238 lines
8.0 KiB
C++

// Copyright 2019 Google LLC. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#include "sandboxed_api/sandbox2/mounts.h"
#include <unistd.h>
#include <utility>
#include "gmock/gmock.h"
#include "gtest/gtest.h"
#include "absl/strings/match.h"
#include "absl/strings/str_cat.h"
#include "sandboxed_api/sandbox2/testing.h"
#include "sandboxed_api/sandbox2/util/file_helpers.h"
#include "sandboxed_api/sandbox2/util/path.h"
#include "sandboxed_api/sandbox2/util/temp_file.h"
#include "sandboxed_api/util/status_matchers.h"
using sapi::IsOk;
using sapi::StatusIs;
using ::testing::Eq;
using ::testing::UnorderedElementsAreArray;
namespace sandbox2 {
namespace {
constexpr size_t kTmpfsSize = 1024;
TEST(MountTreeTest, TestInvalidFilenames) {
Mounts mounts;
EXPECT_THAT(mounts.AddFile(""), StatusIs(sapi::StatusCode::kInvalidArgument));
EXPECT_THAT(mounts.AddFile("a"),
StatusIs(sapi::StatusCode::kInvalidArgument));
EXPECT_THAT(mounts.AddFileAt("/a", ""),
StatusIs(sapi::StatusCode::kInvalidArgument));
EXPECT_THAT(mounts.AddFileAt("", "/a"),
StatusIs(sapi::StatusCode::kInvalidArgument));
EXPECT_THAT(mounts.AddFileAt("/a", "a"),
StatusIs(sapi::StatusCode::kInvalidArgument));
EXPECT_THAT(mounts.AddFile("/"),
StatusIs(sapi::StatusCode::kInvalidArgument));
EXPECT_THAT(mounts.AddFileAt("/a", "/"),
StatusIs(sapi::StatusCode::kInvalidArgument));
}
TEST(MountTreeTest, TestAddFile) {
Mounts mounts;
EXPECT_THAT(mounts.AddFile("/a"), IsOk());
EXPECT_THAT(mounts.AddFile("/b"), IsOk());
EXPECT_THAT(mounts.AddFile("/c/d"), IsOk());
EXPECT_THAT(mounts.AddFile("/c/e"), IsOk());
EXPECT_THAT(mounts.AddFile("/c/dd/e"), IsOk());
EXPECT_THAT(mounts.AddFileAt("/a", "/f"), IsOk());
}
TEST(MountTreeTest, TestAddDir) {
Mounts mounts;
EXPECT_THAT(mounts.AddDirectoryAt("/a", "/a"), IsOk());
EXPECT_THAT(mounts.AddDirectoryAt("/c/d", "/c/d"), IsOk());
EXPECT_THAT(mounts.AddDirectoryAt("/c/d/e", "/c/d/e"), IsOk());
}
TEST(MountTreeTest, TestAddTmpFs) {
Mounts mounts;
EXPECT_THAT(mounts.AddTmpfs("/a", kTmpfsSize), IsOk());
EXPECT_THAT(mounts.AddTmpfs("/a/b", kTmpfsSize), IsOk());
EXPECT_THAT(mounts.AddFile("/a/b/c"), IsOk());
EXPECT_THAT(mounts.AddDirectoryAt("/a/b/d", "/a/b/d"), IsOk());
}
TEST(MountTreeTest, TestMultipleInsertionFileSymlink) {
Mounts mounts;
auto result_or = CreateNamedTempFileAndClose(
file::JoinPath(GetTestTempPath(), "testdir_"));
ASSERT_THAT(result_or.status(), IsOk());
std::string path = result_or.ValueOrDie();
result_or = CreateNamedTempFileAndClose(
file::JoinPath(GetTestTempPath(), "testdir_"));
ASSERT_THAT(result_or.status(), IsOk());
std::string symlink_path = result_or.ValueOrDie();
ASSERT_THAT(unlink(symlink_path.c_str()), Eq(0));
ASSERT_THAT(symlink(path.c_str(), symlink_path.c_str()), Eq(0));
EXPECT_THAT(mounts.AddFileAt(path, "/a"), IsOk());
EXPECT_THAT(mounts.AddFileAt(path, "/a"), IsOk());
EXPECT_THAT(mounts.AddFileAt(symlink_path, "/a"), IsOk());
}
TEST(MountTreeTest, TestMultipleInsertionDirSymlink) {
Mounts mounts;
auto result_or = CreateTempDir(file::JoinPath(GetTestTempPath(), "testdir_"));
ASSERT_THAT(result_or.status(), IsOk());
std::string path = result_or.ValueOrDie();
result_or = CreateNamedTempFileAndClose(
file::JoinPath(GetTestTempPath(), "testdir_"));
ASSERT_THAT(result_or.status(), IsOk());
std::string symlink_path = result_or.ValueOrDie();
ASSERT_THAT(unlink(symlink_path.c_str()), Eq(0));
ASSERT_THAT(symlink(path.c_str(), symlink_path.c_str()), Eq(0));
EXPECT_THAT(mounts.AddDirectoryAt(path, "/a"), IsOk());
EXPECT_THAT(mounts.AddDirectoryAt(path, "/a"), IsOk());
EXPECT_THAT(mounts.AddDirectoryAt(symlink_path, "/a"), IsOk());
EXPECT_THAT(mounts.AddDirectoryAt(symlink_path, "/a"), IsOk());
}
TEST(MountTreeTest, TestMultipleInsertion) {
Mounts mounts;
EXPECT_THAT(mounts.AddFile("/c/d"), IsOk());
EXPECT_THAT(mounts.AddFile("/c"),
StatusIs(sapi::StatusCode::kFailedPrecondition));
EXPECT_THAT(mounts.AddFileAt("/f", "/c"),
StatusIs(sapi::StatusCode::kFailedPrecondition));
EXPECT_THAT(mounts.AddDirectoryAt("/f", "/c"), IsOk());
EXPECT_THAT(mounts.AddFile("/c/d/e"),
StatusIs(sapi::StatusCode::kFailedPrecondition));
EXPECT_THAT(mounts.AddFileAt("/f", "/c/d/e"),
StatusIs(sapi::StatusCode::kFailedPrecondition));
EXPECT_THAT(mounts.AddDirectoryAt("/f", "/c/d/e"),
StatusIs(sapi::StatusCode::kFailedPrecondition));
}
TEST(MountTreeTest, TestEvilNullByte) {
Mounts mounts;
// create the filename with a null byte this way as g4 fix forces newlines
// otherwise.
std::string filename{"/a/b"};
filename[2] = '\0';
EXPECT_THAT(mounts.AddFile(filename),
StatusIs(sapi::StatusCode::kInvalidArgument));
EXPECT_THAT(mounts.AddFileAt(filename, "/a"),
StatusIs(sapi::StatusCode::kInvalidArgument));
EXPECT_THAT(mounts.AddFileAt("/a", filename),
StatusIs(sapi::StatusCode::kInvalidArgument));
EXPECT_THAT(mounts.AddDirectoryAt(filename, "/a"),
StatusIs(sapi::StatusCode::kInvalidArgument));
EXPECT_THAT(mounts.AddDirectoryAt("/a", filename),
StatusIs(sapi::StatusCode::kInvalidArgument));
EXPECT_THAT(mounts.AddTmpfs(filename, kTmpfsSize),
StatusIs(sapi::StatusCode::kInvalidArgument));
}
TEST(MountTreeTest, TestMinimalDynamicBinary) {
Mounts mounts;
EXPECT_THAT(mounts.AddMappingsForBinary(
GetTestSourcePath("sandbox2/testcases/minimal_dynamic")),
IsOk());
EXPECT_THAT(mounts.AddFile("/lib/x86_64-linux-gnu/libc.so.6"), IsOk());
}
TEST(MountTreeTest, TestList) {
struct TestCase {
const char *path;
const bool is_ro;
};
// clang-format off
const TestCase test_cases[] = {
// NOTE: Directories have a trailing '/'; files don't.
{"/a/b", true},
{"/a/c/", true},
{"/a/c/d/e/f/g", true},
{"/h", true},
{"/i/j/k", false},
{"/i/l/", false},
};
// clang-format on
Mounts mounts;
// Create actual directories and files on disk and selectively add
for (const auto &test_case : test_cases) {
const auto inside_path = test_case.path;
const std::string outside_path = absl::StrCat("/some/dir/", inside_path);
if (absl::EndsWith(outside_path, "/")) {
ASSERT_THAT(
mounts.AddDirectoryAt(file::CleanPath(outside_path),
file::CleanPath(inside_path), test_case.is_ro),
IsOk());
} else {
ASSERT_THAT(
mounts.AddFileAt(file::CleanPath(outside_path),
file::CleanPath(inside_path), test_case.is_ro),
IsOk());
}
}
std::vector<std::string> outside_entries;
std::vector<std::string> inside_entries;
mounts.RecursivelyListMounts(&outside_entries, &inside_entries);
// clang-format off
EXPECT_THAT(
inside_entries,
UnorderedElementsAreArray({
"R /a/b",
"R /a/c/",
"R /a/c/d/e/f/g",
"R /h",
"W /i/j/k",
"W /i/l/",
}));
EXPECT_THAT(
outside_entries,
UnorderedElementsAreArray({
absl::StrCat("/some/dir/", "a/b"),
absl::StrCat("/some/dir/", "a/c/"),
absl::StrCat("/some/dir/", "a/c/d/e/f/g"),
absl::StrCat("/some/dir/", "h"),
absl::StrCat("/some/dir/", "i/j/k"),
absl::StrCat("/some/dir/", "i/l/"),
}));
// clang-format on
}
} // namespace
} // namespace sandbox2