diff options
Diffstat (limited to 'brillo/minijail')
-rw-r--r-- | brillo/minijail/minijail.cc | 135 | ||||
-rw-r--r-- | brillo/minijail/minijail.h | 115 | ||||
-rw-r--r-- | brillo/minijail/mock_minijail.h | 67 |
3 files changed, 317 insertions, 0 deletions
diff --git a/brillo/minijail/minijail.cc b/brillo/minijail/minijail.cc new file mode 100644 index 0000000..b72f41b --- /dev/null +++ b/brillo/minijail/minijail.cc @@ -0,0 +1,135 @@ +// Copyright (c) 2012 The Chromium OS Authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +#include "brillo/minijail/minijail.h" + +#include <sys/types.h> +#include <sys/wait.h> + +using std::vector; + +namespace brillo { + +static base::LazyInstance<Minijail> g_minijail = LAZY_INSTANCE_INITIALIZER; + +Minijail::Minijail() {} + +Minijail::~Minijail() {} + +// static +Minijail* Minijail::GetInstance() { + return g_minijail.Pointer(); +} + +struct minijail* Minijail::New() { + return minijail_new(); +} + +void Minijail::Destroy(struct minijail* jail) { + minijail_destroy(jail); +} + +void Minijail::DropRoot(struct minijail* jail, uid_t uid, gid_t gid) { + minijail_change_uid(jail, uid); + minijail_change_gid(jail, gid); +} + +bool Minijail::DropRoot(struct minijail* jail, + const char* user, + const char* group) { + // |user| and |group| are copied so the only reason either of these + // calls can fail is ENOMEM. + return !minijail_change_user(jail, user) && + !minijail_change_group(jail, group); +} + +void Minijail::EnterNewPidNamespace(struct minijail* jail) { + minijail_namespace_pids(jail); +} + +void Minijail::MountTmp(struct minijail* jail) { + minijail_mount_tmp(jail); +} + +void Minijail::UseSeccompFilter(struct minijail* jail, const char* path) { + minijail_no_new_privs(jail); + minijail_use_seccomp_filter(jail); + minijail_parse_seccomp_filters(jail, path); +} + +void Minijail::UseCapabilities(struct minijail* jail, uint64_t capmask) { + minijail_use_caps(jail, capmask); +} + +void Minijail::Enter(struct minijail* jail) { + minijail_enter(jail); +} + +bool Minijail::Run(struct minijail* jail, vector<char*> args, pid_t* pid) { + return minijail_run_pid(jail, args[0], args.data(), pid) == 0; +} + +bool Minijail::RunSync(struct minijail* jail, vector<char*> args, int* status) { + pid_t pid; + if (Run(jail, args, &pid) && waitpid(pid, status, 0) == pid) { + return true; + } + + return false; +} + +bool Minijail::RunPipe(struct minijail* jail, + vector<char*> args, + pid_t* pid, + int* stdin) { + return minijail_run_pid_pipe(jail, args[0], args.data(), pid, stdin) == 0; +} + +bool Minijail::RunPipes(struct minijail* jail, + vector<char*> args, + pid_t* pid, + int* stdin, + int* stdout, + int* stderr) { + return minijail_run_pid_pipes( + jail, args[0], args.data(), pid, stdin, stdout, stderr) == 0; +} + +bool Minijail::RunAndDestroy(struct minijail* jail, + vector<char*> args, + pid_t* pid) { + bool res = Run(jail, args, pid); + Destroy(jail); + return res; +} + +bool Minijail::RunSyncAndDestroy(struct minijail* jail, + vector<char*> args, + int* status) { + bool res = RunSync(jail, args, status); + Destroy(jail); + return res; +} + +bool Minijail::RunPipeAndDestroy(struct minijail* jail, + vector<char*> args, + pid_t* pid, + int* stdin) { + bool res = RunPipe(jail, args, pid, stdin); + Destroy(jail); + return res; +} + +bool Minijail::RunPipesAndDestroy(struct minijail* jail, + vector<char*> args, + pid_t* pid, + int* stdin, + int* stdout, + int* stderr) { + bool res = RunPipes(jail, args, pid, stdin, stdout, stderr); + Destroy(jail); + return res; +} + +} // namespace brillo diff --git a/brillo/minijail/minijail.h b/brillo/minijail/minijail.h new file mode 100644 index 0000000..a04268d --- /dev/null +++ b/brillo/minijail/minijail.h @@ -0,0 +1,115 @@ +// Copyright (c) 2012 The Chromium OS Authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +#ifndef LIBCHROMEOS_BRILLO_MINIJAIL_MINIJAIL_H_ +#define LIBCHROMEOS_BRILLO_MINIJAIL_MINIJAIL_H_ + +#include <vector> + +extern "C" { +#include <linux/capability.h> +#include <sys/types.h> +} + +#include <base/lazy_instance.h> + +#include <libminijail.h> + +namespace brillo { + +// A Minijail abstraction allowing Minijail mocking in tests. +class Minijail { + public: + virtual ~Minijail(); + + // This is a singleton -- use Minijail::GetInstance()->Foo(). + static Minijail* GetInstance(); + + // minijail_new + virtual struct minijail* New(); + // minijail_destroy + virtual void Destroy(struct minijail* jail); + + // minijail_change_uid/minijail_change_gid + virtual void DropRoot(struct minijail* jail, uid_t uid, gid_t gid); + + // minijail_change_user/minijail_change_group + virtual bool DropRoot(struct minijail* jail, + const char* user, + const char* group); + + // minijail_namespace_pids + virtual void EnterNewPidNamespace(struct minijail* jail); + + // minijail_mount_tmp + virtual void MountTmp(struct minijail* jail); + + // minijail_use_seccomp_filter/minijail_no_new_privs/ + // minijail_parse_seccomp_filters + virtual void UseSeccompFilter(struct minijail* jail, const char* path); + + // minijail_use_caps + virtual void UseCapabilities(struct minijail* jail, uint64_t capmask); + + // minijail_enter + virtual void Enter(struct minijail* jail); + + // minijail_run_pid + virtual bool Run(struct minijail* jail, std::vector<char*> args, pid_t* pid); + + // minijail_run_pid and waitpid + virtual bool RunSync(struct minijail* jail, + std::vector<char*> args, + int* status); + + // minijail_run_pid_pipe + virtual bool RunPipe(struct minijail* jail, + std::vector<char*> args, + pid_t* pid, + int* stdin); + + // minijail_run_pid_pipes + virtual bool RunPipes(struct minijail* jail, + std::vector<char*> args, + pid_t* pid, + int* stdin, + int* stdout, + int* stderr); + + // Run() and Destroy() + virtual bool RunAndDestroy(struct minijail* jail, + std::vector<char*> args, + pid_t* pid); + + // RunSync() and Destroy() + virtual bool RunSyncAndDestroy(struct minijail* jail, + std::vector<char*> args, + int* status); + + // RunPipe() and Destroy() + virtual bool RunPipeAndDestroy(struct minijail* jail, + std::vector<char*> args, + pid_t* pid, + int* stdin); + + // RunPipes() and Destroy() + virtual bool RunPipesAndDestroy(struct minijail* jail, + std::vector<char*> args, + pid_t* pid, + int* stdin, + int* stdout, + int* stderr); + + protected: + Minijail(); + + private: + friend struct base::DefaultLazyInstanceTraits<Minijail>; + + DISALLOW_COPY_AND_ASSIGN(Minijail); +}; + +} // namespace brillo + +#endif // LIBCHROMEOS_BRILLO_MINIJAIL_MINIJAIL_H_ diff --git a/brillo/minijail/mock_minijail.h b/brillo/minijail/mock_minijail.h new file mode 100644 index 0000000..8eb209f --- /dev/null +++ b/brillo/minijail/mock_minijail.h @@ -0,0 +1,67 @@ +// Copyright (c) 2012 The Chromium OS Authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +#ifndef LIBCHROMEOS_BRILLO_MINIJAIL_MOCK_MINIJAIL_H_ +#define LIBCHROMEOS_BRILLO_MINIJAIL_MOCK_MINIJAIL_H_ + +#include <vector> + +#include <base/macros.h> +#include <gmock/gmock.h> + +#include "brillo/minijail/minijail.h" + +namespace brillo { + +class MockMinijail : public brillo::Minijail { + public: + MockMinijail() {} + virtual ~MockMinijail() {} + + MOCK_METHOD0(New, struct minijail*()); + MOCK_METHOD1(Destroy, void(struct minijail*)); + + MOCK_METHOD3(DropRoot, + bool(struct minijail* jail, + const char* user, + const char* group)); + MOCK_METHOD2(UseSeccompFilter, void(struct minijail* jail, const char* path)); + MOCK_METHOD2(UseCapabilities, void(struct minijail* jail, uint64_t capmask)); + MOCK_METHOD1(Enter, void(struct minijail* jail)); + MOCK_METHOD3(Run, + bool(struct minijail* jail, + std::vector<char*> args, + pid_t* pid)); + MOCK_METHOD3(RunSync, + bool(struct minijail* jail, + std::vector<char*> args, + int* status)); + MOCK_METHOD3(RunAndDestroy, + bool(struct minijail* jail, + std::vector<char*> args, + pid_t* pid)); + MOCK_METHOD3(RunSyncAndDestroy, + bool(struct minijail* jail, + std::vector<char*> args, + int* status)); + MOCK_METHOD4(RunPipeAndDestroy, + bool(struct minijail* jail, + std::vector<char*> args, + pid_t* pid, + int* stdin)); + MOCK_METHOD6(RunPipesAndDestroy, + bool(struct minijail* jail, + std::vector<char*> args, + pid_t* pid, + int* stdin, + int* stdout, + int* stderr)); + + private: + DISALLOW_COPY_AND_ASSIGN(MockMinijail); +}; + +} // namespace brillo + +#endif // LIBCHROMEOS_BRILLO_MINIJAIL_MOCK_MINIJAIL_H_ |