/* Copyright 2016 The ChromiumOS Authors

* Use of this source code is governed by a BSD-style license that can be

* found in the LICENSE file.

*

* Test platform independent logic of Minijail using gtest.

*/

#include <errno.h>

#include <dirent.h>

#include <fcntl.h>

#include <sys/mman.h>

#include <sys/mount.h>

#include <sys/resource.h>

#include <sys/stat.h>

#include <sys/syscall.h>

#include <sys/types.h>

#include <sys/wait.h>

#include <unistd.h>

#include <gtest/gtest.h>

#include <functional>

#include <map>

#include <set>

#include <string>

#include "landlock_util.h"

#include "libminijail-private.h"

#include "libminijail.h"

#include "scoped_minijail.h"

#include "test_util.h"

#include "unittest_util.h"

#include "util.h"

namespace {

#if defined(__ANDROID__)

#define ROOT_PREFIX "/system"

#else

#define ROOT_PREFIX ""

#endif

constexpr char kShellPath[] = ROOT_PREFIX "/bin/sh";

constexpr char kCatPath[] = ROOT_PREFIX "/bin/cat";

constexpr char kPreloadPath[] = "./libminijailpreload.so";

constexpr size_t kBufferSize = 128;

constexpr bool kCompiledWithCoverage =

#if defined(CROS_CODE_COVERAGE_ENABLED)

true;

#else

false;

#endif

std::set<pid_t> GetProcessSubtreePids(pid_t root_pid) {

std::set<pid_t> pids{root_pid};

bool progress = false;

do {

progress = false;

DIR* d = opendir("/proc");

if (!d)

pdie("opendir(\"/proc\")");

struct dirent* dir_entry;

while ((dir_entry = readdir(d)) != nullptr) {

if (dir_entry->d_type != DT_DIR)

continue;

char* end;

const int pid = strtol(dir_entry->d_name, &end, 10);

if (*end != '\0')

continue;

std::string path = "/proc/" + std::to_string(pid) + "/stat";

FILE* f = fopen(path.c_str(), "re");

if (!f) {

if (errno == ENOENT) {

// This loop is inherently racy, since PIDs can be reaped in the

// middle of this. Not being able to find one /proc/PID/stat file is

// completely normal.

continue;

}

pdie("fopen(%s)", path.c_str());

}

pid_t ppid;

int ret = fscanf(f, "%*d (%*[^)]) %*c %d", &ppid);

fclose(f);

if (ret != 1) {

continue;

}

if (pids.find(ppid) == pids.end())

continue;

progress |= pids.insert(pid).second;

}

closedir(d);

} while (progress);

return pids;

}

std::map<std::string, std::string> GetNamespaces(

pid_t pid, const std::vector<std::string>& namespace_names) {

std::map<std::string, std::string> namespaces;

char buf[kBufferSize];

for (const auto& namespace_name : namespace_names) {

std::string path = "/proc/" + std::to_string(pid) + "/ns/" + namespace_name;

ssize_t len = readlink(path.c_str(), buf, sizeof(buf));

if (len == -1)

pdie("readlink(\"%s\")", path.c_str());

namespaces.emplace(namespace_name, std::string(buf, len));

}

return namespaces;

}

void set_preload_path(minijail* j) {

// We need to get the absolute path because entering a new mntns will

// implicitly chdir(/) for us.

char* preload_path = realpath(kPreloadPath, nullptr);

ASSERT_NE(preload_path, nullptr);

minijail_set_preload_path(j, preload_path);

free(preload_path);

}

} // namespace

/* Silence unused variable warnings. */

TEST(silence, silence_unused) {

EXPECT_STREQ(kLdPreloadEnvVar, kLdPreloadEnvVar);

EXPECT_STREQ(kFdEnvVar, kFdEnvVar);

EXPECT_STRNE(kFdEnvVar, kLdPreloadEnvVar);

}

TEST(consumebytes, zero) {

char buf[1024];

size_t len = sizeof(buf);

char* pos = &buf[0];

EXPECT_NE(nullptr, consumebytes(0, &pos, &len));

EXPECT_EQ(&buf[0], pos);

EXPECT_EQ(sizeof(buf), len);

}

TEST(consumebytes, exact) {

char buf[1024];

size_t len = sizeof(buf);

char* pos = &buf[0];

/* One past the end since it consumes the whole buffer. */

char* end = &buf[sizeof(buf)];

EXPECT_NE(nullptr, consumebytes(len, &pos, &len));

EXPECT_EQ((size_t)0, len);

EXPECT_EQ(end, pos);

}

TEST(consumebytes, half) {

char buf[1024];

size_t len = sizeof(buf);

char* pos = &buf[0];

/* One past the end since it consumes the whole buffer. */

char* end = &buf[sizeof(buf) / 2];

EXPECT_NE(nullptr, consumebytes(len / 2, &pos, &len));

EXPECT_EQ(sizeof(buf) / 2, len);

EXPECT_EQ(end, pos);

}

TEST(consumebytes, toolong) {

char buf[1024];

size_t len = sizeof(buf);

char* pos = &buf[0];

/* One past the end since it consumes the whole buffer. */

EXPECT_EQ(nullptr, consumebytes(len + 1, &pos, &len));

EXPECT_EQ(sizeof(buf), len);

EXPECT_EQ(&buf[0], pos);

}

TEST(consumestr, zero) {

char buf[1024];

size_t len = 0;

char* pos = &buf[0];

memset(buf, 0xff, sizeof(buf));

EXPECT_EQ(nullptr, consumestr(&pos, &len));

EXPECT_EQ((size_t)0, len);

EXPECT_EQ(&buf[0], pos);

}

TEST(consumestr, nonul) {

char buf[1024];

size_t len = sizeof(buf);

char* pos = &buf[0];

memset(buf, 0xff, sizeof(buf));

EXPECT_EQ(nullptr, consumestr(&pos, &len));

EXPECT_EQ(sizeof(buf), len);

EXPECT_EQ(&buf[0], pos);

}

TEST(consumestr, full) {

char buf[1024];

size_t len = sizeof(buf);

char* pos = &buf[0];

memset(buf, 0xff, sizeof(buf));

buf[sizeof(buf) - 1] = '\0';

EXPECT_EQ((void*)buf, consumestr(&pos, &len));

EXPECT_EQ((size_t)0, len);

EXPECT_EQ(&buf[sizeof(buf)], pos);

}

TEST(consumestr, trailing_nul) {

char buf[1024];

size_t len = sizeof(buf) - 1;

char* pos = &buf[0];

memset(buf, 0xff, sizeof(buf));

buf[sizeof(buf) - 1] = '\0';

EXPECT_EQ(nullptr, consumestr(&pos, &len));

EXPECT_EQ(sizeof(buf) - 1, len);

EXPECT_EQ(&buf[0], pos);

}

class MarshalTest : public ::testing::Test {

protected:

virtual void SetUp() {

m_ = minijail_new();

j_ = minijail_new();

size_ = minijail_size(m_);

}

virtual void TearDown() {

minijail_destroy(m_);

minijail_destroy(j_);

}

char buf_[4096];

struct minijail* m_;

struct minijail* j_;

size_t size_;

};

TEST_F(MarshalTest, empty) {

ASSERT_EQ(0, minijail_marshal(m_, buf_, sizeof(buf_)));

EXPECT_EQ(0, minijail_unmarshal(j_, buf_, size_));

}

TEST_F(MarshalTest, 0xff) {

memset(buf_, 0xff, sizeof(buf_));

/* Should fail on the first consumestr since a NUL will never be found. */

EXPECT_EQ(-EINVAL, minijail_unmarshal(j_, buf_, sizeof(buf_)));

}

TEST_F(MarshalTest, copy_empty) {

ASSERT_EQ(0, minijail_copy_jail(m_, j_));

}

TEST_F(MarshalTest, profile_flags) {

minijail_bind(m_, "/var", "/var", false);

minijail_set_using_minimalistic_mountns(m_);

minijail_set_enable_profile_fs_restrictions(m_);

minijail_add_minimalistic_mountns_fs_rules(m_);

size_ = minijail_size(m_);

for (size_t offset = 0; offset < 8; ++offset) {

do_log(LOG_INFO, "offset: %zu", offset);

ASSERT_EQ(0, minijail_marshal(m_, buf_ + offset, sizeof(buf_) - offset));

EXPECT_EQ(0, minijail_unmarshal(j_, buf_ + offset, size_));

}

}

TEST(KillTest, running_process) {

const ScopedMinijail j(minijail_new());

char* const argv[] = {"sh", "-c", "sleep 1000", nullptr};

EXPECT_EQ(minijail_run(j.get(), kShellPath, argv), 0);

EXPECT_EQ(minijail_kill(j.get()), 128 + SIGTERM);

EXPECT_EQ(minijail_kill(j.get()), -ESRCH);

}

TEST(KillTest, process_already_awaited) {

const ScopedMinijail j(minijail_new());

char* const argv[] = {"sh", "-c", "sleep 1; exit 42", nullptr};

set_preload_path(j.get());

EXPECT_EQ(minijail_run(j.get(), kShellPath, argv), 0);

EXPECT_EQ(minijail_wait(j.get()), 42);

EXPECT_EQ(minijail_kill(j.get()), -ESRCH);

}

TEST(KillTest, process_already_finished_but_not_awaited) {

int fds[2];

const ScopedMinijail j(minijail_new());

char* const argv[] = {"sh", "-c", "exit 42", nullptr};

set_preload_path(j.get());

ASSERT_EQ(pipe(fds), 0);

EXPECT_EQ(minijail_run(j.get(), kShellPath, argv), 0);

ASSERT_EQ(close(fds[1]), 0);

// Wait for process to finish.

char buf[PIPE_BUF];

EXPECT_EQ(read(fds[0], buf, PIPE_BUF), 0);

EXPECT_EQ(minijail_kill(j.get()), 42);

EXPECT_EQ(minijail_wait(j.get()), -ECHILD);

}

TEST(KillTest, process_not_started) {

const ScopedMinijail j(minijail_new());

EXPECT_EQ(minijail_kill(j.get()), -ECHILD);

}

TEST(WaitTest, return_zero) {

const ScopedMinijail j(minijail_new());

char* const argv[] = {"sh", "-c", "exit 0", nullptr};

set_preload_path(j.get());

EXPECT_EQ(minijail_run(j.get(), kShellPath, argv), 0);

EXPECT_EQ(minijail_wait(j.get()), 0);

}

TEST(WaitTest, return_max) {

const ScopedMinijail j(minijail_new());

char* const argv[] = {"sh", "-c", "exit 255", nullptr};

set_preload_path(j.get());

EXPECT_EQ(minijail_run(j.get(), kShellPath, argv), 0);

EXPECT_EQ(minijail_wait(j.get()), 255);

}

TEST(WaitTest, return_modulo) {

const ScopedMinijail j(minijail_new());

char* const argv[] = {"sh", "-c", "exit 256", nullptr};

set_preload_path(j.get());

EXPECT_EQ(minijail_run(j.get(), kShellPath, argv), 0);

EXPECT_EQ(minijail_wait(j.get()), 0);

}

TEST(WaitTest, killed_by_sigkill) {

const ScopedMinijail j(minijail_new());

char* const argv[] = {"sh", "-c", "kill -KILL $$; sleep 1000", nullptr};

set_preload_path(j.get());

EXPECT_EQ(minijail_run(j.get(), kShellPath, argv), 0);

EXPECT_EQ(minijail_wait(j.get()), MINIJAIL_ERR_SIG_BASE + SIGKILL);

}

TEST(WaitTest, killed_by_sigsys) {

const ScopedMinijail j(minijail_new());

char* const argv[] = {"sh", "-c", "kill -SYS $$; sleep 1000", nullptr};

set_preload_path(j.get());

EXPECT_EQ(minijail_run(j.get(), kShellPath, argv), 0);

EXPECT_EQ(minijail_wait(j.get()), MINIJAIL_ERR_SECCOMP_VIOLATION);

}

TEST(WaitTest, command_not_found) {

const ScopedMinijail j(minijail_new());

char* const argv[] = {"whatever", nullptr};

EXPECT_EQ(minijail_run(j.get(), "command that cannot be found", argv), 0);

EXPECT_EQ(minijail_wait(j.get()), MINIJAIL_ERR_NO_COMMAND);

}

TEST(WaitTest, command_not_run) {

const ScopedMinijail j(minijail_new());

char* const argv[] = {"whatever", nullptr};

EXPECT_EQ(minijail_run(j.get(), "/dev/null", argv), 0);

EXPECT_EQ(minijail_wait(j.get()), MINIJAIL_ERR_NO_ACCESS);

}

TEST(WaitTest, no_process) {

const ScopedMinijail j(minijail_new());

EXPECT_EQ(minijail_wait(j.get()), -ECHILD);

}

TEST(WaitTest, can_wait_only_once) {

const ScopedMinijail j(minijail_new());

char* const argv[] = {"sh", "-c", "exit 0", nullptr};

set_preload_path(j.get());

EXPECT_EQ(minijail_run(j.get(), kShellPath, argv), 0);

EXPECT_EQ(minijail_wait(j.get()), 0);

EXPECT_EQ(minijail_wait(j.get()), -ECHILD);

}

TEST(Test, seccomp_logging_emits_warning_to_stderr_when_logging_to_fd) {

if (!debug_logging_allowed())

GTEST_SKIP() << "seccomp logging disabled in this build";

std::string policy_path = source_path("test/seccomp.policy");

int pipefd[2];

ASSERT_EQ(pipe(pipefd), 0);

pid_t pid = fork();

ASSERT_GE(pid, 0);

if (pid == 0) {

close(pipefd[0]);

minijail_log_to_fd(pipefd[1], LOG_INFO);

ScopedMinijail j(minijail_new());

minijail_no_new_privs(j.get());

minijail_use_seccomp_filter(j.get());

minijail_log_seccomp_filter_failures(j.get());

minijail_parse_seccomp_filters(j.get(), policy_path.c_str());

minijail_enter(j.get());

_exit(0);

}

close(pipefd[1]);

std::string log_output;

char buffer[256];

ssize_t read_ret;

while ((read_ret = read(pipefd[0], buffer, sizeof(buffer))) > 0) {

log_output.append(buffer, static_cast<size_t>(read_ret));

}

close(pipefd[0]);

int status;

ASSERT_EQ(waitpid(pid, &status, 0), pid);

ASSERT_TRUE(WIFEXITED(status));

EXPECT_EQ(WEXITSTATUS(status), 0);

EXPECT_NE(log_output.find("logging seccomp filter failures"),

std::string::npos);

}

TEST(Test, minijail_preserve_fd_no_leak) {

const ScopedMinijail j(minijail_new());

char* const script = R"(

echo Hi >&1;

exec 1>&-;

read line1;

read line2;

echo "$line1$line2 and Goodbye" >&2;

exit 42;

)";

char* const argv[] = {"sh", "-c", script, nullptr};

struct rlimit limit {};

ASSERT_EQ(0, getrlimit(RLIMIT_NOFILE, &limit));

const int high_fd = static_cast<int>(limit.rlim_cur) - 1;

const int npipes = 4;

int fds[npipes][2];

// Create pipes.

for (int i = 0; i < npipes; ++i) {

ASSERT_EQ(pipe(fds[i]), 0);

}

// (b/308042314) Move a pipe to > 1024 to check for a crash.

ASSERT_FALSE(minijail_fd_is_open(high_fd)) << "high_fd is already in use";

ASSERT_EQ(dup2(fds[3][1], high_fd), high_fd) << strerror(errno);

EXPECT_EQ(close(fds[3][1]), 0);

fds[3][1] = high_fd;

// All pipes are output pipes except for the first one which is used as

// input pipe.

std::swap(fds[0][0], fds[0][1]);

for (int i = 0; i < npipes; ++i) {

const int fd = fds[i][1];

minijail_preserve_fd(j.get(), fd, i);

}

minijail_close_open_fds(j.get());

EXPECT_EQ(minijail_run_no_preload(j.get(), kShellPath, argv), 0);

// Close unused end of pipes.

for (int i = 0; i < npipes; ++i) {

const int fd = fds[i][1];

ASSERT_EQ(close(fd), 0);

}

const int in = fds[0][0];

const int out = fds[1][0];

const int err = fds[2][0];

char buf[PIPE_BUF];

ssize_t nbytes;

// Check that stdout pipe works.

nbytes = read(out, buf, PIPE_BUF);

ASSERT_GT(nbytes, 0);

EXPECT_EQ(std::string(buf, nbytes), "Hi\n");

// Check that the write end of stdout pipe got closed by the child process. If

// the child process kept other file descriptors connected to stdout, then the

// parent process wouldn't be able to detect that all write ends of this pipe

// are closed and it would block here.

EXPECT_EQ(read(out, buf, PIPE_BUF), 0);

ASSERT_EQ(close(out), 0);

// Check that stdin pipe works.

const std::string s = "Greetings\n";

EXPECT_EQ(write(in, s.data(), s.size()), s.size());

// Close write end of pipe connected to child's stdin. If there was another

// file descriptor connected to this write end, then the child process

// wouldn't be able to detect that this write end is closed and it would

// block.

ASSERT_EQ(close(in), 0);

// Check that child process continued and ended.

nbytes = read(err, buf, PIPE_BUF);

ASSERT_GT(nbytes, 0);

EXPECT_EQ(std::string(buf, nbytes), "Greetings and Goodbye\n");

// Check that the write end of the stderr pipe is closed when the child

// process finishes.

EXPECT_EQ(read(err, buf, PIPE_BUF), 0);

ASSERT_EQ(close(err), 0);

// Check the child process termination status.

EXPECT_EQ(minijail_wait(j.get()), 42);

}

TEST(Test, close_original_pipes_after_dup2) {

// Pipe used by child process to signal that it continued after reading from

// stdin.

int to_wait[2];

ASSERT_EQ(pipe(to_wait), 0);

const ScopedMinijail j(minijail_new());

// Ensure the child inherits a stable write fd for signaling.

const int preserved_fd = 3;

minijail_preserve_fd(j.get(), to_wait[1], preserved_fd);

char* program;

ASSERT_GT(asprintf(&program, R"(

echo Hi >&1;

echo There >&2;

exec 1>&-;

exec 2>&-;

read line1;

read line2;

echo "$line1$line2 and Goodbye" >&%d;

exit 42;

)", preserved_fd),

0);

char* const argv[] = {"sh", "-c", program, nullptr};

int in = -1;

int out = -1;

int err = -1;

EXPECT_EQ(minijail_run_pid_pipes_no_preload(j.get(), kShellPath, argv,

nullptr, &in, &out, &err),

0);

free(program);

EXPECT_GT(in, 0);

EXPECT_GT(out, 0);

EXPECT_GT(err, 0);

char buf[PIPE_BUF];

ssize_t n;

// Check that stdout and stderr pipes work.

n = read(out, buf, PIPE_BUF);

ASSERT_GT(n, 0);

EXPECT_EQ(std::string(buf, n), "Hi\n");

n = read(err, buf, PIPE_BUF);

ASSERT_GT(n, 0);

EXPECT_EQ(std::string(buf, n), "There\n");

// Check that the write ends of stdout and stderr pipes got closed by the

// child process. If the child process kept other file descriptors connected

// to stdout and stderr, then the parent process wouldn't be able to detect

// that all write ends of these pipes are closed and it would block here.

EXPECT_EQ(read(out, buf, PIPE_BUF), 0);

ASSERT_EQ(close(out), 0);

EXPECT_EQ(read(err, buf, PIPE_BUF), 0);

ASSERT_EQ(close(err), 0);

// Check that stdin pipe works.

const std::string s = "Greetings\n";

EXPECT_EQ(write(in, s.data(), s.size()), s.size());

// Close write end of pipe connected to child's stdin. If there was another

// file descriptor connected to this write end, then the child wouldn't be

// able to detect that this write end is closed and it would block.

ASSERT_EQ(close(in), 0);

// Check that child process continued and ended.

n = read(to_wait[0], buf, PIPE_BUF);

ASSERT_GT(n, 0);

EXPECT_EQ(std::string(buf, n), "Greetings and Goodbye\n");

EXPECT_EQ(minijail_wait(j.get()), 42);

}

TEST(Test, minijail_no_clobber_pipe_fd) {

const ScopedMinijail j(minijail_new());

char* const script = R"(

echo Hi >&1;

exec 1>&-;

exec 4>&-;

exec 7>&-;

read line1;

read line2;

echo "$line1$line2 and Goodbye" >&2;

exit 42;

)";

char* const argv[] = {"sh", "-c", script, nullptr};

const int npipes = 3;

int fds[npipes][2];

// Create pipes.

for (int i = 0; i < npipes; ++i) {

ASSERT_EQ(pipe(fds[i]), 0);

}

// All pipes are output pipes except for the first one which is used as

// input pipe.

std::swap(fds[0][0], fds[0][1]);

// Generate a lot of mappings to try to clobber any file descriptors generated

// by libminijail.

for (int offset = 0; offset < npipes * 3; offset += npipes) {

for (int i = 0; i < npipes; ++i) {

const int fd = fds[i][1];

minijail_preserve_fd(j.get(), fd, i + offset);

}

}

minijail_close_open_fds(j.get());

EXPECT_EQ(minijail_run_no_preload(j.get(), kShellPath, argv), 0);

// Close unused end of pipes.

for (int i = 0; i < npipes; ++i) {

const int fd = fds[i][1];

ASSERT_EQ(close(fd), 0);

}

const int in = fds[0][0];

const int out = fds[1][0];

const int err = fds[2][0];

char buf[PIPE_BUF];

ssize_t nbytes;

// Check that stdout pipe works.

nbytes = read(out, buf, PIPE_BUF);

ASSERT_GT(nbytes, 0);

EXPECT_EQ(std::string(buf, nbytes), "Hi\n");

// Check that the write end of stdout pipe got closed by the child process. If

// the child process kept other file descriptors connected to stdout, then the

// parent process wouldn't be able to detect that all write ends of this pipe

// are closed and it would block here.

EXPECT_EQ(read(out, buf, PIPE_BUF), 0);

ASSERT_EQ(close(out), 0);

// Check that stdin pipe works.

const std::string s = "Greetings\n";

EXPECT_EQ(write(in, s.data(), s.size()), s.size());

// Close write end of pipe connected to child's stdin. If there was another

// file descriptor connected to this write end, then the child process

// wouldn't be able to detect that this write end is closed and it would

// block.

ASSERT_EQ(close(in), 0);

// Check that child process continued and ended.

nbytes = read(err, buf, PIPE_BUF);

ASSERT_GT(nbytes, 0);

EXPECT_EQ(std::string(buf, nbytes), "Greetings and Goodbye\n");

// Check that the write end of the stderr pipe is closed when the child

// process finishes.

EXPECT_EQ(read(err, buf, PIPE_BUF), 0);

ASSERT_EQ(close(err), 0);

// Check the child process termination status.

EXPECT_EQ(minijail_wait(j.get()), 42);

}

TEST(Test, minijail_run_env_pid_pipes) {

// TODO(crbug.com/895875): The preload library interferes with ASan since they

// both need to use LD_PRELOAD.

// TODO(b/238743201): This test consistently breaks with code coverage

// enabled. That should be fixed.

if (kCompiledWithCoverage || running_with_asan())

GTEST_SKIP();

ScopedMinijail j(minijail_new());

set_preload_path(j.get());

char* argv[4];

argv[0] = const_cast<char*>(kCatPath);

argv[1] = NULL;

pid_t pid;

int child_stdin, child_stdout;

int mj_run_ret = minijail_run_pid_pipes(j.get(), argv[0], argv, &pid,

&child_stdin, &child_stdout, NULL);

EXPECT_EQ(mj_run_ret, 0);

char teststr[] = "test\n";

const size_t teststr_len = strlen(teststr);

ssize_t write_ret = write(child_stdin, teststr, teststr_len);

EXPECT_EQ(write_ret, static_cast<ssize_t>(teststr_len));

char buf[kBufferSize] = {};

ssize_t read_ret = read(child_stdout, buf, sizeof(buf) - 1);

EXPECT_EQ(read_ret, static_cast<ssize_t>(teststr_len));

EXPECT_STREQ(buf, teststr);

int status;

EXPECT_EQ(kill(pid, SIGTERM), 0);

EXPECT_EQ(waitpid(pid, &status, 0), pid);

ASSERT_TRUE(WIFSIGNALED(status));

EXPECT_EQ(WTERMSIG(status), SIGTERM);

argv[0] = const_cast<char*>(kShellPath);

argv[1] = "-c";

argv[2] = "echo \"${TEST_PARENT+set}|${TEST_VAR}\" >&2";

argv[3] = nullptr;

char* envp[2];

envp[0] = "TEST_VAR=test";

envp[1] = NULL;

// Set a canary env var in the parent that should not be present in the child.

ASSERT_EQ(setenv("TEST_PARENT", "test", 1 /*overwrite*/), 0);

int child_stderr;

mj_run_ret =

minijail_run_env_pid_pipes(j.get(), argv[0], argv, envp, &pid,

&child_stdin, &child_stdout, &child_stderr);

EXPECT_EQ(mj_run_ret, 0);

memset(buf, 0, sizeof(buf));

read_ret = read(child_stderr, buf, sizeof(buf) - 1);

EXPECT_GE(read_ret, 0);

EXPECT_STREQ(buf, "|test\n");

EXPECT_EQ(waitpid(pid, &status, 0), pid);

ASSERT_TRUE(WIFEXITED(status));

EXPECT_EQ(WEXITSTATUS(status), 0);

}

TEST(Test, minijail_run_fd_env_pid_pipes) {

// TODO(crbug.com/895875): The preload library interferes with ASan since they

// both need to use LD_PRELOAD.

// TODO(b/238743201): This test consistently breaks with code coverage

// enabled. That should be fixed.

if (kCompiledWithCoverage || running_with_asan())

GTEST_SKIP();

ScopedMinijail j(minijail_new());

set_preload_path(j.get());

char* argv[4];

argv[0] = const_cast<char*>(kShellPath);

argv[1] = "-c";

argv[2] = "echo \"${TEST_PARENT+set}|${TEST_VAR}\" >&2\n";

argv[3] = nullptr;

char* envp[2];

envp[0] = "TEST_VAR=test";

envp[1] = nullptr;

// Set a canary env var in the parent that should not be present in the child.

ASSERT_EQ(setenv("TEST_PARENT", "test", 1 /*overwrite*/), 0);

int elf_fd = open(const_cast<char*>(kShellPath), O_RDONLY | O_CLOEXEC);

ASSERT_NE(elf_fd, -1);

int dev_null = open("/dev/null", O_RDONLY);

ASSERT_NE(dev_null, -1);

// Create a mapping to dev_null that would clobber elf_fd if it is not

// relocated.

minijail_preserve_fd(j.get(), dev_null, elf_fd);

pid_t pid;

int child_stdin, child_stdout, child_stderr;

int mj_run_ret =

minijail_run_fd_env_pid_pipes(j.get(), elf_fd, argv, envp, &pid,

&child_stdin, &child_stdout, &child_stderr);

EXPECT_EQ(mj_run_ret, 0);

close(dev_null);

char buf[kBufferSize] = {};

ssize_t read_ret = read(child_stderr, buf, sizeof(buf) - 1);

EXPECT_GE(read_ret, 0);

EXPECT_STREQ(buf, "|test\n");

int status;

EXPECT_EQ(waitpid(pid, &status, 0), pid);

ASSERT_TRUE(WIFEXITED(status));

EXPECT_EQ(WEXITSTATUS(status), 0);

}

TEST(Test, minijail_run_env_pid_pipes_with_local_preload) {

// TODO(crbug.com/895875): The preload library interferes with ASan since they

// both need to use LD_PRELOAD.

// TODO(b/238743201): This test consistently breaks with code coverage

// enabled. That should be fixed.

if (kCompiledWithCoverage || running_with_asan())

GTEST_SKIP();

ScopedMinijail j(minijail_new());

// Use the preload library from this test build.

set_preload_path(j.get());

char* argv[4];

argv[0] = const_cast<char*>(kCatPath);

argv[1] = NULL;

pid_t pid;

int child_stdin, child_stdout;

int mj_run_ret = minijail_run_pid_pipes(j.get(), argv[0], argv, &pid,

&child_stdin, &child_stdout, NULL);

EXPECT_EQ(mj_run_ret, 0);

char teststr[] = "test\n";

const size_t teststr_len = strlen(teststr);

ssize_t write_ret = write(child_stdin, teststr, teststr_len);

EXPECT_EQ(write_ret, static_cast<ssize_t>(teststr_len));

char buf[kBufferSize] = {};

ssize_t read_ret = read(child_stdout, buf, sizeof(buf) - 1);

EXPECT_EQ(read_ret, static_cast<ssize_t>(teststr_len));

EXPECT_STREQ(buf, teststr);

int status;

EXPECT_EQ(kill(pid, SIGTERM), 0);

EXPECT_EQ(waitpid(pid, &status, 0), pid);

ASSERT_TRUE(WIFSIGNALED(status));

EXPECT_EQ(WTERMSIG(status), SIGTERM);

argv[0] = const_cast<char*>(kShellPath);

argv[1] = "-c";

argv[2] = "echo \"${TEST_PARENT+set}|${TEST_VAR}\" >&2";

argv[3] = nullptr;

char* envp[2];

envp[0] = "TEST_VAR=test";

envp[1] = NULL;

// Set a canary env var in the parent that should not be present in the child.

ASSERT_EQ(setenv("TEST_PARENT", "test", 1 /*overwrite*/), 0);

int child_stderr;

mj_run_ret =

minijail_run_env_pid_pipes(j.get(), argv[0], argv, envp, &pid,

&child_stdin, &child_stdout, &child_stderr);

EXPECT_EQ(mj_run_ret, 0);

memset(buf, 0, sizeof(buf));

read_ret = read(child_stderr, buf, sizeof(buf) - 1);

EXPECT_GE(read_ret, 0);

EXPECT_STREQ(buf, "|test\n");

EXPECT_EQ(waitpid(pid, &status, 0), pid);

ASSERT_TRUE(WIFEXITED(status));

EXPECT_EQ(WEXITSTATUS(status), 0);

}

TEST(Test, preload_clears_logging_env_var_for_child) {

if (kCompiledWithCoverage || running_with_asan())

GTEST_SKIP();

ScopedMinijail j(minijail_new());

set_preload_path(j.get());

char* argv[4];

argv[0] = const_cast<char*>(kShellPath);

argv[1] = "-c";

argv[2] = "env | grep '^__MINIJAIL_LOGGING=' || echo missing";

argv[3] = nullptr;

char* envp[2];

envp[0] = "__MINIJAIL_LOGGING=stderr";

envp[1] = nullptr;

pid_t pid;

int child_stdin, child_stdout;

int mj_run_ret =

minijail_run_env_pid_pipes(j.get(), argv[0], argv, envp, &pid,

&child_stdin, &child_stdout, nullptr);

ASSERT_EQ(mj_run_ret, 0);

ASSERT_EQ(close(child_stdin), 0);

char buf[kBufferSize] = {};

ssize_t read_ret = read(child_stdout, buf, sizeof(buf) - 1);

ASSERT_GT(read_ret, 0);

EXPECT_STREQ(buf, "missing\n");

ASSERT_EQ(close(child_stdout), 0);

int status;

EXPECT_EQ(waitpid(pid, &status, 0), pid);

ASSERT_TRUE(WIFEXITED(status));

EXPECT_EQ(WEXITSTATUS(status), 0);

}

TEST(Test, test_minijail_no_clobber_fds) {

int dev_null = open("/dev/null", O_RDONLY);

ASSERT_NE(dev_null, -1);

ScopedMinijail j(minijail_new());

// Keep stderr.

minijail_preserve_fd(j.get(), 2, 2);

// Create a lot of mappings to dev_null to possibly clobber libminijail.c fds.

for (int i = 3; i < 15; ++i) {

minijail_preserve_fd(j.get(), dev_null, i);

}

char* argv[4];

argv[0] = const_cast<char*>(kShellPath);

argv[1] = "-c";

argv[2] = "echo Hello; read line1; echo \"${line1}\" >&2";

argv[3] = nullptr;

pid_t pid;

int child_stdin;

int child_stdout;

int child_stderr;

int mj_run_ret = minijail_run_pid_pipes_no_preload(

j.get(), argv[0], argv, &pid, &child_stdin, &child_stdout, &child_stderr);

EXPECT_EQ(mj_run_ret, 0);

char buf[kBufferSize];

ssize_t read_ret = read(child_stdout, buf, sizeof(buf));

EXPECT_GE(read_ret, 0);

buf[read_ret] = '\0';

EXPECT_STREQ(buf, "Hello\n");

constexpr char to_write[] = "test in and err\n";

ssize_t write_ret = write(child_stdin, to_write, sizeof(to_write));

EXPECT_EQ(write_ret, sizeof(to_write));

read_ret = read(child_stderr, buf, sizeof(buf));

EXPECT_GE(read_ret, 0);

buf[read_ret] = '\0';

EXPECT_STREQ(buf, to_write);

int status;

waitpid(pid, &status, 0);

ASSERT_TRUE(WIFEXITED(status));

EXPECT_EQ(WEXITSTATUS(status), 0);

close(dev_null);

}

TEST(Test, test_minijail_no_fd_leaks) {

pid_t pid;

int child_stdout;

int mj_run_ret;

ssize_t read_ret;

char buf[kBufferSize];

char script[kBufferSize];

int status;

char* argv[4];

int dev_null = open("/dev/null", O_RDONLY);

ASSERT_NE(dev_null, -1);

snprintf(script, sizeof(script),

"[ -e /proc/self/fd/%d ] && echo yes || echo no", dev_null);

struct minijail* j = minijail_new();

argv[0] = const_cast<char*>(kShellPath);

argv[1] = "-c";

argv[2] = script;

argv[3] = NULL;

mj_run_ret = minijail_run_pid_pipes_no_preload(j, argv[0], argv, &pid, NULL,

&child_stdout, NULL);

EXPECT_EQ(mj_run_ret, 0);

read_ret = read(child_stdout, buf, sizeof(buf));

EXPECT_GE(read_ret, 0);

buf[read_ret] = '\0';

EXPECT_STREQ(buf, "yes\n");

waitpid(pid, &status, 0);

ASSERT_TRUE(WIFEXITED(status));

EXPECT_EQ(WEXITSTATUS(status), 0);

minijail_close_open_fds(j);

mj_run_ret = minijail_run_pid_pipes_no_preload(j, argv[0], argv, &pid, NULL,

&child_stdout, NULL);

EXPECT_EQ(mj_run_ret, 0);

read_ret = read(child_stdout, buf, sizeof(buf));

EXPECT_GE(read_ret, 0);

buf[read_ret] = '\0';

EXPECT_STREQ(buf, "no\n");

waitpid(pid, &status, 0);

ASSERT_TRUE(WIFEXITED(status));

EXPECT_EQ(WEXITSTATUS(status), 0);

minijail_destroy(j);

close(dev_null);

}

TEST(Test, test_minijail_fork) {

pid_t mj_fork_ret;

int status;

int pipe_fds[2];

ssize_t pid_size = sizeof(mj_fork_ret);

ScopedMinijail j(minijail_new());

ASSERT_EQ(pipe(pipe_fds), 0);

mj_fork_ret = minijail_fork(j.get());

ASSERT_GE(mj_fork_ret, 0);

if (mj_fork_ret == 0) {