mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Ayush RanjanandgVisor bot
b6d0f8496a
As described in the comments, this is the only feasible way of really checking CAP_NET_RAW properly. This is what Fuchsia (test/util/fuchsia_capability_util.cc) uses as well. This also allows us to more granularly check raw socket capabilities. For example, it is possible to have caps for socket(AF_INET, SOCK_RAW, IPPROTO_RAW) but *not* for socket(AF_INET, SOCK_RAW, IPPROTO_UDP). Fixes test failures where the test was being run in a new userns but the netns had the initial userns. So the test effectively could open raw sockets. Cleanup: - Cleaned up some redundant SKIP_IF(Have[RawIP/Packet]SocketCapability()) from various TEST_P/TEST_F tests whose test class's SetUp() was already calling GTEST_SKIP() when the capability was not available. - Removed redundant EPERM checks after Have[RawIP/Packet]SocketCapability() returned false. Now the implementation only returns false if socket creation results in EPERM. So the EPERM check again was redundant. PiperOrigin-RevId: 881067665
49 lines
1.5 KiB
C++
49 lines
1.5 KiB
C++
// Copyright 2018 The gVisor Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
// Utilities for testing capabilities.
|
|
|
|
#ifndef GVISOR_TEST_UTIL_CAPABILITY_UTIL_H_
|
|
#define GVISOR_TEST_UTIL_CAPABILITY_UTIL_H_
|
|
|
|
#include "test/util/posix_error.h"
|
|
|
|
#if defined(__Fuchsia__)
|
|
// Nothing to include.
|
|
#elif defined(__linux__)
|
|
#include "test/util/linux_capability_util.h"
|
|
#else
|
|
#error "Unhandled platform"
|
|
#endif
|
|
|
|
namespace gvisor {
|
|
namespace testing {
|
|
|
|
// HaveRawIPSocketCapability returns whether or not the process has access to
|
|
// raw IP sockets.
|
|
//
|
|
// Returns an error when raw IP socket access cannot be determined.
|
|
PosixErrorOr<bool> HaveRawIPSocketCapability(int family, int protocol);
|
|
|
|
// HavePacketSocketCapability returns whether or not the process has access to
|
|
// packet sockets.
|
|
//
|
|
// Returns an error when packet socket access cannot be determined.
|
|
PosixErrorOr<bool> HavePacketSocketCapability(int type, int protocol);
|
|
|
|
} // namespace testing
|
|
} // namespace gvisor
|
|
|
|
#endif // GVISOR_TEST_UTIL_CAPABILITY_UTIL_H_
|