mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Ayush RanjanandgVisor bot
b6d0f8496a
As described in the comments, this is the only feasible way of really checking CAP_NET_RAW properly. This is what Fuchsia (test/util/fuchsia_capability_util.cc) uses as well. This also allows us to more granularly check raw socket capabilities. For example, it is possible to have caps for socket(AF_INET, SOCK_RAW, IPPROTO_RAW) but *not* for socket(AF_INET, SOCK_RAW, IPPROTO_UDP). Fixes test failures where the test was being run in a new userns but the netns had the initial userns. So the test effectively could open raw sockets. Cleanup: - Cleaned up some redundant SKIP_IF(Have[RawIP/Packet]SocketCapability()) from various TEST_P/TEST_F tests whose test class's SetUp() was already calling GTEST_SKIP() when the capability was not available. - Removed redundant EPERM checks after Have[RawIP/Packet]SocketCapability() returned false. Now the implementation only returns false if socket creation results in EPERM. So the EPERM check again was redundant. PiperOrigin-RevId: 881067665
74 lines
2.1 KiB
C++
74 lines
2.1 KiB
C++
// Copyright 2021 The gVisor Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
#ifdef __Fuchsia__
|
|
|
|
#include <netinet/if_ether.h>
|
|
#include <netinet/in.h>
|
|
#include <sys/socket.h>
|
|
|
|
#include "test/util/socket_util.h"
|
|
|
|
namespace gvisor {
|
|
namespace testing {
|
|
|
|
// On Linux, access to raw IP and packet socket is controlled by a single
|
|
// capability (CAP_NET_RAW). However on Fuchsia, access to raw IP and packet
|
|
// sockets are controlled by separate capabilities/protocols.
|
|
|
|
namespace {
|
|
|
|
PosixErrorOr<bool> HaveSocketCapability(int domain, int type, int protocol) {
|
|
// Fuchsia does not have a platform supported way to check the protocols made
|
|
// available to a sandbox. As a workaround, simply try to create the specified
|
|
// socket and assume no access if we get a no permissions error.
|
|
auto s = Socket(domain, type, protocol);
|
|
if (s.ok()) {
|
|
return true;
|
|
}
|
|
if (s.error().errno_value() == EPERM) {
|
|
return false;
|
|
}
|
|
return s.error();
|
|
}
|
|
|
|
} // namespace
|
|
|
|
PosixErrorOr<bool> HaveRawIPSocketCapability(int family, int protocol) {
|
|
static PosixErrorOr<bool> result(false);
|
|
static std::once_flag once;
|
|
|
|
std::call_once(once, [&]() {
|
|
result = HaveSocketCapability(family, SOCK_RAW, protocol);
|
|
});
|
|
|
|
return result;
|
|
}
|
|
|
|
PosixErrorOr<bool> HavePacketSocketCapability(int type, int protocol) {
|
|
static PosixErrorOr<bool> result(false);
|
|
static std::once_flag once;
|
|
|
|
std::call_once(once, [&]() {
|
|
result = HaveSocketCapability(AF_PACKET, type, htons(protocol));
|
|
});
|
|
|
|
return result;
|
|
}
|
|
|
|
} // namespace testing
|
|
} // namespace gvisor
|
|
|
|
#endif // __Fuchsia__
|