sandbox/linux/syscall_broker/broker_file_permission_unittest.cc - chromium/src - Git at Google

 // Copyright 2014 The Chromium Authors
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

 #include "sandbox/linux/syscall_broker/broker_file_permission.h"

 #include <fcntl.h>
 #include <string.h>
 #include <sys/inotify.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>

 #include "base/check.h"
 #include "base/notreached.h"
 #include "sandbox/linux/tests/test_utils.h"
 #include "sandbox/linux/tests/unit_tests.h"
 #include "testing/gtest/include/gtest/gtest.h"

 namespace sandbox {
 namespace syscall_broker {

 class BrokerFilePermissionTester {
  public:
   BrokerFilePermissionTester(const BrokerFilePermissionTester&) = delete;
   BrokerFilePermissionTester& operator=(const BrokerFilePermissionTester&) =
       delete;

   static bool ValidatePath(const char* path) {
     return BrokerFilePermission::ValidatePath(path);
   }
   static const char* GetErrorMessage() {
     return BrokerFilePermission::GetErrorMessageForTests();
   }
 };

 namespace {

 // Creation tests are DEATH tests as a bad permission causes termination.
 SANDBOX_TEST(BrokerFilePermission, CreateGood) {
   const char kPath[] = "/tmp/good";
   BrokerFilePermission perm = BrokerFilePermission::ReadOnly(kPath);
 }

 SANDBOX_TEST(BrokerFilePermission, CreateGoodRecursive) {
   const char kPath[] = "/tmp/good/";
   BrokerFilePermission perm = BrokerFilePermission::ReadOnlyRecursive(kPath);
 }

 // In official builds, CHECK(x) causes a SIGTRAP on the architectures where the
 // sanbox is enabled (that are x86, x86_64, arm64 and 32-bit arm processes
 // running on a arm64 kernel).
 #if defined(OFFICIAL_BUILD)
 #define DEATH_BY_CHECK(msg) DEATH_BY_SIGNAL(SIGTRAP)
 #else
 #define DEATH_BY_CHECK(msg) DEATH_MESSAGE(msg)
 #endif

 SANDBOX_DEATH_TEST(
     BrokerFilePermission,
     CreateBad,
     DEATH_BY_CHECK(BrokerFilePermissionTester::GetErrorMessage())) {
   const char kPath[] = "/tmp/bad/";
   BrokerFilePermission perm = BrokerFilePermission::ReadOnly(kPath);
 }

 SANDBOX_DEATH_TEST(
     BrokerFilePermission,
     CreateBadRecursive,
     DEATH_BY_CHECK(BrokerFilePermissionTester::GetErrorMessage())) {
   const char kPath[] = "/tmp/bad";
   BrokerFilePermission perm = BrokerFilePermission::ReadOnlyRecursive(kPath);
 }

 SANDBOX_DEATH_TEST(
     BrokerFilePermission,
     CreateBadNotAbs,
     DEATH_BY_CHECK(BrokerFilePermissionTester::GetErrorMessage())) {
   const char kPath[] = "tmp/bad";
   BrokerFilePermission perm = BrokerFilePermission::ReadOnly(kPath);
 }

 SANDBOX_DEATH_TEST(
     BrokerFilePermission,
     CreateBadEmpty,
     DEATH_BY_CHECK(BrokerFilePermissionTester::GetErrorMessage())) {
   const char kPath[] = "";
   BrokerFilePermission perm = BrokerFilePermission::ReadOnly(kPath);
 }

 // CheckPerm tests |path| against |perm| given |access_flags|.
 // If |create| is true then file creation is tested for success.
 void CheckPerm(const BrokerFilePermission& perm,
                const char* path,
                int access_flags,
                bool create) {
   ASSERT_FALSE(perm.CheckAccess(path, X_OK));
   ASSERT_TRUE(perm.CheckAccess(path, F_OK));
   // check bad perms
   switch (access_flags) {
     case O_RDONLY:
       ASSERT_TRUE(perm.CheckOpen(path, O_RDONLY).first);
       ASSERT_FALSE(perm.CheckOpen(path, O_WRONLY).first);
       ASSERT_FALSE(perm.CheckOpen(path, O_RDWR).first);
       ASSERT_TRUE(perm.CheckAccess(path, R_OK));
       ASSERT_FALSE(perm.CheckAccess(path, W_OK));
       break;
     case O_WRONLY:
       ASSERT_FALSE(perm.CheckOpen(path, O_RDONLY).first);
       ASSERT_TRUE(perm.CheckOpen(path, O_WRONLY).first);
       ASSERT_FALSE(perm.CheckOpen(path, O_RDWR).first);
       ASSERT_FALSE(perm.CheckAccess(path, R_OK));
       ASSERT_TRUE(perm.CheckAccess(path, W_OK));
       break;
     case O_RDWR:
       ASSERT_TRUE(perm.CheckOpen(path, O_RDONLY).first);
       ASSERT_TRUE(perm.CheckOpen(path, O_WRONLY).first);
       ASSERT_TRUE(perm.CheckOpen(path, O_RDWR).first);
       ASSERT_TRUE(perm.CheckAccess(path, R_OK));
       ASSERT_TRUE(perm.CheckAccess(path, W_OK));
       break;
     default:
       // Bad test case
       NOTREACHED();
   }

 // O_SYNC can be defined as (__O_SYNC|O_DSYNC)
 #ifdef O_DSYNC
   const int kSyncFlag = O_SYNC & ~O_DSYNC;
 #else
   const int kSyncFlag = O_SYNC;
 #endif

   const int kNumberOfBitsInOAccMode = 2;
   static_assert(O_ACCMODE == ((1 << kNumberOfBitsInOAccMode) - 1),
                 "incorrect number of bits");
   // check every possible flag and act accordingly.
   // Skipping AccMode bits as they are present in every case.
   for (int i = kNumberOfBitsInOAccMode; i < 32; i++) {
     int flag = 1 << i;
     switch (flag) {
       case O_APPEND:
       case O_ASYNC:
       case O_DIRECT:
       case O_DIRECTORY:
 #ifdef O_DSYNC
       case O_DSYNC:
 #endif
       case O_EXCL:
       case O_LARGEFILE:
       case O_NOATIME:
       case O_NOCTTY:
       case O_NOFOLLOW:
       case O_NONBLOCK:
 #if (O_NONBLOCK != O_NDELAY)
       case O_NDELAY:
 #endif
       case kSyncFlag:
         ASSERT_TRUE(perm.CheckOpen(path, access_flags | flag).first);
         break;
       case O_TRUNC: {
         // The effect of (O_RDONLY | O_TRUNC) is undefined, and in some cases it
         // actually truncates, so deny.
         const char* result = perm.CheckOpen(path, access_flags | flag).first;
         if (access_flags == O_RDONLY) {
           ASSERT_FALSE(result);
         } else {
           ASSERT_TRUE(result);
         }
         break;
       }
       case O_CREAT:
         continue;  // Handled below.
       case O_CLOEXEC:
       default:
         ASSERT_FALSE(perm.CheckOpen(path, access_flags | flag).first);
     }
   }
   if (create) {
     const char* result;
     bool unlink;
     std::tie(result, unlink) =
         perm.CheckOpen(path, O_CREAT | O_EXCL | access_flags);
     ASSERT_TRUE(result);
     ASSERT_FALSE(unlink);
   } else {
     ASSERT_FALSE(perm.CheckOpen(path, O_CREAT | O_EXCL | access_flags).first);
   }
 }

 TEST(BrokerFilePermission, ReadOnly) {
   const char kPath[] = "/tmp/good";
   BrokerFilePermission perm = BrokerFilePermission::ReadOnly(kPath);
   CheckPerm(perm, kPath, O_RDONLY, false);
   // Don't do anything here, so that ASSERT works in the subfunction as
   // expected.
 }

 TEST(BrokerFilePermission, ReadOnlyRecursive) {
   const char kPath[] = "/tmp/good/";
   const char kPathFile[] = "/tmp/good/file";
   BrokerFilePermission perm = BrokerFilePermission::ReadOnlyRecursive(kPath);
   CheckPerm(perm, kPathFile, O_RDONLY, false);
   // Don't do anything here, so that ASSERT works in the subfunction as
   // expected.
 }

 // Explicit test for O_RDONLY|O_TRUNC, which should be denied due to
 // undefined behavior.
 TEST(BrokerFilePermission, ReadOnlyTruncate) {
   const char kPath[] = "/tmp/good";
   BrokerFilePermission perm = BrokerFilePermission::ReadOnly(kPath);
   ASSERT_FALSE(perm.CheckOpen(kPath, O_RDONLY | O_TRUNC).first);
 }

 TEST(BrokerFilePermission, WriteOnly) {
   const char kPath[] = "/tmp/good";
   BrokerFilePermission perm = BrokerFilePermission::WriteOnly(kPath);
   CheckPerm(perm, kPath, O_WRONLY, false);
   // Don't do anything here, so that ASSERT works in the subfunction as
   // expected.
 }

 TEST(BrokerFilePermission, ReadWrite) {
   const char kPath[] = "/tmp/good";
   BrokerFilePermission perm = BrokerFilePermission::ReadWrite(kPath);
   CheckPerm(perm, kPath, O_RDWR, false);
   // Don't do anything here, so that ASSERT works in the subfunction as
   // expected.
 }

 TEST(BrokerFilePermission, ReadWriteCreate) {
   const char kPath[] = "/tmp/good";
   BrokerFilePermission perm = BrokerFilePermission::ReadWriteCreate(kPath);
   CheckPerm(perm, kPath, O_RDWR, true);
   // Don't do anything here, so that ASSERT works in the subfunction as
   // expected.
 }

 void CheckUnlink(BrokerFilePermission& perm,
                  const char* path,
                  int access_flags) {
   ASSERT_FALSE(perm.CheckOpen(path, access_flags).first);

   const char* result;
   bool unlink;
   std::tie(result, unlink) =
       perm.CheckOpen(path, access_flags | O_CREAT | O_EXCL);
   ASSERT_TRUE(result);
   ASSERT_TRUE(unlink);
 }

 TEST(BrokerFilePermission, ReadWriteCreateTemporaryRecursive) {
   const char kPath[] = "/tmp/good/";
   const char kPathFile[] = "/tmp/good/file";
   BrokerFilePermission perm =
       BrokerFilePermission::ReadWriteCreateTemporaryRecursive(kPath);
   CheckUnlink(perm, kPathFile, O_RDWR);
   // Don't do anything here, so that ASSERT works in the subfunction as
   // expected.
 }

 TEST(BrokerFilePermission, StatOnlyWithIntermediateDirs) {
   const char kPath[] = "/tmp/good/path";
   const char kLeading1[] = "/";
   const char kLeading2[] = "/tmp";
   const char kLeading3[] = "/tmp/good/path";
   const char kBadPrefix[] = "/tmp/good/pa";
   const char kTrailing[] = "/tmp/good/path/bad";

   BrokerFilePermission perm =
       BrokerFilePermission::StatOnlyWithIntermediateDirs(kPath);
   // No open or access permission.
   ASSERT_FALSE(perm.CheckOpen(kPath, O_RDONLY).first);
   ASSERT_FALSE(perm.CheckOpen(kPath, O_WRONLY).first);
   ASSERT_FALSE(perm.CheckOpen(kPath, O_RDWR).first);
   ASSERT_FALSE(perm.CheckAccess(kPath, R_OK));
   ASSERT_FALSE(perm.CheckAccess(kPath, W_OK));

   // Stat for all leading paths, but not trailing paths.
   ASSERT_TRUE(perm.CheckStatWithIntermediates(kPath));
   ASSERT_TRUE(perm.CheckStatWithIntermediates(kLeading1));
   ASSERT_TRUE(perm.CheckStatWithIntermediates(kLeading2));
   ASSERT_TRUE(perm.CheckStatWithIntermediates(kLeading3));
   ASSERT_FALSE(perm.CheckStatWithIntermediates(kBadPrefix));
   ASSERT_FALSE(perm.CheckStatWithIntermediates(kTrailing));
 }

 TEST(BrokerFilePermission, InotifyAddWatchWithIntermediateDirs) {
   const char kPath[] = "/tmp/good/path";
   const char kLeading1[] = "/";
   const char kLeading2[] = "/tmp";
   const char kLeading3[] = "/tmp/good/path";
   const char kBadPrefix[] = "/tmp/good/pa";
   const char kTrailing[] = "/tmp/good/path/bad";

   const uint32_t kBadMask =
       IN_CREATE | IN_DELETE | IN_CLOSE_WRITE | IN_MOVE | IN_ONLYDIR;
   const uint32_t kGoodMask = kBadMask | IN_ATTRIB;

   BrokerFilePermission perm =
       BrokerFilePermission::InotifyAddWatchWithIntermediateDirs(kPath);
   // No open or access permission.
   ASSERT_FALSE(perm.CheckOpen(kPath, O_RDONLY).first);
   ASSERT_FALSE(perm.CheckOpen(kPath, O_WRONLY).first);
   ASSERT_FALSE(perm.CheckOpen(kPath, O_RDWR).first);
   ASSERT_FALSE(perm.CheckAccess(kPath, R_OK));
   ASSERT_FALSE(perm.CheckAccess(kPath, W_OK));

   // Inotify_add_watch for all leading paths, but not trailing paths.
   ASSERT_TRUE(perm.CheckInotifyAddWatchWithIntermediates(kPath, kGoodMask));
   ASSERT_TRUE(perm.CheckInotifyAddWatchWithIntermediates(kLeading1, kGoodMask));
   ASSERT_TRUE(perm.CheckInotifyAddWatchWithIntermediates(kLeading2, kGoodMask));
   ASSERT_TRUE(perm.CheckInotifyAddWatchWithIntermediates(kLeading3, kGoodMask));
   ASSERT_FALSE(
       perm.CheckInotifyAddWatchWithIntermediates(kBadPrefix, kGoodMask));
   ASSERT_FALSE(
       perm.CheckInotifyAddWatchWithIntermediates(kTrailing, kGoodMask));

   // Fails without correct mask.
   ASSERT_FALSE(perm.CheckInotifyAddWatchWithIntermediates(kPath, kBadMask));
 }

 TEST(BrokerFilePermission, AllPermissions) {
   // `kPath` and `kPathDir` get allowlisted with AllPermissions and
   // AllPermissionsRecursive, respectively.
   static constexpr char kPath[] = "/tmp/good";
   static constexpr char kPathDir[] = "/tmp/good/";
   static constexpr char kPathFile[] = "/tmp/good/file";
   static constexpr char kPathFileExtraStuff[] = "/tmp/good/file/extrastuff";
   static constexpr char kLeading1[] = "/";
   static constexpr char kLeading2[] = "/tmp";
   static constexpr char kBadPrefix[] = "/tmp/go";
   static constexpr char kExtraStuff[] = "/tmp/good_extra_stuff";
   static constexpr char kExtraStuffFile[] = "/tmp/good_extra_stuff/file";
   static constexpr char kDoubleSlash[] = "/tmp//good/file";
   static constexpr char kParentRef[] = "/tmp/good/../file";

   constexpr uint32_t kBadInotifyMask =
       IN_CREATE | IN_DELETE | IN_CLOSE_WRITE | IN_MOVE | IN_ONLYDIR;
   constexpr uint32_t kGoodInotifyMask = kBadInotifyMask | IN_ATTRIB;

   BrokerFilePermission perm =
       BrokerFilePermission::AllPermissionsRecursive(kPathDir);
   // Opening and accessing the nested files `kPathFile` and
   // `kPathFileExtraStuff` should work.
   EXPECT_TRUE(perm.CheckOpen(kPathFile, O_CREAT | O_EXCL | O_RDONLY).first);
   EXPECT_TRUE(perm.CheckOpen(kPathFile, O_CREAT | O_EXCL | O_RDWR).first);
   EXPECT_TRUE(perm.CheckAccess(kPathFile, R_OK));
   EXPECT_TRUE(perm.CheckAccess(kPathFile, W_OK));
   EXPECT_TRUE(
       perm.CheckOpen(kPathFileExtraStuff, O_CREAT | O_EXCL | O_RDONLY).first);
   EXPECT_TRUE(
       perm.CheckOpen(kPathFileExtraStuff, O_CREAT | O_EXCL | O_RDWR).first);
   EXPECT_TRUE(perm.CheckAccess(kPathFileExtraStuff, R_OK));
   EXPECT_TRUE(perm.CheckAccess(kPathFileExtraStuff, W_OK));
   // Opening and accessing anything above the path shouldn't work.
   EXPECT_FALSE(perm.CheckOpen(kBadPrefix, R_OK).first);
   EXPECT_FALSE(perm.CheckAccess(kBadPrefix, R_OK));
   EXPECT_FALSE(perm.CheckOpen(kLeading1, R_OK).first);
   EXPECT_FALSE(perm.CheckAccess(kLeading1, R_OK));
   EXPECT_FALSE(perm.CheckOpen(kLeading2, R_OK).first);
   EXPECT_FALSE(perm.CheckAccess(kLeading2, R_OK));
   // Stat should work recursively and on intermediates but not on all files.
   EXPECT_TRUE(perm.CheckStatWithIntermediates(kPathFile));
   EXPECT_TRUE(perm.CheckStatWithIntermediates(kLeading1));
   EXPECT_TRUE(perm.CheckStatWithIntermediates(kLeading2));
   EXPECT_FALSE(perm.CheckStatWithIntermediates(kBadPrefix));
   // InotifyAddWatch should work recursively and on intermediates but not on all
   // files.
   EXPECT_TRUE(
       perm.CheckInotifyAddWatchWithIntermediates(kPathFile, kGoodInotifyMask));
   EXPECT_TRUE(
       perm.CheckInotifyAddWatchWithIntermediates(kLeading1, kGoodInotifyMask));
   EXPECT_TRUE(
       perm.CheckInotifyAddWatchWithIntermediates(kLeading2, kGoodInotifyMask));
   EXPECT_FALSE(
       perm.CheckInotifyAddWatchWithIntermediates(kBadPrefix, kGoodInotifyMask));
   // InotifyAddWatch should still fail without the correct mask.
   EXPECT_FALSE(
       perm.CheckInotifyAddWatchWithIntermediates(kPathFile, kBadInotifyMask));

   EXPECT_TRUE(perm.CheckStatWithIntermediates(kPath));
   EXPECT_TRUE(
       perm.CheckInotifyAddWatchWithIntermediates(kPath, kGoodInotifyMask));
   // Empty string should always fail
   EXPECT_FALSE(perm.CheckOpen("", O_CREAT | O_EXCL | O_RDONLY).first);
   EXPECT_FALSE(perm.CheckOpen("", O_CREAT | O_EXCL | O_RDWR).first);
   EXPECT_FALSE(perm.CheckAccess("", R_OK));
   EXPECT_FALSE(perm.CheckAccess("", W_OK));
   EXPECT_FALSE(perm.CheckStatWithIntermediates(""));
   EXPECT_FALSE(
       perm.CheckInotifyAddWatchWithIntermediates("", kGoodInotifyMask));
   // Extra characters on the allowlisted path shouldn't pass:
   EXPECT_FALSE(perm.CheckOpen(kExtraStuff, O_CREAT | O_EXCL | O_RDONLY).first);
   EXPECT_FALSE(perm.CheckOpen(kExtraStuff, O_CREAT | O_EXCL | O_RDWR).first);
   EXPECT_FALSE(perm.CheckAccess(kExtraStuff, R_OK));
   EXPECT_FALSE(perm.CheckAccess(kExtraStuff, W_OK));
   EXPECT_FALSE(perm.CheckStatWithIntermediates(kExtraStuff));
   EXPECT_FALSE(perm.CheckInotifyAddWatchWithIntermediates(kExtraStuff,
                                                           kGoodInotifyMask));
   // Extra characters and an extra filename on the allowlisted path shouldn't
   // pass:
   EXPECT_FALSE(
       perm.CheckOpen(kExtraStuffFile, O_CREAT | O_EXCL | O_RDONLY).first);
   EXPECT_FALSE(
       perm.CheckOpen(kExtraStuffFile, O_CREAT | O_EXCL | O_RDWR).first);
   EXPECT_FALSE(perm.CheckAccess(kExtraStuffFile, R_OK));
   EXPECT_FALSE(perm.CheckAccess(kExtraStuffFile, W_OK));
   EXPECT_FALSE(perm.CheckStatWithIntermediates(kExtraStuffFile));
   EXPECT_FALSE(perm.CheckInotifyAddWatchWithIntermediates(kExtraStuffFile,
                                                           kGoodInotifyMask));
   // The sandbox doesn't bother parsing multiple separators in a row:
   EXPECT_FALSE(perm.CheckOpen(kDoubleSlash, O_CREAT | O_EXCL | O_RDONLY).first);
   EXPECT_FALSE(perm.CheckOpen(kDoubleSlash, O_CREAT | O_EXCL | O_RDWR).first);
   EXPECT_FALSE(perm.CheckAccess(kDoubleSlash, R_OK));
   EXPECT_FALSE(perm.CheckAccess(kDoubleSlash, W_OK));
   EXPECT_FALSE(perm.CheckStatWithIntermediates(kDoubleSlash));
   EXPECT_FALSE(perm.CheckInotifyAddWatchWithIntermediates(kDoubleSlash,
                                                           kGoodInotifyMask));
   // The sandbox auto-rejects paths with parent references:
   EXPECT_FALSE(perm.CheckOpen(kParentRef, O_CREAT | O_EXCL | O_RDONLY).first);
   EXPECT_FALSE(perm.CheckOpen(kParentRef, O_CREAT | O_EXCL | O_RDWR).first);
   EXPECT_FALSE(perm.CheckAccess(kParentRef, R_OK));
   EXPECT_FALSE(perm.CheckAccess(kParentRef, W_OK));
   EXPECT_FALSE(perm.CheckStatWithIntermediates(kParentRef));
   EXPECT_FALSE(
       perm.CheckInotifyAddWatchWithIntermediates(kParentRef, kGoodInotifyMask));

   // This permission should allow all access to `kPath` specifically.
   perm = BrokerFilePermission::AllPermissions(kPath);
   EXPECT_TRUE(perm.CheckOpen(kPath, O_CREAT | O_EXCL | O_RDONLY).first);
   EXPECT_TRUE(perm.CheckOpen(kPath, O_CREAT | O_EXCL | O_RDWR).first);
   EXPECT_TRUE(perm.CheckAccess(kPath, R_OK));
   EXPECT_TRUE(perm.CheckAccess(kPath, W_OK));
   EXPECT_TRUE(perm.CheckStatWithIntermediates(kPath));
   EXPECT_TRUE(
       perm.CheckInotifyAddWatchWithIntermediates(kPath, kGoodInotifyMask));
   // InotifyAddWatch should still fail without the correct mask.
   EXPECT_FALSE(
       perm.CheckInotifyAddWatchWithIntermediates(kPath, kBadInotifyMask));
   // Empty string should always fail
   EXPECT_FALSE(perm.CheckOpen("", O_CREAT | O_EXCL | O_RDONLY).first);
   EXPECT_FALSE(perm.CheckOpen("", O_CREAT | O_EXCL | O_RDWR).first);
   EXPECT_FALSE(perm.CheckAccess("", R_OK));
   EXPECT_FALSE(perm.CheckAccess("", W_OK));
   EXPECT_FALSE(perm.CheckStatWithIntermediates(""));
   EXPECT_FALSE(
       perm.CheckInotifyAddWatchWithIntermediates("", kGoodInotifyMask));
   // Extra characters on the allowlisted path shouldn't pass:
   EXPECT_FALSE(perm.CheckOpen(kExtraStuff, O_CREAT | O_EXCL | O_RDONLY).first);
   EXPECT_FALSE(perm.CheckOpen(kExtraStuff, O_CREAT | O_EXCL | O_RDWR).first);
   EXPECT_FALSE(perm.CheckAccess(kExtraStuff, R_OK));
   EXPECT_FALSE(perm.CheckAccess(kExtraStuff, W_OK));
   EXPECT_FALSE(perm.CheckStatWithIntermediates(kExtraStuff));
   EXPECT_FALSE(perm.CheckInotifyAddWatchWithIntermediates(kExtraStuff,
                                                           kGoodInotifyMask));
   // Extra characters and an extra filename on the allowlisted path shouldn't
   // pass:
   EXPECT_FALSE(
       perm.CheckOpen(kExtraStuffFile, O_CREAT | O_EXCL | O_RDONLY).first);
   EXPECT_FALSE(
       perm.CheckOpen(kExtraStuffFile, O_CREAT | O_EXCL | O_RDWR).first);
   EXPECT_FALSE(perm.CheckAccess(kExtraStuffFile, R_OK));
   EXPECT_FALSE(perm.CheckAccess(kExtraStuffFile, W_OK));
   EXPECT_FALSE(perm.CheckStatWithIntermediates(kExtraStuffFile));
   EXPECT_FALSE(perm.CheckInotifyAddWatchWithIntermediates(kExtraStuffFile,
                                                           kGoodInotifyMask));
   // The sandbox doesn't bother parsing multiple separators in a row:
   EXPECT_FALSE(perm.CheckOpen(kDoubleSlash, O_CREAT | O_EXCL | O_RDONLY).first);
   EXPECT_FALSE(perm.CheckOpen(kDoubleSlash, O_CREAT | O_EXCL | O_RDWR).first);
   EXPECT_FALSE(perm.CheckAccess(kDoubleSlash, R_OK));
   EXPECT_FALSE(perm.CheckAccess(kDoubleSlash, W_OK));
   EXPECT_FALSE(perm.CheckStatWithIntermediates(kDoubleSlash));
   EXPECT_FALSE(perm.CheckInotifyAddWatchWithIntermediates(kDoubleSlash,
                                                           kGoodInotifyMask));
 }

 TEST(BrokerFilePermission, ValidatePath) {
   EXPECT_TRUE(BrokerFilePermissionTester::ValidatePath("/path"));
   EXPECT_TRUE(BrokerFilePermissionTester::ValidatePath("/"));
   EXPECT_TRUE(BrokerFilePermissionTester::ValidatePath("/..path"));

   EXPECT_FALSE(BrokerFilePermissionTester::ValidatePath(""));
   EXPECT_FALSE(BrokerFilePermissionTester::ValidatePath("bad"));
   EXPECT_FALSE(BrokerFilePermissionTester::ValidatePath("/bad/"));
   EXPECT_FALSE(BrokerFilePermissionTester::ValidatePath("bad/"));
   EXPECT_FALSE(BrokerFilePermissionTester::ValidatePath("/bad/.."));
   EXPECT_FALSE(BrokerFilePermissionTester::ValidatePath("/bad/../bad"));
   EXPECT_FALSE(BrokerFilePermissionTester::ValidatePath("/../bad"));
 }

 }  // namespace
 }  // namespace syscall_broker
 }  // namespace sandbox
	// Copyright 2014 The Chromium Authors
	// Use of this source code is governed by a BSD-style license that can be
	// found in the LICENSE file.

	#include "sandbox/linux/syscall_broker/broker_file_permission.h"

	#include <fcntl.h>
	#include <string.h>
	#include <sys/inotify.h>
	#include <sys/stat.h>
	#include <sys/types.h>
	#include <unistd.h>

	#include "base/check.h"
	#include "base/notreached.h"
	#include "sandbox/linux/tests/test_utils.h"
	#include "sandbox/linux/tests/unit_tests.h"
	#include "testing/gtest/include/gtest/gtest.h"

	namespace sandbox {
	namespace syscall_broker {

	class BrokerFilePermissionTester {
	public:
	BrokerFilePermissionTester(const BrokerFilePermissionTester&) = delete;
	BrokerFilePermissionTester& operator=(const BrokerFilePermissionTester&) =
	delete;

	static bool ValidatePath(const char* path) {
	return BrokerFilePermission::ValidatePath(path);
	}
	static const char* GetErrorMessage() {
	return BrokerFilePermission::GetErrorMessageForTests();
	}
	};

	namespace {

	// Creation tests are DEATH tests as a bad permission causes termination.
	SANDBOX_TEST(BrokerFilePermission, CreateGood) {
	const char kPath[] = "/tmp/good";
	BrokerFilePermission perm = BrokerFilePermission::ReadOnly(kPath);
	}

	SANDBOX_TEST(BrokerFilePermission, CreateGoodRecursive) {
	const char kPath[] = "/tmp/good/";
	BrokerFilePermission perm = BrokerFilePermission::ReadOnlyRecursive(kPath);
	}

	// In official builds, CHECK(x) causes a SIGTRAP on the architectures where the
	// sanbox is enabled (that are x86, x86_64, arm64 and 32-bit arm processes
	// running on a arm64 kernel).
	#if defined(OFFICIAL_BUILD)
	#define DEATH_BY_CHECK(msg) DEATH_BY_SIGNAL(SIGTRAP)
	#else
	#define DEATH_BY_CHECK(msg) DEATH_MESSAGE(msg)
	#endif

	SANDBOX_DEATH_TEST(
	BrokerFilePermission,
	CreateBad,
	DEATH_BY_CHECK(BrokerFilePermissionTester::GetErrorMessage())) {
	const char kPath[] = "/tmp/bad/";
	BrokerFilePermission perm = BrokerFilePermission::ReadOnly(kPath);
	}

	SANDBOX_DEATH_TEST(
	BrokerFilePermission,
	CreateBadRecursive,
	DEATH_BY_CHECK(BrokerFilePermissionTester::GetErrorMessage())) {
	const char kPath[] = "/tmp/bad";
	BrokerFilePermission perm = BrokerFilePermission::ReadOnlyRecursive(kPath);
	}

	SANDBOX_DEATH_TEST(
	BrokerFilePermission,
	CreateBadNotAbs,
	DEATH_BY_CHECK(BrokerFilePermissionTester::GetErrorMessage())) {
	const char kPath[] = "tmp/bad";
	BrokerFilePermission perm = BrokerFilePermission::ReadOnly(kPath);
	}

	SANDBOX_DEATH_TEST(
	BrokerFilePermission,
	CreateBadEmpty,
	DEATH_BY_CHECK(BrokerFilePermissionTester::GetErrorMessage())) {
	const char kPath[] = "";
	BrokerFilePermission perm = BrokerFilePermission::ReadOnly(kPath);
	}

	// CheckPerm tests \|path\| against \|perm\| given \|access_flags\|.
	// If \|create\| is true then file creation is tested for success.
	void CheckPerm(const BrokerFilePermission& perm,
	const char* path,
	int access_flags,
	bool create) {
	ASSERT_FALSE(perm.CheckAccess(path, X_OK));
	ASSERT_TRUE(perm.CheckAccess(path, F_OK));
	// check bad perms
	switch (access_flags) {
	case O_RDONLY:
	ASSERT_TRUE(perm.CheckOpen(path, O_RDONLY).first);
	ASSERT_FALSE(perm.CheckOpen(path, O_WRONLY).first);
	ASSERT_FALSE(perm.CheckOpen(path, O_RDWR).first);
	ASSERT_TRUE(perm.CheckAccess(path, R_OK));
	ASSERT_FALSE(perm.CheckAccess(path, W_OK));
	break;
	case O_WRONLY:
	ASSERT_FALSE(perm.CheckOpen(path, O_RDONLY).first);
	ASSERT_TRUE(perm.CheckOpen(path, O_WRONLY).first);
	ASSERT_FALSE(perm.CheckOpen(path, O_RDWR).first);
	ASSERT_FALSE(perm.CheckAccess(path, R_OK));
	ASSERT_TRUE(perm.CheckAccess(path, W_OK));
	break;
	case O_RDWR:
	ASSERT_TRUE(perm.CheckOpen(path, O_RDONLY).first);
	ASSERT_TRUE(perm.CheckOpen(path, O_WRONLY).first);
	ASSERT_TRUE(perm.CheckOpen(path, O_RDWR).first);
	ASSERT_TRUE(perm.CheckAccess(path, R_OK));
	ASSERT_TRUE(perm.CheckAccess(path, W_OK));
	break;
	default:
	// Bad test case
	NOTREACHED();
	}

	// O_SYNC can be defined as (__O_SYNC\|O_DSYNC)
	#ifdef O_DSYNC
	const int kSyncFlag = O_SYNC & ~O_DSYNC;
	#else
	const int kSyncFlag = O_SYNC;
	#endif

	const int kNumberOfBitsInOAccMode = 2;
	static_assert(O_ACCMODE == ((1 << kNumberOfBitsInOAccMode) - 1),
	"incorrect number of bits");
	// check every possible flag and act accordingly.
	// Skipping AccMode bits as they are present in every case.
	for (int i = kNumberOfBitsInOAccMode; i < 32; i++) {
	int flag = 1 << i;
	switch (flag) {
	case O_APPEND:
	case O_ASYNC:
	case O_DIRECT:
	case O_DIRECTORY:
	#ifdef O_DSYNC
	case O_DSYNC:
	#endif
	case O_EXCL:
	case O_LARGEFILE:
	case O_NOATIME:
	case O_NOCTTY:
	case O_NOFOLLOW:
	case O_NONBLOCK:
	#if (O_NONBLOCK != O_NDELAY)
	case O_NDELAY:
	#endif
	case kSyncFlag:
	ASSERT_TRUE(perm.CheckOpen(path, access_flags \| flag).first);
	break;
	case O_TRUNC: {
	// The effect of (O_RDONLY \| O_TRUNC) is undefined, and in some cases it
	// actually truncates, so deny.
	const char* result = perm.CheckOpen(path, access_flags \| flag).first;
	if (access_flags == O_RDONLY) {
	ASSERT_FALSE(result);
	} else {
	ASSERT_TRUE(result);
	}
	break;
	}
	case O_CREAT:
	continue; // Handled below.
	case O_CLOEXEC:
	default:
	ASSERT_FALSE(perm.CheckOpen(path, access_flags \| flag).first);
	}
	}
	if (create) {
	const char* result;
	bool unlink;
	std::tie(result, unlink) =
	perm.CheckOpen(path, O_CREAT \| O_EXCL \| access_flags);
	ASSERT_TRUE(result);
	ASSERT_FALSE(unlink);
	} else {
	ASSERT_FALSE(perm.CheckOpen(path, O_CREAT \| O_EXCL \| access_flags).first);
	}
	}

	TEST(BrokerFilePermission, ReadOnly) {
	const char kPath[] = "/tmp/good";
	BrokerFilePermission perm = BrokerFilePermission::ReadOnly(kPath);
	CheckPerm(perm, kPath, O_RDONLY, false);
	// Don't do anything here, so that ASSERT works in the subfunction as
	// expected.
	}

	TEST(BrokerFilePermission, ReadOnlyRecursive) {
	const char kPath[] = "/tmp/good/";
	const char kPathFile[] = "/tmp/good/file";
	BrokerFilePermission perm = BrokerFilePermission::ReadOnlyRecursive(kPath);
	CheckPerm(perm, kPathFile, O_RDONLY, false);
	// Don't do anything here, so that ASSERT works in the subfunction as
	// expected.
	}

	// Explicit test for O_RDONLY\|O_TRUNC, which should be denied due to
	// undefined behavior.
	TEST(BrokerFilePermission, ReadOnlyTruncate) {
	const char kPath[] = "/tmp/good";
	BrokerFilePermission perm = BrokerFilePermission::ReadOnly(kPath);
	ASSERT_FALSE(perm.CheckOpen(kPath, O_RDONLY \| O_TRUNC).first);
	}

	TEST(BrokerFilePermission, WriteOnly) {
	const char kPath[] = "/tmp/good";
	BrokerFilePermission perm = BrokerFilePermission::WriteOnly(kPath);
	CheckPerm(perm, kPath, O_WRONLY, false);
	// Don't do anything here, so that ASSERT works in the subfunction as
	// expected.
	}

	TEST(BrokerFilePermission, ReadWrite) {
	const char kPath[] = "/tmp/good";
	BrokerFilePermission perm = BrokerFilePermission::ReadWrite(kPath);
	CheckPerm(perm, kPath, O_RDWR, false);
	// Don't do anything here, so that ASSERT works in the subfunction as
	// expected.
	}

	TEST(BrokerFilePermission, ReadWriteCreate) {
	const char kPath[] = "/tmp/good";
	BrokerFilePermission perm = BrokerFilePermission::ReadWriteCreate(kPath);
	CheckPerm(perm, kPath, O_RDWR, true);
	// Don't do anything here, so that ASSERT works in the subfunction as
	// expected.
	}

	void CheckUnlink(BrokerFilePermission& perm,
	const char* path,
	int access_flags) {
	ASSERT_FALSE(perm.CheckOpen(path, access_flags).first);

	const char* result;
	bool unlink;
	std::tie(result, unlink) =
	perm.CheckOpen(path, access_flags \| O_CREAT \| O_EXCL);
	ASSERT_TRUE(result);
	ASSERT_TRUE(unlink);
	}

	TEST(BrokerFilePermission, ReadWriteCreateTemporaryRecursive) {
	const char kPath[] = "/tmp/good/";
	const char kPathFile[] = "/tmp/good/file";
	BrokerFilePermission perm =
	BrokerFilePermission::ReadWriteCreateTemporaryRecursive(kPath);
	CheckUnlink(perm, kPathFile, O_RDWR);
	// Don't do anything here, so that ASSERT works in the subfunction as
	// expected.
	}

	TEST(BrokerFilePermission, StatOnlyWithIntermediateDirs) {
	const char kPath[] = "/tmp/good/path";
	const char kLeading1[] = "/";
	const char kLeading2[] = "/tmp";
	const char kLeading3[] = "/tmp/good/path";
	const char kBadPrefix[] = "/tmp/good/pa";
	const char kTrailing[] = "/tmp/good/path/bad";

	BrokerFilePermission perm =
	BrokerFilePermission::StatOnlyWithIntermediateDirs(kPath);
	// No open or access permission.
	ASSERT_FALSE(perm.CheckOpen(kPath, O_RDONLY).first);
	ASSERT_FALSE(perm.CheckOpen(kPath, O_WRONLY).first);
	ASSERT_FALSE(perm.CheckOpen(kPath, O_RDWR).first);
	ASSERT_FALSE(perm.CheckAccess(kPath, R_OK));
	ASSERT_FALSE(perm.CheckAccess(kPath, W_OK));

	// Stat for all leading paths, but not trailing paths.
	ASSERT_TRUE(perm.CheckStatWithIntermediates(kPath));
	ASSERT_TRUE(perm.CheckStatWithIntermediates(kLeading1));
	ASSERT_TRUE(perm.CheckStatWithIntermediates(kLeading2));
	ASSERT_TRUE(perm.CheckStatWithIntermediates(kLeading3));
	ASSERT_FALSE(perm.CheckStatWithIntermediates(kBadPrefix));
	ASSERT_FALSE(perm.CheckStatWithIntermediates(kTrailing));
	}

	TEST(BrokerFilePermission, InotifyAddWatchWithIntermediateDirs) {
	const char kPath[] = "/tmp/good/path";
	const char kLeading1[] = "/";
	const char kLeading2[] = "/tmp";
	const char kLeading3[] = "/tmp/good/path";
	const char kBadPrefix[] = "/tmp/good/pa";
	const char kTrailing[] = "/tmp/good/path/bad";

	const uint32_t kBadMask =
	IN_CREATE \| IN_DELETE \| IN_CLOSE_WRITE \| IN_MOVE \| IN_ONLYDIR;
	const uint32_t kGoodMask = kBadMask \| IN_ATTRIB;

	BrokerFilePermission perm =
	BrokerFilePermission::InotifyAddWatchWithIntermediateDirs(kPath);
	// No open or access permission.
	ASSERT_FALSE(perm.CheckOpen(kPath, O_RDONLY).first);
	ASSERT_FALSE(perm.CheckOpen(kPath, O_WRONLY).first);
	ASSERT_FALSE(perm.CheckOpen(kPath, O_RDWR).first);
	ASSERT_FALSE(perm.CheckAccess(kPath, R_OK));
	ASSERT_FALSE(perm.CheckAccess(kPath, W_OK));

	// Inotify_add_watch for all leading paths, but not trailing paths.
	ASSERT_TRUE(perm.CheckInotifyAddWatchWithIntermediates(kPath, kGoodMask));
	ASSERT_TRUE(perm.CheckInotifyAddWatchWithIntermediates(kLeading1, kGoodMask));
	ASSERT_TRUE(perm.CheckInotifyAddWatchWithIntermediates(kLeading2, kGoodMask));
	ASSERT_TRUE(perm.CheckInotifyAddWatchWithIntermediates(kLeading3, kGoodMask));
	ASSERT_FALSE(
	perm.CheckInotifyAddWatchWithIntermediates(kBadPrefix, kGoodMask));
	ASSERT_FALSE(
	perm.CheckInotifyAddWatchWithIntermediates(kTrailing, kGoodMask));

	// Fails without correct mask.
	ASSERT_FALSE(perm.CheckInotifyAddWatchWithIntermediates(kPath, kBadMask));
	}

	TEST(BrokerFilePermission, AllPermissions) {
	// `kPath` and `kPathDir` get allowlisted with AllPermissions and
	// AllPermissionsRecursive, respectively.
	static constexpr char kPath[] = "/tmp/good";
	static constexpr char kPathDir[] = "/tmp/good/";
	static constexpr char kPathFile[] = "/tmp/good/file";
	static constexpr char kPathFileExtraStuff[] = "/tmp/good/file/extrastuff";
	static constexpr char kLeading1[] = "/";
	static constexpr char kLeading2[] = "/tmp";
	static constexpr char kBadPrefix[] = "/tmp/go";
	static constexpr char kExtraStuff[] = "/tmp/good_extra_stuff";
	static constexpr char kExtraStuffFile[] = "/tmp/good_extra_stuff/file";
	static constexpr char kDoubleSlash[] = "/tmp//good/file";
	static constexpr char kParentRef[] = "/tmp/good/../file";

	constexpr uint32_t kBadInotifyMask =
	IN_CREATE \| IN_DELETE \| IN_CLOSE_WRITE \| IN_MOVE \| IN_ONLYDIR;
	constexpr uint32_t kGoodInotifyMask = kBadInotifyMask \| IN_ATTRIB;

	BrokerFilePermission perm =
	BrokerFilePermission::AllPermissionsRecursive(kPathDir);
	// Opening and accessing the nested files `kPathFile` and
	// `kPathFileExtraStuff` should work.
	EXPECT_TRUE(perm.CheckOpen(kPathFile, O_CREAT \| O_EXCL \| O_RDONLY).first);
	EXPECT_TRUE(perm.CheckOpen(kPathFile, O_CREAT \| O_EXCL \| O_RDWR).first);
	EXPECT_TRUE(perm.CheckAccess(kPathFile, R_OK));
	EXPECT_TRUE(perm.CheckAccess(kPathFile, W_OK));
	EXPECT_TRUE(
	perm.CheckOpen(kPathFileExtraStuff, O_CREAT \| O_EXCL \| O_RDONLY).first);
	EXPECT_TRUE(
	perm.CheckOpen(kPathFileExtraStuff, O_CREAT \| O_EXCL \| O_RDWR).first);
	EXPECT_TRUE(perm.CheckAccess(kPathFileExtraStuff, R_OK));
	EXPECT_TRUE(perm.CheckAccess(kPathFileExtraStuff, W_OK));
	// Opening and accessing anything above the path shouldn't work.
	EXPECT_FALSE(perm.CheckOpen(kBadPrefix, R_OK).first);
	EXPECT_FALSE(perm.CheckAccess(kBadPrefix, R_OK));
	EXPECT_FALSE(perm.CheckOpen(kLeading1, R_OK).first);
	EXPECT_FALSE(perm.CheckAccess(kLeading1, R_OK));
	EXPECT_FALSE(perm.CheckOpen(kLeading2, R_OK).first);
	EXPECT_FALSE(perm.CheckAccess(kLeading2, R_OK));
	// Stat should work recursively and on intermediates but not on all files.
	EXPECT_TRUE(perm.CheckStatWithIntermediates(kPathFile));
	EXPECT_TRUE(perm.CheckStatWithIntermediates(kLeading1));
	EXPECT_TRUE(perm.CheckStatWithIntermediates(kLeading2));
	EXPECT_FALSE(perm.CheckStatWithIntermediates(kBadPrefix));
	// InotifyAddWatch should work recursively and on intermediates but not on all
	// files.
	EXPECT_TRUE(
	perm.CheckInotifyAddWatchWithIntermediates(kPathFile, kGoodInotifyMask));
	EXPECT_TRUE(
	perm.CheckInotifyAddWatchWithIntermediates(kLeading1, kGoodInotifyMask));
	EXPECT_TRUE(
	perm.CheckInotifyAddWatchWithIntermediates(kLeading2, kGoodInotifyMask));
	EXPECT_FALSE(
	perm.CheckInotifyAddWatchWithIntermediates(kBadPrefix, kGoodInotifyMask));
	// InotifyAddWatch should still fail without the correct mask.
	EXPECT_FALSE(
	perm.CheckInotifyAddWatchWithIntermediates(kPathFile, kBadInotifyMask));

	EXPECT_TRUE(perm.CheckStatWithIntermediates(kPath));
	EXPECT_TRUE(
	perm.CheckInotifyAddWatchWithIntermediates(kPath, kGoodInotifyMask));
	// Empty string should always fail
	EXPECT_FALSE(perm.CheckOpen("", O_CREAT \| O_EXCL \| O_RDONLY).first);
	EXPECT_FALSE(perm.CheckOpen("", O_CREAT \| O_EXCL \| O_RDWR).first);
	EXPECT_FALSE(perm.CheckAccess("", R_OK));
	EXPECT_FALSE(perm.CheckAccess("", W_OK));
	EXPECT_FALSE(perm.CheckStatWithIntermediates(""));
	EXPECT_FALSE(
	perm.CheckInotifyAddWatchWithIntermediates("", kGoodInotifyMask));
	// Extra characters on the allowlisted path shouldn't pass:
	EXPECT_FALSE(perm.CheckOpen(kExtraStuff, O_CREAT \| O_EXCL \| O_RDONLY).first);
	EXPECT_FALSE(perm.CheckOpen(kExtraStuff, O_CREAT \| O_EXCL \| O_RDWR).first);
	EXPECT_FALSE(perm.CheckAccess(kExtraStuff, R_OK));
	EXPECT_FALSE(perm.CheckAccess(kExtraStuff, W_OK));
	EXPECT_FALSE(perm.CheckStatWithIntermediates(kExtraStuff));
	EXPECT_FALSE(perm.CheckInotifyAddWatchWithIntermediates(kExtraStuff,
	kGoodInotifyMask));
	// Extra characters and an extra filename on the allowlisted path shouldn't
	// pass:
	EXPECT_FALSE(
	perm.CheckOpen(kExtraStuffFile, O_CREAT \| O_EXCL \| O_RDONLY).first);
	EXPECT_FALSE(
	perm.CheckOpen(kExtraStuffFile, O_CREAT \| O_EXCL \| O_RDWR).first);
	EXPECT_FALSE(perm.CheckAccess(kExtraStuffFile, R_OK));
	EXPECT_FALSE(perm.CheckAccess(kExtraStuffFile, W_OK));
	EXPECT_FALSE(perm.CheckStatWithIntermediates(kExtraStuffFile));
	EXPECT_FALSE(perm.CheckInotifyAddWatchWithIntermediates(kExtraStuffFile,
	kGoodInotifyMask));
	// The sandbox doesn't bother parsing multiple separators in a row:
	EXPECT_FALSE(perm.CheckOpen(kDoubleSlash, O_CREAT \| O_EXCL \| O_RDONLY).first);
	EXPECT_FALSE(perm.CheckOpen(kDoubleSlash, O_CREAT \| O_EXCL \| O_RDWR).first);
	EXPECT_FALSE(perm.CheckAccess(kDoubleSlash, R_OK));
	EXPECT_FALSE(perm.CheckAccess(kDoubleSlash, W_OK));
	EXPECT_FALSE(perm.CheckStatWithIntermediates(kDoubleSlash));
	EXPECT_FALSE(perm.CheckInotifyAddWatchWithIntermediates(kDoubleSlash,
	kGoodInotifyMask));
	// The sandbox auto-rejects paths with parent references:
	EXPECT_FALSE(perm.CheckOpen(kParentRef, O_CREAT \| O_EXCL \| O_RDONLY).first);
	EXPECT_FALSE(perm.CheckOpen(kParentRef, O_CREAT \| O_EXCL \| O_RDWR).first);
	EXPECT_FALSE(perm.CheckAccess(kParentRef, R_OK));
	EXPECT_FALSE(perm.CheckAccess(kParentRef, W_OK));
	EXPECT_FALSE(perm.CheckStatWithIntermediates(kParentRef));
	EXPECT_FALSE(
	perm.CheckInotifyAddWatchWithIntermediates(kParentRef, kGoodInotifyMask));

	// This permission should allow all access to `kPath` specifically.
	perm = BrokerFilePermission::AllPermissions(kPath);
	EXPECT_TRUE(perm.CheckOpen(kPath, O_CREAT \| O_EXCL \| O_RDONLY).first);
	EXPECT_TRUE(perm.CheckOpen(kPath, O_CREAT \| O_EXCL \| O_RDWR).first);
	EXPECT_TRUE(perm.CheckAccess(kPath, R_OK));
	EXPECT_TRUE(perm.CheckAccess(kPath, W_OK));
	EXPECT_TRUE(perm.CheckStatWithIntermediates(kPath));
	EXPECT_TRUE(
	perm.CheckInotifyAddWatchWithIntermediates(kPath, kGoodInotifyMask));
	// InotifyAddWatch should still fail without the correct mask.
	EXPECT_FALSE(
	perm.CheckInotifyAddWatchWithIntermediates(kPath, kBadInotifyMask));
	// Empty string should always fail
	EXPECT_FALSE(perm.CheckOpen("", O_CREAT \| O_EXCL \| O_RDONLY).first);
	EXPECT_FALSE(perm.CheckOpen("", O_CREAT \| O_EXCL \| O_RDWR).first);
	EXPECT_FALSE(perm.CheckAccess("", R_OK));
	EXPECT_FALSE(perm.CheckAccess("", W_OK));
	EXPECT_FALSE(perm.CheckStatWithIntermediates(""));
	EXPECT_FALSE(
	perm.CheckInotifyAddWatchWithIntermediates("", kGoodInotifyMask));
	// Extra characters on the allowlisted path shouldn't pass:
	EXPECT_FALSE(perm.CheckOpen(kExtraStuff, O_CREAT \| O_EXCL \| O_RDONLY).first);
	EXPECT_FALSE(perm.CheckOpen(kExtraStuff, O_CREAT \| O_EXCL \| O_RDWR).first);
	EXPECT_FALSE(perm.CheckAccess(kExtraStuff, R_OK));
	EXPECT_FALSE(perm.CheckAccess(kExtraStuff, W_OK));
	EXPECT_FALSE(perm.CheckStatWithIntermediates(kExtraStuff));
	EXPECT_FALSE(perm.CheckInotifyAddWatchWithIntermediates(kExtraStuff,
	kGoodInotifyMask));
	// Extra characters and an extra filename on the allowlisted path shouldn't
	// pass:
	EXPECT_FALSE(
	perm.CheckOpen(kExtraStuffFile, O_CREAT \| O_EXCL \| O_RDONLY).first);
	EXPECT_FALSE(
	perm.CheckOpen(kExtraStuffFile, O_CREAT \| O_EXCL \| O_RDWR).first);
	EXPECT_FALSE(perm.CheckAccess(kExtraStuffFile, R_OK));
	EXPECT_FALSE(perm.CheckAccess(kExtraStuffFile, W_OK));
	EXPECT_FALSE(perm.CheckStatWithIntermediates(kExtraStuffFile));
	EXPECT_FALSE(perm.CheckInotifyAddWatchWithIntermediates(kExtraStuffFile,
	kGoodInotifyMask));
	// The sandbox doesn't bother parsing multiple separators in a row:
	EXPECT_FALSE(perm.CheckOpen(kDoubleSlash, O_CREAT \| O_EXCL \| O_RDONLY).first);
	EXPECT_FALSE(perm.CheckOpen(kDoubleSlash, O_CREAT \| O_EXCL \| O_RDWR).first);
	EXPECT_FALSE(perm.CheckAccess(kDoubleSlash, R_OK));
	EXPECT_FALSE(perm.CheckAccess(kDoubleSlash, W_OK));
	EXPECT_FALSE(perm.CheckStatWithIntermediates(kDoubleSlash));
	EXPECT_FALSE(perm.CheckInotifyAddWatchWithIntermediates(kDoubleSlash,
	kGoodInotifyMask));
	}

	TEST(BrokerFilePermission, ValidatePath) {
	EXPECT_TRUE(BrokerFilePermissionTester::ValidatePath("/path"));
	EXPECT_TRUE(BrokerFilePermissionTester::ValidatePath("/"));
	EXPECT_TRUE(BrokerFilePermissionTester::ValidatePath("/..path"));

	EXPECT_FALSE(BrokerFilePermissionTester::ValidatePath(""));
	EXPECT_FALSE(BrokerFilePermissionTester::ValidatePath("bad"));
	EXPECT_FALSE(BrokerFilePermissionTester::ValidatePath("/bad/"));
	EXPECT_FALSE(BrokerFilePermissionTester::ValidatePath("bad/"));
	EXPECT_FALSE(BrokerFilePermissionTester::ValidatePath("/bad/.."));
	EXPECT_FALSE(BrokerFilePermissionTester::ValidatePath("/bad/../bad"));
	EXPECT_FALSE(BrokerFilePermissionTester::ValidatePath("/../bad"));
	}

	} // namespace
	} // namespace syscall_broker
	} // namespace sandbox