diff options
| author |   Michał Górny <mgorny@gentoo.org> | 2017-09-25 20:42:03 +0200 |
|---|---|---|
| committer | Michał Górny <mgorny@gentoo.org> | 2017-10-03 18:38:51 +0200 |
| commit | 9ed52ff7daa39cdf4748f5b9c91358f421c8be7a (patch) | |
| tree | 1146540a4d23f6d0937043ae180b97df39514a12 /tests | |
| parent | Remove no-longer-necessary symlink hack in ACL (diff) | |
| download | sandbox-9ed52ff7daa39cdf4748f5b9c91358f421c8be7a.tar.gz sandbox-9ed52ff7daa39cdf4748f5b9c91358f421c8be7a.tar.bz2 sandbox-9ed52ff7daa39cdf4748f5b9c91358f421c8be7a.zip | |
libsandbox: Fix path matching not to dumbly match prefixes
Fix the path matching code to match prefixes component-wide rather than
literally. This means that a path such as '/foo' will no longer match
'/foobar' but only '/foo' and its subdirectories (if it is a directory).
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/script-14.sh | 20 | ||||
| -rw-r--r-- | tests/script.at | 1 |
2 files changed, 21 insertions, 0 deletions
diff --git a/tests/script-14.sh b/tests/script-14.sh new file mode 100644 index 0000000..6fa55a0 --- /dev/null +++ b/tests/script-14.sh @@ -0,0 +1,20 @@ +#!/bin/sh +# check that paths don't accidentally match other files by prefix +[ "${at_xfail}" = "yes" ] && exit 77 # see script-0 + +( +# This clobbers all existing writable paths for this one write. +SANDBOX_PREDICT=/dev/null +SANDBOX_WRITE="${PWD}/foo" +echo FAIL >foobar +) +# the write to 'logfoobar' should be rejected since only 'log' +# is supposed to be writable +if [ $? -eq 0 ] ; then + exit 1 +fi + +# and we should have gotten a sandbox violation +test -s "${SANDBOX_LOG}" + +exit $? diff --git a/tests/script.at b/tests/script.at index 58a5077..9134ac1 100644 --- a/tests/script.at +++ b/tests/script.at @@ -11,3 +11,4 @@ SB_CHECK(10) SB_CHECK(11) SB_CHECK(12) SB_CHECK(13) +SB_CHECK(14) |