64 SANDBOX_TEST(Credentials, DropAllCaps) {  in SANDBOX_TEST()  argument
65   CHECK(Credentials::DropAllCapabilities());  in SANDBOX_TEST()
66   CHECK(!Credentials::HasAnyCapability());  in SANDBOX_TEST()
69 SANDBOX_TEST(Credentials, MoveToNewUserNS) {  in SANDBOX_TEST()  argument
70   CHECK(Credentials::DropAllCapabilities());  in SANDBOX_TEST()
71   bool moved_to_new_ns = Credentials::MoveToNewUserNS();  in SANDBOX_TEST()
82   CHECK(Credentials::HasAnyCapability());  in SANDBOX_TEST()
83   CHECK(Credentials::DropAllCapabilities());  in SANDBOX_TEST()
84   CHECK(!Credentials::HasAnyCapability());  in SANDBOX_TEST()
87 SANDBOX_TEST(Credentials, CanCreateProcessInNewUserNS) {  in SANDBOX_TEST()  argument
88   CHECK(Credentials::DropAllCapabilities());  in SANDBOX_TEST()
89   bool user_ns_supported = Credentials::CanCreateProcessInNewUserNS();  in SANDBOX_TEST()
90   bool moved_to_new_ns = Credentials::MoveToNewUserNS();  in SANDBOX_TEST()
94 SANDBOX_TEST(Credentials, UidIsPreserved) {  in SANDBOX_TEST()  argument
95   CHECK(Credentials::DropAllCapabilities());  in SANDBOX_TEST()
101   if (!Credentials::MoveToNewUserNS()) return;  in SANDBOX_TEST()
116   if (!Credentials::MoveToNewUserNS() ||  in NewUserNSCycle()
117       !Credentials::HasAnyCapability() ||  in NewUserNSCycle()
118       !Credentials::DropAllCapabilities() ||  in NewUserNSCycle()
119       Credentials::HasAnyCapability()) {  in NewUserNSCycle()
125 SANDBOX_TEST(Credentials, NestedUserNS) {  in SANDBOX_TEST()  argument
126   CHECK(Credentials::DropAllCapabilities());  in SANDBOX_TEST()
128   if (!Credentials::MoveToNewUserNS()) return;  in SANDBOX_TEST()
129   CHECK(Credentials::DropAllCapabilities());  in SANDBOX_TEST()
139 SANDBOX_TEST(Credentials, CanDetectRoot) {  in SANDBOX_TEST()  argument
147 SANDBOX_TEST(Credentials, DISABLE_ON_ASAN(DropFileSystemAccessIsSafe)) {  in SANDBOX_TEST()  argument
148   CHECK(Credentials::DropAllCapabilities());  in SANDBOX_TEST()
150   if (!Credentials::MoveToNewUserNS()) return;  in SANDBOX_TEST()
151   CHECK(Credentials::DropFileSystemAccess(ProcUtil::OpenProc().get()));  in SANDBOX_TEST()
162 SANDBOX_TEST(Credentials, DISABLE_ON_ASAN(CannotRegainPrivileges)) {  in SANDBOX_TEST()  argument
164   CHECK(Credentials::DropAllCapabilities(proc_fd.get()));  in SANDBOX_TEST()
166   if (!Credentials::MoveToNewUserNS()) return;  in SANDBOX_TEST()
167   CHECK(Credentials::DropFileSystemAccess(proc_fd.get()));  in SANDBOX_TEST()
168   CHECK(Credentials::DropAllCapabilities(proc_fd.get()));  in SANDBOX_TEST()
172   CHECK(!Credentials::CanCreateProcessInNewUserNS());  in SANDBOX_TEST()
173   CHECK(!Credentials::MoveToNewUserNS());  in SANDBOX_TEST()
176 SANDBOX_TEST(Credentials, SetCapabilities) {  in SANDBOX_TEST()  argument
178   if (!Credentials::MoveToNewUserNS())  in SANDBOX_TEST()
183   CHECK(Credentials::HasCapability(Credentials::Capability::SYS_ADMIN));  in SANDBOX_TEST()
184   CHECK(Credentials::HasCapability(Credentials::Capability::SYS_CHROOT));  in SANDBOX_TEST()
186   std::vector<Credentials::Capability> caps;  in SANDBOX_TEST()
187   caps.push_back(Credentials::Capability::SYS_CHROOT);  in SANDBOX_TEST()
188   CHECK(Credentials::SetCapabilities(proc_fd.get(), caps));  in SANDBOX_TEST()
190   CHECK(!Credentials::HasCapability(Credentials::Capability::SYS_ADMIN));  in SANDBOX_TEST()
191   CHECK(Credentials::HasCapability(Credentials::Capability::SYS_CHROOT));  in SANDBOX_TEST()
193   const std::vector<Credentials::Capability> no_caps;  in SANDBOX_TEST()
194   CHECK(Credentials::SetCapabilities(proc_fd.get(), no_caps));  in SANDBOX_TEST()
195   CHECK(!Credentials::HasAnyCapability());  in SANDBOX_TEST()
198 SANDBOX_TEST(Credentials, SetCapabilitiesAndChroot) {  in SANDBOX_TEST()  argument
200   if (!Credentials::MoveToNewUserNS())  in SANDBOX_TEST()
205   CHECK(Credentials::HasCapability(Credentials::Capability::SYS_CHROOT));  in SANDBOX_TEST()
208   std::vector<Credentials::Capability> caps;  in SANDBOX_TEST()
209   caps.push_back(Credentials::Capability::SYS_CHROOT);  in SANDBOX_TEST()
210   CHECK(Credentials::SetCapabilities(proc_fd.get(), caps));  in SANDBOX_TEST()
213   CHECK(Credentials::DropAllCapabilities());  in SANDBOX_TEST()
217 SANDBOX_TEST(Credentials, SetCapabilitiesMatchesLibCap2) {  in SANDBOX_TEST()  argument
219   if (!Credentials::MoveToNewUserNS())  in SANDBOX_TEST()
224   std::vector<Credentials::Capability> caps;  in SANDBOX_TEST()
225   caps.push_back(Credentials::Capability::SYS_CHROOT);  in SANDBOX_TEST()
226   CHECK(Credentials::SetCapabilities(proc_fd.get(), caps));  in SANDBOX_TEST()
249 SANDBOX_TEST(Credentials, DISABLE_ON_ASAN(DropFileSystemAccessPreservesTLS)) {  in SANDBOX_TEST()  argument
251   if (!Credentials::MoveToNewUserNS()) return;  in SANDBOX_TEST()
252   CHECK(Credentials::DropFileSystemAccess(ProcUtil::OpenProc().get()));  in SANDBOX_TEST()