blob: fd8dcb29d65c0a175da44986a3e4c7a4b6b8eb36 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
|
.include <src.opts.mk>
TESTSDIR= ${TESTSBASE}/sys/capsicum
ATF_TESTS_C+= bindat_connectat
ATF_TESTS_C+= ioctls_test
CFLAGS+= -I${SRCTOP}/tests
.if ${MK_GOOGLETEST} != no
.PATH: ${SRCTOP}/contrib/capsicum-test
GTESTS+= capsicum-test
GTESTS_WRAPPER_SH.capsicum-test= functional
# This test script runs the same test suite twice, once as root and once as an
# unprivileged user. Serialize them since some tests access global namespaces,
# e.g., mqueuefs, and can trample on each other.
TEST_METADATA.functional+= is_exclusive="true"
SRCS.capsicum-test+= \
capsicum-test-main.cc \
capsicum-test.cc \
capability-fd.cc \
copy_file_range.cc \
fexecve.cc \
procdesc.cc \
capmode.cc \
fcntl.cc \
ioctl.cc \
openat.cc \
sysctl.cc \
select.cc \
mqueue.cc \
socket.cc \
sctp.cc \
capability-fd-pair.cc \
overhead.cc \
rename.cc
LIBADD.capsicum-test+= gtest pthread procstat
TEST_METADATA.capsicum-test= required_user="unprivileged"
.for p in mini-me mini-me.noexec mini-me.setuid
PROGS+= $p
NO_SHARED.$p=
SRCS.$p= mini-me.c
.endfor
.if ${MK_ASAN} != "no" || ${MK_UBSAN} != "no"
# mini-me.o is linked into a static binary so we can't use sanitizers.
# Note: We have to set CFLAGS here since it will be built as part of
# _PROGS_COMMON_OBJS and therefore NO_SHARED.$p does not disable ASAN/UBSAN.
CFLAGS.mini-me.c+= -fno-sanitize=address -fno-sanitize=undefined
.endif
BINDIR= ${TESTSDIR}
BINMODE.mini-me.noexec= ${NOBINMODE}
BINMODE.mini-me.setuid= 4555
WARNS.capsicum-test= 3
.endif # MK_GOOGLETEST
.include <bsd.test.mk>
|
