Documentation
¶
Overview ¶
Package security contains local Tast tests that exercise core security-related features.
Some of these tests could arguably live elsewhere (e.g. the kernel or platform packages), but we group them here based on their relevance to security.
Index ¶
- func ASLR(ctx context.Context, s *testing.State)
- func AltSyscall(ctx context.Context, s *testing.State)
- func CPUVulnerabilities(ctx context.Context, s *testing.State)
- func CPUVulnerabilitiesCrostini(ctx context.Context, s *testing.State)
- func ChromeSandboxed(ctx context.Context, s *testing.State)
- func ExecStack(ctx context.Context, s *testing.State)
- func Firewall(ctx context.Context, s *testing.State)
- func GPUSandboxed(ctx context.Context, s *testing.State)
- func HardLinkRestrictions(ctx context.Context, s *testing.State)
- func LogPerms(ctx context.Context, s *testing.State)
- func Manatee(ctx context.Context, s *testing.State)
- func Microcode(ctx context.Context, s *testing.State)
- func Minijail(ctx context.Context, s *testing.State)
- func MinijailSeccomp(ctx context.Context, s *testing.State)
- func ModuleLocking(ctx context.Context, s *testing.State)
- func MountSymlink(ctx context.Context, s *testing.State)
- func Mprotect(ctx context.Context, s *testing.State)
- func Mtab(ctx context.Context, s *testing.State)
- func NetworkListenersARC(ctx context.Context, s *testing.State)
- func NetworkListenersNonARC(ctx context.Context, s *testing.State)
- func OpenSSLBlocklist(ctx context.Context, s *testing.State)
- func PrivilegedFiles(ctx context.Context, s *testing.State)
- func ProtocolFamilies(ctx context.Context, s *testing.State)
- func PtraceProcess(ctx context.Context, s *testing.State)
- func PtraceThread(ctx context.Context, s *testing.State)
- func RootCA(ctx context.Context, s *testing.State)
- func RunFiles(ctx context.Context, s *testing.State)
- func RunOCI(ctx context.Context, s *testing.State)
- func SELinuxAuditBasic(ctx context.Context, s *testing.State)
- func SELinuxFilesARC(ctx context.Context, s *testing.State)
- func SELinuxFilesDataDir(ctx context.Context, s *testing.State)
- func SELinuxFilesNonARC(ctx context.Context, s *testing.State)
- func SELinuxFilesSystem(ctx context.Context, s *testing.State)
- func SELinuxFilesSystemInformational(ctx context.Context, s *testing.State)
- func SELinuxProcesses(ctx context.Context, s *testing.State)
- func SELinuxProcessesARC(ctx context.Context, s *testing.State)
- func SELinuxProcessesARCInformational(ctx context.Context, s *testing.State)
- func SELinuxProcessesExperimental(ctx context.Context, s *testing.State)
- func SELinuxProcessesInformational(ctx context.Context, s *testing.State)
- func SELinuxValidity(ctx context.Context, s *testing.State)
- func SafesetidEnsurePolicy(ctx context.Context, s *testing.State)
- func SandboxLinuxUnittests(ctx context.Context, s *testing.State)
- func SandboxedServices(ctx context.Context, s *testing.State)
- func SharedFilesystemState(ctx context.Context, s *testing.State)
- func StatefulFiles(ctx context.Context, s *testing.State)
- func StatefulPartitionHardening(ctx context.Context, s *testing.State)
- func SymlinkRestrictions(ctx context.Context, s *testing.State)
- func SystemDirs(ctx context.Context, s *testing.State)
- func ToolchainOptions(ctx context.Context, s *testing.State)
- func USBBouncer(ctx context.Context, s *testing.State)
- func USBGuard(ctx context.Context, s *testing.State)
- func UserFilesGuest(ctx context.Context, s *testing.State)
- func UserFilesLoggedIn(ctx context.Context, s *testing.State)
- type BootLockboxService
- func (c *BootLockboxService) CloseChrome(ctx context.Context, req *empty.Empty) (*empty.Empty, error)
- func (c *BootLockboxService) NewChromeLogin(ctx context.Context, req *empty.Empty) (*empty.Empty, error)
- func (*BootLockboxService) Read(ctx context.Context, request *security.ReadBootLockboxRequest) (*security.ReadBootLockboxResponse, error)
- func (*BootLockboxService) Store(ctx context.Context, request *security.StoreBootLockboxRequest) (*empty.Empty, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func SafesetidEnsurePolicy ¶
SafesetidEnsurePolicy forks processes as non-root users and ensures the processes can change UID to a user that is explicitly allowed in the system-wide allowlist, but no other user.
func SharedFilesystemState ¶
SharedFilesystemState test will fail if you are adding a new shared mount to the init mount namespace. If this is the case, follow these steps:
- Confirm that it is necessary and prepare reasoning for why this mount must be shared and in the init mount namespace.
- Add the mount to the appropriate list below (based on whether it exists in ARCVM/ARC++ and whether it exists when the user is logged in or not).
- Add short reasoning as a comment above the mount, then add a more detailed explanation in https://chrome-internal.googlesource.com/chromeos/docs/+/HEAD/security/shared_filesystem_state.md
- Add nvaa@ or another chromeos-security@ engineer as a reviewer on the CL.
Types ¶
type BootLockboxService ¶
type BootLockboxService struct {
// contains filtered or unexported fields
}
BootLockboxService implements tast.cros.security.BootLockboxService.
func (*BootLockboxService) CloseChrome ¶
func (*BootLockboxService) NewChromeLogin ¶
func (*BootLockboxService) Read ¶
func (*BootLockboxService) Read(ctx context.Context, request *security.ReadBootLockboxRequest) (*security.ReadBootLockboxResponse, error)
func (*BootLockboxService) Store ¶
func (*BootLockboxService) Store(ctx context.Context, request *security.StoreBootLockboxRequest) (*empty.Empty, error)
Source Files
¶
- alt_syscall.go
- aslr.go
- boot_lockbox_service.go
- chrome_sandboxed.go
- cpu_vulnerabilities.go
- cpu_vulnerabilities_crostini.go
- doc.go
- exec_stack.go
- firewall.go
- gpu_sandboxed.go
- hard_link_restrictions.go
- log_perms.go
- manatee.go
- microcode.go
- minijail.go
- minijail_seccomp.go
- module_locking.go
- mount_symlink.go
- mprotect.go
- mtab.go
- network_listeners_arc.go
- network_listeners_non_arc.go
- openssl_blocklist.go
- privileged_files.go
- protocol_families.go
- ptrace_process.go
- ptrace_thread.go
- root_ca.go
- run_files.go
- run_oci.go
- safesetid_ensure_policy.go
- sandbox_linux_unittests.go
- sandboxed_services.go
- selinux_audit_basic.go
- selinux_files_arc.go
- selinux_files_data_dir.go
- selinux_files_non_arc.go
- selinux_files_system.go
- selinux_files_system_informational.go
- selinux_processes.go
- selinux_processes_arc.go
- selinux_processes_arc_informational.go
- selinux_processes_experimental.go
- selinux_processes_informational.go
- selinux_validity.go
- shared_filesystem_state.go
- stateful_files.go
- stateful_partition_hardening.go
- symlink_restrictions.go
- system_dirs.go
- toolchain_options.go
- usb_bouncer.go
- usbguard.go
- user_files_guest.go
- user_files_logged_in.go
Directories
¶
| Path | Synopsis |
|---|---|
|
Package filecheck helps tests check permissions and ownership of on-disk files.
|
Package filecheck helps tests check permissions and ownership of on-disk files. |
|
Package filesetup provides file-related utility functions for security tests.
|
Package filesetup provides file-related utility functions for security tests. |
|
Package fscaps reads Linux file capabilities.
|
Package fscaps reads Linux file capabilities. |
|
Package netlisten compares code shared by security.NetworkListeners tests.
|
Package netlisten compares code shared by security.NetworkListeners tests. |
|
Package openfds contains support code for the security.OpenFDs test.
|
Package openfds contains support code for the security.OpenFDs test. |
|
Package sandboxing provides functions for obtaining sandboxing-related information about running processes.
|
Package sandboxing provides functions for obtaining sandboxing-related information about running processes. |
|
Package seccomp leverages integration tests for generating Minijail seccomp policies.
|
Package seccomp leverages integration tests for generating Minijail seccomp policies. |
|
Package selinux contains shared logic for security tests that verify SELinux configuration.
|
Package selinux contains shared logic for security tests that verify SELinux configuration. |
|
Package toolchain contains support code for the security.ToolchainOptions test.
|
Package toolchain contains support code for the security.ToolchainOptions test. |
|
Package userfiles contains shared logic for security.UserFiles* tests.
|
Package userfiles contains shared logic for security.UserFiles* tests. |
Click to show internal directories.
Click to hide internal directories.