From 9bc2f77daa1ba67d7e83e6a163b371b54e7c8506 Mon Sep 17 00:00:00 2001 From: aszlig Date: Thu, 2 Jul 2015 10:51:52 +0200 Subject: [PATCH] nixos/tests/chromium: Improve sandbox checking. We no longer need have "SUID sandbox" enabled in the chrome://sandbox status page and we now also check for "You are adequately sandboxed." to be absolutely sure that we're running with proper sandboxing. Signed-off-by: aszlig --- nixos/tests/chromium.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/nixos/tests/chromium.nix b/nixos/tests/chromium.nix index 2241bc9c3bca..6c2302594b91 100644 --- a/nixos/tests/chromium.nix +++ b/nixos/tests/chromium.nix @@ -157,10 +157,11 @@ import ./make-test.nix ( my $clipboard = $machine->succeed("${pkgs.xclip}/bin/xclip -o"); die "sandbox not working properly: $clipboard" - unless $clipboard =~ /(?:suid|namespace) sandbox.*yes/mi + unless $clipboard =~ /namespace sandbox.*yes/mi && $clipboard =~ /pid namespaces.*yes/mi && $clipboard =~ /network namespaces.*yes/mi - && $clipboard =~ /seccomp.*sandbox.*yes/mi; + && $clipboard =~ /seccomp.*sandbox.*yes/mi + && $clipboard =~ /you are adequately sandboxed/mi; }; }; }