NAME=sandbox disable
FILE=-
CMDS=<<EOF
e cfg.sandbox=true
e cfg.sandbox=false
e cfg.sandbox
EOF
EXPECT=<<EOF
true
EOF
RUN

NAME=sandbox open
FILE=-
CMDS=<<EOF
e cfg.sandbox=true
o~[4]
oc /bin/ls
EOF
EXPECT=<<EOF
malloc://512
EOF
RUN

NAME=sandbox grain default is all
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain
EOF
EXPECT=<<EOF
all
EOF
RUN

NAME=sandbox grain=none blocks exec
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=none
e cfg.sandbox=true
!!echo hello 2>/dev/null
EOF
EXPECT=<<EOF
EOF
RUN

NAME=sandbox without exec blocks pid modifiers and thread iteration
FILE=-
CMDS=<<EOF
e dbg.backend=null
e cfg.sandbox.grain=all,!exec
e cfg.sandbox=true
?vi $P @p:42
?vi $P @dp:42
?e unexpected @@t
?vi $P
?e alive
EOF
EXPECT=<<EOF
0
0
0
alive
EOF
EXPECT_ERR=<<EOF
ERROR: Temporary pid selection is disabled in sandbox mode
ERROR: Temporary pid selection is disabled in sandbox mode
ERROR: Thread iteration is disabled in sandbox mode
EOF
RUN

NAME=sandbox exec permits pid modifiers and thread iteration
FILE=-
CMDS=<<EOF
e dbg.backend=null
?vi $P @p:7
e cfg.sandbox.grain=exec
e cfg.sandbox=true
?vi $P @p:42
?vi $P @dp:43
?e unexpected @@t
?vi $P
EOF
EXPECT=<<EOF
7
42
43
7
EOF
EXPECT_ERR=
RUN

NAME=sandbox grain=none blocks shell subcommands
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=none
e cfg.sandbox=true
?e $(!echo dollar)
?e $(?e safe)
e cfg.sandbox
EOF
EXPECT=<<EOF
safe
true
EOF
RUN

NAME=sandbox grain=none blocks backtick shell subcommands
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=none
e cfg.sandbox=true
?e `!echo backtick`
?e `?e safe`
e cfg.sandbox
EOF
EXPECT=<<EOF
safe
true
EOF
RUN

NAME=sandbox grain=exec allows exec
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=exec
e cfg.sandbox=true
!!echo hello
?e $(!!echo dollar)
?e `!!echo backtick`
EOF
EXPECT=<<EOF
hello
dollar
backtick
EOF
RUN

NAME=sandbox grain=all allows exec
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=all
e cfg.sandbox=true
!!echo hello
EOF
EXPECT=<<EOF
hello
EOF
RUN

NAME=sandbox grain order does not matter
FILE=-
CMDS=<<EOF
e cfg.sandbox=true
e cfg.sandbox.grain=exec
!!echo hello
EOF
EXPECT=<<EOF
hello
EOF
RUN

NAME=sandbox grain=none blocks oc
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=none
e cfg.sandbox=true
o~[4]
oc /bin/ls
EOF
EXPECT=<<EOF
malloc://512
EOF
RUN

NAME=sandbox grain=environ allows environ
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=environ
e cfg.sandbox=true
?e empty
%SHELL~?
?e empty
e cfg.sandbox.grain=none
%SHELL~?
?e empty
EOF
EXPECT=<<EOF
empty
1
empty
0
empty
EOF
RUN

NAME=sandbox grain=disk,exec combined
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=disk,exec
e cfg.sandbox=true
!!echo works
EOF
EXPECT=<<EOF
works
EOF
RUN

NAME=sandbox grain persist after enable
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=exec
e cfg.sandbox=true
e cfg.sandbox.grain
EOF
EXPECT=<<EOF
exec
EOF
RUN

NAME=sandbox grain=hidden option
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=hidden
e cfg.sandbox.grain
EOF
EXPECT=<<EOF
hidden
EOF
RUN

NAME=sandbox grain cannot grant additional permissions
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=environ
e cfg.sandbox=true
e cfg.sandbox.grain=exec,environ
e cfg.sandbox.grain
e cfg.sandbox.grain=none
e cfg.sandbox.grain=all
e cfg.sandbox.grain
EOF
EXPECT=<<EOF
environ
none
EOF
RUN

NAME=sandbox configuration cannot be reset
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=none
e cfg.sandbox=true
e-
e cfg.sandbox
e cfg.sandbox.grain
EOF
EXPECT=<<EOF
true
none
EOF
RUN

NAME=sandbox grain exclusions block environment access
FILE=-
CMDS=<<EOF
%R2_GRAIN_TEST=visible
e cfg.sandbox.grain=!disk,!exec
e cfg.sandbox=true
%R2_GRAIN_TEST~?
e cfg.sandbox.grain=!disk,!exec,!environ
%R2_GRAIN_TEST~?
e cfg.sandbox.grain=!exec
e cfg.sandbox.grain
EOF
EXPECT=<<EOF
1
0
!disk,!exec,!environ
EOF
RUN

NAME=HTTP sandbox grain is independent of local sandbox
FILE=-
CMDS=<<EOF
e http.sandbox.grain
e cfg.sandbox.grain=environ
e http.sandbox.grain=all,!exec
e http.sandbox.grain
e cfg.sandbox
e cfg.sandbox.grain
EOF
EXPECT=<<EOF
none
all,!exec
false
environ
EOF
RUN

NAME=HTTP sandbox grain rejects malformed values without side effects
FILE=-
CMDS=<<EOF
e http.sandbox.grain=environ
e http.sandbox.grain=exec,
e http.sandbox.grain
e http.sandbox.grain=bogus
e http.sandbox.grain
e http.sandbox.grain=exec,,environ
e http.sandbox.grain
e http.sandbox.grain=!
e http.sandbox.grain
e cfg.sandbox
e cfg.sandbox.grain
EOF
EXPECT=<<EOF
environ
environ
environ
environ
false
all
EOF
RUN

NAME=HTTP sandbox grain assignment does not change active local permissions
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=none
e cfg.sandbox=true
e http.sandbox.grain=exec
e http.sandbox.grain
e cfg.sandbox.grain=exec
e cfg.sandbox.grain
EOF
EXPECT=<<EOF
exec
none
EOF
RUN

NAME=sandbox grain=none blocks lang pipe
FILE=--
CMDS=<<EOF
e cfg.sandbox.grain=none
e cfg.sandbox=true
#!pipe echo PIPE_RAN
?e done
EOF
EXPECT=<<EOF
done
EOF
RUN

NAME=sandbox grain=none refuses r2pipe without exiting
FILE=--
CMDS=<<EOF
e cfg.sandbox.grain=none
e cfg.sandbox=true
o r2pipe://x
?e alive
EOF
EXPECT=<<EOF
alive
EOF
RUN

NAME=sandbox tcc include of an absolute path
FILE=--
CMDS=<<EOF
e types.plugin=tcc
e cfg.sandbox=true
'td #include "/etc/hosts"
?e done
EOF
EXPECT=<<EOF
done
EOF
EXPECT_ERR=<<EOF
include file './/etc/hosts' not found
ERROR: Cannot parse C type declarations
EOF
RUN

NAME=sandbox blocks the ===errmsg stderr redirection
FILE=--
CMDS=<<EOF
e cfg.sandbox=true
===errmsg
===-errmsg
?e done
EOF
EXPECT=<<EOF
done
EOF
EXPECT_ERR=<<EOF
ERROR: The === command is disabled in sandbox mode
ERROR: The === command is disabled in sandbox mode
EOF
RUN

NAME=sandbox refuses zos and kd writes
FILE=--
CMDS=<<EOF
za foo b 90
e cfg.sandbox=true
zos zigns.sdb
kd zigns.sdb anal
?e done
EOF
EXPECT=<<EOF
done
EOF
EXPECT_ERR=<<EOF
ERROR: Cannot save zignatures to zigns.sdb in sandbox mode
ERROR: Cannot write zigns.sdb in sandbox mode
EOF
RUN

NAME=sandbox blocks the spp system, pipe, include and grepline tags
FILE=malloc://64
CMDS=<<EOF2
e asm.arch=x86
e asm.bits=32
e asm.spp=true
e cfg.sandbox.grain=none
e cfg.sandbox=true
'pa <{system echo int3}>nop
'pa <{pipe cat}>nop<{endpipe}>
'pa <{include /etc/hosts}>nop
'pa <{grepline /etc/hosts 1}>nop
EOF2
EXPECT=<<EOF2
90
90
90
90
EOF2
RUN

NAME=sandbox blocks r2k:// regardless of grain
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=all
e cfg.sandbox=true
o r2k://
EOF
EXPECT=
EXPECT_ERR=<<EOF
ERROR: Sandbox prevents opening the r2k driver
ERROR: Cannot open file r2k://
EOF
RUN

NAME=sandbox grain none blocks localhost connections
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=none
e cfg.sandbox=true
curl http://127.0.0.1:1/
EOF
EXPECT=
EXPECT_ERR=<<EOF
ERROR: sandbox: network access denied for 'http://127.0.0.1:1/'
EOF
RUN

NAME=sandbox grain socket allows localhost only
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=socket
e cfg.sandbox=true
curl http://127.0.0.1:1/
curl http://192.0.2.1:1/
EOF
EXPECT=
EXPECT_ERR=<<EOF
ERROR: Cannot connect to 127.0.0.1:1
ERROR: sandbox: network access denied for 'http://192.0.2.1:1/'
EOF
RUN

NAME=sandbox grain network allows localhost
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=network
e cfg.sandbox=true
curl http://127.0.0.1:1/
EOF
EXPECT=
EXPECT_ERR=<<EOF
ERROR: Cannot connect to 127.0.0.1:1
EOF
RUN

NAME=sandbox blocks mktemp
FILE=-
CMDS=<<EOF
e cfg.sandbox.grain=none
e cfg.sandbox=true
mktemp ../r2r-sandbox-file || ?e refused
EOF
EXPECT=<<EOF
refused
EOF
EXPECT_ERR=<<EOF
ERROR: Cannot create '../r2r-sandbox-file'
EOF
RUN

NAME=sandbox blocks zip archives outside the allowed paths
FILE=-
CMDS=<<EOF
e cfg.sandbox=true
o zip:///etc/../etc/hosts.zip//inner
?e done
EOF
EXPECT=<<EOF
done
EOF
EXPECT_ERR=<<EOF
ERROR: Sandbox prevents accessing zip archive '/etc/../etc/hosts.zip'
ERROR: Failed to open the archive /etc/../etc/hosts.zip and file inner
ERROR: Cannot open file zip:///etc/../etc/hosts.zip//inner
EOF
RUN

NAME=sandbox blocks listing zip mounts
FILE=malloc://37
CMDS=<<EOF
wx 504b0506000000000000000000000000000000000000
e cfg.sandbox=true
m /z zip
md /z
?e done
EOF
EXPECT=<<EOF
done
EOF
EXPECT_ERR=<<EOF
ERROR: Sandbox prevents listing zip mounts
ERROR: Invalid path
EOF
RUN
