StarMirror/sandboxed-api
1
0
Fork 0
mirror of https://github.com/google/sandboxed-api.git synced 2024-03-22 13:11:30 +08:00
Code Issues Projects Releases Wiki Activity
722 Commits 1 Branch 3 Tags 144 MiB
08e1e733a0
Commit Graph

61 Commits

Author SHA1 Message Date
Wiktor Garbacz
d9824dff16 Use absl::Span in BPF disassembler 
PiperOrigin-RevId: 369636095
Change-Id: I13a8ae08ba354e54c502e0f6cdd35287fdfbb723
 2021-04-21 05:33:12 -07:00
Catalin Patulea
4344bbceba Add optional VLOG(1) for additional process info on Syscall Violation. 
PiperOrigin-RevId: 368900451
Change-Id: I331d0e239e2f3176c435bd42012d155d60d0b1ac
 2021-04-16 12:43:08 -07:00
Christian Blichmann
55a8373ec3 Avoid sanitizer macros use Abseil's where necessary 
Using C++17 means we can get rid of many `#ifdef`s by using `if constexpr`.
This way, we ensure that both branches compile and still retain zero runtime
overhead.

Note that open source builds of Sandboxed API do not ship with sanitizer
configurations yet. This will be added in follow-up changes.

PiperOrigin-RevId: 354932160
Change-Id: I3678dffc47ea873919f0a8c01f3a7d999fc29a5b
 2021-02-01 07:11:15 -08:00
Wiktor Garbacz
ec870c3d15 Simplify Executor ctor hierarchy 
Also accept `absl::string_view` and `absl::Span<const std::string>` arguments.

Drive-by:
 - Move using declaration into namespace
PiperOrigin-RevId: 354271016
Change-Id: Iadd873377e51cac7fa3800aab1f9e85ff94bd4e9
 2021-01-28 02:20:37 -08:00
Wiktor Garbacz
b98bed9860 Internal change 
PiperOrigin-RevId: 353233756
Change-Id: Ib658a3602097dc0288af592e21db373eb12e2077
 2021-01-22 07:00:05 -08:00
Christian Blichmann
75bbd0e1c1 Internal change 
Only externally visible changes should be a few changed includes as well as
some formatting changes.

PiperOrigin-RevId: 353226662
Change-Id: Iebf5be13774efcbd94c5d5a17b9b27e47275b229
 2021-01-22 06:01:34 -08:00
Christian Blichmann
dbaf95c724 Move utility code into sandboxed_api/util 
This change should make it less confusing where utility code comes from.
Having it in two places made sense when we were debating whether to publish
Sandbox2 separately, but not any longer.

Follow-up changes will move `sandbox2/util.h` and rename the remaining
`sandbox2/util` folder.

PiperOrigin-RevId: 351601640
Change-Id: I6256845261f610e590c25e2c59851cc51da2d778
 2021-01-13 09:25:52 -08:00
Wiktor Garbacz
6d98090962 Do not fail if forkserver is disabled by env when lib_ctor is used 
PiperOrigin-RevId: 346743575
Change-Id: I948aad88120746e15535e3c5270581a31a0b3d29
 2020-12-10 02:49:54 -08:00
Wiktor Garbacz
da64459e3f Allow shutting down the global forkserver 
PiperOrigin-RevId: 345198374
Change-Id: I3b5c49f6e5abb76d2b0a57078ffeb0609e0be008
 2020-12-02 03:05:37 -08:00
Wiktor Garbacz
5001778443 Use binary search in syscall defs 
The lookup is not on the hot path and this removes the SYSCALLS_UNUSED macros.

PiperOrigin-RevId: 344240762
Change-Id: I324bd798945851ac0b92e257206525eab4ec36e5
 2020-11-25 06:15:29 -08:00
Wiktor Garbacz
f8a2729c32 Start global fork-server on demand 
Allow disabling global fork-server with a flag.

PiperOrigin-RevId: 340860588
Change-Id: I184603dc3a81eb90f715053e14fb3b8d66a6f104
 2020-11-05 08:48:03 -08:00
Christian Blichmann
7c30aebe2d Use Abseil hash maps instead of std::map<T> 
PiperOrigin-RevId: 340807499
Change-Id: I2689bd1d32be45e3085dcc7a0ba4b8fedd7d53b0
 2020-11-05 01:49:14 -08:00
Christian Blichmann
6a1e4b881c Introduce config header to centralize CPU architecture checks 
This allows us to remove some uses of macros.

Related changes:
- Make it clear that we support hosting sandboxed binaries from 64-bit
  processes only. CPU architectures are x86-64 and POWER64 (little endian).
- Introduced CPU architecture macros, abstracting away compiler specifics

PiperOrigin-RevId: 330918134
Change-Id: Ife7ad5f14723eec9f68055127b0583b8aecd38dd
 2020-09-10 05:48:00 -07:00
Sandboxed API Team
23da55c19a Internal BUILD refactoring 
PiperOrigin-RevId: 329720214
Change-Id: I25fbb94dea17db3bdca6438d17508fa304d9706f
 2020-09-03 07:40:33 -07:00
Sandboxed API Team
1c833d6f25 Internal cleanup migrating StatusOr. 
PiperOrigin-RevId: 329304527
Change-Id: Id6c141272df54c4e165829d690f9f5b2e9ee90cc
 2020-08-31 08:13:29 -07:00
Wiktor Garbacz
f7d3f442df Extract ForkClient to a separate target 
PiperOrigin-RevId: 321757582
Change-Id: I48b89ab4e4b1d87dd9444874de5bf5bd2526531a
 2020-07-17 04:54:54 -07:00
Wiktor Garbacz
e9f7293e21 Fix ptrace_hook dependency graph 
PiperOrigin-RevId: 321748143
Change-Id: Idb453054b78e932ce13c5f44f7d408cc0f9c31f2
 2020-07-17 03:20:43 -07:00
Chris Kennelly
63a8b3ff15 Refactoring for internal change 
PiperOrigin-RevId: 320612442
Change-Id: I65729ac5d83c76dac047a47f866b7ad4af3c56c1
 2020-07-10 09:01:49 -07:00
Wiktor Garbacz
6008dc6db4 Reduce dependencies on libcap 
PiperOrigin-RevId: 319228803
Change-Id: I1a9497f9e33bbe1e84749505305cd9c148b6d700
 2020-07-01 08:23:46 -07:00
Sandboxed API Team
9b85dc49c1 Split sanitizer.h into a separate library 
PiperOrigin-RevId: 305327952
Change-Id: I6708729d379d019c3d299e9cb54b76338ced23bf
 2020-04-07 13:26:51 -07:00
Sandboxed API Team
2fa0bf85f4 Fix an ODR violation 
PiperOrigin-RevId: 303066199
Change-Id: I0cde5fce6f9538136b913edccc5a3195e0b4e503
 2020-03-26 01:59:05 -07:00
Sandboxed API Team
22c6417307 Adding new build rule for sanitizer 
PiperOrigin-RevId: 302687093
Change-Id: I090352c70df67e51eba79a618315b7ca9696bcfe
 2020-03-24 09:54:49 -07:00
Christian Blichmann
f6c3db4c6e Replace sapi::Status with absl::Status 
PiperOrigin-RevId: 297614681
Change-Id: I89fe1357a172ed4d28df6dd84b80fee364ce1c14
 2020-02-27 09:24:12 -08:00
bielec
5a4e3f3d29 Now network proxy server supports IP filtering. API to policybuilder is added to make a list of allowed pairs of allowed IP, mask and port where mask and port are optional. 
PiperOrigin-RevId: 296206385
Change-Id: I53b23122abece1fe318ed4c6a7e37bf3228c8f5f
 2020-02-20 07:45:44 -08:00
Sandboxed API Team
05280287e0 Automated rollback of commit 800339d672. 
PiperOrigin-RevId: 294644781
Change-Id: I88ad35abd96468476294039a41b6f2a8234db6ca
 2020-02-17 10:39:08 +01:00
bielec
800339d672 Now network proxy server supports IP filtering. API to policybuilder is added to make a list of allowed pairs of allowed IP, mask and port where mask and port are optional. 
PiperOrigin-RevId: 294640297
Change-Id: I4c6520685a658f8b7762af238588830f71b3f54a
 2020-02-17 10:38:44 +01:00
Wiktor Garbacz
d74215d30d Properly test read-only mounts 
PiperOrigin-RevId: 291337704
Change-Id: I806d0d09051ab205813d6626ea70e9e57a28a7a5
 2020-01-24 02:38:11 -08:00
Christian Blichmann
441201884a Update license header with recommended best practices 
PiperOrigin-RevId: 290250533
Change-Id: Ic34b253446463cf971a055b70a242df93a598ee3
 2020-01-17 05:05:29 -08:00
Sandboxed API Team
4608a7baea Explicitly export files needed by other packages 
PiperOrigin-RevId: 283942197
Change-Id: If1287d2544b2161e3087fb7f5f5395f69a2eb741
 2019-12-05 03:33:32 -08:00
Wiktor Garbacz
8a7d0d1cb3 Use a nested userns&mntns to pre-pivot_root 
This addresses a latency issue - chroot_fs_refs called inside pivot_root
in the kernel can take several milliseconds on machines with many threads
running.
This might not always reduce latency for custom forkservers, as additional
fork can be more costly than pivot_root.

PiperOrigin-RevId: 281306284
Change-Id: If503ac76a70e5438e94caf708d79cb0219c66def
 2019-11-19 09:02:28 -08:00
Christian Blichmann
c6b8e301e4 This fixes broken _proto_cc_cc_proto build target suffixes. 
These where inadvertently introduced in an internal cleanup change.

This change also removes a C++17-ism in var_proto.h. To make things easier for
downstream projects, we should stick to C++11 for the time being.

PiperOrigin-RevId: 271117700
Change-Id: I4eaacec88be16e1a561d3f77a61acce0a1af0b9d
 2019-09-25 07:13:58 -07:00
Sandboxed API Team
ce46cb3fef internal BUILD file cleanup. 
PiperOrigin-RevId: 270906748
Change-Id: I6a79c2f84a1d8a9fcb91061caa5f9e538fa83cba
 2019-09-24 08:12:21 -07:00
Kevin Hamacher
51d1a0e8ba Rollback of an internal change 
PiperOrigin-RevId: 270874732
Change-Id: I69538a0a37ba008a41220fe9d77b3e59f8d06610
 2019-09-24 04:11:52 -07:00
Sandboxed API Team
cee4ac35ae Internal BUILD file cleanup 
PiperOrigin-RevId: 270672739
Change-Id: I752113fc1fa5fa3f1585b918c89ca68c058db098
 2019-09-23 07:33:08 -07:00
Sandboxed API Team
a6285716f1 Internal cleanup 
PiperOrigin-RevId: 270653397
Change-Id: I495a30cffdfa932da045ebed626bf97f1cb68bb2
 2019-09-23 05:14:00 -07:00
Sandboxed API Team
84702e6c97 No public change. 
PiperOrigin-RevId: 265663675
Change-Id: I6ffcf796a13cddaea4f8b8a0ca20b92cc8e316a7
 2019-08-27 05:36:35 -07:00
bielec
ef7592cfdd Now the network proxy client can automatically redirect connect syscalls to a handler that will send the data (syscall arguments) to the proxy server automatically and will return the obtained socket from the proxy server, in the future rules like allowed IP, protocols, etc. will be added 
PiperOrigin-RevId: 259512665
Change-Id: I2747c7548ab24c7d2c90abb303fd783c11fed6f4
 2019-07-23 04:41:08 -07:00
Wiktor Garbacz
691104c851 Extract RunInitProcess and SendPid/RecvPid 
Also properly check status of send and use one-byte messages
to avoid issues with partial send, receive.

PiperOrigin-RevId: 258362495
Change-Id: I889b4699c100c80d15b129bf3a254f5442405bc2
 2019-07-16 07:23:17 -07:00
Christian Blichmann
6d06df1b86 Break out executor into its own build target 
PiperOrigin-RevId: 257147090
Change-Id: I34c5e86ca68f865fdae42e4077c52c6168672c06
 2019-07-09 01:53:56 -07:00
Christian Blichmann
747ccb57e8 Rename stack-trace{.h,.cc,._test.cc} to use underscores 
PiperOrigin-RevId: 257144753
Change-Id: I4ce0dffad552c25b61102adfb1c03b8aea427dd9
 2019-07-09 01:32:25 -07:00
Christian Blichmann
ffd4e1270a Internal change 
PiperOrigin-RevId: 251590551
Change-Id: Ic69f8f5f798006c0d096357b7a746cdc4ce530a3
 2019-06-05 00:26:14 -07:00
Sandboxed API Team
6666f41ba2 Fix unnecessary unique_ptr in LogServer. 
PiperOrigin-RevId: 250050562
Change-Id: I6840e68504c741de1e66489279237f4a4a6bc533
 2019-05-26 08:47:38 -07:00
Wiktor Garbacz
42761c8b72 Add a resource starvation test 
PiperOrigin-RevId: 248334209
Change-Id: Iff0f0b3024c67a767c429a547695cc48a2d02a30
 2019-05-15 08:04:58 -07:00
Christian Blichmann
5f3c7171b7 Use Abseil's flag library released in aa468ad75539619b47979911297efbb629c52e44 
PiperOrigin-RevId: 247424939
Change-Id: I22a4696f705f9dcfa7394b329c78bd126f42bd16
 2019-05-09 07:57:55 -07:00
Christian Blichmann
7800fd7402 Disable compiler warnings for consistency with internal settings. 
PiperOrigin-RevId: 247405215
Change-Id: I236170f7b47d9ecd32324db907ef7afc2e797d9a
 2019-05-09 05:21:34 -07:00
Sandboxed API Team
f29a5a81ed Print final FS mounts in sandboxee's chroot 
After all requested filesystem mounts are fully mounted under a sandboxee's virtual chroot, print a list of the outside paths and a list of the inside chroot paths that the outside paths are mapped to. This provides a valuable insight while debugging sandboxed binaries.

PiperOrigin-RevId: 247130923
Change-Id: I42b4b3db68d826587c0fe8127aabbead38bc6f20
 2019-05-07 18:30:13 -07:00
Wiktor Garbacz
5e645a9190 Fix build 
PiperOrigin-RevId: 245400890
Change-Id: I899ef49edd8e371b8714478fa3c911cfb771419b
 2019-04-26 04:42:52 -07:00
Sandboxed API Team
f3c9c6e388 Internal change 
PiperOrigin-RevId: 245377524
Change-Id: If41601b2d68c6ff0f7d3f37811aac62c32441d1f
 2019-04-26 00:46:11 -07:00
Sandboxed API Team
afec50fdb5 automated internal change 
PiperOrigin-RevId: 245070237
Change-Id: Ib6b0d9201f8b603e185eb91c1bc9f500f1af1ed6
 2019-04-24 10:31:13 -07:00
Wiktor Garbacz
c6d16a58eb Internal change 
PiperOrigin-RevId: 244882748
Change-Id: I0342f445df8f60f864d3e7f56145051b821a86e0
 2019-04-23 10:47:34 -07:00