StarMirror/sandboxed-api
1
0
Fork 0
mirror of https://github.com/google/sandboxed-api.git synced 2024-03-22 13:11:30 +08:00
Code Issues Projects Releases Wiki Activity
954 Commits 1 Branch 3 Tags 144 MiB
5f34d11e77
Commit Graph

954 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Christian Blichmann
97b5f0767a Find libclang so that Python3 works, remove PY2 annotations 
We now require that Debian users install the `python3` and `python3-pip`
packages. This change lets the Python code search for `libclang.so`, which can
be located in different directories, depending on version, and is not found by
default otherwise.

Fixes #28

PiperOrigin-RevId: 254745872
Change-Id: Ia77680da2a3235c0a9518125676aa8a460e38e76
 2019-06-24 06:30:34 -07:00
Christian Blichmann
4bcea59309 Use to_list() on Bazel depsets for iteration. 
Starting with Bazel 0.27.0 --incompatible_depset_is_not_iterable became the
default.

Fixes #27

PiperOrigin-RevId: 254703981
Change-Id: I727e4b1c6a907c8794a00f61646c13ad8d4437b7
 2019-06-24 00:45:55 -07:00
Christian Blichmann
6ca744b959 Fix old 'google' namespace in example 
PiperOrigin-RevId: 254203473
Change-Id: I04401074585769f3692f320f5aa0dbbecb51ebcc
 2019-06-20 08:37:56 -07:00
Wiktor Garbacz
4b9be4e78a Fix formating 
PiperOrigin-RevId: 253196457
Change-Id: Id73a08945dedff7a116d500202355ecf266afcf3
 2019-06-14 03:01:09 -07:00
Wiktor Garbacz
605d402121 Use new function naming 
PiperOrigin-RevId: 253191002
Change-Id: If00c0effb925b3e294593f272447cd8386228bac
 2019-06-14 02:09:07 -07:00
Christian Blichmann
4d891de31b Internal change 
PiperOrigin-RevId: 252609329
Change-Id: I46a05641456144e7967e01905c60e18aef164b3f
 2019-06-11 06:49:45 -07:00
Sandboxed API Team
970257d87b Allow two madvise calls for asan & tsan builds. 
bbfa21f177/lib/sanitizer_common/sanitizer_posix_libcdep.cc (L71)

PiperOrigin-RevId: 252048323
Change-Id: I457e708f0b024fd9db4ad39265cb904777ca52b5
 2019-06-07 07:53:10 -07:00
Christian Blichmann
dfbfb5cc43 Add CMake builds for the examples 
PiperOrigin-RevId: 252045309
Change-Id: I57ffc3debbe64010b1f20b2e6df900b9916fa37f
 2019-06-07 07:27:33 -07:00
Christian Blichmann
f2c7f976cf Add minimal Bazel CI config 
PiperOrigin-RevId: 252043934
Change-Id: I29222d770c44522b21560bb736b1f5fd55cb0da0
 2019-06-07 07:14:07 -07:00
Christian Blichmann
24c3e34344 Implement a GetDataDependencyFilepath() for CMake (non-Bazel really). 
This code assumes, like Bazel's runfiles that the data dependency to access
exists in the same sub-tree as the binary:

WORKSPACE
+- sandboxed_api/sandbox2/examples/crc4
                                   +- crc4bin
                                   +- crc4sandbox

The code requires the directory structure to exist, so that in the example
above, crc4sandbox can use
  GetDataDependencyFilepath("sandboxed_api/sandbox2/examples/crc4/crc4bin")

regardless of how it was called.

PiperOrigin-RevId: 251834480
Change-Id: I6470b62ce9b403297116481a0c17c070992f2e81
 2019-06-06 05:44:32 -07:00
Christian Blichmann
65440dddd6 Update to latest Google Test 
PiperOrigin-RevId: 251640007
Change-Id: Ied7b1c07c49c6574bc26591902c520a53b56b658
 2019-06-05 07:40:13 -07:00
Christian Blichmann
9b78e331fa Use newer gflags namespace for command-line flags 
PiperOrigin-RevId: 251639941
Change-Id: I3037ce9510a3bc62cf5c899c64f2e7d344a8b4ee
 2019-06-05 07:39:38 -07:00
Sandboxed API Team
1b2b83676b Internal Change 
PiperOrigin-RevId: 251637952
Change-Id: I532201ec1ba16a4cae71c671ffe2bd34e13a5391
 2019-06-05 07:24:16 -07:00
Christian Blichmann
e09bda2628 Internal change 
PiperOrigin-RevId: 251624033
Change-Id: I9b2ab423082be3bfdb6da66ab7a8e77e5673789b
 2019-06-05 05:28:56 -07:00
Christian Blichmann
ffd4e1270a Internal change 
PiperOrigin-RevId: 251590551
Change-Id: Ic69f8f5f798006c0d096357b7a746cdc4ce530a3
 2019-06-05 00:26:14 -07:00
Christian Blichmann
a3b0949949 Internal change 
PiperOrigin-RevId: 251411359
Change-Id: Ifbed8afa72d130ae803ed71a6a43ac3c9d8755f9
 2019-06-04 04:07:21 -07:00
Christian Blichmann
dd20e170d0 Internal change 
PiperOrigin-RevId: 251409173
Change-Id: Ic5fcf3056c32b39a8365efa0bea4ebf7547d64e0
 2019-06-04 03:47:41 -07:00
Christian Blichmann
9351e02182 Internal change 
PiperOrigin-RevId: 251404733
Change-Id: Iaa53a1c14e7818dae4ae247bfefb2cba4498ba4d
 2019-06-04 03:06:36 -07:00
Christian Blichmann
719cd24933 Fix sandbox2 tests when run with CTest 
This test runs, but fails due to a different problem:
  StackTraceTest.ForkEnterNsLibunwindDoesNotLeakFDs

PiperOrigin-RevId: 251218516
Change-Id: If06cdbcb71fad84ebd9d934ff173d7ef1a1eebc0
 2019-06-03 06:27:59 -07:00
Sandboxed API Team
dd2a84b980 Clarify behavior of Buffer::CreateFromFd 
PiperOrigin-RevId: 250834142
Change-Id: I7aac739c9b590adc0599926e3246bc87e21d951a
 2019-05-30 23:50:54 -07:00
Sandboxed API Team
6666f41ba2 Fix unnecessary unique_ptr in LogServer. 
PiperOrigin-RevId: 250050562
Change-Id: I6840e68504c741de1e66489279237f4a4a6bc533
 2019-05-26 08:47:38 -07:00
Wiktor Garbacz
08ff939ea7 Call DisableNamespaces where needed 
PiperOrigin-RevId: 249637351
Change-Id: I5105d89ea0e8cfb2fca1e5ac342fa67e9caac930
 2019-05-23 07:21:03 -07:00
Wiktor Garbacz
85059ef40d Add DisableNamespaces to PolicyBuilder 
Currently mostly no-op, but this is the first step to turn namespaces on
by default.

PiperOrigin-RevId: 249439158
Change-Id: I5eeb1216dc868c660f62ad50c34f626afbf7db61
 2019-05-22 06:54:12 -07:00
Wiktor Garbacz
71a317e65f Do not emit an error on ESRCH in PTRACE_CONT 
Process might be killed between waitpid and PTRACE_CONT,
even though a PTRACE_EVENT_EXIT will be gererated, continuing
will fail with ESRCH in that case.

PiperOrigin-RevId: 249245726
Change-Id: Ib673529229a306d2266fa60caa3039b6bcd80a65
 2019-05-21 07:30:56 -07:00
Wiktor Garbacz
15993a34e2 Log stack traces with INFO instead of ERROR 
PiperOrigin-RevId: 249035379
Change-Id: Ie62366f45f29741ee0c8b25369d0bb169275ccfd
 2019-05-20 06:16:50 -07:00
Wiktor Garbacz
207b2d9a95 Remove stale comment 
PiperOrigin-RevId: 248715509
Change-Id: I7aa3f4388920e39a79ac349890de403ac3384504
 2019-05-17 07:21:31 -07:00
Wiktor Garbacz
34d17b77ac Remove dead code 
IPC always creates comms object from a fd.

PiperOrigin-RevId: 248683525
Change-Id: Ib4285ec0494d551257237c12f92f983b943205cb
 2019-05-17 02:02:03 -07:00
Wiktor Garbacz
8678af23d0 Extract GetRlimitName into util 
PiperOrigin-RevId: 248682931
Change-Id: I702533a8d36465de956a1a90a40c634434b7a671
 2019-05-17 01:55:35 -07:00
Wiktor Garbacz
6e1c3c3055 Fix prlimit error message 
PiperOrigin-RevId: 248491089
Change-Id: Id4116939d02b6a592c74218955675acf2e3c70fe
 2019-05-16 02:24:59 -07:00
Wiktor Garbacz
7294e9976e Replace custom synchronization with absl::Notification 
PiperOrigin-RevId: 248334969
Change-Id: I7614a3792babd399912c5d5a167ab5e0a0574d20
 2019-05-15 08:09:56 -07:00
Wiktor Garbacz
42761c8b72 Add a resource starvation test 
PiperOrigin-RevId: 248334209
Change-Id: Iff0f0b3024c67a767c429a547695cc48a2d02a30
 2019-05-15 08:04:58 -07:00
Wiktor Garbacz
6588aa2a68 Reintroduce monitor changes. 
Signal handling in Monitor::MainLoop was fixed.

PiperOrigin-RevId: 248331692
Change-Id: I0f85d319802258632d2074742c53597bb922555a
 2019-05-15 07:46:49 -07:00
Sandboxed API Team
d8f7d861d2 Log the progress of dynamic libraries being resolved while creating a sandboxee's virtual FS chroot. This provides valuable insight while debugging problems with dynamically linked sandoxed binaries. 
PiperOrigin-RevId: 247625021
Change-Id: I9bf77af7410deb8766fd49910c8564e148020601
 2019-05-10 09:41:07 -07:00
Christian Blichmann
5f3c7171b7 Use Abseil's flag library released in aa468ad75539619b47979911297efbb629c52e44 
PiperOrigin-RevId: 247424939
Change-Id: I22a4696f705f9dcfa7394b329c78bd126f42bd16
 2019-05-09 07:57:55 -07:00
Christian Blichmann
7800fd7402 Disable compiler warnings for consistency with internal settings. 
PiperOrigin-RevId: 247405215
Change-Id: I236170f7b47d9ecd32324db907ef7afc2e797d9a
 2019-05-09 05:21:34 -07:00
Sandboxed API Team
63f0adbfbb Revert of monitor code update. 
PiperOrigin-RevId: 247255592
Change-Id: I3656ea1628418321b1b8b02660b6a51a58c2c61f
 2019-05-08 11:34:26 -07:00
Wiktor Garbacz
3f5360a7bc Simplify monitor code. 
Make setting result code the condition for main loop exit.

PiperOrigin-RevId: 247218505
Change-Id: I8699012683bc301e8a9f4f41cd5ab018e3cd514c
 2019-05-08 08:34:56 -07:00
Christian Blichmann
a412383d61 Fix build failure with Bazel v0.25.0+ (#25) 
PiperOrigin-RevId: 247206409
Change-Id: Ic6d4d1fea42ea5746613d3ef3de67f61e72848a6
 2019-05-08 07:07:29 -07:00
Sandboxed API Team
f29a5a81ed Print final FS mounts in sandboxee's chroot 
After all requested filesystem mounts are fully mounted under a sandboxee's virtual chroot, print a list of the outside paths and a list of the inside chroot paths that the outside paths are mapped to. This provides a valuable insight while debugging sandboxed binaries.

PiperOrigin-RevId: 247130923
Change-Id: I42b4b3db68d826587c0fe8127aabbead38bc6f20
 2019-05-07 18:30:13 -07:00
Christian Blichmann
bfcd28bb91 Merge pull request #24 from cblichmann:master 
PiperOrigin-RevId: 246817542
Change-Id: I59a35015e68a7f2daef9dd63fc9fb638cd433c1c
 2019-05-06 16:30:30 +02:00
Christian Blichmann
6bfa83befe CMake support for Sandbox2 
- Add a superbuild in cmake/SuperBuild.cmake that downloads and builds
  dependencies
- Builds for sandbox2/ and a its tests
- Helper CMake function to strip proto paths
- Module to find libcap
- Custom build for libunwind that wraps its symbols
- Fix environment so that CTest executes tests similar to Bazel
- Filewrapper functionality, like Bazel's cc_embed_data()
- Build forkserver with embedded binary
- Enable ASM language so that libunwind builds correctly
- Allow glog target to propagate transitively (to propagate its include dirs)

Signed-off-by: Christian Blichmann <cblichmann@google.com>
 2019-05-06 14:03:29 +02:00
Christian Blichmann
7753cded13 Replace non-alphanumeric, non-underscore characters in filewrapper 
PiperOrigin-RevId: 246320238
Change-Id: I08454dc19b6227e4ce2c1b7677b916706e7be5a5
 2019-05-02 08:11:50 -07:00
Wiktor Garbacz
64cfb949f4 Internal change 
PiperOrigin-RevId: 245410078
Change-Id: I9ef7680885927b23734c02e063a617c9dbc3b856
 2019-05-02 05:21:32 -07:00
Wiktor Garbacz
3a2829bafc Fix minielf test 
PiperOrigin-RevId: 245409987
Change-Id: I5c728f012776105b7070e88d77bba27a205d56f1
 2019-04-26 06:22:31 -07:00
Wiktor Garbacz
e8ef753821 Internal change 
PiperOrigin-RevId: 245409914
Change-Id: I20f23a997e09ce4cc2fe9353ac6f341a641e2263
 2019-04-26 06:20:43 -07:00
Wiktor Garbacz
b1aa95fcde Internal change 
PiperOrigin-RevId: 245409846
Change-Id: Ic9f398146a4c0d72592f5bb7b46a01333303ba12
 2019-04-26 06:20:05 -07:00
Wiktor Garbacz
523620f8ab Internal change 
PiperOrigin-RevId: 245409785
Change-Id: I37b1611bed459522803fa1e49c4252d2cad80076
 2019-04-26 06:18:59 -07:00
Wiktor Garbacz
5e645a9190 Fix build 
PiperOrigin-RevId: 245400890
Change-Id: I899ef49edd8e371b8714478fa3c911cfb771419b
 2019-04-26 04:42:52 -07:00
Sandboxed API Team
f3c9c6e388 Internal change 
PiperOrigin-RevId: 245377524
Change-Id: If41601b2d68c6ff0f7d3f37811aac62c32441d1f
 2019-04-26 00:46:11 -07:00
Sandboxed API Team
afec50fdb5 automated internal change 
PiperOrigin-RevId: 245070237
Change-Id: Ib6b0d9201f8b603e185eb91c1bc9f500f1af1ed6
 2019-04-24 10:31:13 -07:00