Oliver Kunz
077203fcf2
Change to proto2::MessageLite and resolve reflextion for mobile builds
...
PiperOrigin-RevId: 432164927
Change-Id: I0821cf443393b0bb16a68fc5750a9633a3f27725
2022-03-03 04:48:30 -08:00
Sandboxed API Team
e1a9513783
Move few policies from tsan to All section.
...
munmap is widely used by sanitizer, but it
probably works for Asan/Msan because it's enabled
by unrelated Allow* call.
Move mprotect to shared part as well. It will be
needed for compress_stack_depot.
PiperOrigin-RevId: 431989551
Change-Id: I7695a2de81d8d0b2112d3308778b2e9a9c7cb596
2022-03-02 11:38:35 -08:00
Sandboxed API Team
546365655d
Introduce commandline flag to pass forkserver_bin path for Android builds.
...
PiperOrigin-RevId: 431942480
Change-Id: I5382b4fc8e8a66bb823dda597e1b812421364212
2022-03-02 08:12:21 -08:00
Sandboxed API Team
3f042fa54f
Fix monitor for Android-ARM64
...
PiperOrigin-RevId: 431926820
Change-Id: Ie5adc1ec6accc7e68782c26b65fac0c32cded498
2022-03-02 06:42:42 -08:00
Sandboxed API Team
9a7ba28ea7
Allow sanitizer to print reports
...
PiperOrigin-RevId: 430271415
Change-Id: Ieb23663aa6ff5997ce0a6b1e81dcb2385ac4b509
2022-02-22 12:33:55 -08:00
Wiktor Garbacz
a2daa0a275
Fix BlockSyscallsWithErrno
...
PiperOrigin-RevId: 429982218
Change-Id: I42b187e678542b295542ca44882945c7695178e1
2022-02-21 00:46:50 -08:00
Christian Blichmann
befdb09597
Link more complex test cases dynamically
...
Linking glibc in fully static mode is mostly unsupported. While such binaries
can easily be produced, conflicting symbols will often make them crash at
runtime. This happens because glibc will always (try to) load some dynamically
linked libraries, even when statically linked. This includes things like the
resolver, unicode/locale handling and others.
Internally at Google, this is not a concern due to the way glibc is being built
there. But in order to make all of our tests run in the open-source version of
this code, we need to change strategy a bit.
As a rule of thumb, glibc can safely be linked statically if a program is
resonably simple and does not use any networking of locale dependent
facilities. Calling syscalls directly instead of the corresponding libc
wrappers works as well, of course.
This change adjusts linker flags and sandbox policies to be more compatible
with regular Linux distributions.
Tested:
- `ctest -R '[A-Z].*'` (all SAPI/Sandbox2 tests)
PiperOrigin-RevId: 429025901
Change-Id: I46b677d9eb61080a8fe868002a34a77de287bf2d
2022-02-16 05:59:13 -08:00
Christian Blichmann
aefdb94575
Update zlib examples
...
- Link `zipe.c` statically (safe)
- Update policy to allow any use of `stat()`
PiperOrigin-RevId: 428971638
Change-Id: Ib0f5f496ea2389582986b41a8830592e6c1d4390
2022-02-16 00:08:28 -08:00
Christian Blichmann
e8cadf8f7d
Allow mprotect(_, _, PROT_READ) for all static binaries
...
Newer toolchains/libcs will use this syscall on x86-64 as well.
PiperOrigin-RevId: 428705078
Change-Id: I705efe37db9ebdd922036b39e4fb3c22dc749a1a
2022-02-15 00:14:25 -08:00
Christian Blichmann
36d0f928c6
Apply page offset during stack unwinding/symbolization
...
This fixes a couple of tests in the open source version of the code.
Internally, since we are using a different ELF loader, the page offset
will always be zero. Hence we never notices this was broken.
PiperOrigin-RevId: 427996428
Change-Id: I44c5b5610b074cf69b9f0c5eeb051be50923e351
2022-02-11 07:19:34 -08:00
Sandboxed API Team
59b942b256
Add a little more logging to failure cases.
...
PiperOrigin-RevId: 427459159
Change-Id: I34b6027cccfc4b3903ef4deeb9c133598b6667d4
2022-02-09 06:54:07 -08:00
Christian Blichmann
4ad8484e63
Tag additional test as not compatible with QEMU user-mode emulation
...
PiperOrigin-RevId: 427409251
Change-Id: I5d853908353923b5b31c8bbb6152bc4f94219b45
2022-02-09 01:41:38 -08:00
Christian Blichmann
dc03c38df1
Enable stack traces on AArch64
...
Note that `//sandboxed_api/sandbox2:stack_trace_test` may still fail for
unrelated reasons, as we are linking libc statically, which is brittle. A
follow-up change will fix this.
PiperOrigin-RevId: 427175045
Change-Id: Ifb5ec2ac3d60f4bcc9708f26c834c83b75e769d7
2022-02-08 06:23:52 -08:00
Sandboxed API Team
b7cb7132a2
Delete deprecated ::sandbox2::Sandbox2::WaitForTsan and its remaining call sites.
...
PiperOrigin-RevId: 426195145
Change-Id: Ia7c8116a0fb08e2f425d9b89406b446edcf7850a
2022-02-03 11:23:56 -08:00
Wiktor Garbacz
943c74827b
Internal change
...
PiperOrigin-RevId: 426180225
Change-Id: Id7ea6118a6403221451d6db22d30ae8b29ef42bf
2022-02-03 10:26:45 -08:00
Sandboxed API Team
1e5e426e70
Remove comment on licenses() rule as per Google guidance.
...
PiperOrigin-RevId: 426136170
Change-Id: I341a2d962637b53f9cfa475fbbfe3e6938ee3a95
2022-02-03 07:10:12 -08:00
Sandboxed API Team
9ee3a26e8b
Delete deprecated ::sandbox2::Sandbox2::GetPid and its remaining call sites.
...
PiperOrigin-RevId: 425910086
Change-Id: I2938ce589e83b5441c084994edde6a22c2007642
2022-02-02 09:57:11 -08:00
Christian Blichmann
d451478e26
Change license link to HTTPS URL
...
PiperOrigin-RevId: 424811734
Change-Id: If5ea692edc56ddc9c99fd478673df41c0246e9cc
2022-01-28 01:39:09 -08:00
Copybara-Service
cc6a1114d5
Merge pull request #84 from Vincenzo-Petrolo:main
...
PiperOrigin-RevId: 424301145
Change-Id: I0336c5ffc2eeefe0ccecb7595b0881df23390bf6
2022-01-26 03:00:06 -08:00
Wiktor Garbacz
ae9432bc03
Internal change
...
PiperOrigin-RevId: 423070471
Change-Id: I876ef8f1d2464383ac319e196c1ba64c46ea4201
2022-01-20 08:09:53 -08:00
Wiktor Garbacz
4041fe824b
Use the using declarations from ::testing
...
PiperOrigin-RevId: 423042437
Change-Id: I9ddfacd597c65d3dc6e490201cce4b00678f18cf
2022-01-20 05:16:01 -08:00
Wiktor Garbacz
4a945a1748
Replace deprecated calls
...
PiperOrigin-RevId: 423037776
Change-Id: Id568d54854dde3778686b778648555e0b48204bc
2022-01-20 04:40:23 -08:00
Christian Blichmann
9229b3fa82
Fix -Wc++11-narrowing error with Clang introduced in 2546d9e
...
PiperOrigin-RevId: 421784429
Change-Id: Ia5d09a980db39bc8d88373dc769cb5889417502d
2022-01-14 03:40:01 -08:00
Sandboxed API Team
2546d9e85b
Ability to inspect a syscall's return value.
...
PiperOrigin-RevId: 421552017
Change-Id: I7103720723b5e5828f80731a724c5672895dfa54
2022-01-13 06:49:19 -08:00
Sandboxed API Team
ebe4475348
Fix typo in log line that displayed decimals with 0x prefix
...
PiperOrigin-RevId: 421547286
Change-Id: Ie088bb7871629db919f34f365eb9b6ab7fe65917
2022-01-13 06:20:47 -08:00
Wiktor Garbacz
99b56fee19
Remove redundant glog dependency for sandbox2::sanitizer
...
PiperOrigin-RevId: 421500119
Change-Id: I720a3efef52868099d388685abee45be887ba430
2022-01-13 01:15:50 -08:00
Sandboxed API Team
85c8ae5125
Automated rollback of commit fac8713fbe.
...
PiperOrigin-RevId: 421356226
Change-Id: I4a179aeed226e005449c980e11b049759dad3878
2022-01-12 11:47:06 -08:00
Sandboxed API Team
fac8713fbe
Ability to inspect a syscall's return value.
...
PiperOrigin-RevId: 421300791
Change-Id: I93b7e97a532f82c2b077766e22fb2fe9effe6ba2
2022-01-12 08:09:09 -08:00
Wiktor Garbacz
b0bc17e456
Fix Regs::SkipSyscallReturnValue for Aarch64
...
Add a test.
PiperOrigin-RevId: 420271649
Change-Id: Ifc857ec5351a0fc70547c98f57c22cf792d5d9f9
2022-01-07 05:26:26 -08:00
Christian Blichmann
21847a1ef1
Emulate PTRACE_GETREGSET in ptrace wrapper
...
Newer versions of libunwind use `PTRACE_GETREGSET` to obtain register data.
This change should make it easier to upgrade the libunwind dependency.
PiperOrigin-RevId: 420057842
Change-Id: Ib9abbeff574e457009709715f912ba5962033c5d
2022-01-06 07:33:13 -08:00
Christian Blichmann
aa3f60148c
Do not run static test on AArch64 user mode emulation
...
PiperOrigin-RevId: 417556328
Change-Id: Ib04b3c6bbe8e5fcece11652c7a751a319899b73c
2021-12-21 00:17:22 -08:00
Wiktor Garbacz
3f5184770d
Introduce util::CharPtrArray with proper ownership semantics
...
Replace existing calls to VecStringToCharPtrArr
PiperOrigin-RevId: 417383812
Change-Id: Ibf9d878df5ada2cb3a0872f7ca7cab96c304a5c1
2021-12-20 05:08:12 -08:00
Sandboxed API Team
a44e57e243
Update references to the new documentation
...
PiperOrigin-RevId: 416317448
Change-Id: Ic148364e012405cc34840c12428cbd912ed377ae
2021-12-14 09:03:29 -08:00
Christian Blichmann
11619a08f4
Remove SyscallInitializer
...
PiperOrigin-RevId: 416231431
Change-Id: I83575ee3a51c348912f3d13db600d104ee927265
2021-12-14 00:45:27 -08:00
Christian Blichmann
01ffc2a1c2
#Cleanup PolicyBuilder API using absl::Span
...
PiperOrigin-RevId: 415979969
Change-Id: I23e00a48ce9ba14c480f8d137c6ae3981a238e13
2021-12-13 01:31:59 -08:00
Christian Blichmann
354cbe89f9
Add more convenience functions to PolicyBuilder
...
- Allow to specify multiple syscalls with `BlockSyscallsWithErrno()`
- Add functions to allow `unlink()` and `rename()` in all their spellings
PiperOrigin-RevId: 414987303
Change-Id: Ic0e680b785e8e3a3498f20e6a7403737e63fe876
2021-12-08 06:41:21 -08:00
Sandboxed API Team
46c09e0024
Implement WaitForTsan on other sanitizers
...
__sanitizer_sandbox_on_notify is not tsan specific.
It's empty for other sanitizers now, but we are going to need it soon.
PiperOrigin-RevId: 414873197
Change-Id: I251ac38e5c886980b4baa7f05306643599a25090
2021-12-07 17:59:05 -08:00
Wiktor Garbacz
8979b47d7f
Remove arg filter on rt_sigprocmask in AllowStaticStartup
...
PiperOrigin-RevId: 414692179
Change-Id: If2a5f741ad38f626287988911b85bef7a711f80a
2021-12-07 05:04:01 -08:00
Sandboxed API Team
8e8ce0955f
Fix unwind module for Android-ARM64
...
PiperOrigin-RevId: 414673588
Change-Id: Ib40e4f6b53692440591a1a1e9e069f974832f733
2021-12-07 03:33:56 -08:00
Wiktor Garbacz
8562306c97
Add CloseAllFDsExcept test.
...
Move VecStringToCharPtrArr before fork, so that it cannot deadlock when other thread holds allocation lock.
PiperOrigin-RevId: 414661912
Change-Id: Ie8aa5c36693e6f86c69d67a1da51b7e7ff1ec30b
2021-12-07 02:23:23 -08:00
Wiktor Garbacz
4061666f44
Fix dependencies for sanitizer target
...
PiperOrigin-RevId: 414659990
Change-Id: I25215d0f03cf998fee068ae7db91b7e438fcc4f5
2021-12-07 02:13:15 -08:00
Sandboxed API Team
84c29dd3bb
Relax the policy to allow stat (and possibly stat64).
...
PiperOrigin-RevId: 414480521
Change-Id: If0ffca2141589ea3cf0dec4b0524c50ca37489b4
2021-12-06 10:23:31 -08:00
Christian Blichmann
60eb52c17f
Explicitly narrow size argument for BPF
...
This fixes a build error introduced in 26da6e6b0a
2021-12-06 04:51:28 -08:00
Wiktor Garbacz
4e6cafa934
Readd function comment removed by mistake
...
PiperOrigin-RevId: 414406963
Change-Id: Id8155b67ce063a9171b70e24b58d407415b30e78
2021-12-06 04:43:32 -08:00
Wiktor Garbacz
245a8c7650
Remove deprecated AddTmpfs
...
PiperOrigin-RevId: 414387983
Change-Id: I872c2f3bc1ccaf7a20d7ab97a5cb104d4f096a3f
2021-12-06 02:36:02 -08:00
Wiktor Garbacz
2a67805a13
Add prlimit64 to AllowLogForwarding
...
PiperOrigin-RevId: 414385430
Change-Id: I4e70d25f886f1ef65fab1b62c67e80eb45407bc7
2021-12-06 02:19:03 -08:00
Chris Kennelly
e61a84979a
Internal change
...
PiperOrigin-RevId: 413954176
Change-Id: Ie07c1c8d96019e1605ea3b9ed58030754954ee97
2021-12-03 09:34:32 -08:00
Wiktor Garbacz
e4ef46631d
Replace raw_logging with regular logging in Monitor
...
PiperOrigin-RevId: 413928700
Change-Id: I0bc4dd86b45c0ddd679a435003fbad2aea27fbf2
2021-12-03 07:17:36 -08:00
Wiktor Garbacz
2fa92bf47c
Internal change
...
PiperOrigin-RevId: 413911008
Change-Id: I59cdac60c092f31fb487f032b3489341c0ba626a
2021-12-03 05:21:01 -08:00
Wiktor Garbacz
c3308b56fc
Replace deprecated AddTmpfs call
...
PiperOrigin-RevId: 413907279
Change-Id: I3a32be4b19acab8b2b2092961df3dd9f3699261b
2021-12-03 04:56:40 -08:00
