Commit Graph

671 Commits

Author SHA1 Message Date
Christian Blichmann
75bbd0e1c1 Internal change
Only externally visible changes should be a few changed includes as well as
some formatting changes.

PiperOrigin-RevId: 353226662
Change-Id: Iebf5be13774efcbd94c5d5a17b9b27e47275b229
2021-01-22 06:01:34 -08:00
Christian Blichmann
19fd11b91e Move GetInternalDataDependencyFilePath() into internal namespace
Implements #79

PiperOrigin-RevId: 351778836
Change-Id: I726837d8e75880bf5ddfb1a327249dd666adec53
2021-01-14 05:11:22 -08:00
Christian Blichmann
dbaf95c724 Move utility code into sandboxed_api/util
This change should make it less confusing where utility code comes from.
Having it in two places made sense when we were debating whether to publish
Sandbox2 separately, but not any longer.

Follow-up changes will move `sandbox2/util.h` and rename the remaining
`sandbox2/util` folder.

PiperOrigin-RevId: 351601640
Change-Id: I6256845261f610e590c25e2c59851cc51da2d778
2021-01-13 09:25:52 -08:00
Sandboxed API Team
b61b2a37b7 Add IsStarted() method to GlobalForkClient.
PiperOrigin-RevId: 351170872
Change-Id: I5544eb27962606a562ce79b97d508f841ec0dc56
2021-01-11 09:34:13 -08:00
Sandboxed API Team
3d737e3830 Automated rollback of commit 7440916b80.
PiperOrigin-RevId: 351144593
Change-Id: Ic1401e16dcf2b6b009a9f53395929e31a68cfa77
2021-01-11 06:58:30 -08:00
Maciej Szawłowski
7440916b80 Internal tests tweak.
PiperOrigin-RevId: 351138044
Change-Id: I98e27ca5f0ea456a906c5382aa22135f21c8a1d9
2021-01-11 06:07:45 -08:00
Wiktor Garbacz
451c24c1c4 Fix fd leak
Support swapping and move assignment in FDCloser

PiperOrigin-RevId: 351119550
Change-Id: I9865d2fcad029a440cab60328b8731f8e1dc340f
2021-01-11 03:33:27 -08:00
Wiktor Garbacz
e94ba3a16b Fix cURL example build
Fixes #76

PiperOrigin-RevId: 350728353
Change-Id: Iebc4a0a381fff379498b66dfa9238d33efa69ec1
2021-01-08 02:48:05 -08:00
Wiktor Garbacz
6dd0a52561 Use unique var name in SAPI_RETURN_IF_ERROR to avoid name clashes
PiperOrigin-RevId: 350724380
Change-Id: I07c11b1897043df188bbef7934b5a41185a82a79
2021-01-08 02:09:40 -08:00
Copybara-Service
918a409126 Merge pull request #78 from cblichmann:gen2-clang-path
PiperOrigin-RevId: 350524271
Change-Id: I46080c86c8e03f13a7468a73d752e968d5e9b56d
2021-01-07 03:19:55 -08:00
Christian Blichmann
f9b4083dee
Header generator: Enable to find latest Clang
This also allows to install `libclang1` instead of `libclang1-dev` as
one of the build dependencies on Ubuntu/Debian.

Signed-off-by: Christian Blichmann <cblichmann@google.com>
2021-01-07 11:15:13 +01:00
Copybara-Service
f2e4817509 Merge pull request #75 from cblichmann:modules
PiperOrigin-RevId: 350351630
Change-Id: I3ccbadd8a12dee2ede87b9aeece95a115553c29c
2021-01-06 07:50:01 -08:00
Christian Blichmann
4ff125df7a
Reactivate cURL git submodule
- Fix commands in `README.md`

Signed-off-by: Christian Blichmann <cblichmann@google.com>
2021-01-06 16:11:00 +01:00
Wiktor Garbacz
195ac67c9d Fix dependencies in CMake build
PiperOrigin-RevId: 350313683
Change-Id: I133594e930cd3a710b6053de64bc94894d872241
2021-01-06 02:34:53 -08:00
Wiktor Garbacz
a59cb96d52 Fix dependencies in add_sapi_library
PiperOrigin-RevId: 350307675
Change-Id: Ib3a085ad214690083fcf23a791f194c37223da11
2021-01-06 01:48:55 -08:00
Wiktor Garbacz
3e8a60c5b1 Fix raw_logging includes
PiperOrigin-RevId: 350142444
Change-Id: I15184e6e46594f7eecf75ff0a6f0961caa015f2d
2021-01-05 08:10:05 -08:00
Wiktor Garbacz
fe79c95a50 IWYU in sapi code generator
PiperOrigin-RevId: 350134692
Change-Id: I5389df8a02f6679a3881b20b599ff5d9fc81650e
2021-01-05 07:18:41 -08:00
Sandboxed API Team
142c35898c Allow TcMalloc to use membarrier syscall.
PiperOrigin-RevId: 348604579
Change-Id: Ibe54acc51597f36d1682368eb6baf1f8d45cf3dd
2020-12-22 02:50:16 -08:00
Anton D. Kachalov
d0c8224e61 Add support for ARM32 (hard float target)
This change enables support for 32-bit ARM, as used by embedded controllers and older phones.
Note: This does not support 32-bit sandboxees on AArch64. Both sandboxee and host code must have the same bitness.
PiperOrigin-RevId: 347835193
Change-Id: I6395882677530f9862f118d2dc10230a61049836
2020-12-16 09:18:25 -08:00
Chris Kennelly
324ab5974c Optimize calls to std::string::find() and friends for a single char.
The character literal overload is more efficient.

PiperOrigin-RevId: 347827459
Change-Id: I91ab1c5ea699886b6c15ad5016338063e0c98f40
2020-12-16 08:30:45 -08:00
Anton D. Kachalov
4763959227 Add pkg-config files generation.
PiperOrigin-RevId: 347812826
Change-Id: I1722d39759628ad976b99887c8406cff08195009
2020-12-16 06:46:03 -08:00
Christian Blichmann
f29b0091fc Add GitHub workflow build badge
PiperOrigin-RevId: 347779534
Change-Id: I16469a601a2d1295d710de88ab6dc4f476b9f6b8
2020-12-16 01:35:32 -08:00
Christian Blichmann
507010781a Follow-up with more build fixes
Because any change that touches continuous integration needs a companion o.O

PiperOrigin-RevId: 347769780
Change-Id: I20525aaac2ce41c48f619b641baa31e880432e50
2020-12-16 00:09:28 -08:00
Christian Blichmann
07d4d02628 Build fixes for older GCC and Ubuntu
- Ubuntu 18.04 ships with GCC 7, which needs `std::move()` when returning an `absl::StatusOr<>`
- Ignore C++ AST nodes of type `cindex.TypeKind.UNEXPOSED` in Python generator
- Remove default values in `ubuntu-cmake.yml`

PiperOrigin-RevId: 347605109
Change-Id: Ibe167249ecf4ef1af1654d63c2e067fc02e5782d
2020-12-15 07:09:22 -08:00
Anton D. Kachalov
0e8d16e011 Enable shared libraries build and cross-compilation
This allows resource-constrained environments to benefit from the
space savings of dynamic linking. This is not meant to be used in
the general case.

PiperOrigin-RevId: 347398828
Change-Id: Ia634959148a31159878f48c44255dd733424a2b8
2020-12-14 09:16:14 -08:00
Anton D. Kachalov
218435d88e Make compiler/linker flags visible to dependencies.
PiperOrigin-RevId: 347396613
Change-Id: Ic80b6a731a3b182f3aa320d36b598d074e7f3802
2020-12-14 09:03:52 -08:00
Christian Blichmann
319493f5f0 Remove FsDescription proto
FS checks are an internal feature that has been deprecated for a while in
favor of user namespaces.

PiperOrigin-RevId: 347378761
Change-Id: I1d7956cecd6db47b2b96fdedaada0b2a36f9b112
2020-12-14 07:12:59 -08:00
Anton D. Kachalov
8924b63d5a Add hardening linker options.
PiperOrigin-RevId: 347367335
Change-Id: Ia7d707bd3e7e58021fc3bb14df13a9f06c5e2735
2020-12-14 05:39:35 -08:00
Christian Blichmann
c3ac45be3e Reimplement raw logging to avoid Abseil internals
The defined raw logging macros should be compatible with Abseil and
we can remove our version once Abseil releases theirs.

PiperOrigin-RevId: 347354273
Change-Id: I178a89cfd2e19bcd707a06fa9dfd7b767e2b654b
2020-12-14 03:34:02 -08:00
Anton D. Kachalov
8bf410f0bb Add gmouse@ to authors.
PiperOrigin-RevId: 347336942
Change-Id: Iaa8aef0084882ced82fb1331841bb2aa21753004
2020-12-14 03:33:52 -08:00
Wiktor Garbacz
742fafa433 Prefixed (unique) names for executables in cmake
PiperOrigin-RevId: 347335966
Change-Id: Ic8cc22b882fa489d37b636406a1a5fe51745d808
2020-12-14 01:13:31 -08:00
Sandboxed API Team
d172411d7b Force -fno-exceptions compiler option.
Add hardening compiler options (enabled via SAPI_HARDENED_SOURCE)

PiperOrigin-RevId: 347081406
Change-Id: I6c293a95a3bb05ea3b581bd9497381847c7aa510
2020-12-11 14:58:27 -08:00
Sandboxed API Team
13ff7a42da Avoid double insertion of interpreter value.
PiperOrigin-RevId: 346985006
Change-Id: Id18346702cee973e487cc608ccf2bd08f40a0da6
2020-12-11 06:11:43 -08:00
Christian Blichmann
2a9320dbac Update/simplify linker flags for testcases
- Bazel: Use "incompatible" flag to fix fully static linking. The flag will
  become the default in Bazel 4.0.
- Bazel: Deduplicate features into `FULLY_STATIC_FEATURES` variable
- CMake: Remove the testcase properties. `sapi::base` already sets
  `POSITION_INDEPENDENT_CODE`. Note that `-pie` is incompatible with `-static`
  and `-static-pie` requires GCC 8 and GLIBC 2.27.

PiperOrigin-RevId: 346952478
Change-Id: I7a317c90a3bec9691b13df1a00e3fddf4481df4d
2020-12-11 01:12:05 -08:00
Wiktor Garbacz
81a68382d8 Use file helpers in minielf_test
PiperOrigin-RevId: 346949861
Change-Id: Ib323a9ecd8fd8f268f09b028d13b220d3d8b60d1
2020-12-11 00:48:23 -08:00
Sandboxed API Team
d4d58361e9 Bump Abseil-cpp version to 2020-11-19.
PiperOrigin-RevId: 346793646
Change-Id: I5dc41ed78439d117f46b08f609459e761392e802
2020-12-10 08:52:22 -08:00
Wiktor Garbacz
6d98090962 Do not fail if forkserver is disabled by env when lib_ctor is used
PiperOrigin-RevId: 346743575
Change-Id: I948aad88120746e15535e3c5270581a31a0b3d29
2020-12-10 02:49:54 -08:00
Christian Blichmann
2869e3f598 Fix missing argument in call to open() in namespace test
Calling `open()` with `O_CREAT` requires 3 arguments.

PiperOrigin-RevId: 346739861
Change-Id: I38167e9184f4755e48307eaa674277069bd4ccf8
2020-12-10 02:19:21 -08:00
Sandboxed API Team
c7d8e83d60 Declare global forkserver start mode flag in header file so it can be overridden in code more easily.
PiperOrigin-RevId: 346588150
Change-Id: I1013b928a45bab164e7db28d49be8504353dc064
2020-12-09 10:53:41 -08:00
Christian Blichmann
7ce4b24cb5 Update OSS build transform to move .github to the right place
PiperOrigin-RevId: 346538768
Change-Id: I3b25d67d1646a9bbbe4a7feefbb124f0f0679d70
2020-12-09 06:37:13 -08:00
Christian Blichmann
a2fa269080 Add GitHub workflow for CMake build
PiperOrigin-RevId: 346521211
Change-Id: Idf60be85aa3983ad625bcef53b48e8d0b797ed4a
2020-12-09 04:14:37 -08:00
Copybara-Service
6f8e758177 Merge pull request #56 from alexelex:master
PiperOrigin-RevId: 346286713
Change-Id: Ib052758d6a7deaa1c62660fd43d8f0e31f42bc09
2020-12-08 03:15:35 -08:00
Copybara-Service
08bb2f80d1 Merge pull request #69 from alexelex:libpng-master
PiperOrigin-RevId: 346072038
Change-Id: I23a9e6704106e2834a5900522a1be06341c6421a
2020-12-07 05:34:46 -08:00
Sandboxed API Team
3323ddc129 Permit sandboxee's bpf() to fail
The default policy causes immediate termination of a sandboxee that
calls `bpf`(2).

This does not allow for try-call use of `bpf()` to test for optional
features.

To support such try-call use cases, sandboxes would like to say:

```
  sandbox2::PolicyBuilder builder;
  builder.BlockSyscallWithErrno(__NR_bpf, EPERM);
```

but this doesn't work because the default policy unconditionally treats
`bpf()` as a sandbox violation.

Remove the bpf violation check from the policy if `bpf()` is explicitly
blocked with an errno.

PiperOrigin-RevId: 345239389
Change-Id: I7fcfd3a938c610c8679edf8e1fa0238b32cc9db4
2020-12-02 08:38:32 -08:00
Wiktor Garbacz
da64459e3f Allow shutting down the global forkserver
PiperOrigin-RevId: 345198374
Change-Id: I3b5c49f6e5abb76d2b0a57078ffeb0609e0be008
2020-12-02 03:05:37 -08:00
Christian Blichmann
6587e571f1 Skip entries with zero inode when parsing /proc/PID/maps
This also skips all entries that point to deleted files.

PiperOrigin-RevId: 344244273
Change-Id: Ic47c6ab0dff4eaf4b4dea2779c45685922adc608
2020-11-25 06:46:39 -08:00
Wiktor Garbacz
5001778443 Use binary search in syscall defs
The lookup is not on the hot path and this removes the SYSCALLS_UNUSED macros.

PiperOrigin-RevId: 344240762
Change-Id: I324bd798945851ac0b92e257206525eab4ec36e5
2020-11-25 06:15:29 -08:00
Wiktor Garbacz
f6247aad9d Fix SyscallTable::get to return proper table
PiperOrigin-RevId: 344236195
Change-Id: Ie370c1a771f1896c98ea387c0a84231a433c9d8c
2020-11-25 05:37:18 -08:00
Kevin Hamacher
510b5079ed Internal Change
PiperOrigin-RevId: 343296855
Change-Id: I995fa76f306fca8524a187f7fd1cbc498a92a885
2020-11-19 08:37:41 -08:00
Copybara-Service
fbf3e84799 Merge pull request #65 from andreimedar:libarchive
PiperOrigin-RevId: 343290002
Change-Id: I1f29e4acfc7d423be63fd52e7a78ceb209d29115
2020-11-19 07:53:41 -08:00