Commit Graph

671 Commits

Author SHA1 Message Date
Christian Blichmann
6b24025860 CMake targets for SAPI, add find_package() support for libffi
This change adds CMake targets for the actual Sandboxed API library. On its
own, this is not very useful, as there is no CMake equivalent to the
sapi_library() rule, yet. This will be worked on next.

PiperOrigin-RevId: 257177362
Change-Id: Ic06c945ab534b27306021d970a83691aae2e7e60
2019-07-09 06:13:08 -07:00
Christian Blichmann
b5d85f5e56 Do not use any global compiler settings in CMake build
This change also tries to make the build more idempotent wrt to embedding projects.

PiperOrigin-RevId: 257177255
Change-Id: I291cd02840496db901f829e902623887f6e0eb10
2019-07-09 06:12:11 -07:00
Wiktor Garbacz
d170bc3c80 Deflake namespace_test
When fetching exit status only lower 8-bits will be read.
Thus if getpid()&0xff == 0 the test can fail.

PiperOrigin-RevId: 257163766
Change-Id: I690c645fde33d1205578fd8873c5fc2974352ada
2019-07-09 04:11:07 -07:00
Christian Blichmann
6d06df1b86 Break out executor into its own build target
PiperOrigin-RevId: 257147090
Change-Id: I34c5e86ca68f865fdae42e4077c52c6168672c06
2019-07-09 01:53:56 -07:00
Christian Blichmann
747ccb57e8 Rename stack-trace{.h,.cc,._test.cc} to use underscores
PiperOrigin-RevId: 257144753
Change-Id: I4ce0dffad552c25b61102adfb1c03b8aea427dd9
2019-07-09 01:32:25 -07:00
Christian Blichmann
2da6dad120 Internal change
PiperOrigin-RevId: 257141595
Change-Id: Ic34799290fa88be62ecba38f8f60200a1e55f065
2019-07-09 01:32:09 -07:00
Christian Blichmann
c7f7666d9d Do not leak macro definitions in stack-trace.h
Since we use glog, we need to still rely on gFlags for as long as Abseil
logging is not yet released. To do this, we have the util/flag.h header in
SAPI, faking the newer style API of Abseil's flags library.
The rationale behind this is that glog includes/builds with gflags for
command line flag parsing and having more than one flag parsing library
active at the same time is asking for trouble.

PiperOrigin-RevId: 256982667
Change-Id: I9c5406cb9ef4458daebfec0b0713f9bddbf5c3ad
2019-07-08 08:25:17 -07:00
Christian Blichmann
2301e05097 Follow-up to rev. 6edcf5f which introduced a build failure
PiperOrigin-RevId: 256961234
Change-Id: I312d054c5d35413b2e6b061ddfa30c80397b19eb
2019-07-08 05:56:36 -07:00
Sandboxed API Team
6edcf5f823 Internal change.
PiperOrigin-RevId: 256378370
Change-Id: I1b00662a4c4c743ab79ecf35e857e4f7bc9f5e1c
2019-07-03 09:03:38 -07:00
Christian Blichmann
d48a372aab Use absolute namespace names in generator to avoid collisions
PiperOrigin-RevId: 256349023
Change-Id: Ic6e178a158fd9af0343c747b0525e703aad7ef99
2019-07-03 05:32:46 -07:00
Kevin Hamacher
6d782dd774 Deflake custom_fork_server test
PiperOrigin-RevId: 256149331
Change-Id: I68cfd64ee602757235e6c6d602819a79ae4826fb
2019-07-02 05:59:25 -07:00
Christian Blichmann
732252922a Make sapi::Status and sapi::StatusOr<> public in Bazel build file.
This makes it easier to work with the generated classes from client code.

PiperOrigin-RevId: 256132914
Change-Id: If7fb24a2cac998d2cdb04e8b627272064bf9793d
2019-07-02 03:20:23 -07:00
Maciej Szaw?owski
9435f97538 macro fixes:
- made sure that define order is correct
- made sure to emit all defines related to target define
- fixed a bug where '(' was separated with macro name with space, this breaking the macro

PiperOrigin-RevId: 256129616
Change-Id: I636b13a72c6198fb59e8e387f42567c442b24352
2019-07-02 02:58:17 -07:00
Christian Blichmann
4e20e0702a Use full workspace name to access Bazel packages in generator
Since the interface generator is invoked via a Bazel macro, it will be
expanded in the embedding context of the project using SAPI, so package access
needs to go through the full workspace root @com_google_sandboxed_api.

This change also modifies the CMakeLists.txt accordingly, as the "external"
subdirectory is no longer needed/wanted.

PiperOrigin-RevId: 255918784
Change-Id: I052c687509f65fef7f011a9d1a074a171595330f
2019-07-01 02:53:41 -07:00
Christian Blichmann
0d16c136ae Make external usage easier by providing a sapi_deps() workspace rule
If using Sandboxed API from an external Bazel WORKSPACE, dependencies can be
imported by declaring the repository and calling `sapi_deps()`:

```python
git_repository(
    name = "com_google_sandboxed_api",
    commit = "master",
    remote = "https://github.com/google/sandboxed-api.git",
)

load(
    "@com_google_sandboxed_api//sandboxed_api/bazel:sapi_deps.bzl",
    "sapi_deps",
)

sapi_deps()
```

PiperOrigin-RevId: 255373664
Change-Id: I4c41ffc75e1ca95eb126702cb2d5cedb255191d5
2019-06-27 04:27:53 -07:00
Christian Blichmann
301a265c95 Make bpf_helper visible to projects using SAPI
PiperOrigin-RevId: 255368910
Change-Id: I4f12e8d47fd747619a12d21a5be1c34d7f876b61
2019-06-27 03:43:31 -07:00
Christian Blichmann
0c4a803527 Workaround for Bazel issue #8672 (broken fully_static_link)
This is tracked at
https://github.com/bazelbuild/bazel/issues/8672

and should only affect the tests for now.

PiperOrigin-RevId: 254943708
Change-Id: Iee18a3b8c1b570c7d04d09d533ecff33c3de7d57
2019-06-25 04:32:17 -07:00
Christian Blichmann
97b5f0767a Find libclang so that Python3 works, remove PY2 annotations
We now require that Debian users install the `python3` and `python3-pip`
packages. This change lets the Python code search for `libclang.so`, which can
be located in different directories, depending on version, and is not found by
default otherwise.

Fixes #28

PiperOrigin-RevId: 254745872
Change-Id: Ia77680da2a3235c0a9518125676aa8a460e38e76
2019-06-24 06:30:34 -07:00
Christian Blichmann
4bcea59309 Use to_list() on Bazel depsets for iteration.
Starting with Bazel 0.27.0 --incompatible_depset_is_not_iterable became the
default.

Fixes #27

PiperOrigin-RevId: 254703981
Change-Id: I727e4b1c6a907c8794a00f61646c13ad8d4437b7
2019-06-24 00:45:55 -07:00
Christian Blichmann
6ca744b959 Fix old 'google' namespace in example
PiperOrigin-RevId: 254203473
Change-Id: I04401074585769f3692f320f5aa0dbbecb51ebcc
2019-06-20 08:37:56 -07:00
Wiktor Garbacz
4b9be4e78a Fix formating
PiperOrigin-RevId: 253196457
Change-Id: Id73a08945dedff7a116d500202355ecf266afcf3
2019-06-14 03:01:09 -07:00
Wiktor Garbacz
605d402121 Use new function naming
PiperOrigin-RevId: 253191002
Change-Id: If00c0effb925b3e294593f272447cd8386228bac
2019-06-14 02:09:07 -07:00
Christian Blichmann
4d891de31b Internal change
PiperOrigin-RevId: 252609329
Change-Id: I46a05641456144e7967e01905c60e18aef164b3f
2019-06-11 06:49:45 -07:00
Sandboxed API Team
970257d87b Allow two madvise calls for asan & tsan builds.
bbfa21f177/lib/sanitizer_common/sanitizer_posix_libcdep.cc (L71)

PiperOrigin-RevId: 252048323
Change-Id: I457e708f0b024fd9db4ad39265cb904777ca52b5
2019-06-07 07:53:10 -07:00
Christian Blichmann
dfbfb5cc43 Add CMake builds for the examples
PiperOrigin-RevId: 252045309
Change-Id: I57ffc3debbe64010b1f20b2e6df900b9916fa37f
2019-06-07 07:27:33 -07:00
Christian Blichmann
f2c7f976cf Add minimal Bazel CI config
PiperOrigin-RevId: 252043934
Change-Id: I29222d770c44522b21560bb736b1f5fd55cb0da0
2019-06-07 07:14:07 -07:00
Christian Blichmann
24c3e34344 Implement a GetDataDependencyFilepath() for CMake (non-Bazel really).
This code assumes, like Bazel's runfiles that the data dependency to access
exists in the same sub-tree as the binary:

WORKSPACE
+- sandboxed_api/sandbox2/examples/crc4
                                   +- crc4bin
                                   +- crc4sandbox

The code requires the directory structure to exist, so that in the example
above, crc4sandbox can use
  GetDataDependencyFilepath("sandboxed_api/sandbox2/examples/crc4/crc4bin")

regardless of how it was called.

PiperOrigin-RevId: 251834480
Change-Id: I6470b62ce9b403297116481a0c17c070992f2e81
2019-06-06 05:44:32 -07:00
Christian Blichmann
65440dddd6 Update to latest Google Test
PiperOrigin-RevId: 251640007
Change-Id: Ied7b1c07c49c6574bc26591902c520a53b56b658
2019-06-05 07:40:13 -07:00
Christian Blichmann
9b78e331fa Use newer gflags namespace for command-line flags
PiperOrigin-RevId: 251639941
Change-Id: I3037ce9510a3bc62cf5c899c64f2e7d344a8b4ee
2019-06-05 07:39:38 -07:00
Sandboxed API Team
1b2b83676b Internal Change
PiperOrigin-RevId: 251637952
Change-Id: I532201ec1ba16a4cae71c671ffe2bd34e13a5391
2019-06-05 07:24:16 -07:00
Christian Blichmann
e09bda2628 Internal change
PiperOrigin-RevId: 251624033
Change-Id: I9b2ab423082be3bfdb6da66ab7a8e77e5673789b
2019-06-05 05:28:56 -07:00
Christian Blichmann
ffd4e1270a Internal change
PiperOrigin-RevId: 251590551
Change-Id: Ic69f8f5f798006c0d096357b7a746cdc4ce530a3
2019-06-05 00:26:14 -07:00
Christian Blichmann
a3b0949949 Internal change
PiperOrigin-RevId: 251411359
Change-Id: Ifbed8afa72d130ae803ed71a6a43ac3c9d8755f9
2019-06-04 04:07:21 -07:00
Christian Blichmann
dd20e170d0 Internal change
PiperOrigin-RevId: 251409173
Change-Id: Ic5fcf3056c32b39a8365efa0bea4ebf7547d64e0
2019-06-04 03:47:41 -07:00
Christian Blichmann
9351e02182 Internal change
PiperOrigin-RevId: 251404733
Change-Id: Iaa53a1c14e7818dae4ae247bfefb2cba4498ba4d
2019-06-04 03:06:36 -07:00
Christian Blichmann
719cd24933 Fix sandbox2 tests when run with CTest
This test runs, but fails due to a different problem:
  StackTraceTest.ForkEnterNsLibunwindDoesNotLeakFDs

PiperOrigin-RevId: 251218516
Change-Id: If06cdbcb71fad84ebd9d934ff173d7ef1a1eebc0
2019-06-03 06:27:59 -07:00
Sandboxed API Team
dd2a84b980 Clarify behavior of Buffer::CreateFromFd
PiperOrigin-RevId: 250834142
Change-Id: I7aac739c9b590adc0599926e3246bc87e21d951a
2019-05-30 23:50:54 -07:00
Sandboxed API Team
6666f41ba2 Fix unnecessary unique_ptr in LogServer.
PiperOrigin-RevId: 250050562
Change-Id: I6840e68504c741de1e66489279237f4a4a6bc533
2019-05-26 08:47:38 -07:00
Wiktor Garbacz
08ff939ea7 Call DisableNamespaces where needed
PiperOrigin-RevId: 249637351
Change-Id: I5105d89ea0e8cfb2fca1e5ac342fa67e9caac930
2019-05-23 07:21:03 -07:00
Wiktor Garbacz
85059ef40d Add DisableNamespaces to PolicyBuilder
Currently mostly no-op, but this is the first step to turn namespaces on
by default.

PiperOrigin-RevId: 249439158
Change-Id: I5eeb1216dc868c660f62ad50c34f626afbf7db61
2019-05-22 06:54:12 -07:00
Wiktor Garbacz
71a317e65f Do not emit an error on ESRCH in PTRACE_CONT
Process might be killed between waitpid and PTRACE_CONT,
even though a PTRACE_EVENT_EXIT will be gererated, continuing
will fail with ESRCH in that case.

PiperOrigin-RevId: 249245726
Change-Id: Ib673529229a306d2266fa60caa3039b6bcd80a65
2019-05-21 07:30:56 -07:00
Wiktor Garbacz
15993a34e2 Log stack traces with INFO instead of ERROR
PiperOrigin-RevId: 249035379
Change-Id: Ie62366f45f29741ee0c8b25369d0bb169275ccfd
2019-05-20 06:16:50 -07:00
Wiktor Garbacz
207b2d9a95 Remove stale comment
PiperOrigin-RevId: 248715509
Change-Id: I7aa3f4388920e39a79ac349890de403ac3384504
2019-05-17 07:21:31 -07:00
Wiktor Garbacz
34d17b77ac Remove dead code
IPC always creates comms object from a fd.

PiperOrigin-RevId: 248683525
Change-Id: Ib4285ec0494d551257237c12f92f983b943205cb
2019-05-17 02:02:03 -07:00
Wiktor Garbacz
8678af23d0 Extract GetRlimitName into util
PiperOrigin-RevId: 248682931
Change-Id: I702533a8d36465de956a1a90a40c634434b7a671
2019-05-17 01:55:35 -07:00
Wiktor Garbacz
6e1c3c3055 Fix prlimit error message
PiperOrigin-RevId: 248491089
Change-Id: Id4116939d02b6a592c74218955675acf2e3c70fe
2019-05-16 02:24:59 -07:00
Wiktor Garbacz
7294e9976e Replace custom synchronization with absl::Notification
PiperOrigin-RevId: 248334969
Change-Id: I7614a3792babd399912c5d5a167ab5e0a0574d20
2019-05-15 08:09:56 -07:00
Wiktor Garbacz
42761c8b72 Add a resource starvation test
PiperOrigin-RevId: 248334209
Change-Id: Iff0f0b3024c67a767c429a547695cc48a2d02a30
2019-05-15 08:04:58 -07:00
Wiktor Garbacz
6588aa2a68 Reintroduce monitor changes.
Signal handling in Monitor::MainLoop was fixed.

PiperOrigin-RevId: 248331692
Change-Id: I0f85d319802258632d2074742c53597bb922555a
2019-05-15 07:46:49 -07:00
Sandboxed API Team
d8f7d861d2 Log the progress of dynamic libraries being resolved while creating a sandboxee's virtual FS chroot. This provides valuable insight while debugging problems with dynamically linked sandoxed binaries.
PiperOrigin-RevId: 247625021
Change-Id: I9bf77af7410deb8766fd49910c8564e148020601
2019-05-10 09:41:07 -07:00