Commit Graph

1283 Commits

Author SHA1 Message Date
Sandboxed API Team
7d78b89777 Fix typo.
PiperOrigin-RevId: 557598808
Change-Id: I02ac71ca025be9a5e45011b1bbeb07a144b2e632
2023-08-16 14:13:42 -07:00
Sandboxed API Team
034f24001e In Sandbox2 IPC class, add a MapDupedFd() function to allow application to retain ownership of the local_fd.
PiperOrigin-RevId: 557539211
Change-Id: Ib74a305333bc51a261c766052284e9fa68115e9d
2023-08-16 10:58:55 -07:00
Wiktor Garbacz
abd3faf51b monitor_unotify: Use eventfd instead of pipe for notifications
PiperOrigin-RevId: 557479262
Change-Id: Ie03e4e8915950999ff0b47e8b08c50241e53a600
2023-08-16 07:29:11 -07:00
Wiktor Garbacz
7a57d32711 forkserver: Remove waitpid flag
It was superseded by sandboxee rusage when using unotify monitor

PiperOrigin-RevId: 557396642
Change-Id: I41f84149227f62d4b7727030f9359834a9b61dbc
2023-08-16 01:33:12 -07:00
Christian Blichmann
c501379056 Clang tool: Prevent extra nesting of namespaces
When specifying the `namespace` argument in Bazel (`NAMESPACE` in CMake), the
Clang tool used to put _all_ dependent types in that namespace.

For a declaration of `namespace a::b { struct S {...};` and a `namespace`
argument of `a::b`, this means that the header output was similar to
```
namespace a::b {
namespace a::b {
struct S { ...
```

This was never intended and also does not match the Python based header
generator. The Clang tool now "merges" those same namespaces. This is
correct, as it processes `namespace`d spellings with their full namespace
path.

PiperOrigin-RevId: 557393076
Change-Id: I1474dd30b6c4150d0ae3c1c48579f88060974980
2023-08-16 01:17:54 -07:00
Wiktor Garbacz
1c2596785b Clearer logs on execveat failures
Drive-by: remove redundant log prefix (PLOG prepends filename and line)
PiperOrigin-RevId: 557367980
Change-Id: Id7cc945969e0ae06a451ca3dd0f3e288402b9136
2023-08-15 23:30:44 -07:00
Christian Blichmann
ae3d334cc2 generator2: Skip anonymous structs/unions
The Python code has been relying on `spelling` to return `None` for skipping
anonymous structs/unions.

libclang has been returning a "spelling" for those for a while now (LLVM 16
introduced this in its branch in 2022), though, so this check no longer works.
Use the correct method `clang.CIndex.is_anonymous()` instead.

PiperOrigin-RevId: 557099905
Change-Id: I13707509dbae03481c5edce7fa92554cefdd57e7
2023-08-15 05:20:47 -07:00
Christian Blichmann
352d1f8fb2 Clang tool: Emit aggregates with default initialized members
PiperOrigin-RevId: 556765694
Change-Id: I2547919cdc1fcb048c99de325a8b2c24800b0e06
2023-08-14 06:14:43 -07:00
Wiktor Garbacz
8b70461db4 Automated rollback of commit a946cedc95.
PiperOrigin-RevId: 555902433
Change-Id: I93efb401e64b90ba114911b87ed680456037d248
2023-08-11 04:54:59 -07:00
Wiktor Garbacz
a946cedc95 PtraceMonitor: Add a hard deadline for waiting for kill to take effect
PiperOrigin-RevId: 555854230
Change-Id: If323725e5112344105627844910356dd14c9ad31
2023-08-11 02:01:10 -07:00
Wiktor Garbacz
01e14e0bb7 Fix bypass for enabling ptrace/bpf
PiperOrigin-RevId: 555847265
Change-Id: I671c0650caeefaac590d3d0030ff90e18fda6bbd
2023-08-11 01:34:27 -07:00
Wiktor Garbacz
3079d2b4e0 Make Policy a simple copyable type
PiperOrigin-RevId: 555146979
Change-Id: I83d7260d65d4291c418e6c8e80385cbdc8fbc758
2023-08-09 06:44:22 -07:00
Wiktor Garbacz
c14312c3a2 Kill on each iteration of graceful exit loop
I believe it's possible for the `main_pid` to disappear between `kill` and `sigtimedwait` by means of an `exec` from a multithreaded process (`PTRACE_EVENT_EXIT` happens after the `exec`ing thread changes its tid to main_pid)

PiperOrigin-RevId: 555137959
Change-Id: Id22908fb31497c0906e4f4fda66400fbf9ac9efb
2023-08-09 06:00:19 -07:00
Christian Blichmann
999336a27d Buildkite: Add specific version for 'clang' Python package
PiperOrigin-RevId: 554780053
Change-Id: Ia2cc1649aac173d8c606e049955b5dde1d585dc8
2023-08-08 04:48:59 -07:00
Wiktor Garbacz
48bbb06fe7 Move log warning about non-namespaced stacktraces
PiperOrigin-RevId: 554493643
Change-Id: I27755322edcd7c0191cd125ec8ffdace18a6460c
2023-08-07 09:07:06 -07:00
Wiktor Garbacz
4890c86cec Mark GetNamespaceDescription const
PiperOrigin-RevId: 554460753
Change-Id: I3304fb7d19f93750b1d74aeb1b8213af2f0fea85
2023-08-07 06:48:11 -07:00
Wiktor Garbacz
dd664400d7 More verbose logging on graceful exit timeout
PiperOrigin-RevId: 554382651
Change-Id: I7205fed9285b2aaff93860782d65d3dc829bb5f9
2023-08-07 00:28:10 -07:00
Sandboxed API Team
0a0ac6a66b Automated rollback of commit 4d625e521b.
PiperOrigin-RevId: 553536999
Change-Id: If6ae319e54a3ea5eb88e00888044ba1088bd62d2
2023-08-03 11:23:05 -07:00
Wiktor Garbacz
7722c07d0c Mark Mounts::RecursivelyListMounts() const
PiperOrigin-RevId: 553472906
Change-Id: Ia222751fd4b978dece6ef12c6677db8f3092ac1b
2023-08-03 07:40:16 -07:00
Wiktor Garbacz
4d625e521b Move log warning about non-namespaced stacktraces
PiperOrigin-RevId: 553472372
Change-Id: Iba43cba78edd1826afb29f49a7e08e919554ed80
2023-08-03 07:37:54 -07:00
Wiktor Garbacz
3f9e9a2b25 Make Namespace copyable, movable and copy/move assignable
There is no strong reason why this shouln't be the case.
Some future refactorings will depend on this.

PiperOrigin-RevId: 553456024
Change-Id: I452a2804c59ed006326ab37cbe0dec80f53cd714
2023-08-03 06:21:13 -07:00
Wiktor Garbacz
29b7b49325 Use return value directly instead of SAPI_ASSIGN_OR_RETURN dance
PiperOrigin-RevId: 553449209
Change-Id: Id344bc84a42edfaf92b95dc8cf92582001183494
2023-08-03 05:45:58 -07:00
Wiktor Garbacz
fc8a2340c7 Rename GetCloneFlags
PiperOrigin-RevId: 553448623
Change-Id: Ia49b16dd4b8795ba95bab8a8ea0c7ffc50bba628
2023-08-03 05:42:29 -07:00
Wiktor Garbacz
8fbe21ce0e Really give priority to main_pid
Do process all events as soon one for priority_pid arrives.

PiperOrigin-RevId: 553156575
Change-Id: I57a9b4ca54a0e0fe5f01245b130f53ef3f8678fc
2023-08-02 08:42:51 -07:00
Wiktor Garbacz
3bbb98c494 Better error when calling RunAsync on a Sandbox2 instance twice
PiperOrigin-RevId: 553129224
Change-Id: I92ff15d111ccd5e7d4310a2e1559811dd1cc7027
2023-08-02 06:44:21 -07:00
Wiktor Garbacz
1c960e8389 EmbedFile: Reopen memfds as readonly to workaround problems with CRIU
CRIU while restoring memfd sometimes reopens them, which might result in ETXTBUSY on execveat.

PiperOrigin-RevId: 553114741
Change-Id: I11ee7aabe48a2853a8921a270c6cdcc70b50a518
2023-08-02 05:28:04 -07:00
Oliver Kunz
eaa175c8d2 Sandbox2: Remove file sealing for in-memory files.
The `CreateMemFd` function sets the `MFD_ALLOW_SEALING` flag which enables seals to be set and creating an empty file seal.

PiperOrigin-RevId: 550850108
Change-Id: I1a84b7b14cc9396144048bbeb8995f2f7eca9fb7
2023-07-25 05:04:52 -07:00
Oliver Kunz
04ed89906b Adding AllowOpen to AllowLlvmSanitizers to avoid having to add AllowOpen in addition when it's only needed for running under the sanitizers.
In cases where SAPI users overwrite the default policy instead of extending it, the sandbox will fail with an `openat` violation. This is automatically inherited in the default policy.

The advantage with this implementation is that we don't expose the open* syscalls when not running under the sanitizers.

PiperOrigin-RevId: 550845188
Change-Id: I151d467848983b00b71ec8447d662394fa7176db
2023-07-25 04:38:43 -07:00
Wiktor Garbacz
9d1d4b7fd3 Disallow AddPolicyForSyscalls with an empty list
PiperOrigin-RevId: 549887306
Change-Id: I05a97b39a2c92ad5ab2002c7af7e83a8184392cf
2023-07-21 02:24:44 -07:00
Wiktor Garbacz
e86462db77 Remove redundant buffer test
It tested Comms rather than different Buffer functionality.

PiperOrigin-RevId: 549880115
Change-Id: I095464540fa21cc4b3bee1d87e1e046807b6f18c
2023-07-21 01:53:54 -07:00
Wiktor Garbacz
7683f6995b Do not use GIT in FetchContent_Declare
This causes whole repo (with history) to be fetched.
Protobuf repo is especially big (>200MiB).

PiperOrigin-RevId: 549285765
Change-Id: Ifb5e3a549a014adb51e6e5eef41e72abf0149558
2023-07-19 05:20:28 -07:00
Wiktor Garbacz
25f27ef935 Allow replacing a read-only node with writable for same target
PiperOrigin-RevId: 548942347
Change-Id: I4b22740ca27772831afcddb69d515c84aca04c51
2023-07-18 02:45:13 -07:00
Chris Kennelly
4ba75ea0a2 Allow TCMalloc users access to the possible cpus list.
This is to facilitate online/offline core counting for an accurate count of the
maximum CPU ID that may be seen.

PiperOrigin-RevId: 548715133
Change-Id: I159c0d51b9800fa633172986ba4f8eca352ae336
2023-07-17 09:31:22 -07:00
Wiktor Garbacz
f0e85cea13 Introduce AddFile(At)IfNamespaced/AddDirectory(At)IfNamespaced
Use the new interface in AllowRestartableSequences.

PiperOrigin-RevId: 548619728
Change-Id: I1f8aeb9a1cb412c50391d65a3cd148f77b46bd6f
2023-07-17 01:58:46 -07:00
Sandboxed API Team
39026f7678 Internal Code Change
PiperOrigin-RevId: 548043988
Change-Id: Iba4a828eeb53205f28dae85fc179cee21b104632
2023-07-14 00:30:56 -07:00
Sandboxed API Team
a3fa7d27d5 Internal Code Change
PiperOrigin-RevId: 547689091
Change-Id: I76ddcaefcc50f8ce706d59dae99877ca6f28544d
2023-07-12 22:13:27 -07:00
Sandboxed API Team
619030326c Internal Code Change
PiperOrigin-RevId: 547420866
Change-Id: I7b80e96531a234281a323c03903b922704019135
2023-07-12 01:09:40 -07:00
Oliver Kunz
5dd7584e55 Propagate compatible_with through sapi_library.
If a sandboxing target sets a `compatible_with` constraint, the current sapi.bzl doesn't propagate this to the subsequent target generations.

We implement the forwarding similarly to the `visibility` attribute.

PiperOrigin-RevId: 546838438
Change-Id: I8a0b2623ee3aa91ffe7e6f4b001177c03806f532
2023-07-10 05:07:23 -07:00
Sandboxed API Team
a94b17d821 Use Protobuf's AbslStringify to stringify protos.
Protobuf DebugString APIs will be deprecated.

PiperOrigin-RevId: 543355252
Change-Id: Ieea97e87fc592c023cb2f965be3926f52192ffe4
2023-06-26 00:33:33 -07:00
Christian Blichmann
64ac98bf4d Sandbox2: Remove commented out include
PiperOrigin-RevId: 542784635
Change-Id: Ie763ff5606e2241b2a5e3f89d57ed8d3e1c1ee63
2023-06-23 00:46:59 -07:00
Oliver Kunz
0463298780 Sandbox2: Improve logging of syscall information.
- If --sandbox2_danger_danger_permit_all_and_log is set, we write to a logfile (passed via the flag).

- If --sandbox2_danger_danger_permit_all is set, we do not write any log information.

This change introduces a means to also see the syscall information on stderr by passing --v=1 and --alsologtostderr.

PiperOrigin-RevId: 542232271
Change-Id: Ie4d30f0d8e25bb1de7c60bb37736b27b89406336
2023-06-21 06:11:57 -07:00
Sandboxed API Team
cf43c0f02c Allow prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, ...) with tcmalloc
PiperOrigin-RevId: 540905937
Change-Id: I9275b193ff42b4741925c3cf825841ca9a4071db
2023-06-16 09:34:07 -07:00
Kevin Hamacher
93c1423b15 sandbox2: Provide sandboxee rusage when using unotify monitor
PiperOrigin-RevId: 540841898
Change-Id: Icc635e107c138ac67e2b948eadbbcb4234f6c7f8
2023-06-16 04:37:18 -07:00
Kevin Hamacher
66aeb6e59d Error out if invalid custom forkserver path is specified
PiperOrigin-RevId: 540526350
Change-Id: Id7f4ea9290074c15c700c27c2d252b9f54a282bd
2023-06-15 03:17:02 -07:00
Christian Blichmann
04cb14791e Clang tool: Enable incremental pre-processing
This avoids doing extra work when processing multiple input files.

PiperOrigin-RevId: 539884025
Change-Id: I8e48495f33c09bc53e70f4d5c1d730fe7c1202b2
2023-06-13 01:04:38 -07:00
Christian Blichmann
f2048d028f Clang tool: Force-undefine feature preprocessor defines
To avoid code that is being parsed to include the intrinsics headers, undefine
a few key preprocessor defines.

PiperOrigin-RevId: 539878995
Change-Id: I8afb7cbdadcab3214c943c0acb9006e8bcc30611
2023-06-13 00:38:05 -07:00
Wiktor Garbacz
654668fc4e stack_trace: avoid copying /proc/{pid}/exe if possible
The executable might not be inside the mount tree.

PiperOrigin-RevId: 539564862
Change-Id: I94e748608a36c8e9203ffe4b6de443e026e4546a
2023-06-12 00:14:40 -07:00
Christian Blichmann
045ace8dcb Update Google dependencies
- Abseil
- Protobuf
- Benchmark
- Googletest

In turn, some code changes were necessary:
- Use absolute imports in `sapi_generator.py` when invoked by Bazel
- Add Abseil's source dir as include dir in generated proto `.cc` files
- Bazel: Use `@rules_proto` for `proto_library` and use native `cc_proto_library`

Drive-by:
- Update year in `README.md`
- Look for clang versions 16, 15, 14, and 13 as well in `code.py`
PiperOrigin-RevId: 539032012
Change-Id: Ib9cd1d7fb38409d884eb45e1fa08927f6af83a21
2023-06-09 03:22:00 -07:00
Christian Blichmann
4034fd6240 GitHub Actions: Add workflow to auto-create a pre-release on push
This also uploads the clang tool based header generator as an asset.

PiperOrigin-RevId: 538781230
Change-Id: I50d0e22af1f3bab1e461ae2dd2b64a3e479ce7d1
2023-06-08 07:39:48 -07:00
Christian Blichmann
67d5f1b23f GitHub Actions: Upload artifact for header generator
A follow-up can then upload to a draft release.

PiperOrigin-RevId: 538718585
Change-Id: Ic6dccce6d2127a685b52e465d0e651dbfdef2cb8
2023-06-08 01:38:22 -07:00