Commit Graph

1241 Commits

Author SHA1 Message Date
Kevin Hamacher
93c1423b15 sandbox2: Provide sandboxee rusage when using unotify monitor
PiperOrigin-RevId: 540841898
Change-Id: Icc635e107c138ac67e2b948eadbbcb4234f6c7f8
2023-06-16 04:37:18 -07:00
Kevin Hamacher
66aeb6e59d Error out if invalid custom forkserver path is specified
PiperOrigin-RevId: 540526350
Change-Id: Id7f4ea9290074c15c700c27c2d252b9f54a282bd
2023-06-15 03:17:02 -07:00
Christian Blichmann
04cb14791e Clang tool: Enable incremental pre-processing
This avoids doing extra work when processing multiple input files.

PiperOrigin-RevId: 539884025
Change-Id: I8e48495f33c09bc53e70f4d5c1d730fe7c1202b2
2023-06-13 01:04:38 -07:00
Christian Blichmann
f2048d028f Clang tool: Force-undefine feature preprocessor defines
To avoid code that is being parsed to include the intrinsics headers, undefine
a few key preprocessor defines.

PiperOrigin-RevId: 539878995
Change-Id: I8afb7cbdadcab3214c943c0acb9006e8bcc30611
2023-06-13 00:38:05 -07:00
Wiktor Garbacz
654668fc4e stack_trace: avoid copying /proc/{pid}/exe if possible
The executable might not be inside the mount tree.

PiperOrigin-RevId: 539564862
Change-Id: I94e748608a36c8e9203ffe4b6de443e026e4546a
2023-06-12 00:14:40 -07:00
Christian Blichmann
045ace8dcb Update Google dependencies
- Abseil
- Protobuf
- Benchmark
- Googletest

In turn, some code changes were necessary:
- Use absolute imports in `sapi_generator.py` when invoked by Bazel
- Add Abseil's source dir as include dir in generated proto `.cc` files
- Bazel: Use `@rules_proto` for `proto_library` and use native `cc_proto_library`

Drive-by:
- Update year in `README.md`
- Look for clang versions 16, 15, 14, and 13 as well in `code.py`
PiperOrigin-RevId: 539032012
Change-Id: Ib9cd1d7fb38409d884eb45e1fa08927f6af83a21
2023-06-09 03:22:00 -07:00
Christian Blichmann
4034fd6240 GitHub Actions: Add workflow to auto-create a pre-release on push
This also uploads the clang tool based header generator as an asset.

PiperOrigin-RevId: 538781230
Change-Id: I50d0e22af1f3bab1e461ae2dd2b64a3e479ce7d1
2023-06-08 07:39:48 -07:00
Christian Blichmann
67d5f1b23f GitHub Actions: Upload artifact for header generator
A follow-up can then upload to a draft release.

PiperOrigin-RevId: 538718585
Change-Id: Ic6dccce6d2127a685b52e465d0e651dbfdef2cb8
2023-06-08 01:38:22 -07:00
Christian Blichmann
b0547f3506 GitHub workflows: Migrate to turtlesec-no/get-ninja
This does not depend on the deprecated Node.js v12.

PiperOrigin-RevId: 538672875
Change-Id: Ie26e3adfc67626d53ad5a3d12d48099efd4fe827
2023-06-07 21:00:53 -07:00
Christian Blichmann
72452e1582 Mostly internal change: Optimize OSS transforms
This should only affect the Bazel `BUILD.bazel` files and their formatting.

PiperOrigin-RevId: 538426054
Change-Id: I0162726d3fb4bcb4d7938cddc6f39e0d9f2b4a3d
2023-06-07 02:23:18 -07:00
Wiktor Garbacz
6cd83d68de Fix deadlock in forkserver if setting ns fails
Also make sure we don't kill everything (with a `kill(-1, SIGKILL)`) if reading the pid fails.

PiperOrigin-RevId: 536371566
Change-Id: I17f6ae36b73ec43735709ff16d276abaebb00d44
2023-05-30 05:49:40 -07:00
Christian Blichmann
1c7dfdac12 Bazel: Remove obsolete WORKSPACE dependencies
PiperOrigin-RevId: 536368855
Change-Id: Ied2eb8bdaebb9d780691563198799ae240146d73
2023-05-30 05:34:47 -07:00
Wiktor Garbacz
7ba0a794d1 Fix check for init process
PiperOrigin-RevId: 532473530
Change-Id: Ia5f84073e372a63f70425d0fa68ac178019e80be
2023-05-16 08:51:15 -07:00
Christian Blichmann
340ca4f37a GitHub Worklows: Update OS/compiler matrix, deprecate GCC 6 and 7
To fix Python related errors, explicitly install `libclang1-dev` and `clang`
PIP packages that match.

PiperOrigin-RevId: 532411402
Change-Id: I448a5db4e7d802b7929d93844827906f4e4413de
2023-05-16 04:23:32 -07:00
Christian Blichmann
cc8b5fb4fc GitHub Workflows: Prefix worklow names with OS name
This makes workflows easier to distingiush in the GitHub UI.

PiperOrigin-RevId: 532407546
Change-Id: I827c6f4750cd0fcbd0e670e06703cd3ffd46b59d
2023-05-16 04:06:15 -07:00
Christian Blichmann
434de99233 GitHub Workflows: Update to actions/checkout@v3
This avoids Node.js deprecation warnings during the build.

PiperOrigin-RevId: 532406855
Change-Id: I0577051565432ed885034ac70e09be58777537cd
2023-05-16 04:03:53 -07:00
Christian Blichmann
1bf9437f95 Add GitHub workflow to build Clang tool based header generator
Drive-by:
- Add flags to link libgcc and libstdc++ statically into the binary, making it
  "mostly static"
PiperOrigin-RevId: 532349354
Change-Id: I0a86eb29b6a40aec4cec3cffeaf9511726ee4dc8
2023-05-15 23:45:57 -07:00
Sandboxed API Team
70e3d9f560 ...remove deprecated SetWallTimeLimit variant.
PiperOrigin-RevId: 531477563
Change-Id: I84ca9823ae5f7a0002049ac69b42527872a7ce66
2023-05-12 05:22:52 -07:00
Christian Blichmann
b6cc0ce80d CMake: Make the path to the Clang tool configurable
Set `SAPI_CLANG_TOOL_EXECUTABLE` to specify the location of a pre-built Clang
tool based header generator.

PiperOrigin-RevId: 531425738
Change-Id: I723d19122cc738d9906c8c568d156d44c58d9746
2023-05-12 00:29:55 -07:00
Christian Blichmann
4925df5419 CMake: Add option to link the Clang libraries statically into the header generator
Tested on Debian 10.13 with `LLVM-{11,12,13,14,15,16,17}` packages from https://apt.llvm.org/.

PiperOrigin-RevId: 531211601
Change-Id: I91babb5d85be2a22a4b17d757a5f626de6c03881
2023-05-11 08:36:11 -07:00
Christian Blichmann
9299156727 CMake: Use toolchain info for system includes
CMake already provides `CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES`, so there's
no need to invoke the compiler to determine system include directories.

For the Clang tool based header generator, adding the includes from the
current toolchain is strictly more correct than having it try and figure them
out itself (which will favor files from any installed libc++ and/or Clang).

PiperOrigin-RevId: 531207747
Change-Id: Icfcf7b495a0a5782c21a665984d9039d365db898
2023-05-11 08:20:16 -07:00
Christian Blichmann
a078043f8e CMake: Increase minimum required LLVM version to 11
LLVM 11 is now preseent in all major stable Linux distributions.

PiperOrigin-RevId: 531204137
Change-Id: I6f20aea425915023ea6113c17ff5a038a74aa919
2023-05-11 08:04:59 -07:00
Christian Blichmann
bfa0186f72 CMake: Rename option to enable the Clang tool based header generator
`SAPI_ENABLE_GENERATOR` => `SAPI_ENABLE_CLANG_TOOL`

This prepares further changes in this area.

PiperOrigin-RevId: 531201213
Change-Id: I56bd450e6ed2dd1dbbf45db2825a75c56d277037
2023-05-11 07:52:50 -07:00
Christian Blichmann
4ec1c6be64 CMake: Update policy settings to 3.26
This avoids a warning in newer CMake versions. For `CMP0083`, we still need to
explicitly select `NEW` behavior. `check_pie_supported()` will error if it is
unset even on later CMake versions.

PiperOrigin-RevId: 531200735
Change-Id: Icb17a00cac087bd6888f8a9b9f8dd837358a6090
2023-05-11 07:50:52 -07:00
Wiktor Garbacz
9b307fc204 Remove leftover stack_trace sources from sandbox2 target
PiperOrigin-RevId: 531168602
Change-Id: Ib9c0942e5ba9cf0d577f88a6091245ca02d5674e
2023-05-11 04:59:29 -07:00
Wiktor Garbacz
5b12071ba0 Remove WaitForSanitizers from ptrace monitor & add to global forkserver
This makes should ensure global forkserver will be single threaded before forking the sandboxees as it does not go through WaitAndFork.

Waiting for sanitizers is not needed in the monitor and should reduce latency
by 1 second for all sanitizer builds. Currently it'll always wait up to 1 seconds for the process to become single-threaded, which will never happen as monitor itself is running in a separate thread.

PiperOrigin-RevId: 530878018
Change-Id: Ie9f663848502f2738721861b0ba2dc6f3cc9f1c9
2023-05-10 05:06:18 -07:00
Kevin Hamacher
fb1571c801 Automated rollback of commit f6fd27618b.
PiperOrigin-RevId: 529395980
Change-Id: I6a5d451ed84f8d4a522777815c6cc2d7d7a8923c
2023-05-04 06:53:48 -07:00
Christian Blichmann
7e9f6c3df3 Fix typo
PiperOrigin-RevId: 529325261
Change-Id: Ia663900a55d51805e330d989ed0965dc4e8f9b17
2023-05-04 00:46:53 -07:00
Oliver Kunz
9ab20c5411 Implements the ability to control who is allowed to enable unrestricted networking.
PiperOrigin-RevId: 529309275
Change-Id: Icd88a4469b0c36af96638d44f9e909085c7120d5
2023-05-03 23:29:34 -07:00
Sandboxed API Team
f6fd27618b Automated rollback of commit 8c53262539.
PiperOrigin-RevId: 529101664
Change-Id: Ica452c6ee8f54b78be09fa830a09d6a89800cf44
2023-05-03 08:45:11 -07:00
Kevin Hamacher
8c53262539 Allow forkserver to use waitpid as alternative to sa_nochldwait
PiperOrigin-RevId: 529074278
Change-Id: If63015586673610e111ee589995e5264523be7a7
2023-05-03 06:41:07 -07:00
Wiktor Garbacz
a5bad44fac Fix wrong pytype annotation
PiperOrigin-RevId: 520972266
Change-Id: Ib5775e01bf3389e7d123480b3bb3b7a4f33a07b0
2023-03-31 11:30:33 -07:00
Wiktor Garbacz
0caa3e740c Do not expose forkserver.h
PiperOrigin-RevId: 520562657
Change-Id: I89fbe3012a5e63a50c46fd4f1e4ade8d36616c0b
2023-03-30 00:49:44 -07:00
Wiktor Garbacz
5efae5cdf5 Do not exit from within ForkServer to get more precise coverage data
PiperOrigin-RevId: 520273079
Change-Id: I3f37d9eacc2c284c45f37842e1e63364cf64faf2
2023-03-29 02:22:16 -07:00
Wiktor Garbacz
a4d602298b Dump coverage prior to execveat
PiperOrigin-RevId: 520002416
Change-Id: Ic792b0b71b8e7b2f00b669db9b6831acd8341c5c
2023-03-28 05:50:43 -07:00
Wiktor Garbacz
1755ba08e1 Internal Code Change
PiperOrigin-RevId: 519725866
Change-Id: Ibac005b875127ae68e28346fb78e74e789cff01e
2023-03-27 08:14:10 -07:00
Sandboxed API Team
9f2ba9d6a1 Comms constructor for non abstract sockets
Allows to create a Comms with unix domain sockets that are not abstract. This allows to use Comms to talk across network namespaces

PiperOrigin-RevId: 518854724
Change-Id: I4fd65466bba9512f448b73bde367f38a0fbb584d
2023-03-23 07:34:32 -07:00
Sandboxed API Team
18894d57f9 Add a helper method to allow the eventfd* family of syscalls.
PiperOrigin-RevId: 518565738
Change-Id: I2a3efe069ab1da65dd5f7cdcd3762637b7274b49
2023-03-22 07:46:56 -07:00
Wiktor Garbacz
b50bc23138 Remove no longer needed friend declaration
Drive-by dependencies cleanup

PiperOrigin-RevId: 518551045
Change-Id: I132dfc42945f500e8efec58a4d58d3bee4d1f191
2023-03-22 06:27:21 -07:00
Wiktor Garbacz
8a38e4de47 Copy environ in sandbox2_test to get better coverage data
PiperOrigin-RevId: 518544187
Change-Id: Id13a5503060817e1dead7ee4a5e310d322de3a5e
2023-03-22 05:47:00 -07:00
Wiktor Garbacz
99931c2ad6 Move abort into ExecuteProcess and mark it noreturn
PiperOrigin-RevId: 518528953
Change-Id: Ieaa03af484188bb35f9734d69d987eabbdcc23ab
2023-03-22 04:07:10 -07:00
Sandboxed API Team
b62d103426 Internal change
PiperOrigin-RevId: 518204712
Change-Id: Idcb8cc7b20198dcc0f3692aa0c89e9c620b9d65d
2023-03-21 01:49:22 -07:00
Wiktor Garbacz
9867ce3beb Make SAPI_RAW_LOG(FATAL, ...) noreturn
PiperOrigin-RevId: 517941912
Change-Id: I655aaf7101c566f8f01c1a5296539186701a10de
2023-03-20 05:43:28 -07:00
Wiktor Garbacz
10b89d4d33 Add missing LOAD_SYSCALL_NR
PiperOrigin-RevId: 516777043
Change-Id: Icccb8260c7e54299c5aa2ddfee4086232e2b8ffb
2023-03-15 03:29:56 -07:00
Wiktor Garbacz
690b31a038 Fix the poll in wait_for_sandboxee branch
PiperOrigin-RevId: 516544270
Change-Id: Ibb10611b9b7713ac6513199b6213c15d22772ea5
2023-03-14 09:19:30 -07:00
Wiktor Garbacz
5a2bdd436d Fix poll in unotify monitor
Fixes incorrect timeout calculation and increases the wakeup interval.
Also makes poll behave correctly in presence of signals.

PiperOrigin-RevId: 516514260
Change-Id: I035701e1bb351f9ad26157b59b13b4f300cc229a
2023-03-14 07:04:18 -07:00
Wiktor Garbacz
cb63dfead5 Add tests for util.cc
PiperOrigin-RevId: 516439597
Change-Id: I2ac88b6188738e47f0e0bdb04382a50aa5aa9366
2023-03-14 00:04:14 -07:00
Wiktor Garbacz
10d44614fd Partial support for sandbox2::Notify in UnotifyMonitor
PiperOrigin-RevId: 515562555
Change-Id: Ie73c34bc7e35942b307c458cfef80510e0b734c3
2023-03-10 00:59:37 -08:00
Wiktor Garbacz
6a79282895 contrib/lodepng: Add missing dependencies
PiperOrigin-RevId: 515305267
Change-Id: I009925b74c109f282f18e97d2c33e9aa023952a5
2023-03-09 05:10:55 -08:00
Wiktor Garbacz
a31584ff49 Add explicit cast to fix build error
PiperOrigin-RevId: 515263097
Change-Id: Ib5b6c28587be889b5e2ef8d013fa57cbb0d8ffd3
2023-03-09 01:03:36 -08:00