Christian Blichmann
1b93745d00
Honor SAPI_ENABLE_TESTS in examples
...
PiperOrigin-RevId: 259927061
Change-Id: I7ae2156630c60e54ba0d9933d03816d750db31f3
2019-07-25 05:11:58 -07:00
bielec
ef7592cfdd
Now the network proxy client can automatically redirect connect syscalls to a handler that will send the data (syscall arguments) to the proxy server automatically and will return the obtained socket from the proxy server, in the future rules like allowed IP, protocols, etc. will be added
...
PiperOrigin-RevId: 259512665
Change-Id: I2747c7548ab24c7d2c90abb303fd783c11fed6f4
2019-07-23 04:41:08 -07:00
Sandboxed API Team
ae9836e6bf
Add dependencies on @com_google_absl//absl/base:log_severity
...
to targets including "absl/base/log_severity.h"
PiperOrigin-RevId: 259483071
Change-Id: Ide51ea54ca18ce466be863c1e7755098618801c0
2019-07-23 00:31:55 -07:00
Wiktor Garbacz
2300141bdb
Require namespaces to be disabled explicitly
...
PiperOrigin-RevId: 258730797
Change-Id: I5a1df23c5176a3cecd5a343483500550f27adf44
2019-07-18 02:18:26 -07:00
Wiktor Garbacz
691104c851
Extract RunInitProcess and SendPid/RecvPid
...
Also properly check status of send and use one-byte messages
to avoid issues with partial send, receive.
PiperOrigin-RevId: 258362495
Change-Id: I889b4699c100c80d15b129bf3a254f5442405bc2
2019-07-16 07:23:17 -07:00
Wiktor Garbacz
2349325e2b
Move root chdir to namespace setup
...
PiperOrigin-RevId: 258361265
Change-Id: Ifa065559e36606afa7111ef6d8e2d5d621b57426
2019-07-16 07:13:17 -07:00
Sandboxed API Team
418ad07086
Initialize std::atomic_flag members
...
PiperOrigin-RevId: 258309720
Change-Id: Id9cb6ee627c0aea11bbbabfcab10731e2235e534
2019-07-15 23:59:24 -07:00
Wiktor Garbacz
8a4e665cba
Remove redundant process setup
...
PR_SET_PDEATHSIG is already issued for init process in SanitizeCurrentProcess
Same for setsid
PiperOrigin-RevId: 258142844
Change-Id: Iad9e94bd402d576c1b24caab0b03efc50e2df07e
2019-07-15 05:36:27 -07:00
Wiktor Garbacz
9f36bd80d2
Fix double EnableNamespaces
...
PiperOrigin-RevId: 258142629
Change-Id: Ied76490e51278371fd51e117053599cce52991f1
2019-07-15 05:34:31 -07:00
Christian Blichmann
6d33c1f908
Add CMake options to exclude examples and tests from build
...
PiperOrigin-RevId: 258136393
Change-Id: Ifb2d7a24f93cd1d2782b4e4d6ac2c34a0d1c2bff
2019-07-15 04:42:58 -07:00
Christian Blichmann
99ac7fa60d
Refactor CMake files
...
* Move add_sapi_library() into a build defs file
* Override protobuf_generate_cpp() instead of naming it sapi_protobuf_generate_cpp()
* Factor out inclusion/find_package() calls of external dependencies
PiperOrigin-RevId: 258133422
Change-Id: Ibdbab0c735157eac0ed6122ab78f9d583c6905cc
2019-07-15 04:13:15 -07:00
Christian Blichmann
b219661be0
Add basic CMake support for SAPI, build examples
...
* Implement add_sapi_library() similar to the Bazel rule
* Fix SuperBuild so that glog properly depends on gflags (needed for --logtostderr)
* Raise minimum required version of CMake to 3.10 (Ubuntu 18.04 LTS)
* Update sum sandbox policy to allow to get IDs and PIDs
PiperOrigin-RevId: 258124160
Change-Id: I64c2f8b27a3e842874adca9100bfce20a2b74f17
2019-07-15 02:53:43 -07:00
Christian Blichmann
686c6d254f
Fix documentation link to zlib example
...
PiperOrigin-RevId: 257793227
Change-Id: I9c43c3814d75c5b79affd4854212eec07dc14f77
2019-07-12 06:38:49 -07:00
Christian Blichmann
ab35eb49af
Make embedding the sandbox code the default
...
PiperOrigin-RevId: 257778382
Change-Id: Ib6dc472355092c08b905e42978efe7f47703c128
2019-07-12 04:07:11 -07:00
Christian Blichmann
6b24025860
CMake targets for SAPI, add find_package() support for libffi
...
This change adds CMake targets for the actual Sandboxed API library. On its
own, this is not very useful, as there is no CMake equivalent to the
sapi_library() rule, yet. This will be worked on next.
PiperOrigin-RevId: 257177362
Change-Id: Ic06c945ab534b27306021d970a83691aae2e7e60
2019-07-09 06:13:08 -07:00
Wiktor Garbacz
d170bc3c80
Deflake namespace_test
...
When fetching exit status only lower 8-bits will be read.
Thus if getpid()&0xff == 0 the test can fail.
PiperOrigin-RevId: 257163766
Change-Id: I690c645fde33d1205578fd8873c5fc2974352ada
2019-07-09 04:11:07 -07:00
Christian Blichmann
6d06df1b86
Break out executor into its own build target
...
PiperOrigin-RevId: 257147090
Change-Id: I34c5e86ca68f865fdae42e4077c52c6168672c06
2019-07-09 01:53:56 -07:00
Christian Blichmann
747ccb57e8
Rename stack-trace{.h,.cc,._test.cc} to use underscores
...
PiperOrigin-RevId: 257144753
Change-Id: I4ce0dffad552c25b61102adfb1c03b8aea427dd9
2019-07-09 01:32:25 -07:00
Christian Blichmann
2da6dad120
Internal change
...
PiperOrigin-RevId: 257141595
Change-Id: Ic34799290fa88be62ecba38f8f60200a1e55f065
2019-07-09 01:32:09 -07:00
Christian Blichmann
c7f7666d9d
Do not leak macro definitions in stack-trace.h
...
Since we use glog, we need to still rely on gFlags for as long as Abseil
logging is not yet released. To do this, we have the util/flag.h header in
SAPI, faking the newer style API of Abseil's flags library.
The rationale behind this is that glog includes/builds with gflags for
command line flag parsing and having more than one flag parsing library
active at the same time is asking for trouble.
PiperOrigin-RevId: 256982667
Change-Id: I9c5406cb9ef4458daebfec0b0713f9bddbf5c3ad
2019-07-08 08:25:17 -07:00
Christian Blichmann
2301e05097
Follow-up to rev. 6edcf5f
which introduced a build failure
...
PiperOrigin-RevId: 256961234
Change-Id: I312d054c5d35413b2e6b061ddfa30c80397b19eb
2019-07-08 05:56:36 -07:00
Sandboxed API Team
6edcf5f823
Internal change.
...
PiperOrigin-RevId: 256378370
Change-Id: I1b00662a4c4c743ab79ecf35e857e4f7bc9f5e1c
2019-07-03 09:03:38 -07:00
Christian Blichmann
d48a372aab
Use absolute namespace names in generator to avoid collisions
...
PiperOrigin-RevId: 256349023
Change-Id: Ic6e178a158fd9af0343c747b0525e703aad7ef99
2019-07-03 05:32:46 -07:00
Kevin Hamacher
6d782dd774
Deflake custom_fork_server test
...
PiperOrigin-RevId: 256149331
Change-Id: I68cfd64ee602757235e6c6d602819a79ae4826fb
2019-07-02 05:59:25 -07:00
Christian Blichmann
732252922a
Make sapi::Status and sapi::StatusOr<> public in Bazel build file.
...
This makes it easier to work with the generated classes from client code.
PiperOrigin-RevId: 256132914
Change-Id: If7fb24a2cac998d2cdb04e8b627272064bf9793d
2019-07-02 03:20:23 -07:00
Maciej Szaw?owski
9435f97538
macro fixes:
...
- made sure that define order is correct
- made sure to emit all defines related to target define
- fixed a bug where '(' was separated with macro name with space, this breaking the macro
PiperOrigin-RevId: 256129616
Change-Id: I636b13a72c6198fb59e8e387f42567c442b24352
2019-07-02 02:58:17 -07:00
Christian Blichmann
4e20e0702a
Use full workspace name to access Bazel packages in generator
...
Since the interface generator is invoked via a Bazel macro, it will be
expanded in the embedding context of the project using SAPI, so package access
needs to go through the full workspace root @com_google_sandboxed_api.
This change also modifies the CMakeLists.txt accordingly, as the "external"
subdirectory is no longer needed/wanted.
PiperOrigin-RevId: 255918784
Change-Id: I052c687509f65fef7f011a9d1a074a171595330f
2019-07-01 02:53:41 -07:00
Christian Blichmann
0d16c136ae
Make external usage easier by providing a sapi_deps() workspace rule
...
If using Sandboxed API from an external Bazel WORKSPACE, dependencies can be
imported by declaring the repository and calling `sapi_deps()`:
```python
git_repository(
name = "com_google_sandboxed_api",
commit = "master",
remote = "https://github.com/google/sandboxed-api.git ",
)
load(
"@com_google_sandboxed_api//sandboxed_api/bazel:sapi_deps.bzl",
"sapi_deps",
)
sapi_deps()
```
PiperOrigin-RevId: 255373664
Change-Id: I4c41ffc75e1ca95eb126702cb2d5cedb255191d5
2019-06-27 04:27:53 -07:00
Christian Blichmann
301a265c95
Make bpf_helper visible to projects using SAPI
...
PiperOrigin-RevId: 255368910
Change-Id: I4f12e8d47fd747619a12d21a5be1c34d7f876b61
2019-06-27 03:43:31 -07:00
Christian Blichmann
0c4a803527
Workaround for Bazel issue #8672 (broken fully_static_link)
...
This is tracked at
https://github.com/bazelbuild/bazel/issues/8672
and should only affect the tests for now.
PiperOrigin-RevId: 254943708
Change-Id: Iee18a3b8c1b570c7d04d09d533ecff33c3de7d57
2019-06-25 04:32:17 -07:00
Christian Blichmann
97b5f0767a
Find libclang so that Python3 works, remove PY2
annotations
...
We now require that Debian users install the `python3` and `python3-pip`
packages. This change lets the Python code search for `libclang.so`, which can
be located in different directories, depending on version, and is not found by
default otherwise.
Fixes #28
PiperOrigin-RevId: 254745872
Change-Id: Ia77680da2a3235c0a9518125676aa8a460e38e76
2019-06-24 06:30:34 -07:00
Christian Blichmann
4bcea59309
Use to_list() on Bazel depsets for iteration.
...
Starting with Bazel 0.27.0 --incompatible_depset_is_not_iterable became the
default.
Fixes #27
PiperOrigin-RevId: 254703981
Change-Id: I727e4b1c6a907c8794a00f61646c13ad8d4437b7
2019-06-24 00:45:55 -07:00
Christian Blichmann
6ca744b959
Fix old 'google' namespace in example
...
PiperOrigin-RevId: 254203473
Change-Id: I04401074585769f3692f320f5aa0dbbecb51ebcc
2019-06-20 08:37:56 -07:00
Wiktor Garbacz
4b9be4e78a
Fix formating
...
PiperOrigin-RevId: 253196457
Change-Id: Id73a08945dedff7a116d500202355ecf266afcf3
2019-06-14 03:01:09 -07:00
Wiktor Garbacz
605d402121
Use new function naming
...
PiperOrigin-RevId: 253191002
Change-Id: If00c0effb925b3e294593f272447cd8386228bac
2019-06-14 02:09:07 -07:00
Christian Blichmann
4d891de31b
Internal change
...
PiperOrigin-RevId: 252609329
Change-Id: I46a05641456144e7967e01905c60e18aef164b3f
2019-06-11 06:49:45 -07:00
Sandboxed API Team
970257d87b
Allow two madvise calls for asan & tsan builds.
...
bbfa21f177/lib/sanitizer_common/sanitizer_posix_libcdep.cc (L71)
PiperOrigin-RevId: 252048323
Change-Id: I457e708f0b024fd9db4ad39265cb904777ca52b5
2019-06-07 07:53:10 -07:00
Christian Blichmann
dfbfb5cc43
Add CMake builds for the examples
...
PiperOrigin-RevId: 252045309
Change-Id: I57ffc3debbe64010b1f20b2e6df900b9916fa37f
2019-06-07 07:27:33 -07:00
Christian Blichmann
f2c7f976cf
Add minimal Bazel CI config
...
PiperOrigin-RevId: 252043934
Change-Id: I29222d770c44522b21560bb736b1f5fd55cb0da0
2019-06-07 07:14:07 -07:00
Christian Blichmann
24c3e34344
Implement a GetDataDependencyFilepath() for CMake (non-Bazel really).
...
This code assumes, like Bazel's runfiles that the data dependency to access
exists in the same sub-tree as the binary:
WORKSPACE
+- sandboxed_api/sandbox2/examples/crc4
+- crc4bin
+- crc4sandbox
The code requires the directory structure to exist, so that in the example
above, crc4sandbox can use
GetDataDependencyFilepath("sandboxed_api/sandbox2/examples/crc4/crc4bin")
regardless of how it was called.
PiperOrigin-RevId: 251834480
Change-Id: I6470b62ce9b403297116481a0c17c070992f2e81
2019-06-06 05:44:32 -07:00
Christian Blichmann
9b78e331fa
Use newer gflags namespace for command-line flags
...
PiperOrigin-RevId: 251639941
Change-Id: I3037ce9510a3bc62cf5c899c64f2e7d344a8b4ee
2019-06-05 07:39:38 -07:00
Sandboxed API Team
1b2b83676b
Internal Change
...
PiperOrigin-RevId: 251637952
Change-Id: I532201ec1ba16a4cae71c671ffe2bd34e13a5391
2019-06-05 07:24:16 -07:00
Christian Blichmann
ffd4e1270a
Internal change
...
PiperOrigin-RevId: 251590551
Change-Id: Ic69f8f5f798006c0d096357b7a746cdc4ce530a3
2019-06-05 00:26:14 -07:00
Christian Blichmann
a3b0949949
Internal change
...
PiperOrigin-RevId: 251411359
Change-Id: Ifbed8afa72d130ae803ed71a6a43ac3c9d8755f9
2019-06-04 04:07:21 -07:00
Christian Blichmann
719cd24933
Fix sandbox2 tests when run with CTest
...
This test runs, but fails due to a different problem:
StackTraceTest.ForkEnterNsLibunwindDoesNotLeakFDs
PiperOrigin-RevId: 251218516
Change-Id: If06cdbcb71fad84ebd9d934ff173d7ef1a1eebc0
2019-06-03 06:27:59 -07:00
Sandboxed API Team
dd2a84b980
Clarify behavior of Buffer::CreateFromFd
...
PiperOrigin-RevId: 250834142
Change-Id: I7aac739c9b590adc0599926e3246bc87e21d951a
2019-05-30 23:50:54 -07:00
Sandboxed API Team
6666f41ba2
Fix unnecessary unique_ptr in LogServer.
...
PiperOrigin-RevId: 250050562
Change-Id: I6840e68504c741de1e66489279237f4a4a6bc533
2019-05-26 08:47:38 -07:00
Wiktor Garbacz
08ff939ea7
Call DisableNamespaces where needed
...
PiperOrigin-RevId: 249637351
Change-Id: I5105d89ea0e8cfb2fca1e5ac342fa67e9caac930
2019-05-23 07:21:03 -07:00
Wiktor Garbacz
85059ef40d
Add DisableNamespaces to PolicyBuilder
...
Currently mostly no-op, but this is the first step to turn namespaces on
by default.
PiperOrigin-RevId: 249439158
Change-Id: I5eeb1216dc868c660f62ad50c34f626afbf7db61
2019-05-22 06:54:12 -07:00
Wiktor Garbacz
71a317e65f
Do not emit an error on ESRCH in PTRACE_CONT
...
Process might be killed between waitpid and PTRACE_CONT,
even though a PTRACE_EVENT_EXIT will be gererated, continuing
will fail with ESRCH in that case.
PiperOrigin-RevId: 249245726
Change-Id: Ib673529229a306d2266fa60caa3039b6bcd80a65
2019-05-21 07:30:56 -07:00
Wiktor Garbacz
15993a34e2
Log stack traces with INFO instead of ERROR
...
PiperOrigin-RevId: 249035379
Change-Id: Ie62366f45f29741ee0c8b25369d0bb169275ccfd
2019-05-20 06:16:50 -07:00
Wiktor Garbacz
207b2d9a95
Remove stale comment
...
PiperOrigin-RevId: 248715509
Change-Id: I7aa3f4388920e39a79ac349890de403ac3384504
2019-05-17 07:21:31 -07:00
Wiktor Garbacz
34d17b77ac
Remove dead code
...
IPC always creates comms object from a fd.
PiperOrigin-RevId: 248683525
Change-Id: Ib4285ec0494d551257237c12f92f983b943205cb
2019-05-17 02:02:03 -07:00
Wiktor Garbacz
8678af23d0
Extract GetRlimitName into util
...
PiperOrigin-RevId: 248682931
Change-Id: I702533a8d36465de956a1a90a40c634434b7a671
2019-05-17 01:55:35 -07:00
Wiktor Garbacz
6e1c3c3055
Fix prlimit error message
...
PiperOrigin-RevId: 248491089
Change-Id: Id4116939d02b6a592c74218955675acf2e3c70fe
2019-05-16 02:24:59 -07:00
Wiktor Garbacz
7294e9976e
Replace custom synchronization with absl::Notification
...
PiperOrigin-RevId: 248334969
Change-Id: I7614a3792babd399912c5d5a167ab5e0a0574d20
2019-05-15 08:09:56 -07:00
Wiktor Garbacz
42761c8b72
Add a resource starvation test
...
PiperOrigin-RevId: 248334209
Change-Id: Iff0f0b3024c67a767c429a547695cc48a2d02a30
2019-05-15 08:04:58 -07:00
Wiktor Garbacz
6588aa2a68
Reintroduce monitor changes.
...
Signal handling in Monitor::MainLoop was fixed.
PiperOrigin-RevId: 248331692
Change-Id: I0f85d319802258632d2074742c53597bb922555a
2019-05-15 07:46:49 -07:00
Sandboxed API Team
d8f7d861d2
Log the progress of dynamic libraries being resolved while creating a sandboxee's virtual FS chroot. This provides valuable insight while debugging problems with dynamically linked sandoxed binaries.
...
PiperOrigin-RevId: 247625021
Change-Id: I9bf77af7410deb8766fd49910c8564e148020601
2019-05-10 09:41:07 -07:00
Christian Blichmann
5f3c7171b7
Use Abseil's flag library released in aa468ad75539619b47979911297efbb629c52e44
...
PiperOrigin-RevId: 247424939
Change-Id: I22a4696f705f9dcfa7394b329c78bd126f42bd16
2019-05-09 07:57:55 -07:00
Christian Blichmann
7800fd7402
Disable compiler warnings for consistency with internal settings.
...
PiperOrigin-RevId: 247405215
Change-Id: I236170f7b47d9ecd32324db907ef7afc2e797d9a
2019-05-09 05:21:34 -07:00
Sandboxed API Team
63f0adbfbb
Revert of monitor code update.
...
PiperOrigin-RevId: 247255592
Change-Id: I3656ea1628418321b1b8b02660b6a51a58c2c61f
2019-05-08 11:34:26 -07:00
Wiktor Garbacz
3f5360a7bc
Simplify monitor code.
...
Make setting result code the condition for main loop exit.
PiperOrigin-RevId: 247218505
Change-Id: I8699012683bc301e8a9f4f41cd5ab018e3cd514c
2019-05-08 08:34:56 -07:00
Christian Blichmann
a412383d61
Fix build failure with Bazel v0.25.0+ ( #25 )
...
PiperOrigin-RevId: 247206409
Change-Id: Ic6d4d1fea42ea5746613d3ef3de67f61e72848a6
2019-05-08 07:07:29 -07:00
Sandboxed API Team
f29a5a81ed
Print final FS mounts in sandboxee's chroot
...
After all requested filesystem mounts are fully mounted under a sandboxee's virtual chroot, print a list of the outside paths and a list of the inside chroot paths that the outside paths are mapped to. This provides a valuable insight while debugging sandboxed binaries.
PiperOrigin-RevId: 247130923
Change-Id: I42b4b3db68d826587c0fe8127aabbead38bc6f20
2019-05-07 18:30:13 -07:00
Christian Blichmann
6bfa83befe
CMake support for Sandbox2
...
- Add a superbuild in cmake/SuperBuild.cmake that downloads and builds
dependencies
- Builds for sandbox2/ and a its tests
- Helper CMake function to strip proto paths
- Module to find libcap
- Custom build for libunwind that wraps its symbols
- Fix environment so that CTest executes tests similar to Bazel
- Filewrapper functionality, like Bazel's cc_embed_data()
- Build forkserver with embedded binary
- Enable ASM language so that libunwind builds correctly
- Allow glog target to propagate transitively (to propagate its include dirs)
Signed-off-by: Christian Blichmann <cblichmann@google.com>
2019-05-06 14:03:29 +02:00
Christian Blichmann
7753cded13
Replace non-alphanumeric, non-underscore characters in filewrapper
...
PiperOrigin-RevId: 246320238
Change-Id: I08454dc19b6227e4ce2c1b7677b916706e7be5a5
2019-05-02 08:11:50 -07:00
Wiktor Garbacz
64cfb949f4
Internal change
...
PiperOrigin-RevId: 245410078
Change-Id: I9ef7680885927b23734c02e063a617c9dbc3b856
2019-05-02 05:21:32 -07:00
Wiktor Garbacz
3a2829bafc
Fix minielf test
...
PiperOrigin-RevId: 245409987
Change-Id: I5c728f012776105b7070e88d77bba27a205d56f1
2019-04-26 06:22:31 -07:00
Wiktor Garbacz
e8ef753821
Internal change
...
PiperOrigin-RevId: 245409914
Change-Id: I20f23a997e09ce4cc2fe9353ac6f341a641e2263
2019-04-26 06:20:43 -07:00
Wiktor Garbacz
b1aa95fcde
Internal change
...
PiperOrigin-RevId: 245409846
Change-Id: Ic9f398146a4c0d72592f5bb7b46a01333303ba12
2019-04-26 06:20:05 -07:00
Wiktor Garbacz
523620f8ab
Internal change
...
PiperOrigin-RevId: 245409785
Change-Id: I37b1611bed459522803fa1e49c4252d2cad80076
2019-04-26 06:18:59 -07:00
Wiktor Garbacz
5e645a9190
Fix build
...
PiperOrigin-RevId: 245400890
Change-Id: I899ef49edd8e371b8714478fa3c911cfb771419b
2019-04-26 04:42:52 -07:00
Sandboxed API Team
f3c9c6e388
Internal change
...
PiperOrigin-RevId: 245377524
Change-Id: If41601b2d68c6ff0f7d3f37811aac62c32441d1f
2019-04-26 00:46:11 -07:00
Sandboxed API Team
afec50fdb5
automated internal change
...
PiperOrigin-RevId: 245070237
Change-Id: Ib6b0d9201f8b603e185eb91c1bc9f500f1af1ed6
2019-04-24 10:31:13 -07:00
Christian Blichmann
feba2c35d7
Apply special whole-archive linker options only where necessary
...
PiperOrigin-RevId: 245038294
Change-Id: I99367e7c982a340a88acf730619a467d34d53203
2019-04-24 07:07:14 -07:00
Wiktor Garbacz
c6d16a58eb
Internal change
...
PiperOrigin-RevId: 244882748
Change-Id: I0342f445df8f60f864d3e7f56145051b821a86e0
2019-04-23 10:47:34 -07:00
Wiktor Garbacz
53d85ab4f2
Internal change
...
PiperOrigin-RevId: 244882228
Change-Id: I506b92326fa83f214b1e7fab6c5b2e0889f8b197
2019-04-23 10:46:58 -07:00
Wiktor Garbacz
63006c1476
Internal change
...
PiperOrigin-RevId: 244881751
Change-Id: I3f3200c4d85906058ac17ed941e69ea22d9a4090
2019-04-23 10:42:14 -07:00
Wiktor Garbacz
0fd468be7c
Internal change
...
PiperOrigin-RevId: 244879634
Change-Id: Ifa63ef7b0cc10e87d18f17b85cce55af03cd37cf
2019-04-23 10:31:51 -07:00
Wiktor Garbacz
6cbaaead8b
Make StatusMatcher more flexible
...
PiperOrigin-RevId: 244879203
Change-Id: I5f7994130a898e84f041b18c0b5313d7e8b32780
2019-04-23 10:30:45 -07:00
Sandboxed API Team
726b1fb451
n/a
...
PiperOrigin-RevId: 244836017
Change-Id: I034cfb1af4835256aa9b8b7ac3e80a341e9a9271
2019-04-23 05:14:22 -07:00
Kevin Hamacher
8ad4fcd0a8
minielf: Increase maximum amount of symbols loaded
...
PiperOrigin-RevId: 243775723
Change-Id: I5398ec23bd76be01c48c69bd4decb015a48386fc
2019-04-16 03:00:28 -07:00
Kevin Hamacher
af44845246
Try to demangle c++ symbols when logging the stacktrace
...
PiperOrigin-RevId: 243612828
Change-Id: I09c748da0c119ba2024b2906802858b5b9bcfeb0
2019-04-15 07:37:23 -07:00
Chris Kennelly
d90b2c6328
Allow TCMalloc to access the rseq syscall.
...
PiperOrigin-RevId: 243441655
Change-Id: I82918459c20f164b56cc0c5b621b004315a011ec
2019-04-13 13:45:35 -07:00
Chris Kennelly
e2eb0597cb
Internal change
...
PiperOrigin-RevId: 243440925
Change-Id: I085535962e1d754f7bc32e08b1785a574062edaa
2019-04-13 13:45:25 -07:00
Kevin Hamacher
ac6a5dfc85
Delete copy constructor of FDCloser
...
PiperOrigin-RevId: 243263443
Change-Id: If22d287ce1872ad070454824e8daa36585ab0258
2019-04-12 07:54:31 -07:00
Kevin Hamacher
6b5f3645ab
Make embed_file use raw logging
...
PiperOrigin-RevId: 242868093
Change-Id: Ibf1f448878219a9ce8fc6bb7d3e93626fa24b1f6
2019-04-10 07:56:06 -07:00
Wiktor Garbacz
79525950fe
Add support for new SECCOMP_RET_* in disassembler
...
PiperOrigin-RevId: 242642525
Change-Id: Iea9a54f01d56cadf19a020340d07c1790c858a0f
2019-04-09 14:38:05 +02:00
Kevin Hamacher
1b50485be6
Move forkserver into a dedicated binary
...
PiperOrigin-RevId: 242637894
Change-Id: I16f19d077e2b5b9d0d4ef58344d5caaef95af7c6
2019-04-09 14:37:41 +02:00
Kevin Hamacher
e44231e28a
Wrap waitpid with TEMP_FAILURE_RETRY and use __WALL to make sure we reap all children
...
PiperOrigin-RevId: 242111281
Change-Id: I322623303487b0292c2aea53d6eae5d9f53d79b6
2019-04-05 05:50:12 -07:00
Copybara-Service
5b0c46fa18
Merge pull request #21 from happyCoder92:master
...
PiperOrigin-RevId: 242110016
Change-Id: I148ba1d8a6d2c675271662e91b41c4aa04b7d0c9
2019-04-05 05:34:00 -07:00
Kevin Hamacher
77ad64ac30
Use high FD numbers in the forkserver to avoid collision with FDs mapped by the user
...
PiperOrigin-RevId: 242106285
Change-Id: I0f4bd130f8e66e6b47ad1d7311e0fff519aa9e90
2019-04-05 04:51:41 -07:00
Wiktor Garbacz
98928a0570
Document required deps for Gentoo
2019-04-05 11:09:02 +02:00
Sandboxed API Team
6a65e63eae
Add //tools/cpp:current_cc_toolchain to the toolchains attribute.
...
This is so that CC Make Variables will be resolved properly.
PiperOrigin-RevId: 241721367
Change-Id: Ic0d3f864b1398107118a1ada4c99cc4516db924f
2019-04-03 16:51:55 +02:00
Wiktor Garbacz
29fac2d393
mounts: Validate interpreter as early as possible
...
PiperOrigin-RevId: 240972700
Change-Id: I9049af7d053152cebd264fbfc352d2971a06d363
2019-03-29 07:07:55 -07:00
Sandboxed API Team
137f772f2b
Allow TCMalloc to call madvise with MADV_NOHUGEPAGE
...
PiperOrigin-RevId: 240555428
Change-Id: I05fd61ecd09fc0a3f76dade0341d35b04a590b90
2019-03-27 07:40:57 -07:00
Christian Blichmann
dda0daa449
Fix typo
...
PiperOrigin-RevId: 240368596
Change-Id: Id517ae6ecece98998316ba5a2672e075e037133a
2019-03-26 09:57:32 -07:00
Christian Blichmann
88213b0d1b
Copybara import of the project:
...
- 05cbe1250a0905c975cb3de175a6c3690dbbc00b Don't accidentially generate trigraphs by Mackie Loeffel <mackie.loeffel@web.de>
- 25e66c1080fa50d8b0661d10ecde39cfcbf51289 Merge 05cbe1250a0905c975cb3de175a6c3690dbbc00b into 6679f... by MackieLoeffel <MackieLoeffel@users.noreply.github.com>
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/sandboxed-api/pull/17 from MackieLoeffel:fix_trigraphs_in_filewrapper 05cbe1250a0905c975cb3de175a6c3690dbbc00b
PiperOrigin-RevId: 240365879
Change-Id: I31fa5dfeadac3cee79e7d66b4dd4fe58a7a4b242
2019-03-26 09:43:16 -07:00
Christian Blichmann
f04be9276f
Formatting fixes and include file hygiene.
...
PiperOrigin-RevId: 240346890
Change-Id: I1a9617f10a62a848b6314a6196512e016ae02643
2019-03-26 07:54:21 -07:00
Christian Blichmann
33206c5d3f
Use a longer string in the CRC4 buffer overflow example.
...
On some newer compiler versions, compiler optimizations and loop unrolling
change the memory layout so that 64 bytes are not enough to overwrite the
return address reliably.
PiperOrigin-RevId: 240343358
Change-Id: Ifb1a1dc1cb482793b7387887f0fd68a237879227
2019-03-26 07:28:15 -07:00
Kevin Hamacher
1dd0428713
Add missing chdir() in the init process
...
PiperOrigin-RevId: 239425921
Change-Id: Ia1b02ae0a2f319faa601d6098a9f94a3043656a8
2019-03-20 10:36:11 -07:00
Christian Blichmann
52f4c1f927
Disable "mini" debug format support in libunwind to avoid additional library dependency
...
PiperOrigin-RevId: 239397518
Change-Id: Icd8c641f9d5aac721a2cf1e4e0d3347743f49d58
2019-03-20 08:03:08 -07:00
Christian Blichmann
2ed1e9b7a4
Merge pull request #5 from disconnect3d:patch-5
...
PiperOrigin-RevId: 239387531
Change-Id: I7929c296cb838c5a1ed05539efca4e771c1f68b3
2019-03-20 14:51:11 +01:00
Christian Blichmann
30c25286f3
Merge pull request #8 from shaan1337:patch-1
...
PiperOrigin-RevId: 239384106
Change-Id: Ibeb4b6a76226a1384fc21df33378101a31764012
2019-03-20 14:33:36 +01:00
Wiktor Garbacz
2e9f50a68f
Rename deathrattle_fatalmsg proto
...
PiperOrigin-RevId: 239377742
Change-Id: I169407087f5e6f3275e282a51232bb6eea330e49
2019-03-20 05:19:55 -07:00
Sandboxed API Team
c8a4131e74
Test that isatty is being allowed by AllowTCGETS.
...
PiperOrigin-RevId: 239370864
Change-Id: Id98f3e5d8dceedb3cfbcd23b980e828f576d3e8d
2019-03-20 04:11:21 -07:00
Christian Blichmann
3600a8a090
Merge pull request #2 from disconnect3d:patch-3
...
PiperOrigin-RevId: 239354706
Change-Id: Ib9b5eca822bcf114a90c7dc96a9a2dacd318d016
2019-03-20 09:42:47 +01:00
Christian Blichmann
6eb6dc5f9c
Merge pull request #4 from disconnect3d:patch-4
...
PiperOrigin-RevId: 239244132
Change-Id: I33a50f866b23a23ce63ff5609e6865184fec0863
2019-03-19 21:40:14 +01:00
Christian Blichmann
0babaf094d
Improve internal<->external code transforms #3
...
Note: These commits only change very minor formatting issues in
the GitHub version. There is more than meets the eye, though. These
changes help to be able to accept pull requests.
PiperOrigin-RevId: 239225828
Change-Id: Ib31bf114e7cc4ccda49f7dcc4e9e24eebc735065
2019-03-19 10:58:21 -07:00
Christian Blichmann
cb36b974eb
Improve internal<->external code transforms #2
...
PiperOrigin-RevId: 239221234
Change-Id: I5b50ed6472df894c43310addb9d8e8ca35b2c822
2019-03-19 10:38:52 -07:00
Christian Blichmann
22eeb45d0f
Add missing transactions.md
...
Fixes #7
PiperOrigin-RevId: 239176066
Change-Id: I6fde1246447610ed5157db39f30472c38b206474
2019-03-19 06:16:40 -07:00
Christian Blichmann
90d276f913
Improve internal<->external code transforms
...
This includes changing the way libcap headers are included.
PiperOrigin-RevId: 239173120
Change-Id: I5562d924b96bab26a29342903895324bfe385e5a
2019-03-19 05:51:53 -07:00
Kevin Hamacher
5d216fb191
Only spawn init processes when using PID NS
...
PiperOrigin-RevId: 239169620
Change-Id: I9f26cfab90189a1baa5b87a700ce892cf0c95a89
2019-03-19 05:14:29 -07:00
Wiktor Garbacz
7ecdd2f8fc
Internal change.
...
PiperOrigin-RevId: 239163024
Change-Id: I6918cc7f1472271b3cf99e042d8eb52d42868e6c
2019-03-19 04:11:51 -07:00
Sandboxed API Team
5aa13876a4
Formatting fixes.
...
PiperOrigin-RevId: 239159980
Change-Id: Ic6185368392622bf3f4c661e37f6b9fcca0d60a6
2019-03-19 03:41:32 -07:00
Shaan Nobee
88a23c878a
Fix typo
2019-03-19 09:43:12 +04:00
Disconnect3d
845ad06d37
Update library.md
...
There is no https://github.com/google/sandboxed-api/blob/master/sandboxed_api/examples/zlib/lib/sandbox.h - it either wasn't commited or we meant different sandbox.h here. For now I linked to sum's sandbox.h
2019-03-18 21:34:41 +01:00
Disconnect3d
64acef11c5
fix formatting in docs/library.md
2019-03-18 21:29:35 +01:00
Disconnect3d
95d35615b8
Fix user namespaces link in howitoworks.md
2019-03-18 21:22:53 +01:00
Christian Blichmann
177b969e8c
Sandboxed API OSS release.
...
PiperOrigin-RevId: 238996664
Change-Id: I9646527e2be68ee0b6b371572b7aafe967102e57
Signed-off-by: Christian Blichmann <cblichmann@google.com>
2019-03-18 19:00:48 +01:00