f614862e07
Remove deprecated VecStringToCharPtrArr
...
PiperOrigin-RevId: 563374332
Change-Id: I6873ca0d45fd5de6ad8eab1cbc395032130e9697
2023-09-07 03:09:30 -07:00
b350a41a10
Gather more coverage data
...
Switch to ForkWithFlags for InitProcess (it will not reset coverage).
Explicitly dump coverage after initial namespace setup.
Return instead of exiting from libunwind sandbox.
PiperOrigin-RevId: 563368599
Change-Id: I3b764db015a71bd091ee7b4b5b614281cbb84832
2023-09-07 02:43:04 -07:00
f6ec787902
PtraceMonitor: Add a hard deadline for waiting for kill to take effect
...
PiperOrigin-RevId: 563064233
Change-Id: Id340ba3793b82737f1976638a57df513c3d4136c
2023-09-06 04:38:51 -07:00
98d7f91b4d
Run more tests with sanitizers and coverage
...
PiperOrigin-RevId: 562768789
Change-Id: I2ee9e05a75a1f4e46887ef4c6587628f36ba16eb
2023-09-05 07:14:49 -07:00
92aeadddee
PolicyBuilder: test error conditions for AddPolicyOnSyscalls
...
PiperOrigin-RevId: 562768777
Change-Id: If756f83ea657cc6cd4c1283339a2909071a47493
2023-09-05 07:13:56 -07:00
02d770adcc
NetworkProxyTest: test more error conditions
...
PiperOrigin-RevId: 562708702
Change-Id: Ifedcb0eb2bc84396627a0b53828e1e10e4c562ad
2023-09-05 02:17:25 -07:00
b088c01ab2
Add missing Aarch64 syscall entries
...
PiperOrigin-RevId: 562705740
Change-Id: Ie75c13b4b1669cc7bcd45baa51119c633e120993
2023-09-05 02:03:36 -07:00
5f9698612e
Better network proxy tests
...
Fix sending error on `connect` failure.
PiperOrigin-RevId: 562693682
Change-Id: I70c710a9001f22e172cbe4df328983bfa7188d3d
2023-09-05 00:57:27 -07:00
3ea315858d
Remove mutexes from Comms
...
It was never fully thread-safe.
e.g. calling SendProtoBuf concurrently from 2 threads
could result in a data race.
Also not all users need the thread-safety thus it's better left off to be done externally by the ones that require it.
PiperOrigin-RevId: 562548941
Change-Id: Ie32dfca366be9e0c32841e55b688907f4f5f7704
2023-09-04 07:00:57 -07:00
197f03aa5b
Adjust code so that variable name is correct
...
PiperOrigin-RevId: 562509424
Change-Id: I33bf50c2cdce0fbd38d669d76da95b448f1841e4
2023-09-04 03:13:42 -07:00
e23acfd7e7
Made slight optimizations in Sandbox2's comms.
...
The optimizations are:
* Reduced the number of calls to `write` (originating from `SendTLV()`) from 3 to 1-2 (depending on size of the payload).
* Reduced the number of calls to `read()` (originating from `RecvTLV()`) from 3 to 2.
PiperOrigin-RevId: 561750509
Change-Id: I81bc092edf602e12c85ee97bd2e77b587b750d65
2023-08-31 13:50:26 -07:00
2c9ac02b68
Rework network_proxy related tests/examples
...
PiperOrigin-RevId: 561632543
Change-Id: I85843cc1cac8348273a5593339b38ae08e07592c
2023-08-31 06:06:09 -07:00
a0eb8d4445
Increase limits in ElfParser
...
PiperOrigin-RevId: 561621211
Change-Id: I3bbe8aecd3e3044251b67145927ee3a04bc56532
2023-08-31 05:01:51 -07:00
dc25251af9
Enable sandboxed stack traces for coverage
...
PiperOrigin-RevId: 561611676
Change-Id: I852eec8fc3728da1ae0b4bca8ccc9a628b8b5adc
2023-08-31 04:05:49 -07:00
f715bd8ba9
Run more tests with coverage enabled
...
PiperOrigin-RevId: 561575508
Change-Id: Ifc9a678b6a6cbcd892a1f8710b941514eb1d9764
2023-08-31 00:44:23 -07:00
47c868e6b1
Merge block bpf/ptrace tests
...
PiperOrigin-RevId: 561338563
Change-Id: If2704835c75ca0ae367375212c2104289e7b5cb0
2023-08-30 07:47:15 -07:00
5802d5b681
Refactor Forkserver::LaunchChild
...
PiperOrigin-RevId: 561331391
Change-Id: Ia96187ac1aff25a729c92dfc937f48cc0ae64342
2023-08-30 07:12:30 -07:00
09a48bac06
Reduce CHECK-failures in unotify monitor
...
This also fixes a CHECK-failure in Join() when waiting for sandboxee
times out.
PiperOrigin-RevId: 561282248
Change-Id: I5568c3b9e6b8dce531167c267f7896996326d2e2
2023-08-30 02:56:16 -07:00
4a6b0d4633
Always override forkservers comms_fd in sandboxee
...
PiperOrigin-RevId: 561276110
Change-Id: I8bd1ce7e2f363b5e371a431b1e6db6534023e401
2023-08-30 02:20:56 -07:00
0150026d38
Make PolicyBuilder helpers more self-contained
...
PiperOrigin-RevId: 561032912
Change-Id: I74db0c33609eb74df144db8d1d844b7267bf8ce4
2023-08-29 08:12:19 -07:00
37f00991b9
Final round of IWYU fixes for Sandbox2
...
PiperOrigin-RevId: 560077736
Change-Id: Id810db20b0042b8cd4f8f7a352b2cc571de51b71
2023-08-25 06:50:29 -07:00
c04ef4572c
CMake: Re-add missing library deps due to bad merge
...
PiperOrigin-RevId: 560020224
Change-Id: I54d329b12282f1a0c711b60f31f174c42ab3d893
2023-08-25 01:49:39 -07:00
7de1c4d8d0
More IWYU annotations
...
PiperOrigin-RevId: 560004823
Change-Id: If4d5048d01b09041c8b7175498a751df51ac0ba6
2023-08-25 00:35:09 -07:00
c175ac2c20
Fix missing dep for users of SANDBOX2_TRACE
...
PiperOrigin-RevId: 560004680
Change-Id: I7e9b86939ab1df2e2a400887ee53c8b9110e341c
2023-08-25 00:34:20 -07:00
edde724ab9
Internal change
...
PiperOrigin-RevId: 559996678
Change-Id: I25a18212dc2ab15dd106cffea6132bea4a3b842d
2023-08-24 23:55:35 -07:00
8254d13faf
Reenable the stack_trace_test
...
It was fixed internally and https://github.com/libunwind/libunwind/pull/602 should make it better for OSS.
PiperOrigin-RevId: 559772982
Change-Id: Ifcbf824d37cb4988dc56db20a8bbaaaf52a2cb81
2023-08-24 09:11:56 -07:00
d5ff466c59
Support passing `stderrthreshold` to sandboxee
...
PiperOrigin-RevId: 559769140
Change-Id: I57ad45e1155355e51a821d7903b2eb73dd1303ee
2023-08-24 08:58:26 -07:00
3adc232a07
Add missing dependencies bazel/BUILD
...
PiperOrigin-RevId: 559742911
Change-Id: I4212fa4abf27d8318b394425c1f3206b9377e63b
2023-08-24 07:09:14 -07:00
127176d72f
Bulk IWYU and build_cleaner fixes
...
PiperOrigin-RevId: 559733768
Change-Id: Ia38f4c176e9f0abbfdb3a8f1109f482d8870eb0f
2023-08-24 06:23:36 -07:00
38e5be910e
Temporarily disable a non-sandboxed crash stack_trace_test
...
This might fail under some versions of libunwind.
PiperOrigin-RevId: 559728630
Change-Id: I12bad6ec68a52164f79c8bf9a7b349fcd1a462e9
2023-08-24 05:59:50 -07:00
eaf8ef88c4
Sandboxed API: Env vars: Set `GOOGLE_STDERRTHRESHOLD` used by OSS Abseil
...
Internally, Abseil and Google logging use different flags and env vars to
control output.
PiperOrigin-RevId: 559715938
Change-Id: I4a908eb835ae0c5d598fb1ca6dc09182a9c3be22
2023-08-24 04:50:21 -07:00
0036d9d09f
Update Abseil
...
PiperOrigin-RevId: 559684012
Change-Id: Iee3e338a0b4dc1548f44610ba5e535e8787cf969
2023-08-24 01:59:03 -07:00
6986af58bb
IWYU fixes
...
PiperOrigin-RevId: 559444773
Change-Id: If92cdc4f978a22bfdbd61b0c9e0b43ea272bca8d
2023-08-23 09:04:00 -07:00
696d0eed11
Add IWYU pragma
...
PiperOrigin-RevId: 559415055
Change-Id: I8bbcc6b1e0b422ce46a63d2a9a429edd3402c51e
2023-08-23 07:14:21 -07:00
9dcc9db919
Replace StrError with PLOG
...
PiperOrigin-RevId: 559380593
Change-Id: Ia7d2bcb3908b5e739ac5c4aaec1559fb6f86f383
2023-08-23 04:09:02 -07:00
41003aae83
Automated rollback of commit 1e26cd50dc.
...
PiperOrigin-RevId: 559102360
Change-Id: I5dd175d5f0b9ece602f5c26454ad1f1e2e3a60fc
2023-08-22 07:12:09 -07:00
c4660f8a6e
Provide sealing flags if not defined in the headers
...
Also adjust naming of MFD_ constants
PiperOrigin-RevId: 559091482
Change-Id: I74271aee443a6d174950fd258bd238587cb4c75e
2023-08-22 06:21:25 -07:00
e75be07bb0
Automated rollback of commit 9c21744460.
...
PiperOrigin-RevId: 559063479
Change-Id: I4ccf8d5717b8669921c5b580eb415975cd625eaf
2023-08-22 03:59:49 -07:00
8a6b689c29
Cleanup includes
...
PiperOrigin-RevId: 559053598
Change-Id: Ie28d6db5505ed6ed14181fca9224390d883c20de
2023-08-22 03:04:38 -07:00
632fdc639d
Add missing includes
...
PiperOrigin-RevId: 559052007
Change-Id: I3bc95cbc204c207d60c5aabb414840fdaba8c0c6
2023-08-22 02:56:16 -07:00
1e26cd50dc
Always override forkservers comms_fd in sandboxee
...
PiperOrigin-RevId: 558721787
Change-Id: I331efd38b0571877b53cdc14190bae0ed639ce3f
2023-08-21 02:15:52 -07:00
56d11ae733
Client::PrepareEnvironment simplify by supporting just a single preserved fd
...
PiperOrigin-RevId: 558133382
Change-Id: I043985fcf331761b424ce720791711e5ea1f4fb9
2023-08-18 06:52:45 -07:00
1e9b686c4f
Make `Comms` movable
...
PiperOrigin-RevId: 558110484
Change-Id: I87fec43c0157e16ba683c498d8b50b3655efac17
2023-08-18 04:41:30 -07:00
08b81b52e0
Internal change
...
PiperOrigin-RevId: 558105430
Change-Id: I6b0c1c3a389b8b22c50fe3b2e753aba9a3e804ab
2023-08-18 04:10:42 -07:00
bf9fe79dbe
Introduce a SAPI_RAW_VLOG_IS_ON just for raw_logging
...
PiperOrigin-RevId: 558094899
Change-Id: I9da55eb55af22eafc74a81999dc920dbab98a1a3
2023-08-18 03:12:36 -07:00
ff23e878d3
Prefer regular logging to raw_logging
...
PiperOrigin-RevId: 558089528
Change-Id: Id3fb3ec16d25c5df859c305e1b0db00b54212958
2023-08-18 02:43:27 -07:00
b258535161
Treat libunwind sandbox as a ~regular sandboxee
...
This removes dependency on unwind from forkserver,
which should reduce binary size for all the custom forkservers (also the SAPI generated ones).
Unwind was only ever used by the global forkserver anyhow
PiperOrigin-RevId: 557921074
Change-Id: Iea4904da0506fee5a00f970538f512cba7b02326
2023-08-17 13:32:44 -07:00
6a64659fac
Use default SAPI policy in the examples
...
PiperOrigin-RevId: 557903883
Change-Id: Ieb65c5cf109037073449f16a466e33937deeb553
2023-08-17 12:34:47 -07:00
77fbfa7f5f
forkserver: use eventfd instead pipe for initial namespace creation
...
PiperOrigin-RevId: 557764601
Change-Id: I146c67bc6d4ba68f17c2117b1ca4d6bc71d30ffa
2023-08-17 03:02:19 -07:00
5d13550877
Allow set_robust_list for TSAN
...
It might spawn a thread which will likely invoke that syscall.
PiperOrigin-RevId: 557762639
Change-Id: I26a7a79253338bbe83d22d1680256e5cdb914762
2023-08-17 02:52:53 -07:00
Wiktor Garbacz
Jaeden Quintana
Sandboxed API Team
Christian Blichmann