StarMirror/sandboxed-api
1
0
Fork 0
mirror of https://github.com/google/sandboxed-api.git synced 2024-03-22 13:11:30 +08:00
Code Issues Projects Releases Wiki Activity
288 Commits 1 Branch 3 Tags 144 MiB
f7d3f442df
Commit Graph

288 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Christian Blichmann
5c38f62ba7 Fix unused warning for IsFdOpen() 
PiperOrigin-RevId: 282346983
Change-Id: I7010caf0e6f3ddb420ef992f6aa2554d540667a3
 2019-11-25 06:44:14 -08:00
Christian Blichmann
4f892864c8 Update dependencies to newer version 
- Same upstream dependency versions for CMake and Bazel
- Use maybe() from build_defs to conditionally define Bazel repositories

PiperOrigin-RevId: 282331418
Change-Id: I8a7db84a1d3115f3c1f31cc1dfcc8c29fe391a62
 2019-11-25 04:32:01 -08:00
Kevin Hamacher
3cbd871454 Allow sandboxee c-strings to be read as std::string 
PiperOrigin-RevId: 281960106
Change-Id: I54256dda2b6b0374d0f2ce3f762370478b912683
 2019-11-22 07:00:03 -08:00
Kevin Hamacher
a193cb4ed7 sandboxed_api: Expose strlen in the rpc channel 
PiperOrigin-RevId: 281958333
Change-Id: If15d7d5b915fec3c5521ef53ee44c58d7482d1bc
 2019-11-22 06:44:31 -08:00
Christian Blichmann
d9d45bcfe5 Fix generator not finding libclang 
PiperOrigin-RevId: 281745276
Change-Id: I8c55b142a72265f577d6d1e3b673890529428c21
 2019-11-21 07:33:03 -08:00
Christian Blichmann
948b75efe9 CMake cleanups 
- Bump minimum requred version to 3.12 (Ubuntu Cosmic LTS)
- Rename `SAPI_USE_?` options to `SAPI_DOWNLOAD_?`
- Improve detection of Python 3
- Use platform independent static library suffixes for `find_library()`

PiperOrigin-RevId: 281727467
Change-Id: I45596b6ba08e4f8201d8dcde19a03baf825b83ec
 2019-11-21 05:17:25 -08:00
Christian Blichmann
d47c066112 Enable sapi_test target in CMake, add Benchmark dependency 
PiperOrigin-RevId: 281719298
Change-Id: Idd2570fff4907c81cdab1070bd1f3e41e29c76f6
 2019-11-21 04:04:14 -08:00
Christian Blichmann
6dd97f5073 Move dependency on libdl into build defs, like CMake 
PiperOrigin-RevId: 281699435
Change-Id: Iced13e98578b2c36a1eeac71fd02a6d7ed87a8fb
 2019-11-21 01:36:34 -08:00
Christian Blichmann
ae2954f598 Build in C++17 mode. 
Practically all current compilers fully support C++17 by now, with the exception of `filesystem` (which we won't use).

PiperOrigin-RevId: 281494879
Change-Id: Ia0ef650ede4e5907e4a6421b8ad11743c8bae88f
 2019-11-20 04:40:09 -08:00
Wiktor Garbacz
8a7d0d1cb3 Use a nested userns&mntns to pre-pivot_root 
This addresses a latency issue - chroot_fs_refs called inside pivot_root
in the kernel can take several milliseconds on machines with many threads
running.
This might not always reduce latency for custom forkservers, as additional
fork can be more costly than pivot_root.

PiperOrigin-RevId: 281306284
Change-Id: If503ac76a70e5438e94caf708d79cb0219c66def
 2019-11-19 09:02:28 -08:00
Wiktor Garbacz
1673ade4e4 Remount chroot as read-only 
PiperOrigin-RevId: 280394655
Change-Id: I1490b7dfbbca3d91f5efb4dd5800397c9da57da8
 2019-11-14 03:51:26 -08:00
Wiktor Garbacz
a1b291d44a Fix mount entries listing for tmpfs 
PiperOrigin-RevId: 276447076
Change-Id: Ia5873e34327c281e5c9fb66f5f58a0dd49ba10b0
 2019-10-24 02:37:54 -07:00
Sandboxed API Team
282f2d65e7 Fix a file descriptor leak in sandbox2::Executor. 
PiperOrigin-RevId: 276294193
Change-Id: I9def39a41704db9948735c259e435ccfc71bacc5
 2019-10-23 09:52:07 -07:00
Christian Blichmann
8412af7e5f Add BazelCI build badge 
PiperOrigin-RevId: 276269876
Change-Id: I5fd50b3532344cb76b34748cd0640bba931ed290
 2019-10-23 07:24:01 -07:00
Christian Blichmann
08bd3ddc22 Update BazelCI configuration to use Debian 10 
PiperOrigin-RevId: 276260896
Change-Id: I0203446d6dcf00f1e8c4955183d8d1868f073c1e
 2019-10-23 06:10:05 -07:00
Kevin Hamacher
4da8f68aa8 Rework stacktrace mounttree logic 
The previous one was not quite correct in cases where the outside binary path
did not match the inside path. This should be fixed with this.

PiperOrigin-RevId: 276075886
Change-Id: I1c7c4fa0191960437a2d2360b805c7098b1407c9
 2019-10-22 09:05:33 -07:00
Christian Blichmann
254abe04fe Use unified diff for zlib patch 
PiperOrigin-RevId: 276075544
Change-Id: Icf06e360a400834e7304c2bde34954dbc71f135f
 2019-10-22 09:04:29 -07:00
Wiktor Garbacz
a7cfbb92a6 Remove uneeded read-only remount 
Caused failures if root is mounted as nodev, nosuid etc.
Root is pivoted and unmounted right after this anyhow.

PiperOrigin-RevId: 273707731
Change-Id: I75f1edaf2877c096e4f5bb7dc1b2bb8eb5c437a3
 2019-10-09 02:47:38 -07:00
Kristj?n J?nsson
78824353d1 Make PolicyBuilder a value class. 
This makes the class more ergonomic because
* You don't have to heap allocate the builder.
* You can create a policy builder "template" and re-use it across sandboxes to avoid repetitive work.

PiperOrigin-RevId: 273555679
Change-Id: I4084ee9c74f95ebfde873eb0dc021b3b3cdc5ea2
 2019-10-08 10:45:45 -07:00
Sandboxed API Team
9931593fdc Corrects typo in link 
PiperOrigin-RevId: 273248066
Change-Id: I37682d1b82fbe0b0e06d43dfe511da0d6aaa8c5a
 2019-10-07 02:36:35 -07:00
Christian Blichmann
c6b8e301e4 This fixes broken _proto_cc_cc_proto build target suffixes. 
These where inadvertently introduced in an internal cleanup change.

This change also removes a C++17-ism in var_proto.h. To make things easier for
downstream projects, we should stick to C++11 for the time being.

PiperOrigin-RevId: 271117700
Change-Id: I4eaacec88be16e1a561d3f77a61acce0a1af0b9d
 2019-09-25 07:13:58 -07:00
Sandboxed API Team
ce46cb3fef internal BUILD file cleanup. 
PiperOrigin-RevId: 270906748
Change-Id: I6a79c2f84a1d8a9fcb91061caa5f9e538fa83cba
 2019-09-24 08:12:21 -07:00
Kevin Hamacher
1cf9bf8ab6 Internal change 
PiperOrigin-RevId: 270878802
Change-Id: I4c946fdb5f566909eaead35a3050a99ab9047553
 2019-09-24 04:50:18 -07:00
Kevin Hamacher
c337ea117e Return descriptive string if stack-traces are disabled 
PiperOrigin-RevId: 270876245
Change-Id: I899a4628541712a212aa24d3a01d48d9b070c734
 2019-09-24 04:27:09 -07:00
Kevin Hamacher
51d1a0e8ba Rollback of an internal change 
PiperOrigin-RevId: 270874732
Change-Id: I69538a0a37ba008a41220fe9d77b3e59f8d06610
 2019-09-24 04:11:52 -07:00
Sandboxed API Team
6131774256 internal BUILD file cleanup 
PiperOrigin-RevId: 270833113
Change-Id: Ie8b2ab2486b7ca224f37d5fc3a07674d15e1b458
 2019-09-23 22:24:27 -07:00
Sandboxed API Team
b390354794 internal BUILD file cleanup 
PiperOrigin-RevId: 270833110
Change-Id: Ifc075bd59cf9e25d0c4ecc165592906f05875ee8
 2019-09-23 22:23:57 -07:00
Sandboxed API Team
cee4ac35ae Internal BUILD file cleanup 
PiperOrigin-RevId: 270672739
Change-Id: I752113fc1fa5fa3f1585b918c89ca68c058db098
 2019-09-23 07:33:08 -07:00
Sandboxed API Team
a6285716f1 Internal cleanup 
PiperOrigin-RevId: 270653397
Change-Id: I495a30cffdfa932da045ebed626bf97f1cb68bb2
 2019-09-23 05:14:00 -07:00
Sandboxed API Team
ad2521a1e8 Internal cleanup 
PiperOrigin-RevId: 270631972
Change-Id: Ifd8db261bd5380fd14357a283fb9fd67c7d25fa0
 2019-09-23 02:31:54 -07:00
Wiktor Garbacz
d43d09c746 fail soft if sandboxee exits before init is ptraced 
PiperOrigin-RevId: 270254470
Change-Id: Ifa13f4fe0e7ae91b79fc689e1d7dcb2a49b09cde
 2019-09-20 06:13:44 -07:00
Sandboxed API Team
0aec7a511b Don't try to parse "[vsyscall]" as an ELF image. 
PiperOrigin-RevId: 269811752
Change-Id: I2118badab9b5392eae7bfd36583384a33ab8a7d5
 2019-09-18 08:32:11 -07:00
Wiktor Garbacz
846717def1 Fix coverage for network and network_proxy tests 
PiperOrigin-RevId: 269314101
Change-Id: I65f15261a22f8f5b6250396e41d76ef40a90ef94
 2019-09-16 05:43:06 -07:00
Christian Blichmann
0aa7183502 Refactor the tests and strings example a bit 
PiperOrigin-RevId: 268865491
Change-Id: Ie16e5f17e2eb22e25821c34edf0068cb81bcc2fe
 2019-09-13 02:28:42 -07:00
Wiktor Garbacz
d6ca9d9564 Use proper return code for static_sandbox example 
Also bump FSIZE limit to make it less likely to fail.

PiperOrigin-RevId: 268857718
Change-Id: I955ed4a10d8a49585ae330ab668a0bd891bb6ed6
 2019-09-13 01:22:36 -07:00
Wiktor Garbacz
2e22b13b39 Enable namespaces by default 
PiperOrigin-RevId: 268417712
Change-Id: I496d76e8a90665627b9be2bb5f9872a5df1c84e4
 2019-09-11 02:39:49 -07:00
Christian Blichmann
4034f1235e Revert accidental deletion of the sandbox image 
PiperOrigin-RevId: 267141212
Change-Id: I1aa0edf6f3ebeb19975fdead241e91927e7679f7
 2019-09-04 06:33:29 -07:00
Christian Blichmann
ea1a934d51 Migrate Sandboxed API docs to developer.google.com/sandboxed-api 
This change removes the in-tree documentation in favor of the one hosted on
the Google's Developer site. This makes it easier to maintain for the
sandbox team, as there is now only a single source of truth for both internal
and external documentation.

If you find errors/bugs in the documentation, please file regular GitHub
issues.

PiperOrigin-RevId: 267132623
Change-Id: I4c950fcef77da0b361cb35b99aa2f187efe6f320
 2019-09-04 05:22:03 -07:00
Wiktor Garbacz
daa3defac0 Internal change 
PiperOrigin-RevId: 266889781
Change-Id: Ibea87a7bb5fafb50ae3d09f7b0df876beecaf087
 2019-09-04 05:21:47 -07:00
Wiktor Garbacz
da3c6c138e Fail in monitor if init process pid not received 
PiperOrigin-RevId: 266886637
Change-Id: I4e896ebda8d9e15d0aefcb4139c8dc07ab938502
 2019-09-03 02:37:09 -07:00
Sandboxed API Team
84702e6c97 No public change. 
PiperOrigin-RevId: 265663675
Change-Id: I6ffcf796a13cddaea4f8b8a0ca20b92cc8e316a7
 2019-08-27 05:36:35 -07:00
Christian Blichmann
2dd7d27952 Fix unused variable warning in monitor 
PiperOrigin-RevId: 265439933
Change-Id: Idc62e0e1640bd2b866bd1a6f3c60370ae1b70592
 2019-08-26 06:03:03 -07:00
Christian Blichmann
276b7efc92 Internal change. 
PiperOrigin-RevId: 265057217
Change-Id: Id00c867b373dbe8c9112c23ef4b0300ed3ca9e5b
 2019-08-23 08:08:51 -07:00
Christian Blichmann
d91879f752 Ensure compatibility with CMake 3.10 
This fixes some CMake-3.12+-isms, like `list(JOIN ...)` and setting link
properties on OBJECT libraries.

PiperOrigin-RevId: 265033725
Change-Id: I0ee1ec0e1b1097ea8226ad6fdeff794a97c2881b
 2019-08-23 05:08:55 -07:00
Christian Blichmann
c966f21109 Improve handling of protobuf dependency 
PiperOrigin-RevId: 264631771
Change-Id: I341fd31ee7acd3f7748b1f0cada5fcd9d27341a7
 2019-08-21 10:01:12 -07:00
Christian Blichmann
df83f19d49 Fix broken include in client.cc 
PiperOrigin-RevId: 261864188
Change-Id: I247455085764373d9a004d85fbfe37cadf7ed6eb
 2019-08-06 01:36:12 -07:00
Sandboxed API Team
35d9d0c60a Internal change. 
PiperOrigin-RevId: 261197411
Change-Id: Ic3c388af3f807bc039ad137267e17dc9fc666c84
 2019-08-01 14:26:07 -07:00
Christian Blichmann
0c64532a8c Validate Unix-only compiler flags in CMake build 
PiperOrigin-RevId: 260706238
Change-Id: I2206f4d724a93de8714aeef521c544b660101d17
 2019-07-30 06:51:38 -07:00
Christian Blichmann
b7cbc36071 Follow-up to 3c51348 fixing linker issues with gflags and glog 
The temporary solution for binaries/tests that fully statically linked is to
link against `gflags` using `-Wl,--whole-archive`. This will no longer be
necessary, once Abseil ships with logging. Then we can (finally) use Abseil
flags and use a logging library that does not depend on a different flags
library.

PiperOrigin-RevId: 260705702
Change-Id: I8562faaff59f9c3e0e1d331186d2806d387438fb
 2019-07-30 06:48:38 -07:00
Christian Blichmann
1be24d945c Improve formatting of the generated code 
PiperOrigin-RevId: 260142999
Change-Id: Id170e212012c7e10e3525d031d620a01f90fb388
 2019-07-26 07:47:02 -07:00