This change moves away from a classical superbuild which downloads and builds
at build time. Instead, we now follow a "Fetch Content" workflow (available as
FetchContent in CMake 3.11+) and download dependencies at config time.
Rationale: Superbuild projects have the disadvantage that projects cannot
directly access their individual declared targets. This is not a problem with
regular libraries, as those are usually/supposed to be installed. With
Sandboxed API, this is not desirable, as it has dependencies like Abseil and
glog, which are almost always consumed by including their source tree using
add_subdirectory().
Fixes#10 and makes external embedding easier.
PiperOrigin-RevId: 260129870
Change-Id: I70f295f29a6e4fc8c330512c94b01ef10c017166
Sandbox2 is a C++ security sandbox for Linux which can be used to run untrusted
programs or portions of programs in confined environments. The idea is that the
runtime environment is so restricted that security bugs such as buffer overflows
in the protected region cause no harm.
Who is it for?
Sandbox2 is aimed to sandbox C/C++ code or whole binaries in production.
See the sandboxing options overview page to make
sure this is the type of sandboxing you are looking for.
How does it work?
Read our How it works page to learn everything about this
technology.
3c51348aaf