sandboxed-api/sandboxed_api/examples/stringop/BUILD.bazel
Christian Blichmann befdb09597 Link more complex test cases dynamically
Linking glibc in fully static mode is mostly unsupported. While such binaries
can easily be produced, conflicting symbols will often make them crash at
runtime. This happens because glibc will always (try to) load some dynamically
linked libraries, even when statically linked. This includes things like the
resolver, unicode/locale handling and others.

Internally at Google, this is not a concern due to the way glibc is being built
there. But in order to make all of our tests run in the open-source version of
this code, we need to change strategy a bit.

As a rule of thumb, glibc can safely be linked statically if a program is
resonably simple and does not use any networking of locale dependent
facilities. Calling syscalls directly instead of the corresponding libc
wrappers works as well, of course.

This change adjusts linker flags and sandbox policies to be more compatible
with regular Linux distributions.

Tested:
- `ctest -R '[A-Z].*'` (all SAPI/Sandbox2 tests)
PiperOrigin-RevId: 429025901
Change-Id: I46b677d9eb61080a8fe868002a34a77de287bf2d
2022-02-16 05:59:13 -08:00

84 lines
2.3 KiB
Python

# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Description: Example using dynamic length structures for Sandboxed API
load("//sandboxed_api/bazel:build_defs.bzl", "sapi_platform_copts")
load("//sandboxed_api/bazel:proto.bzl", "sapi_proto_library")
load("//sandboxed_api/bazel:sapi.bzl", "sapi_library")
licenses(["notice"])
sapi_proto_library(
name = "stringop_params_proto",
srcs = ["stringop_params.proto"],
visibility = ["//visibility:public"],
alwayslink = True,
)
cc_library(
name = "stringop",
srcs = ["stringop.cc"],
copts = sapi_platform_copts(),
linkstatic = True,
visibility = ["//visibility:public"],
deps = [
":stringop_params_cc_proto",
"//sandboxed_api:lenval_core",
"@com_google_absl//absl/base:core_headers",
],
alwayslink = True,
)
sapi_library(
name = "stringop-sapi",
srcs = [],
hdrs = ["sandbox.h"],
functions = [
"duplicate_string",
"reverse_string",
"pb_duplicate_string",
"pb_reverse_string",
"nop",
"violate",
"get_raw_c_string",
],
input_files = ["stringop.cc"],
lib = ":stringop",
lib_name = "Stringop",
namespace = "",
visibility = ["//visibility:public"],
deps = [":stringop_params_cc_proto"],
)
cc_test(
name = "main_stringop",
srcs = ["main_stringop.cc"],
copts = sapi_platform_copts(),
tags = ["local"],
deps = [
":stringop-sapi",
":stringop_params_cc_proto",
"//sandboxed_api:sapi",
"//sandboxed_api:vars",
"//sandboxed_api/util:flags",
"//sandboxed_api/util:status",
"//sandboxed_api/util:status_matchers",
"@com_google_absl//absl/memory",
"@com_google_absl//absl/status",
"@com_google_absl//absl/time",
"@com_google_googletest//:gtest_main",
],
)