StarMirror
/
sandboxed-api
mirror of https://github.com/google/sandboxed-api
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
sandboxed-api/oss-internship-2020/guetzli
History
Christian Blichmann dbaf95c724 Move utility code into `sandboxed_api/util` 
This change should make it less confusing where utility code comes from.
Having it in two places made sense when we were debating whether to publish
Sandbox2 separately, but not any longer.

Follow-up changes will move `sandbox2/util.h` and rename the remaining
`sandbox2/util` folder.

PiperOrigin-RevId: 351601640
Change-Id: I6256845261f610e590c25e2c59851cc51da2d778
 		2021-01-13 09:25:52 -08:00
..
external Changed README, Bazel deps and different parts of code according to the review 2020-08-31 02:19:00 -07:00
testdata Moved tests to root folder, removed unused headers 2020-09-13 18:20:10 +03:00
.bazelrc First version of guetzli sandbox 2020-08-11 15:48:48 -07:00
BUILD.bazel Migrate guetzli to `absl::StatusOr<>` 2020-09-25 07:43:34 -07:00
README.md Changed README, Bazel deps and different parts of code according to the review 2020-08-31 02:19:00 -07:00
WORKSPACE.bazel Migrate guetzli to `absl::StatusOr<>` 2020-09-25 07:43:34 -07:00
guetzli_entry_points.cc Move utility code into `sandboxed_api/util` 2021-01-13 09:25:52 -08:00
guetzli_entry_points.h Merge pull request #49 from bohdanty:master 2020-09-17 08:36:07 -07:00
guetzli_sandbox.h Merge pull request #49 from bohdanty:master 2020-09-17 08:36:07 -07:00
guetzli_sandboxed.cc Move utility code into `sandboxed_api/util` 2021-01-13 09:25:52 -08:00
guetzli_sapi_test.cc Move utility code into `sandboxed_api/util` 2021-01-13 09:25:52 -08:00
guetzli_transaction.cc Cleans up statusor.h includes. 2020-10-26 09:08:41 -07:00
guetzli_transaction.h Cleans up statusor.h includes. 2020-10-26 09:08:41 -07:00
guetzli_transaction_test.cc Move utility code into `sandboxed_api/util` 2021-01-13 09:25:52 -08:00

README.md

Guetzli Sandbox

This is an example implementation of a sandbox for the Guetzli library using Sandboxed API. Please read Guetzli's documentation to learn more about it.

Implementation details

Because Guetzli provides a C++ API and SAPI requires functions to be extern "C", a wrapper library has been written for the compatibility. SAPI provides a Transaction class, which is a convenient way to create a wrapper for your sandboxed API that handles internal errors. The original Guetzli has a command-line utility to encode images, so a fully compatible utility that uses sandboxed Guetzli is provided.

The wrapper around Guetzli uses file descriptors to pass data to the sandbox. This approach restricts the sandbox from using the open() syscall and also helps to prevent making copies of data, because you need to synchronize it between processes.

Build Guetzli Sandboxed

Right now Sandboxed API support only Linux systems, so you need one to build it. Guetzli sandboxed uses Bazel as a build system so you need to install it before building.

To build Guetzli sandboxed encoding utility you can use this command: bazel build //:guetzli_sandboxed

Then you can use it in this way:

guetzli_sandboxed [--quality Q] [--verbose] original.png output.jpg
guetzli_sandboxed [--quality Q] [--verbose] original.jpg output.jpg

Refer to Guetzli's documentation to read more about usage.

Examples

There are two different sets of unit tests which demonstrate how to use different parts of Guetzli sandboxed:

  • tests/guetzli_sapi_test.cc - example usage of Guetzli sandboxed API.
  • tests/guetzli_transaction_test.cc - example usage of Guetzli transaction.

To run tests use the following command: bazel test ...

Also, there is an example of custom security policy for your sandbox in guetzli_sandbox.h