dbaf95c724
This change should make it less confusing where utility code comes from. Having it in two places made sense when we were debating whether to publish Sandbox2 separately, but not any longer. Follow-up changes will move `sandbox2/util.h` and rename the remaining `sandbox2/util` folder. PiperOrigin-RevId: 351601640 Change-Id: I6256845261f610e590c25e2c59851cc51da2d778 |
||
|---|---|---|
| .. | ||
| external | ||
| testdata | ||
| .bazelrc | ||
| BUILD.bazel | ||
| guetzli_entry_points.cc | ||
| guetzli_entry_points.h | ||
| guetzli_sandbox.h | ||
| guetzli_sandboxed.cc | ||
| guetzli_sapi_test.cc | ||
| guetzli_transaction_test.cc | ||
| guetzli_transaction.cc | ||
| guetzli_transaction.h | ||
| README.md | ||
| WORKSPACE.bazel | ||
Guetzli Sandbox
This is an example implementation of a sandbox for the Guetzli library using Sandboxed API. Please read Guetzli's documentation to learn more about it.
Implementation details
Because Guetzli provides a C++ API and SAPI requires functions to be extern "C", a wrapper library has been written for the compatibility. SAPI provides a Transaction class, which is a convenient way to create a wrapper for your sandboxed API that handles internal errors. The original Guetzli has a command-line utility to encode images, so a fully compatible utility that uses sandboxed Guetzli is provided.
The wrapper around Guetzli uses file descriptors to pass data to the sandbox. This approach restricts the sandbox from using the open() syscall and also helps to prevent making copies of data, because you need to synchronize it between processes.
Build Guetzli Sandboxed
Right now Sandboxed API support only Linux systems, so you need one to build it. Guetzli sandboxed uses Bazel as a build system so you need to install it before building.
To build Guetzli sandboxed encoding utility you can use this command:
bazel build //:guetzli_sandboxed
Then you can use it in this way:
guetzli_sandboxed [--quality Q] [--verbose] original.png output.jpg
guetzli_sandboxed [--quality Q] [--verbose] original.jpg output.jpg
Refer to Guetzli's documentation to read more about usage.
Examples
There are two different sets of unit tests which demonstrate how to use different parts of Guetzli sandboxed:
tests/guetzli_sapi_test.cc- example usage of Guetzli sandboxed API.tests/guetzli_transaction_test.cc- example usage of Guetzli transaction.
To run tests use the following command:
bazel test ...
Also, there is an example of custom security policy for your sandbox in
guetzli_sandbox.h