sandboxed-api/oss-internship-2020/guetzli
Sandboxed API Team ea379ef4d6 Cleans up statusor.h includes.
PiperOrigin-RevId: 339050213
Change-Id: Iea5747f907b294503cdb37e1c25cf787c7e83dcf
2020-10-26 09:08:41 -07:00
..
external Changed README, Bazel deps and different parts of code according to the review 2020-08-31 02:19:00 -07:00
testdata Moved tests to root folder, removed unused headers 2020-09-13 18:20:10 +03:00
.bazelrc First version of guetzli sandbox 2020-08-11 15:48:48 -07:00
BUILD.bazel Migrate guetzli to absl::StatusOr<> 2020-09-25 07:43:34 -07:00
guetzli_entry_points.cc Migrate guetzli to absl::StatusOr<> 2020-09-25 07:43:34 -07:00
guetzli_entry_points.h Merge pull request #49 from bohdanty:master 2020-09-17 08:36:07 -07:00
guetzli_sandbox.h Merge pull request #49 from bohdanty:master 2020-09-17 08:36:07 -07:00
guetzli_sandboxed.cc Migrate guetzli to absl::StatusOr<> 2020-09-25 07:43:34 -07:00
guetzli_sapi_test.cc Cleans up statusor.h includes. 2020-10-26 09:08:41 -07:00
guetzli_transaction_test.cc Merge pull request #49 from bohdanty:master 2020-09-17 08:36:07 -07:00
guetzli_transaction.cc Cleans up statusor.h includes. 2020-10-26 09:08:41 -07:00
guetzli_transaction.h Cleans up statusor.h includes. 2020-10-26 09:08:41 -07:00
README.md Changed README, Bazel deps and different parts of code according to the review 2020-08-31 02:19:00 -07:00
WORKSPACE.bazel Migrate guetzli to absl::StatusOr<> 2020-09-25 07:43:34 -07:00

Guetzli Sandbox

This is an example implementation of a sandbox for the Guetzli library using Sandboxed API. Please read Guetzli's documentation to learn more about it.

Implementation details

Because Guetzli provides a C++ API and SAPI requires functions to be extern "C", a wrapper library has been written for the compatibility. SAPI provides a Transaction class, which is a convenient way to create a wrapper for your sandboxed API that handles internal errors. The original Guetzli has a command-line utility to encode images, so a fully compatible utility that uses sandboxed Guetzli is provided.

The wrapper around Guetzli uses file descriptors to pass data to the sandbox. This approach restricts the sandbox from using the open() syscall and also helps to prevent making copies of data, because you need to synchronize it between processes.

Build Guetzli Sandboxed

Right now Sandboxed API support only Linux systems, so you need one to build it. Guetzli sandboxed uses Bazel as a build system so you need to install it before building.

To build Guetzli sandboxed encoding utility you can use this command: bazel build //:guetzli_sandboxed

Then you can use it in this way:

guetzli_sandboxed [--quality Q] [--verbose] original.png output.jpg
guetzli_sandboxed [--quality Q] [--verbose] original.jpg output.jpg

Refer to Guetzli's documentation to read more about usage.

Examples

There are two different sets of unit tests which demonstrate how to use different parts of Guetzli sandboxed:

  • tests/guetzli_sapi_test.cc - example usage of Guetzli sandboxed API.
  • tests/guetzli_transaction_test.cc - example usage of Guetzli transaction.

To run tests use the following command: bazel test ...

Also, there is an example of custom security policy for your sandbox in guetzli_sandbox.h