1 # Copyright 2014 The Chromium Authors. All rights reserved.
2 # Use of this source code is governed by a BSD-style license that can be
3 # found in the LICENSE file.
5 import("//build/config/features.gni")
8 compile_suid_client = is_linux
10 compile_credentials = is_linux
12 compile_seccomp_bpf_demo =
13 (is_linux && (cpu_arch == "x86" || cpu_arch == "x64"))
16 # We have two principal targets: sandbox and sandbox_linux_unittests
17 # All other targets are listed as dependencies.
18 # There is one notable exception: for historical reasons, chrome_sandbox is
19 # the setuid sandbox and is its own target.
26 if (compile_suid_client) {
27 deps += [ ":suid_sandbox_client" ]
29 if (use_seccomp_bpf) {
32 ":seccomp_bpf_helpers",
37 source_set("sandbox_linux_test_utils") {
39 "tests/sandbox_test_runner.cc",
40 "tests/sandbox_test_runner.h",
41 "tests/sandbox_test_runner_function_pointer.cc",
42 "tests/sandbox_test_runner_function_pointer.h",
43 "tests/test_utils.cc",
45 "tests/unit_tests.cc",
53 if (use_seccomp_bpf) {
55 "seccomp-bpf/bpf_tester_compatibility_delegate.h",
56 "seccomp-bpf/bpf_tests.h",
57 "seccomp-bpf/sandbox_bpf_test_runner.cc",
58 "seccomp-bpf/sandbox_bpf_test_runner.h",
66 # The main sandboxing test target.
67 test("sandbox_linux_unittests") {
69 "services/broker_process_unittest.cc",
70 "services/scoped_process_unittest.cc",
71 "services/thread_helpers_unittests.cc",
72 "services/yama_unittests.cc",
74 "tests/scoped_temporary_file.cc",
75 "tests/scoped_temporary_file.h",
76 "tests/scoped_temporary_file_unittest.cc",
77 "tests/unit_tests_unittest.cc",
82 ":sandbox_linux_test_utils",
84 "//base/test:test_support",
88 if (compile_suid_client) {
90 "suid/client/setuid_sandbox_client_unittest.cc",
93 if (use_seccomp_bpf) {
95 "bpf_dsl/bpf_dsl_unittest.cc",
96 "bpf_dsl/cons_unittest.cc",
97 "seccomp-bpf-helpers/baseline_policy_unittest.cc",
98 "seccomp-bpf/bpf_tests_unittest.cc",
99 "seccomp-bpf/codegen_unittest.cc",
100 "seccomp-bpf/errorcode_unittest.cc",
101 "seccomp-bpf/sandbox_bpf_unittest.cc",
102 "seccomp-bpf/syscall_iterator_unittest.cc",
103 "seccomp-bpf/syscall_unittest.cc",
106 if (compile_credentials) {
108 "services/credentials_unittest.cc",
109 "services/unix_domain_socket_unittest.cc",
114 # TODO(GYP) Android version of this test.
116 # # This target is the shared library used by Android APK (i.e.
117 # # JNI-friendly) tests.
118 # "target_name": "sandbox_linux_jni_unittests",
120 # "sandbox_linux_test_sources.gypi",
122 # "type": "shared_library",
124 # [ "OS == "android"", {
126 # "../testing/android/native_test.gyp:native_test_native_code",
132 component("seccomp_bpf") {
134 "bpf_dsl/bpf_dsl.cc",
137 "seccomp-bpf/basicblock.cc",
138 "seccomp-bpf/basicblock.h",
139 "seccomp-bpf/codegen.cc",
140 "seccomp-bpf/codegen.h",
141 "seccomp-bpf/die.cc",
143 "seccomp-bpf/errorcode.cc",
144 "seccomp-bpf/errorcode.h",
145 "seccomp-bpf/instruction.h",
146 "seccomp-bpf/linux_seccomp.h",
147 "seccomp-bpf/sandbox_bpf.cc",
148 "seccomp-bpf/sandbox_bpf.h",
149 "seccomp-bpf/sandbox_bpf_compatibility_policy.h",
150 "seccomp-bpf/sandbox_bpf_policy.cc",
151 "seccomp-bpf/sandbox_bpf_policy.h",
152 "seccomp-bpf/syscall.cc",
153 "seccomp-bpf/syscall.h",
154 "seccomp-bpf/syscall_iterator.cc",
155 "seccomp-bpf/syscall_iterator.h",
156 "seccomp-bpf/trap.cc",
157 "seccomp-bpf/trap.h",
158 "seccomp-bpf/verifier.cc",
159 "seccomp-bpf/verifier.h",
161 defines = [ "SANDBOX_IMPLEMENTATION" ]
164 ":sandbox_services_headers",
169 component("seccomp_bpf_helpers") {
171 "seccomp-bpf-helpers/baseline_policy.cc",
172 "seccomp-bpf-helpers/baseline_policy.h",
173 "seccomp-bpf-helpers/sigsys_handlers.cc",
174 "seccomp-bpf-helpers/sigsys_handlers.h",
175 "seccomp-bpf-helpers/syscall_parameters_restrictions.cc",
176 "seccomp-bpf-helpers/syscall_parameters_restrictions.h",
177 "seccomp-bpf-helpers/syscall_sets.cc",
178 "seccomp-bpf-helpers/syscall_sets.h",
180 defines = [ "SANDBOX_IMPLEMENTATION" ]
188 if (compile_seccomp_bpf_demo) {
189 # A demonstration program for the seccomp-bpf sandbox.
190 executable("seccomp_bpf_demo") {
192 "seccomp-bpf/demo.cc",
200 # The setuid sandbox for Linux.
201 executable("chrome_sandbox") {
203 "suid/common/sandbox.h",
204 "suid/common/suid_unsafe_environment_variables.h",
207 "suid/process_util.h",
208 "suid/process_util_linux.c",
215 # These files have a suspicious comparison.
216 # TODO fix this and re-enable this warning.
221 component("sandbox_services") {
223 "services/broker_process.cc",
224 "services/broker_process.h",
225 "services/init_process_reaper.cc",
226 "services/init_process_reaper.h",
227 "services/scoped_process.cc",
228 "services/scoped_process.h",
229 "services/thread_helpers.cc",
230 "services/thread_helpers.h",
235 defines = [ "SANDBOX_IMPLEMENTATION" ]
237 if (compile_credentials) {
239 "services/credentials.cc",
240 "services/credentials.h",
242 # For capabilities.cc.
243 configs += [ "//build/config/linux:libcap" ]
251 source_set("sandbox_services_headers") {
253 "services/android_arm_ucontext.h",
254 "services/android_arm64_ucontext.h",
255 "services/android_futex.h",
256 "services/android_ucontext.h",
257 "services/android_i386_ucontext.h",
258 "services/arm_linux_syscalls.h",
259 "services/arm64_linux_syscalls.h",
260 "services/linux_syscalls.h",
261 "services/x86_32_linux_syscalls.h",
262 "services/x86_64_linux_syscalls.h",
266 # We make this its own target so that it does not interfere with our tests.
267 source_set("libc_urandom_override") {
269 "services/libc_urandom_override.cc",
270 "services/libc_urandom_override.h",
277 component("suid_sandbox_client") {
279 "suid/common/sandbox.h",
280 "suid/common/suid_unsafe_environment_variables.h",
281 "suid/client/setuid_sandbox_client.cc",
282 "suid/client/setuid_sandbox_client.h",
284 defines = [ "SANDBOX_IMPLEMENTATION" ]
293 # TODO(GYP) enable this. Needs an android_strip wrapper python script.
294 #action("sandbox_linux_unittests_stripped") {
295 # script = "android_stip.py"
297 # in_file = "$root_out_dir/sandbox_linux_unittests"
299 # out_file = "$root_out_dir/sandbox_linux_unittests_stripped"
300 # outputs = [ out_file ]
303 # rebase_path(in_file, root_build_dir),
304 # "-o", rebase_path(out_file, root_build_dir),
308 # ":sandbox_linux_unittests",
312 # TODO(GYP) convert this.
314 # 'target_name': 'sandbox_linux_jni_unittests_apk',
317 # 'test_suite_name': 'sandbox_linux_jni_unittests',
320 # 'sandbox_linux_jni_unittests',
322 # 'includes': [ '../../build/apk_test.gypi' ],