sandbox/linux/BUILD.gn

   1 # Copyright 2014 The Chromium Authors. All rights reserved.
   2 # Use of this source code is governed by a BSD-style license that can be
   3 # found in the LICENSE file.
   4
   5 import("//build/config/features.gni")
   6 import("//testing/test.gni")
   7
   8 declare_args() {
   9   compile_suid_client = is_linux
  10
  11   compile_credentials = is_linux
  12
  13   # On Android, use plain GTest.
  14   use_base_test_suite = is_linux
  15 }
  16
  17 # We have two principal targets: sandbox and sandbox_linux_unittests
  18 # All other targets are listed as dependencies.
  19 # There is one notable exception: for historical reasons, chrome_sandbox is
  20 # the setuid sandbox and is its own target.
  21
  22 group("sandbox") {
  23   deps = [
  24     ":sandbox_services",
  25   ]
  26
  27   if (compile_suid_client) {
  28     deps += [ ":suid_sandbox_client" ]
  29   }
  30   if (use_seccomp_bpf) {
  31     deps += [
  32       ":seccomp_bpf",
  33       ":seccomp_bpf_helpers",
  34     ]
  35   }
  36 }
  37
  38 source_set("sandbox_linux_test_utils") {
  39   testonly = true
  40   sources = [
  41     "tests/sandbox_test_runner.cc",
  42     "tests/sandbox_test_runner.h",
  43     "tests/sandbox_test_runner_function_pointer.cc",
  44     "tests/sandbox_test_runner_function_pointer.h",
  45     "tests/test_utils.cc",
  46     "tests/test_utils.h",
  47     "tests/unit_tests.cc",
  48     "tests/unit_tests.h",
  49   ]
  50
  51   deps = [
  52     "//testing/gtest",
  53   ]
  54
  55   if (use_seccomp_bpf) {
  56     sources += [
  57       "seccomp-bpf/bpf_tester_compatibility_delegate.h",
  58       "seccomp-bpf/bpf_tests.h",
  59       "seccomp-bpf/sandbox_bpf_test_runner.cc",
  60       "seccomp-bpf/sandbox_bpf_test_runner.h",
  61     ]
  62     deps += [ ":seccomp_bpf" ]
  63   }
  64
  65   if (use_base_test_suite) {
  66     deps += [ "//base/test:test_support" ]
  67     defines = [ "SANDBOX_USES_BASE_TEST_SUITE" ]
  68   }
  69 }
  70
  71 # Sources shared by sandbox_linux_unittests and sandbox_linux_jni_unittests.
  72 source_set("sandbox_linux_unittests_sources") {
  73   testonly = true
  74
  75   sources = [
  76     "services/proc_util_unittest.cc",
  77     "services/resource_limits_unittests.cc",
  78     "services/scoped_process_unittest.cc",
  79     "services/syscall_wrappers_unittest.cc",
  80     "services/thread_helpers_unittests.cc",
  81     "services/yama_unittests.cc",
  82     "syscall_broker/broker_file_permission_unittest.cc",
  83     "syscall_broker/broker_process_unittest.cc",
  84     "tests/main.cc",
  85     "tests/scoped_temporary_file.cc",
  86     "tests/scoped_temporary_file.h",
  87     "tests/scoped_temporary_file_unittest.cc",
  88     "tests/test_utils_unittest.cc",
  89     "tests/unit_tests_unittest.cc",
  90   ]
  91
  92   deps = [
  93     ":sandbox",
  94     ":sandbox_linux_test_utils",
  95     "//base",
  96     "//testing/gtest",
  97   ]
  98
  99   if (use_base_test_suite) {
 100     deps += [ "//base/test:test_support" ]
 101     defines = [ "SANDBOX_USES_BASE_TEST_SUITE" ]
 102   }
 103
 104   if (is_linux) {
 105     # Don't use this on Android.
 106     libs = [ "rt" ]
 107   }
 108
 109   if (compile_suid_client) {
 110     sources += [
 111       "suid/client/setuid_sandbox_client_unittest.cc",
 112       "suid/client/setuid_sandbox_host_unittest.cc",
 113     ]
 114   }
 115   if (use_seccomp_bpf) {
 116     sources += [
 117       "bpf_dsl/bpf_dsl_unittest.cc",
 118       "bpf_dsl/codegen_unittest.cc",
 119       "bpf_dsl/cons_unittest.cc",
 120       "bpf_dsl/dump_bpf.cc",
 121       "bpf_dsl/dump_bpf.h",
 122       "bpf_dsl/syscall_set_unittest.cc",
 123       "bpf_dsl/test_trap_registry.cc",
 124       "bpf_dsl/test_trap_registry.h",
 125       "bpf_dsl/test_trap_registry_unittest.cc",
 126       "bpf_dsl/verifier.cc",
 127       "bpf_dsl/verifier.h",
 128       "integration_tests/bpf_dsl_seccomp_unittest.cc",
 129       "integration_tests/seccomp_broker_process_unittest.cc",
 130       "seccomp-bpf-helpers/baseline_policy_unittest.cc",
 131       "seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc",
 132       "seccomp-bpf/bpf_tests_unittest.cc",
 133       "seccomp-bpf/sandbox_bpf_unittest.cc",
 134       "seccomp-bpf/syscall_unittest.cc",
 135       "seccomp-bpf/trap_unittest.cc",
 136     ]
 137     deps += [ ":bpf_dsl_golden" ]
 138   }
 139   if (compile_credentials) {
 140     sources += [
 141       "integration_tests/namespace_unix_domain_socket_unittest.cc",
 142       "services/credentials_unittest.cc",
 143       "services/namespace_utils_unittest.cc",
 144     ]
 145
 146     if (use_base_test_suite) {
 147       # Tests that use advanced features not available in stock GTest.
 148       sources += [ "services/namespace_sandbox_unittest.cc" ]
 149     }
 150
 151     # For credentials_unittest.cc
 152     configs += [ "//build/config/linux:libcap" ]
 153   }
 154 }
 155
 156 action("bpf_dsl_golden") {
 157   script = "bpf_dsl/golden/generate.py"
 158   inputs = [
 159     "bpf_dsl/golden/i386/ArgSizePolicy.txt",
 160     "bpf_dsl/golden/i386/BasicPolicy.txt",
 161     "bpf_dsl/golden/i386/ElseIfPolicy.txt",
 162     "bpf_dsl/golden/i386/MaskingPolicy.txt",
 163     "bpf_dsl/golden/i386/MoreBooleanLogicPolicy.txt",
 164     "bpf_dsl/golden/i386/NegativeConstantsPolicy.txt",
 165     "bpf_dsl/golden/i386/SwitchPolicy.txt",
 166     "bpf_dsl/golden/x86-64/ArgSizePolicy.txt",
 167     "bpf_dsl/golden/x86-64/BasicPolicy.txt",
 168     "bpf_dsl/golden/x86-64/BooleanLogicPolicy.txt",
 169     "bpf_dsl/golden/x86-64/ElseIfPolicy.txt",
 170     "bpf_dsl/golden/x86-64/MaskingPolicy.txt",
 171     "bpf_dsl/golden/x86-64/MoreBooleanLogicPolicy.txt",
 172     "bpf_dsl/golden/x86-64/NegativeConstantsPolicy.txt",
 173     "bpf_dsl/golden/x86-64/SwitchPolicy.txt",
 174   ]
 175   outputs = [
 176     "$target_gen_dir/bpf_dsl/golden/golden_files.h",
 177   ]
 178   args =
 179       rebase_path(outputs, root_build_dir) + rebase_path(inputs, root_build_dir)
 180 }
 181
 182 # TODO(GYP): Delete this after we've converted everything to GN.
 183 # The _run targets exist only for compatibility w/ GYP.
 184 group("sandbox_linux_unittests_run") {
 185   testonly = true
 186   deps = [
 187     ":sandbox_linux_unittests",
 188   ]
 189 }
 190
 191 # The main sandboxing test target.
 192 test("sandbox_linux_unittests") {
 193   deps = [
 194     ":sandbox_linux_unittests_sources",
 195   ]
 196 }
 197
 198 # This target is the shared library used by Android APK (i.e.
 199 # JNI-friendly) tests.
 200 shared_library("sandbox_linux_jni_unittests") {
 201   testonly = true
 202   deps = [
 203     ":sandbox_linux_unittests_sources",
 204     "//build/config/sanitizers:deps",
 205   ]
 206   if (is_android) {
 207     deps += [ "//testing/android/native_test:native_test_native_code" ]
 208   }
 209 }
 210
 211 component("seccomp_bpf") {
 212   sources = [
 213     "bpf_dsl/bpf_dsl.cc",
 214     "bpf_dsl/bpf_dsl.h",
 215     "bpf_dsl/bpf_dsl_forward.h",
 216     "bpf_dsl/bpf_dsl_impl.h",
 217     "bpf_dsl/codegen.cc",
 218     "bpf_dsl/codegen.h",
 219     "bpf_dsl/cons.h",
 220     "bpf_dsl/errorcode.h",
 221     "bpf_dsl/linux_syscall_ranges.h",
 222     "bpf_dsl/policy.cc",
 223     "bpf_dsl/policy.h",
 224     "bpf_dsl/policy_compiler.cc",
 225     "bpf_dsl/policy_compiler.h",
 226     "bpf_dsl/seccomp_macros.h",
 227     "bpf_dsl/syscall_set.cc",
 228     "bpf_dsl/syscall_set.h",
 229     "bpf_dsl/trap_registry.h",
 230     "seccomp-bpf/die.cc",
 231     "seccomp-bpf/die.h",
 232     "seccomp-bpf/sandbox_bpf.cc",
 233     "seccomp-bpf/sandbox_bpf.h",
 234     "seccomp-bpf/syscall.cc",
 235     "seccomp-bpf/syscall.h",
 236     "seccomp-bpf/trap.cc",
 237     "seccomp-bpf/trap.h",
 238   ]
 239   defines = [ "SANDBOX_IMPLEMENTATION" ]
 240
 241   deps = [
 242     ":sandbox_services",
 243     ":sandbox_services_headers",
 244     "//base",
 245   ]
 246 }
 247
 248 component("seccomp_bpf_helpers") {
 249   sources = [
 250     "seccomp-bpf-helpers/baseline_policy.cc",
 251     "seccomp-bpf-helpers/baseline_policy.h",
 252     "seccomp-bpf-helpers/sigsys_handlers.cc",
 253     "seccomp-bpf-helpers/sigsys_handlers.h",
 254     "seccomp-bpf-helpers/syscall_parameters_restrictions.cc",
 255     "seccomp-bpf-helpers/syscall_parameters_restrictions.h",
 256     "seccomp-bpf-helpers/syscall_sets.cc",
 257     "seccomp-bpf-helpers/syscall_sets.h",
 258   ]
 259   defines = [ "SANDBOX_IMPLEMENTATION" ]
 260
 261   deps = [
 262     "//base",
 263     ":sandbox_services",
 264     ":seccomp_bpf",
 265   ]
 266 }
 267
 268 if (is_linux) {
 269   # The setuid sandbox for Linux.
 270   executable("chrome_sandbox") {
 271     sources = [
 272       "suid/common/sandbox.h",
 273       "suid/common/suid_unsafe_environment_variables.h",
 274       "suid/process_util.h",
 275       "suid/process_util_linux.c",
 276       "suid/sandbox.c",
 277     ]
 278
 279     cflags = [
 280       # For ULLONG_MAX
 281       "-std=gnu99",
 282
 283       # These files have a suspicious comparison.
 284       # TODO fix this and re-enable this warning.
 285       "-Wno-sign-compare",
 286     ]
 287
 288     deps = [
 289       "//build/config/sanitizers:deps",
 290     ]
 291   }
 292 }
 293
 294 component("sandbox_services") {
 295   sources = [
 296     "services/init_process_reaper.cc",
 297     "services/init_process_reaper.h",
 298     "services/proc_util.cc",
 299     "services/proc_util.h",
 300     "services/resource_limits.cc",
 301     "services/resource_limits.h",
 302     "services/scoped_process.cc",
 303     "services/scoped_process.h",
 304     "services/syscall_wrappers.cc",
 305     "services/syscall_wrappers.h",
 306     "services/thread_helpers.cc",
 307     "services/thread_helpers.h",
 308     "services/yama.cc",
 309     "services/yama.h",
 310     "syscall_broker/broker_channel.cc",
 311     "syscall_broker/broker_channel.h",
 312     "syscall_broker/broker_client.cc",
 313     "syscall_broker/broker_client.h",
 314     "syscall_broker/broker_common.h",
 315     "syscall_broker/broker_file_permission.cc",
 316     "syscall_broker/broker_file_permission.h",
 317     "syscall_broker/broker_host.cc",
 318     "syscall_broker/broker_host.h",
 319     "syscall_broker/broker_policy.cc",
 320     "syscall_broker/broker_policy.h",
 321     "syscall_broker/broker_process.cc",
 322     "syscall_broker/broker_process.h",
 323   ]
 324
 325   defines = [ "SANDBOX_IMPLEMENTATION" ]
 326
 327   deps = [
 328     "//base",
 329   ]
 330
 331   if (compile_credentials) {
 332     sources += [
 333       "services/credentials.cc",
 334       "services/credentials.h",
 335       "services/namespace_sandbox.cc",
 336       "services/namespace_sandbox.h",
 337       "services/namespace_utils.cc",
 338       "services/namespace_utils.h",
 339     ]
 340
 341     deps += [ ":sandbox_services_headers" ]
 342   }
 343 }
 344
 345 source_set("sandbox_services_headers") {
 346   sources = [
 347     "system_headers/arm64_linux_syscalls.h",
 348     "system_headers/arm64_linux_ucontext.h",
 349     "system_headers/arm_linux_syscalls.h",
 350     "system_headers/arm_linux_ucontext.h",
 351     "system_headers/i386_linux_ucontext.h",
 352     "system_headers/linux_futex.h",
 353     "system_headers/linux_seccomp.h",
 354     "system_headers/linux_signal.h",
 355     "system_headers/linux_syscalls.h",
 356     "system_headers/linux_time.h",
 357     "system_headers/linux_ucontext.h",
 358     "system_headers/x86_32_linux_syscalls.h",
 359     "system_headers/x86_64_linux_syscalls.h",
 360   ]
 361 }
 362
 363 # We make this its own target so that it does not interfere with our tests.
 364 source_set("libc_urandom_override") {
 365   sources = [
 366     "services/libc_urandom_override.cc",
 367     "services/libc_urandom_override.h",
 368   ]
 369   deps = [
 370     "//base",
 371   ]
 372 }
 373
 374 if (compile_suid_client) {
 375   component("suid_sandbox_client") {
 376     sources = [
 377       "suid/client/setuid_sandbox_client.cc",
 378       "suid/client/setuid_sandbox_client.h",
 379       "suid/client/setuid_sandbox_host.cc",
 380       "suid/client/setuid_sandbox_host.h",
 381       "suid/common/sandbox.h",
 382       "suid/common/suid_unsafe_environment_variables.h",
 383     ]
 384     defines = [ "SANDBOX_IMPLEMENTATION" ]
 385
 386     deps = [
 387       ":sandbox_services",
 388       "//base",
 389     ]
 390   }
 391 }
 392
 393 if (is_android) {
 394   # TODO(GYP) enable this. Needs an android_strip wrapper python script.
 395   #action("sandbox_linux_unittests_stripped") {
 396   #  script = "android_stip.py"
 397   #
 398   #  in_file = "$root_out_dir/sandbox_linux_unittests"
 399   #
 400   #  out_file = "$root_out_dir/sandbox_linux_unittests_stripped"
 401   #  outputs = [ out_file ]
 402   #
 403   #  args = [
 404   #    rebase_path(in_file, root_build_dir),
 405   #    "-o", rebase_path(out_file, root_build_dir),
 406   #  ]
 407   #
 408   #  deps = [
 409   #    ":sandbox_linux_unittests",
 410   #  ]
 411   #}
 412   # TODO(GYP) convert this.
 413   #      {
 414   #      'target_name': 'sandbox_linux_jni_unittests_apk',
 415   #      'type': 'none',
 416   #      'variables': {
 417   #        'test_suite_name': 'sandbox_linux_jni_unittests',
 418   #      },
 419   #      'dependencies': [
 420   #        'sandbox_linux_jni_unittests',
 421   #      ],
 422   #      'includes': [ '../../build/apk_test.gypi' ],
 423   #      }
 424 }