sandbox/linux/BUILD.gn

   1 # Copyright 2014 The Chromium Authors. All rights reserved.
   2 # Use of this source code is governed by a BSD-style license that can be
   3 # found in the LICENSE file.
   4
   5 import("//build/config/features.gni")
   6 import("//testing/test.gni")
   7
   8 declare_args() {
   9   compile_suid_client = is_linux
  10
  11   compile_credentials = is_linux
  12
  13   compile_seccomp_bpf_demo =
  14       is_linux && (cpu_arch == "x86" || cpu_arch == "x64")
  15 }
  16
  17 # We have two principal targets: sandbox and sandbox_linux_unittests
  18 # All other targets are listed as dependencies.
  19 # There is one notable exception: for historical reasons, chrome_sandbox is
  20 # the setuid sandbox and is its own target.
  21
  22 group("sandbox") {
  23   deps = [
  24     ":sandbox_services",
  25   ]
  26
  27   if (compile_suid_client) {
  28     deps += [ ":suid_sandbox_client" ]
  29   }
  30   if (use_seccomp_bpf) {
  31     deps += [
  32       ":seccomp_bpf",
  33       ":seccomp_bpf_helpers",
  34     ]
  35   }
  36 }
  37
  38 source_set("sandbox_linux_test_utils") {
  39   testonly = true
  40   sources = [
  41     "tests/sandbox_test_runner.cc",
  42     "tests/sandbox_test_runner.h",
  43     "tests/sandbox_test_runner_function_pointer.cc",
  44     "tests/sandbox_test_runner_function_pointer.h",
  45     "tests/test_utils.cc",
  46     "tests/test_utils.h",
  47     "tests/unit_tests.cc",
  48     "tests/unit_tests.h",
  49   ]
  50
  51   deps = [
  52     "//testing/gtest",
  53   ]
  54
  55   if (use_seccomp_bpf) {
  56     sources += [
  57       "seccomp-bpf/bpf_tester_compatibility_delegate.h",
  58       "seccomp-bpf/bpf_tests.h",
  59       "seccomp-bpf/sandbox_bpf_test_runner.cc",
  60       "seccomp-bpf/sandbox_bpf_test_runner.h",
  61     ]
  62     deps += [ ":seccomp_bpf" ]
  63   }
  64 }
  65
  66 # The main sandboxing test target.
  67 test("sandbox_linux_unittests") {
  68   sources = [
  69     "services/proc_util_unittest.cc",
  70     "services/resource_limits_unittests.cc",
  71     "services/scoped_process_unittest.cc",
  72     "services/syscall_wrappers_unittest.cc",
  73     "services/thread_helpers_unittests.cc",
  74     "services/yama_unittests.cc",
  75     "syscall_broker/broker_file_permission_unittest.cc",
  76     "syscall_broker/broker_process_unittest.cc",
  77     "tests/main.cc",
  78     "tests/scoped_temporary_file.cc",
  79     "tests/scoped_temporary_file.h",
  80     "tests/scoped_temporary_file_unittest.cc",
  81     "tests/test_utils_unittest.cc",
  82     "tests/unit_tests_unittest.cc",
  83   ]
  84
  85   deps = [
  86     ":sandbox",
  87     ":sandbox_linux_test_utils",
  88     "//base",
  89     "//base/test:test_support",
  90     "//testing/gtest",
  91   ]
  92
  93   if (is_linux) {
  94     # Don't use this on Android.
  95     libs = [ "rt" ]
  96   }
  97
  98   if (compile_suid_client) {
  99     sources += [
 100       "suid/client/setuid_sandbox_client_unittest.cc",
 101       "suid/client/setuid_sandbox_host_unittest.cc",
 102     ]
 103   }
 104   if (use_seccomp_bpf) {
 105     sources += [
 106       "bpf_dsl/bpf_dsl_unittest.cc",
 107       "bpf_dsl/codegen_unittest.cc",
 108       "bpf_dsl/cons_unittest.cc",
 109       "bpf_dsl/syscall_set_unittest.cc",
 110       "integration_tests/bpf_dsl_seccomp_unittest.cc",
 111       "integration_tests/seccomp_broker_process_unittest.cc",
 112       "seccomp-bpf-helpers/baseline_policy_unittest.cc",
 113       "seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc",
 114       "seccomp-bpf/bpf_tests_unittest.cc",
 115       "seccomp-bpf/errorcode_unittest.cc",
 116       "seccomp-bpf/sandbox_bpf_unittest.cc",
 117       "seccomp-bpf/syscall_unittest.cc",
 118     ]
 119   }
 120   if (compile_credentials) {
 121     sources += [
 122       "integration_tests/namespace_unix_domain_socket_unittest.cc",
 123       "services/credentials_unittest.cc",
 124       "services/namespace_sandbox_unittest.cc",
 125       "services/namespace_utils_unittest.cc",
 126     ]
 127   }
 128 }
 129
 130 # TODO(GYP) Android version of this test.
 131 #    {
 132 #      # This target is the shared library used by Android APK (i.e.
 133 #      # JNI-friendly) tests.
 134 #      "target_name": "sandbox_linux_jni_unittests",
 135 #      "includes": [
 136 #        "sandbox_linux_test_sources.gypi",
 137 #      ],
 138 #      "type": "shared_library",
 139 #      "conditions": [
 140 #        [ "OS == "android"", {
 141 #          "dependencies": [
 142 #            "../testing/android/native_test.gyp:native_test_native_code",
 143 #          ],
 144 #        }],
 145 #      ],
 146 #    },
 147
 148 component("seccomp_bpf") {
 149   sources = [
 150     "bpf_dsl/bpf_dsl.cc",
 151     "bpf_dsl/bpf_dsl.h",
 152     "bpf_dsl/bpf_dsl_forward.h",
 153     "bpf_dsl/bpf_dsl_impl.h",
 154     "bpf_dsl/codegen.cc",
 155     "bpf_dsl/codegen.h",
 156     "bpf_dsl/cons.h",
 157     "bpf_dsl/dump_bpf.cc",
 158     "bpf_dsl/dump_bpf.h",
 159     "bpf_dsl/linux_syscall_ranges.h",
 160     "bpf_dsl/policy.cc",
 161     "bpf_dsl/policy.h",
 162     "bpf_dsl/policy_compiler.cc",
 163     "bpf_dsl/policy_compiler.h",
 164     "bpf_dsl/seccomp_macros.h",
 165     "bpf_dsl/syscall_set.cc",
 166     "bpf_dsl/syscall_set.h",
 167     "bpf_dsl/trap_registry.h",
 168     "seccomp-bpf/die.cc",
 169     "seccomp-bpf/die.h",
 170     "seccomp-bpf/errorcode.cc",
 171     "seccomp-bpf/errorcode.h",
 172     "seccomp-bpf/sandbox_bpf.cc",
 173     "seccomp-bpf/sandbox_bpf.h",
 174     "seccomp-bpf/syscall.cc",
 175     "seccomp-bpf/syscall.h",
 176     "seccomp-bpf/trap.cc",
 177     "seccomp-bpf/trap.h",
 178     "seccomp-bpf/verifier.cc",
 179     "seccomp-bpf/verifier.h",
 180   ]
 181   defines = [ "SANDBOX_IMPLEMENTATION" ]
 182
 183   deps = [
 184     ":sandbox_services",
 185     ":sandbox_services_headers",
 186     "//base",
 187   ]
 188 }
 189
 190 component("seccomp_bpf_helpers") {
 191   sources = [
 192     "seccomp-bpf-helpers/baseline_policy.cc",
 193     "seccomp-bpf-helpers/baseline_policy.h",
 194     "seccomp-bpf-helpers/sigsys_handlers.cc",
 195     "seccomp-bpf-helpers/sigsys_handlers.h",
 196     "seccomp-bpf-helpers/syscall_parameters_restrictions.cc",
 197     "seccomp-bpf-helpers/syscall_parameters_restrictions.h",
 198     "seccomp-bpf-helpers/syscall_sets.cc",
 199     "seccomp-bpf-helpers/syscall_sets.h",
 200   ]
 201   defines = [ "SANDBOX_IMPLEMENTATION" ]
 202
 203   deps = [
 204     "//base",
 205     ":sandbox_services",
 206     ":seccomp_bpf",
 207   ]
 208 }
 209
 210 if (is_linux) {
 211   # The setuid sandbox for Linux.
 212   executable("chrome_sandbox") {
 213     sources = [
 214       "suid/common/sandbox.h",
 215       "suid/common/suid_unsafe_environment_variables.h",
 216       "suid/process_util.h",
 217       "suid/process_util_linux.c",
 218       "suid/sandbox.c",
 219     ]
 220
 221     cflags = [
 222       # For ULLONG_MAX
 223       "-std=gnu99",
 224
 225       # These files have a suspicious comparison.
 226       # TODO fix this and re-enable this warning.
 227       "-Wno-sign-compare",
 228     ]
 229   }
 230 }
 231
 232 component("sandbox_services") {
 233   sources = [
 234     "services/init_process_reaper.cc",
 235     "services/init_process_reaper.h",
 236     "services/proc_util.cc",
 237     "services/proc_util.h",
 238     "services/resource_limits.cc",
 239     "services/resource_limits.h",
 240     "services/scoped_process.cc",
 241     "services/scoped_process.h",
 242     "services/syscall_wrappers.cc",
 243     "services/syscall_wrappers.h",
 244     "services/thread_helpers.cc",
 245     "services/thread_helpers.h",
 246     "services/yama.cc",
 247     "services/yama.h",
 248     "syscall_broker/broker_channel.cc",
 249     "syscall_broker/broker_channel.h",
 250     "syscall_broker/broker_client.cc",
 251     "syscall_broker/broker_client.h",
 252     "syscall_broker/broker_common.h",
 253     "syscall_broker/broker_file_permission.cc",
 254     "syscall_broker/broker_file_permission.h",
 255     "syscall_broker/broker_host.cc",
 256     "syscall_broker/broker_host.h",
 257     "syscall_broker/broker_policy.cc",
 258     "syscall_broker/broker_policy.h",
 259     "syscall_broker/broker_process.cc",
 260     "syscall_broker/broker_process.h",
 261   ]
 262
 263   defines = [ "SANDBOX_IMPLEMENTATION" ]
 264
 265   if (compile_credentials) {
 266     sources += [
 267       "services/credentials.cc",
 268       "services/credentials.h",
 269       "services/namespace_sandbox.cc",
 270       "services/namespace_sandbox.h",
 271       "services/namespace_utils.cc",
 272       "services/namespace_utils.h",
 273     ]
 274
 275     # For capabilities.cc.
 276     configs += [ "//build/config/linux:libcap" ]
 277   }
 278
 279   deps = [
 280     "//base",
 281   ]
 282 }
 283
 284 source_set("sandbox_services_headers") {
 285   sources = [
 286     "system_headers/android_arm64_ucontext.h",
 287     "system_headers/android_arm_ucontext.h",
 288     "system_headers/android_futex.h",
 289     "system_headers/android_i386_ucontext.h",
 290     "system_headers/android_ucontext.h",
 291     "system_headers/arm64_linux_syscalls.h",
 292     "system_headers/arm_linux_syscalls.h",
 293     "system_headers/linux_seccomp.h",
 294     "system_headers/linux_syscalls.h",
 295     "system_headers/x86_32_linux_syscalls.h",
 296     "system_headers/x86_64_linux_syscalls.h",
 297   ]
 298 }
 299
 300 # We make this its own target so that it does not interfere with our tests.
 301 source_set("libc_urandom_override") {
 302   sources = [
 303     "services/libc_urandom_override.cc",
 304     "services/libc_urandom_override.h",
 305   ]
 306   deps = [
 307     "//base",
 308   ]
 309 }
 310
 311 if (compile_suid_client) {
 312   component("suid_sandbox_client") {
 313     sources = [
 314       "suid/common/sandbox.h",
 315       "suid/common/suid_unsafe_environment_variables.h",
 316       "suid/client/setuid_sandbox_client.cc",
 317       "suid/client/setuid_sandbox_client.h",
 318       "suid/client/setuid_sandbox_host.cc",
 319       "suid/client/setuid_sandbox_host.h",
 320     ]
 321     defines = [ "SANDBOX_IMPLEMENTATION" ]
 322
 323     deps = [
 324       ":sandbox_services",
 325       "//base",
 326     ]
 327   }
 328 }
 329
 330 if (is_android) {
 331   # TODO(GYP) enable this. Needs an android_strip wrapper python script.
 332   #action("sandbox_linux_unittests_stripped") {
 333   #  script = "android_stip.py"
 334   #
 335   #  in_file = "$root_out_dir/sandbox_linux_unittests"
 336   #
 337   #  out_file = "$root_out_dir/sandbox_linux_unittests_stripped"
 338   #  outputs = [ out_file ]
 339   #
 340   #  args = [
 341   #    rebase_path(in_file, root_build_dir),
 342   #    "-o", rebase_path(out_file, root_build_dir),
 343   #  ]
 344   #
 345   #  deps = [
 346   #    ":sandbox_linux_unittests",
 347   #  ]
 348   #}
 349   # TODO(GYP) convert this.
 350   #      {
 351   #      'target_name': 'sandbox_linux_jni_unittests_apk',
 352   #      'type': 'none',
 353   #      'variables': {
 354   #        'test_suite_name': 'sandbox_linux_jni_unittests',
 355   #      },
 356   #      'dependencies': [
 357   #        'sandbox_linux_jni_unittests',
 358   #      ],
 359   #      'includes': [ '../../build/apk_test.gypi' ],
 360   #      }
 361 }