| blob | e86345ee600a2e1f73f69e8bb093baf36a0ecfeb |
1 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 # Use of this source code is governed by a BSD-style license that can be
3 # found in the LICENSE file.
5 {
6 'variables': {
7 'conditions': [
8 ['OS=="linux"', {
9 'compile_suid_client': 1,
10 'compile_credentials': 1,
11 }, {
12 'compile_suid_client': 0,
13 'compile_credentials': 0,
14 }],
15 ['OS=="linux" and (target_arch=="ia32" or target_arch=="x64")', {
16 'compile_seccomp_bpf_demo': 1,
17 }, {
18 'compile_seccomp_bpf_demo': 0,
19 }],
20 ],
21 },
22 'target_defaults': {
23 'target_conditions': [
24 # All linux/ files will automatically be excluded on Android
25 # so make sure we re-include them explicitly.
26 ['OS == "android"', {
27 'sources/': [
28 ['include', '^linux/'],
29 ],
30 }],
31 ],
32 },
33 'targets': [
34 # We have two principal targets: sandbox and sandbox_linux_unittests
35 # All other targets are listed as dependencies.
36 # There is one notable exception: for historical reasons, chrome_sandbox is
37 # the setuid sandbox and is its own target.
38 {
39 'target_name': 'sandbox',
40 'type': 'none',
41 'dependencies': [
42 'sandbox_services',
43 ],
44 'conditions': [
45 [ 'compile_suid_client==1', {
46 'dependencies': [
47 'suid_sandbox_client',
48 ],
49 }],
50 # Compile seccomp BPF when we support it.
51 [ 'use_seccomp_bpf==1', {
52 'dependencies': [
53 'seccomp_bpf',
54 'seccomp_bpf_helpers',
55 ],
56 }],
57 ],
58 },
59 {
60 'target_name': 'sandbox_linux_test_utils',
61 'type': 'static_library',
62 'dependencies': [
63 '../testing/gtest.gyp:gtest',
64 ],
65 'include_dirs': [
66 '../..',
67 ],
68 'sources': [
69 'tests/sandbox_test_runner.h',
70 'tests/sandbox_test_runner_function_pointer.cc',
71 'tests/sandbox_test_runner_function_pointer.h',
72 'tests/test_utils.cc',
73 'tests/test_utils.h',
74 'tests/unit_tests.cc',
75 'tests/unit_tests.h',
76 ],
77 'conditions': [
78 [ 'use_seccomp_bpf==1', {
79 'sources': [
80 'seccomp-bpf/bpf_tester_compatibility_delegate.cc',
81 'seccomp-bpf/bpf_tester_compatibility_delegate.h',
82 'seccomp-bpf/bpf_tests.h',
83 'seccomp-bpf/sandbox_bpf_test_runner.cc',
84 'seccomp-bpf/sandbox_bpf_test_runner.h',
85 ],
86 'dependencies': [
87 'seccomp_bpf',
88 ]
89 }],
90 ],
91 },
92 {
93 # The main sandboxing test target.
94 'target_name': 'sandbox_linux_unittests',
95 'includes': [
96 'sandbox_linux_test_sources.gypi',
97 ],
98 'type': 'executable',
99 },
100 {
101 # This target is the shared library used by Android APK (i.e.
102 # JNI-friendly) tests.
103 'target_name': 'sandbox_linux_jni_unittests',
104 'includes': [
105 'sandbox_linux_test_sources.gypi',
106 ],
107 'type': 'shared_library',
108 'conditions': [
109 [ 'OS == "android" and gtest_target_type == "shared_library"', {
110 'dependencies': [
111 '../testing/android/native_test.gyp:native_test_native_code',
112 ],
113 }],
114 ],
115 },
116 {
117 'target_name': 'seccomp_bpf',
118 'type': '<(component)',
119 'sources': [
120 'seccomp-bpf/basicblock.cc',
121 'seccomp-bpf/basicblock.h',
122 'seccomp-bpf/codegen.cc',
123 'seccomp-bpf/codegen.h',
124 'seccomp-bpf/die.cc',
125 'seccomp-bpf/die.h',
126 'seccomp-bpf/errorcode.cc',
127 'seccomp-bpf/errorcode.h',
128 'seccomp-bpf/instruction.h',
129 'seccomp-bpf/linux_seccomp.h',
130 'seccomp-bpf/sandbox_bpf.cc',
131 'seccomp-bpf/sandbox_bpf.h',
132 'seccomp-bpf/sandbox_bpf_compatibility_policy.h',
133 'seccomp-bpf/sandbox_bpf_policy.h',
134 'seccomp-bpf/syscall.cc',
135 'seccomp-bpf/syscall.h',
136 'seccomp-bpf/syscall_iterator.cc',
137 'seccomp-bpf/syscall_iterator.h',
138 'seccomp-bpf/trap.cc',
139 'seccomp-bpf/trap.h',
140 'seccomp-bpf/verifier.cc',
141 'seccomp-bpf/verifier.h',
142 ],
143 'dependencies': [
144 '../base/base.gyp:base',
145 'sandbox_services_headers',
146 ],
147 'defines': [
148 'SANDBOX_IMPLEMENTATION',
149 ],
150 'include_dirs': [
151 '../..',
152 ],
153 },
154 {
155 'target_name': 'seccomp_bpf_helpers',
156 'type': '<(component)',
157 'sources': [
158 'seccomp-bpf-helpers/baseline_policy.cc',
159 'seccomp-bpf-helpers/baseline_policy.h',
160 'seccomp-bpf-helpers/sigsys_handlers.cc',
161 'seccomp-bpf-helpers/sigsys_handlers.h',
162 'seccomp-bpf-helpers/syscall_parameters_restrictions.cc',
163 'seccomp-bpf-helpers/syscall_parameters_restrictions.h',
164 'seccomp-bpf-helpers/syscall_sets.cc',
165 'seccomp-bpf-helpers/syscall_sets.h',
166 ],
167 'dependencies': [
168 '../base/base.gyp:base',
169 'seccomp_bpf',
170 ],
171 'defines': [
172 'SANDBOX_IMPLEMENTATION',
173 ],
174 'include_dirs': [
175 '../..',
176 ],
177 },
178 {
179 # A demonstration program for the seccomp-bpf sandbox.
180 'target_name': 'seccomp_bpf_demo',
181 'conditions': [
182 ['compile_seccomp_bpf_demo==1', {
183 'type': 'executable',
184 'sources': [
185 'seccomp-bpf/demo.cc',
186 ],
187 'dependencies': [
188 'seccomp_bpf',
189 ],
190 }, {
191 'type': 'none',
192 }],
193 ],
194 'include_dirs': [
195 '../../',
196 ],
197 },
198 {
199 # The setuid sandbox, for Linux
200 'target_name': 'chrome_sandbox',
201 'type': 'executable',
202 'sources': [
203 'suid/common/sandbox.h',
204 'suid/common/suid_unsafe_environment_variables.h',
205 'suid/linux_util.c',
206 'suid/linux_util.h',
207 'suid/process_util.h',
208 'suid/process_util_linux.c',
209 'suid/sandbox.c',
210 ],
211 'cflags': [
212 # For ULLONG_MAX
213 '-std=gnu99',
214 ],
215 'include_dirs': [
216 '../..',
217 ],
218 },
219 { 'target_name': 'sandbox_services',
220 'type': '<(component)',
221 'sources': [
222 'services/broker_process.cc',
223 'services/broker_process.h',
224 'services/init_process_reaper.cc',
225 'services/init_process_reaper.h',
226 'services/scoped_process.cc',
227 'services/scoped_process.h',
228 'services/thread_helpers.cc',
229 'services/thread_helpers.h',
230 'services/yama.h',
231 'services/yama.cc',
232 ],
233 'dependencies': [
234 '../base/base.gyp:base',
235 ],
236 'defines': [
237 'SANDBOX_IMPLEMENTATION',
238 ],
239 'conditions': [
240 ['compile_credentials==1', {
241 'sources': [
242 'services/credentials.cc',
243 'services/credentials.h',
244 ],
245 'dependencies': [
246 # for capabilities.cc.
247 '../build/linux/system.gyp:libcap',
248 ],
249 }],
250 ],
251 'include_dirs': [
252 '..',
253 ],
254 },
255 { 'target_name': 'sandbox_services_headers',
256 'type': 'none',
257 'sources': [
258 'services/android_arm_ucontext.h',
259 'services/android_ucontext.h',
260 'services/android_i386_ucontext.h',
261 'services/arm_linux_syscalls.h',
262 'services/linux_syscalls.h',
263 'services/x86_32_linux_syscalls.h',
264 'services/x86_64_linux_syscalls.h',
265 ],
266 'include_dirs': [
267 '..',
268 ],
269 },
270 {
271 # We make this its own target so that it does not interfere
272 # with our tests.
273 'target_name': 'libc_urandom_override',
274 'type': 'static_library',
275 'sources': [
276 'services/libc_urandom_override.cc',
277 'services/libc_urandom_override.h',
278 ],
279 'dependencies': [
280 '../base/base.gyp:base',
281 ],
282 'include_dirs': [
283 '..',
284 ],
285 },
286 {
287 'target_name': 'suid_sandbox_client',
288 'type': '<(component)',
289 'sources': [
290 'suid/common/sandbox.h',
291 'suid/common/suid_unsafe_environment_variables.h',
292 'suid/client/setuid_sandbox_client.cc',
293 'suid/client/setuid_sandbox_client.h',
294 ],
295 'defines': [
296 'SANDBOX_IMPLEMENTATION',
297 ],
298 'dependencies': [
299 '../base/base.gyp:base',
300 'sandbox_services',
301 ],
302 'include_dirs': [
303 '..',
304 ],
305 },
306 ],
307 'conditions': [
308 [ 'OS=="android"', {
309 'targets': [
310 {
311 'target_name': 'sandbox_linux_unittests_stripped',
312 'type': 'none',
313 'dependencies': [ 'sandbox_linux_unittests' ],
314 'actions': [{
315 'action_name': 'strip sandbox_linux_unittests',
316 'inputs': [ '<(PRODUCT_DIR)/sandbox_linux_unittests' ],
317 'outputs': [ '<(PRODUCT_DIR)/sandbox_linux_unittests_stripped' ],
318 'action': [ '<(android_strip)', '<@(_inputs)', '-o', '<@(_outputs)' ],
319 }],
320 }
321 ],
322 }],
323 # Strategy copied from base_unittests_apk in base/base.gyp.
324 [ 'OS=="android" and gtest_target_type == "shared_library"', {
325 'targets': [
326 {
327 'target_name': 'sandbox_linux_jni_unittests_apk',
328 'type': 'none',
329 'variables': {
330 'test_suite_name': 'sandbox_linux_jni_unittests',
331 },
332 'dependencies': [
333 'sandbox_linux_jni_unittests',
334 ],
335 'includes': [ '../../build/apk_test.gypi' ],
336 }
337 ],
338 }],
339 ],
340 }