1*ec63e07aSXin Li# Copyright 2019 Google LLC 2*ec63e07aSXin Li# 3*ec63e07aSXin Li# Licensed under the Apache License, Version 2.0 (the "License"); 4*ec63e07aSXin Li# you may not use this file except in compliance with the License. 5*ec63e07aSXin Li# You may obtain a copy of the License at 6*ec63e07aSXin Li# 7*ec63e07aSXin Li# https://www.apache.org/licenses/LICENSE-2.0 8*ec63e07aSXin Li# 9*ec63e07aSXin Li# Unless required by applicable law or agreed to in writing, software 10*ec63e07aSXin Li# distributed under the License is distributed on an "AS IS" BASIS, 11*ec63e07aSXin Li# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12*ec63e07aSXin Li# See the License for the specific language governing permissions and 13*ec63e07aSXin Li# limitations under the License. 14*ec63e07aSXin Li 15*ec63e07aSXin Li# Description: test cases for sandbox2 unit tests. 16*ec63e07aSXin Li# 17*ec63e07aSXin Li# Some of the following cc_binary options avoid dynamic linking which uses a 18*ec63e07aSXin Li# lot of syscalls (open, mmap, etc.): 19*ec63e07aSXin Li# linkstatic = True Default for cc_binary 20*ec63e07aSXin Li# features = ["fully_static_link"] Adds -static 21*ec63e07aSXin Li# 22*ec63e07aSXin Li# Note that linking fully static with an unmodified glibc is not generally 23*ec63e07aSXin Li# considered safe, due to glibc relying heavily on loading shared objects at 24*ec63e07aSXin Li# runtime. 25*ec63e07aSXin Li# The rule of thumb when it is safe to do so is when the program either only 26*ec63e07aSXin Li# uses plain syscalls (bypassing any libc altogether) or if it does not use 27*ec63e07aSXin Li# any networking and none of the functionality from cstdio/stdio.h (due to 28*ec63e07aSXin Li# auto-loading of locale-specific shared objecs). 29*ec63e07aSXin Li 30*ec63e07aSXin Liload("//sandboxed_api/bazel:build_defs.bzl", "sapi_platform_copts") 31*ec63e07aSXin Li 32*ec63e07aSXin Lipackage(default_visibility = [ 33*ec63e07aSXin Li "//sandboxed_api/sandbox2:__subpackages__", 34*ec63e07aSXin Li]) 35*ec63e07aSXin Li 36*ec63e07aSXin Lilicenses(["notice"]) 37*ec63e07aSXin Li 38*ec63e07aSXin Licc_binary( 39*ec63e07aSXin Li name = "abort", 40*ec63e07aSXin Li testonly = True, 41*ec63e07aSXin Li srcs = ["abort.cc"], 42*ec63e07aSXin Li copts = sapi_platform_copts(), 43*ec63e07aSXin Li features = ["fully_static_link"], 44*ec63e07aSXin Li deps = ["//sandboxed_api/util:raw_logging"], 45*ec63e07aSXin Li) 46*ec63e07aSXin Li 47*ec63e07aSXin Licc_binary( 48*ec63e07aSXin Li name = "add_policy_on_syscalls", 49*ec63e07aSXin Li testonly = True, 50*ec63e07aSXin Li srcs = ["add_policy_on_syscalls.cc"], 51*ec63e07aSXin Li copts = sapi_platform_copts(), 52*ec63e07aSXin Li features = ["fully_static_link"], 53*ec63e07aSXin Li) 54*ec63e07aSXin Li 55*ec63e07aSXin Licc_binary( 56*ec63e07aSXin Li name = "buffer", 57*ec63e07aSXin Li testonly = True, 58*ec63e07aSXin Li srcs = ["buffer.cc"], 59*ec63e07aSXin Li copts = sapi_platform_copts(), 60*ec63e07aSXin Li features = ["fully_static_link"], 61*ec63e07aSXin Li deps = [ 62*ec63e07aSXin Li "//sandboxed_api/sandbox2:buffer", 63*ec63e07aSXin Li ], 64*ec63e07aSXin Li) 65*ec63e07aSXin Li 66*ec63e07aSXin Licc_binary( 67*ec63e07aSXin Li name = "ipc", 68*ec63e07aSXin Li testonly = True, 69*ec63e07aSXin Li srcs = ["ipc.cc"], 70*ec63e07aSXin Li copts = sapi_platform_copts(), 71*ec63e07aSXin Li features = ["fully_static_link"], 72*ec63e07aSXin Li deps = [ 73*ec63e07aSXin Li "//sandboxed_api/sandbox2:client", 74*ec63e07aSXin Li "//sandboxed_api/sandbox2:comms", 75*ec63e07aSXin Li "//sandboxed_api/util:raw_logging", 76*ec63e07aSXin Li "@com_google_absl//absl/strings", 77*ec63e07aSXin Li ], 78*ec63e07aSXin Li) 79*ec63e07aSXin Li 80*ec63e07aSXin Licc_binary( 81*ec63e07aSXin Li name = "malloc_system", 82*ec63e07aSXin Li testonly = True, 83*ec63e07aSXin Li srcs = ["malloc.cc"], 84*ec63e07aSXin Li copts = sapi_platform_copts(), 85*ec63e07aSXin Li features = ["fully_static_link"], 86*ec63e07aSXin Li) 87*ec63e07aSXin Li 88*ec63e07aSXin Licc_binary( 89*ec63e07aSXin Li name = "minimal_dynamic", 90*ec63e07aSXin Li testonly = True, 91*ec63e07aSXin Li srcs = ["minimal.cc"], 92*ec63e07aSXin Li copts = sapi_platform_copts(), 93*ec63e07aSXin Li) 94*ec63e07aSXin Li 95*ec63e07aSXin Licc_binary( 96*ec63e07aSXin Li name = "minimal", 97*ec63e07aSXin Li testonly = True, 98*ec63e07aSXin Li srcs = ["minimal.cc"], 99*ec63e07aSXin Li copts = sapi_platform_copts(), 100*ec63e07aSXin Li features = ["fully_static_link"], 101*ec63e07aSXin Li) 102*ec63e07aSXin Li 103*ec63e07aSXin Licc_binary( 104*ec63e07aSXin Li name = "personality", 105*ec63e07aSXin Li testonly = True, 106*ec63e07aSXin Li srcs = ["personality.cc"], 107*ec63e07aSXin Li copts = sapi_platform_copts(), 108*ec63e07aSXin Li features = ["fully_static_link"], 109*ec63e07aSXin Li) 110*ec63e07aSXin Li 111*ec63e07aSXin Licc_binary( 112*ec63e07aSXin Li name = "pidcomms", 113*ec63e07aSXin Li testonly = True, 114*ec63e07aSXin Li srcs = ["pidcomms.cc"], 115*ec63e07aSXin Li copts = sapi_platform_copts(), 116*ec63e07aSXin Li features = ["fully_static_link"], 117*ec63e07aSXin Li deps = [ 118*ec63e07aSXin Li "//sandboxed_api/sandbox2:client", 119*ec63e07aSXin Li "//sandboxed_api/sandbox2:comms", 120*ec63e07aSXin Li "//sandboxed_api/util:raw_logging", 121*ec63e07aSXin Li ], 122*ec63e07aSXin Li) 123*ec63e07aSXin Li 124*ec63e07aSXin Licc_binary( 125*ec63e07aSXin Li name = "policy", 126*ec63e07aSXin Li testonly = True, 127*ec63e07aSXin Li srcs = ["policy.cc"], 128*ec63e07aSXin Li copts = sapi_platform_copts(), 129*ec63e07aSXin Li features = ["fully_static_link"], 130*ec63e07aSXin Li deps = [ 131*ec63e07aSXin Li "//sandboxed_api:config", 132*ec63e07aSXin Li "@com_google_absl//absl/base:core_headers", 133*ec63e07aSXin Li ], 134*ec63e07aSXin Li) 135*ec63e07aSXin Li 136*ec63e07aSXin Licc_binary( 137*ec63e07aSXin Li name = "sanitizer", 138*ec63e07aSXin Li testonly = True, 139*ec63e07aSXin Li srcs = ["sanitizer.cc"], 140*ec63e07aSXin Li copts = sapi_platform_copts(), 141*ec63e07aSXin Li features = ["fully_static_link"], 142*ec63e07aSXin Li) 143*ec63e07aSXin Li 144*ec63e07aSXin Licc_binary( 145*ec63e07aSXin Li name = "close_fds", 146*ec63e07aSXin Li testonly = True, 147*ec63e07aSXin Li srcs = ["close_fds.cc"], 148*ec63e07aSXin Li copts = sapi_platform_copts(), 149*ec63e07aSXin Li deps = [ 150*ec63e07aSXin Li "//sandboxed_api/sandbox2:sanitizer", 151*ec63e07aSXin Li "@com_google_absl//absl/container:flat_hash_set", 152*ec63e07aSXin Li "@com_google_absl//absl/log:check", 153*ec63e07aSXin Li "@com_google_absl//absl/status", 154*ec63e07aSXin Li "@com_google_absl//absl/strings", 155*ec63e07aSXin Li ], 156*ec63e07aSXin Li) 157*ec63e07aSXin Li 158*ec63e07aSXin Licc_binary( 159*ec63e07aSXin Li name = "sleep", 160*ec63e07aSXin Li testonly = True, 161*ec63e07aSXin Li srcs = ["sleep.cc"], 162*ec63e07aSXin Li copts = sapi_platform_copts(), 163*ec63e07aSXin Li features = ["fully_static_link"], 164*ec63e07aSXin Li) 165*ec63e07aSXin Li 166*ec63e07aSXin Licc_library( 167*ec63e07aSXin Li name = "symbolize_lib", 168*ec63e07aSXin Li testonly = True, 169*ec63e07aSXin Li srcs = ["symbolize_lib.cc"], 170*ec63e07aSXin Li hdrs = ["symbolize_lib.h"], 171*ec63e07aSXin Li copts = sapi_platform_copts([ 172*ec63e07aSXin Li "-fno-omit-frame-pointer", 173*ec63e07aSXin Li "-fno-unwind-tables", 174*ec63e07aSXin Li "-fno-asynchronous-unwind-tables", 175*ec63e07aSXin Li ]), 176*ec63e07aSXin Li features = ["fully_static_link"], 177*ec63e07aSXin Li deps = [ 178*ec63e07aSXin Li "@com_google_absl//absl/base:core_headers", 179*ec63e07aSXin Li ], 180*ec63e07aSXin Li) 181*ec63e07aSXin Li 182*ec63e07aSXin Licc_binary( 183*ec63e07aSXin Li name = "symbolize", 184*ec63e07aSXin Li testonly = True, 185*ec63e07aSXin Li srcs = ["symbolize.cc"], 186*ec63e07aSXin Li copts = sapi_platform_copts(), 187*ec63e07aSXin Li features = ["fully_static_link"], 188*ec63e07aSXin Li deps = [ 189*ec63e07aSXin Li ":symbolize_lib", 190*ec63e07aSXin Li "//sandboxed_api/util:raw_logging", 191*ec63e07aSXin Li "@com_google_absl//absl/base:core_headers", 192*ec63e07aSXin Li "@com_google_absl//absl/strings", 193*ec63e07aSXin Li ], 194*ec63e07aSXin Li) 195*ec63e07aSXin Li 196*ec63e07aSXin Licc_binary( 197*ec63e07aSXin Li name = "tsync", 198*ec63e07aSXin Li testonly = True, 199*ec63e07aSXin Li srcs = ["tsync.cc"], 200*ec63e07aSXin Li copts = sapi_platform_copts(), 201*ec63e07aSXin Li features = ["fully_static_link"], 202*ec63e07aSXin Li deps = [ 203*ec63e07aSXin Li "//sandboxed_api/sandbox2:client", 204*ec63e07aSXin Li "//sandboxed_api/sandbox2:comms", 205*ec63e07aSXin Li ], 206*ec63e07aSXin Li) 207*ec63e07aSXin Li 208*ec63e07aSXin Licc_binary( 209*ec63e07aSXin Li name = "starve", 210*ec63e07aSXin Li testonly = True, 211*ec63e07aSXin Li srcs = ["starve.cc"], 212*ec63e07aSXin Li copts = sapi_platform_copts(), 213*ec63e07aSXin Li features = ["fully_static_link"], 214*ec63e07aSXin Li) 215*ec63e07aSXin Li 216*ec63e07aSXin Licc_binary( 217*ec63e07aSXin Li name = "limits", 218*ec63e07aSXin Li testonly = True, 219*ec63e07aSXin Li srcs = ["limits.cc"], 220*ec63e07aSXin Li copts = sapi_platform_copts(), 221*ec63e07aSXin Li features = ["fully_static_link"], 222*ec63e07aSXin Li) 223*ec63e07aSXin Li 224*ec63e07aSXin Licc_binary( 225*ec63e07aSXin Li name = "namespace", 226*ec63e07aSXin Li testonly = True, 227*ec63e07aSXin Li srcs = ["namespace.cc"], 228*ec63e07aSXin Li copts = sapi_platform_copts(), 229*ec63e07aSXin Li features = ["fully_static_link"], 230*ec63e07aSXin Li deps = [ 231*ec63e07aSXin Li "//sandboxed_api/sandbox2:comms", 232*ec63e07aSXin Li "//sandboxed_api/util:file_base", 233*ec63e07aSXin Li "//sandboxed_api/util:fileops", 234*ec63e07aSXin Li "@com_google_absl//absl/container:flat_hash_set", 235*ec63e07aSXin Li "@com_google_absl//absl/log:check", 236*ec63e07aSXin Li "@com_google_absl//absl/strings", 237*ec63e07aSXin Li ], 238*ec63e07aSXin Li) 239*ec63e07aSXin Li 240*ec63e07aSXin Licc_binary( 241*ec63e07aSXin Li name = "network_proxy", 242*ec63e07aSXin Li testonly = True, 243*ec63e07aSXin Li srcs = ["network_proxy.cc"], 244*ec63e07aSXin Li copts = sapi_platform_copts(), 245*ec63e07aSXin Li deps = [ 246*ec63e07aSXin Li "//sandboxed_api/sandbox2:client", 247*ec63e07aSXin Li "//sandboxed_api/sandbox2:comms", 248*ec63e07aSXin Li "//sandboxed_api/sandbox2/network_proxy:client", 249*ec63e07aSXin Li "//sandboxed_api/util:fileops", 250*ec63e07aSXin Li "//sandboxed_api/util:status", 251*ec63e07aSXin Li "@com_google_absl//absl/base:log_severity", 252*ec63e07aSXin Li "@com_google_absl//absl/flags:flag", 253*ec63e07aSXin Li "@com_google_absl//absl/flags:parse", 254*ec63e07aSXin Li "@com_google_absl//absl/log", 255*ec63e07aSXin Li "@com_google_absl//absl/log:check", 256*ec63e07aSXin Li "@com_google_absl//absl/log:globals", 257*ec63e07aSXin Li "@com_google_absl//absl/log:initialize", 258*ec63e07aSXin Li "@com_google_absl//absl/status", 259*ec63e07aSXin Li "@com_google_absl//absl/status:statusor", 260*ec63e07aSXin Li "@com_google_absl//absl/strings:str_format", 261*ec63e07aSXin Li "@com_google_absl//absl/strings:string_view", 262*ec63e07aSXin Li ], 263*ec63e07aSXin Li) 264*ec63e07aSXin Li 265*ec63e07aSXin Licc_binary( 266*ec63e07aSXin Li name = "custom_fork", 267*ec63e07aSXin Li testonly = True, 268*ec63e07aSXin Li srcs = ["custom_fork.cc"], 269*ec63e07aSXin Li copts = sapi_platform_copts(), 270*ec63e07aSXin Li features = ["fully_static_link"], 271*ec63e07aSXin Li deps = [ 272*ec63e07aSXin Li "//sandboxed_api/sandbox2:comms", 273*ec63e07aSXin Li "//sandboxed_api/sandbox2:forkingclient", 274*ec63e07aSXin Li "//sandboxed_api/util:raw_logging", 275*ec63e07aSXin Li ], 276*ec63e07aSXin Li) 277