blob: 697839bb1ef47620e63c19cbaea669934c4fc576 [file] [log] [blame]
[email protected]75cd8f02014-05-29 20:56:021# Copyright 2014 The Chromium Authors. All rights reserved.
2# Use of this source code is governed by a BSD-style license that can be
3# found in the LICENSE file.
4
5import("//build/config/features.gni")
phosek636bceb32015-10-27 03:36:486import("//build/config/nacl/config.gni")
qsrfb5251d12015-01-21 15:57:227import("//testing/test.gni")
[email protected]75cd8f02014-05-29 20:56:028
[email protected]75cd8f02014-05-29 20:56:029declare_args() {
10 compile_suid_client = is_linux
11
12 compile_credentials = is_linux
13
jln01954fd2015-05-15 06:19:3314 # On Android, use plain GTest.
15 use_base_test_suite = is_linux
[email protected]75cd8f02014-05-29 20:56:0216}
17
phosek636bceb32015-10-27 03:36:4818if (is_nacl_nonsfi) {
19 config("nacl_nonsfi_warnings") {
20 # There are number of platform specific functions in
21 # seccomp-bpf syscall helpers, which are not being used.
22 cflags = [ "-Wno-unused-function" ]
23 }
24}
25
[email protected]75cd8f02014-05-29 20:56:0226# We have two principal targets: sandbox and sandbox_linux_unittests
27# All other targets are listed as dependencies.
28# There is one notable exception: for historical reasons, chrome_sandbox is
29# the setuid sandbox and is its own target.
30
31group("sandbox") {
32 deps = [
33 ":sandbox_services",
34 ]
35
phosek636bceb32015-10-27 03:36:4836 if (compile_suid_client || is_nacl_nonsfi) {
[email protected]75cd8f02014-05-29 20:56:0237 deps += [ ":suid_sandbox_client" ]
38 }
phosek636bceb32015-10-27 03:36:4839 if (use_seccomp_bpf || is_nacl_nonsfi) {
[email protected]75cd8f02014-05-29 20:56:0240 deps += [
41 ":seccomp_bpf",
42 ":seccomp_bpf_helpers",
43 ]
44 }
45}
46
47source_set("sandbox_linux_test_utils") {
Brett Wilson0c8745a2014-09-08 22:59:4948 testonly = true
[email protected]75cd8f02014-05-29 20:56:0249 sources = [
50 "tests/sandbox_test_runner.cc",
51 "tests/sandbox_test_runner.h",
52 "tests/sandbox_test_runner_function_pointer.cc",
53 "tests/sandbox_test_runner_function_pointer.h",
54 "tests/test_utils.cc",
55 "tests/test_utils.h",
56 "tests/unit_tests.cc",
57 "tests/unit_tests.h",
58 ]
59
60 deps = [
61 "//testing/gtest",
62 ]
63
64 if (use_seccomp_bpf) {
65 sources += [
66 "seccomp-bpf/bpf_tester_compatibility_delegate.h",
67 "seccomp-bpf/bpf_tests.h",
68 "seccomp-bpf/sandbox_bpf_test_runner.cc",
69 "seccomp-bpf/sandbox_bpf_test_runner.h",
70 ]
scottmg34fb7e52014-12-03 23:27:2471 deps += [ ":seccomp_bpf" ]
[email protected]75cd8f02014-05-29 20:56:0272 }
jln01954fd2015-05-15 06:19:3373
74 if (use_base_test_suite) {
75 deps += [ "//base/test:test_support" ]
76 defines = [ "SANDBOX_USES_BASE_TEST_SUITE" ]
77 }
[email protected]75cd8f02014-05-29 20:56:0278}
79
pkotwicz41889e32015-10-28 22:17:4880# Sources for sandbox_linux_unittests.
rockot86da06c7f2015-02-21 00:40:5881source_set("sandbox_linux_unittests_sources") {
82 testonly = true
83
[email protected]75cd8f02014-05-29 20:56:0284 sources = [
jlnb14fc802015-02-12 05:32:1185 "services/proc_util_unittest.cc",
jln977185982015-02-13 20:58:4186 "services/resource_limits_unittests.cc",
[email protected]75cd8f02014-05-29 20:56:0287 "services/scoped_process_unittest.cc",
jlnc420f0d2014-11-22 01:12:0988 "services/syscall_wrappers_unittest.cc",
[email protected]75cd8f02014-05-29 20:56:0289 "services/thread_helpers_unittests.cc",
90 "services/yama_unittests.cc",
leecamad78f422014-11-26 22:08:4591 "syscall_broker/broker_file_permission_unittest.cc",
jln70c42c202014-11-01 00:59:5792 "syscall_broker/broker_process_unittest.cc",
[email protected]232f6e112014-06-27 07:51:3893 "tests/main.cc",
94 "tests/scoped_temporary_file.cc",
95 "tests/scoped_temporary_file.h",
96 "tests/scoped_temporary_file_unittest.cc",
jlnc420f0d2014-11-22 01:12:0997 "tests/test_utils_unittest.cc",
[email protected]232f6e112014-06-27 07:51:3898 "tests/unit_tests_unittest.cc",
[email protected]75cd8f02014-05-29 20:56:0299 ]
100
101 deps = [
102 ":sandbox",
103 ":sandbox_linux_test_utils",
104 "//base",
[email protected]75cd8f02014-05-29 20:56:02105 "//testing/gtest",
106 ]
107
jln01954fd2015-05-15 06:19:33108 if (use_base_test_suite) {
109 deps += [ "//base/test:test_support" ]
110 defines = [ "SANDBOX_USES_BASE_TEST_SUITE" ]
111 }
112
Brett Wilson73067532014-09-12 22:24:14113 if (is_linux) {
114 # Don't use this on Android.
115 libs = [ "rt" ]
116 }
Brett Wilsone39344352014-09-12 21:07:26117
[email protected]75cd8f02014-05-29 20:56:02118 if (compile_suid_client) {
mdempsky3cc942a2015-02-05 03:29:25119 sources += [
120 "suid/client/setuid_sandbox_client_unittest.cc",
121 "suid/client/setuid_sandbox_host_unittest.cc",
122 ]
[email protected]75cd8f02014-05-29 20:56:02123 }
124 if (use_seccomp_bpf) {
125 sources += [
[email protected]fb75e2a2014-07-17 07:24:58126 "bpf_dsl/bpf_dsl_unittest.cc",
mdempskyb80b1f52015-02-05 00:54:35127 "bpf_dsl/codegen_unittest.cc",
[email protected]fb75e2a2014-07-17 07:24:58128 "bpf_dsl/cons_unittest.cc",
mdempsky937389d2015-08-31 22:27:23129 "bpf_dsl/dump_bpf.cc",
130 "bpf_dsl/dump_bpf.h",
mdempskyce4c9f12015-02-05 06:23:05131 "bpf_dsl/syscall_set_unittest.cc",
mdempsky3909ebf2015-08-20 23:18:18132 "bpf_dsl/test_trap_registry.cc",
133 "bpf_dsl/test_trap_registry.h",
134 "bpf_dsl/test_trap_registry_unittest.cc",
mdempsky937389d2015-08-31 22:27:23135 "bpf_dsl/verifier.cc",
136 "bpf_dsl/verifier.h",
jlnaedcc3e2015-02-12 03:18:10137 "integration_tests/bpf_dsl_seccomp_unittest.cc",
138 "integration_tests/seccomp_broker_process_unittest.cc",
[email protected]75cd8f02014-05-29 20:56:02139 "seccomp-bpf-helpers/baseline_policy_unittest.cc",
jlnfcdfb102014-09-12 02:47:44140 "seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc",
[email protected]75cd8f02014-05-29 20:56:02141 "seccomp-bpf/bpf_tests_unittest.cc",
jlna29d0a32014-11-26 22:38:35142 "seccomp-bpf/sandbox_bpf_unittest.cc",
[email protected]75cd8f02014-05-29 20:56:02143 "seccomp-bpf/syscall_unittest.cc",
hidehikoa926d0b2015-04-24 21:55:21144 "seccomp-bpf/trap_unittest.cc",
[email protected]75cd8f02014-05-29 20:56:02145 ]
mdempskya3fd0ec2015-08-26 00:45:52146 deps += [ ":bpf_dsl_golden" ]
[email protected]75cd8f02014-05-29 20:56:02147 }
148 if (compile_credentials) {
149 sources += [
jlnaedcc3e2015-02-12 03:18:10150 "integration_tests/namespace_unix_domain_socket_unittest.cc",
[email protected]75cd8f02014-05-29 20:56:02151 "services/credentials_unittest.cc",
rickyz41fb1452015-01-27 03:57:58152 "services/namespace_utils_unittest.cc",
[email protected]75cd8f02014-05-29 20:56:02153 ]
rickyz966f039d2015-03-17 07:23:43154
jln01954fd2015-05-15 06:19:33155 if (use_base_test_suite) {
156 # Tests that use advanced features not available in stock GTest.
157 sources += [ "services/namespace_sandbox_unittest.cc" ]
158 }
159
rickyz966f039d2015-03-17 07:23:43160 # For credentials_unittest.cc
161 configs += [ "//build/config/linux:libcap" ]
[email protected]75cd8f02014-05-29 20:56:02162 }
163}
164
mdempskya3fd0ec2015-08-26 00:45:52165action("bpf_dsl_golden") {
166 script = "bpf_dsl/golden/generate.py"
167 inputs = [
168 "bpf_dsl/golden/i386/ArgSizePolicy.txt",
169 "bpf_dsl/golden/i386/BasicPolicy.txt",
170 "bpf_dsl/golden/i386/ElseIfPolicy.txt",
171 "bpf_dsl/golden/i386/MaskingPolicy.txt",
172 "bpf_dsl/golden/i386/MoreBooleanLogicPolicy.txt",
173 "bpf_dsl/golden/i386/NegativeConstantsPolicy.txt",
174 "bpf_dsl/golden/i386/SwitchPolicy.txt",
175 "bpf_dsl/golden/x86-64/ArgSizePolicy.txt",
176 "bpf_dsl/golden/x86-64/BasicPolicy.txt",
177 "bpf_dsl/golden/x86-64/BooleanLogicPolicy.txt",
178 "bpf_dsl/golden/x86-64/ElseIfPolicy.txt",
179 "bpf_dsl/golden/x86-64/MaskingPolicy.txt",
180 "bpf_dsl/golden/x86-64/MoreBooleanLogicPolicy.txt",
181 "bpf_dsl/golden/x86-64/NegativeConstantsPolicy.txt",
182 "bpf_dsl/golden/x86-64/SwitchPolicy.txt",
183 ]
184 outputs = [
185 "$target_gen_dir/bpf_dsl/golden/golden_files.h",
186 ]
187 args =
188 rebase_path(outputs, root_build_dir) + rebase_path(inputs, root_build_dir)
189}
190
dpranke177c1e22015-07-22 23:07:43191# TODO(GYP): Delete this after we've converted everything to GN.
192# The _run targets exist only for compatibility w/ GYP.
193group("sandbox_linux_unittests_run") {
194 testonly = true
195 deps = [
196 ":sandbox_linux_unittests",
197 ]
198}
199
jbudorick7d704ad2015-10-27 23:30:56200# The main sandboxing test target.
201test("sandbox_linux_unittests") {
rockot86da06c7f2015-02-21 00:40:58202 deps = [
203 ":sandbox_linux_unittests_sources",
rockot86da06c7f2015-02-21 00:40:58204 ]
205}
206
[email protected]75cd8f02014-05-29 20:56:02207component("seccomp_bpf") {
208 sources = [
[email protected]fb75e2a2014-07-17 07:24:58209 "bpf_dsl/bpf_dsl.cc",
210 "bpf_dsl/bpf_dsl.h",
mdempskyc60a1c52014-10-24 23:07:10211 "bpf_dsl/bpf_dsl_forward.h",
mdempskyfb10cce2014-10-14 17:56:44212 "bpf_dsl/bpf_dsl_impl.h",
mdempskyb80b1f52015-02-05 00:54:35213 "bpf_dsl/codegen.cc",
214 "bpf_dsl/codegen.h",
[email protected]fb75e2a2014-07-17 07:24:58215 "bpf_dsl/cons.h",
mdempsky3909ebf2015-08-20 23:18:18216 "bpf_dsl/errorcode.h",
jlna65ffca2015-02-13 04:12:43217 "bpf_dsl/linux_syscall_ranges.h",
mdempskyc60a1c52014-10-24 23:07:10218 "bpf_dsl/policy.cc",
219 "bpf_dsl/policy.h",
mdempsky27e78ad72014-10-16 16:49:54220 "bpf_dsl/policy_compiler.cc",
221 "bpf_dsl/policy_compiler.h",
jlna65ffca2015-02-13 04:12:43222 "bpf_dsl/seccomp_macros.h",
mdempskyce4c9f12015-02-05 06:23:05223 "bpf_dsl/syscall_set.cc",
224 "bpf_dsl/syscall_set.h",
mdempsky27e78ad72014-10-16 16:49:54225 "bpf_dsl/trap_registry.h",
[email protected]75cd8f02014-05-29 20:56:02226 "seccomp-bpf/die.cc",
227 "seccomp-bpf/die.h",
[email protected]75cd8f02014-05-29 20:56:02228 "seccomp-bpf/sandbox_bpf.cc",
229 "seccomp-bpf/sandbox_bpf.h",
[email protected]75cd8f02014-05-29 20:56:02230 "seccomp-bpf/syscall.cc",
231 "seccomp-bpf/syscall.h",
[email protected]75cd8f02014-05-29 20:56:02232 "seccomp-bpf/trap.cc",
233 "seccomp-bpf/trap.h",
[email protected]75cd8f02014-05-29 20:56:02234 ]
235 defines = [ "SANDBOX_IMPLEMENTATION" ]
236
237 deps = [
jlnbd4df41c2014-11-25 02:32:30238 ":sandbox_services",
[email protected]75cd8f02014-05-29 20:56:02239 ":sandbox_services_headers",
240 "//base",
241 ]
phosek636bceb32015-10-27 03:36:48242
243 if (is_nacl_nonsfi) {
244 cflags = [ "-fgnu-inline-asm" ]
245 sources -= [
246 "bpf_dsl/bpf_dsl_forward.h",
247 "bpf_dsl/bpf_dsl_impl.h",
248 "bpf_dsl/cons.h",
249 "bpf_dsl/errorcode.h",
250 "bpf_dsl/linux_syscall_ranges.h",
251 "bpf_dsl/seccomp_macros.h",
252 "bpf_dsl/trap_registry.h",
253 ]
254 }
[email protected]75cd8f02014-05-29 20:56:02255}
256
257component("seccomp_bpf_helpers") {
258 sources = [
259 "seccomp-bpf-helpers/baseline_policy.cc",
260 "seccomp-bpf-helpers/baseline_policy.h",
261 "seccomp-bpf-helpers/sigsys_handlers.cc",
262 "seccomp-bpf-helpers/sigsys_handlers.h",
263 "seccomp-bpf-helpers/syscall_parameters_restrictions.cc",
264 "seccomp-bpf-helpers/syscall_parameters_restrictions.h",
265 "seccomp-bpf-helpers/syscall_sets.cc",
266 "seccomp-bpf-helpers/syscall_sets.h",
267 ]
268 defines = [ "SANDBOX_IMPLEMENTATION" ]
269
270 deps = [
271 "//base",
jamesr4359db72015-01-21 12:40:00272 ":sandbox_services",
[email protected]75cd8f02014-05-29 20:56:02273 ":seccomp_bpf",
274 ]
phosek636bceb32015-10-27 03:36:48275
276 if (is_nacl_nonsfi) {
277 sources -= [
278 "seccomp-bpf-helpers/baseline_policy.cc",
279 "seccomp-bpf-helpers/baseline_policy.h",
280 "seccomp-bpf-helpers/syscall_sets.cc",
281 "seccomp-bpf-helpers/syscall_sets.h",
282 ]
283 configs += [ ":nacl_nonsfi_warnings" ]
284 }
[email protected]75cd8f02014-05-29 20:56:02285}
286
James Robinson060f2e32014-09-10 22:31:37287if (is_linux) {
scottmg34fb7e52014-12-03 23:27:24288 # The setuid sandbox for Linux.
James Robinson060f2e32014-09-10 22:31:37289 executable("chrome_sandbox") {
290 sources = [
291 "suid/common/sandbox.h",
292 "suid/common/suid_unsafe_environment_variables.h",
James Robinson060f2e32014-09-10 22:31:37293 "suid/process_util.h",
294 "suid/process_util_linux.c",
295 "suid/sandbox.c",
296 ]
[email protected]75cd8f02014-05-29 20:56:02297
James Robinson060f2e32014-09-10 22:31:37298 cflags = [
299 # For ULLONG_MAX
300 "-std=gnu99",
scottmg34fb7e52014-12-03 23:27:24301
James Robinson060f2e32014-09-10 22:31:37302 # These files have a suspicious comparison.
303 # TODO fix this and re-enable this warning.
304 "-Wno-sign-compare",
305 ]
brettwba7a73d2015-08-31 22:17:39306
307 deps = [
308 "//build/config/sanitizers:deps",
309 ]
James Robinson060f2e32014-09-10 22:31:37310 }
[email protected]75cd8f02014-05-29 20:56:02311}
312
313component("sandbox_services") {
314 sources = [
[email protected]75cd8f02014-05-29 20:56:02315 "services/init_process_reaper.cc",
316 "services/init_process_reaper.h",
jlnb14fc802015-02-12 05:32:11317 "services/proc_util.cc",
318 "services/proc_util.h",
jln977185982015-02-13 20:58:41319 "services/resource_limits.cc",
320 "services/resource_limits.h",
[email protected]75cd8f02014-05-29 20:56:02321 "services/scoped_process.cc",
322 "services/scoped_process.h",
jln610a4a612014-11-20 18:58:21323 "services/syscall_wrappers.cc",
324 "services/syscall_wrappers.h",
[email protected]75cd8f02014-05-29 20:56:02325 "services/thread_helpers.cc",
326 "services/thread_helpers.h",
[email protected]75cd8f02014-05-29 20:56:02327 "services/yama.cc",
jlnb14fc802015-02-12 05:32:11328 "services/yama.h",
jln878dca32014-11-11 07:43:57329 "syscall_broker/broker_channel.cc",
330 "syscall_broker/broker_channel.h",
jln70c42c202014-11-01 00:59:57331 "syscall_broker/broker_client.cc",
332 "syscall_broker/broker_client.h",
333 "syscall_broker/broker_common.h",
leecamad78f422014-11-26 22:08:45334 "syscall_broker/broker_file_permission.cc",
335 "syscall_broker/broker_file_permission.h",
jln70c42c202014-11-01 00:59:57336 "syscall_broker/broker_host.cc",
337 "syscall_broker/broker_host.h",
338 "syscall_broker/broker_policy.cc",
339 "syscall_broker/broker_policy.h",
340 "syscall_broker/broker_process.cc",
341 "syscall_broker/broker_process.h",
[email protected]75cd8f02014-05-29 20:56:02342 ]
343
344 defines = [ "SANDBOX_IMPLEMENTATION" ]
345
rickyz966f039d2015-03-17 07:23:43346 deps = [
347 "//base",
348 ]
349
phosek636bceb32015-10-27 03:36:48350 if (compile_credentials || is_nacl_nonsfi) {
[email protected]75cd8f02014-05-29 20:56:02351 sources += [
352 "services/credentials.cc",
353 "services/credentials.h",
rickyz8f235da2015-02-03 07:26:19354 "services/namespace_sandbox.cc",
355 "services/namespace_sandbox.h",
rickyz41fb1452015-01-27 03:57:58356 "services/namespace_utils.cc",
357 "services/namespace_utils.h",
[email protected]75cd8f02014-05-29 20:56:02358 ]
scottmg34fb7e52014-12-03 23:27:24359
rickyz966f039d2015-03-17 07:23:43360 deps += [ ":sandbox_services_headers" ]
[email protected]75cd8f02014-05-29 20:56:02361 }
phosek636bceb32015-10-27 03:36:48362
363 if (is_nacl_nonsfi) {
364 sources -= [
365 "services/init_process_reaper.cc",
366 "services/init_process_reaper.h",
367 "services/scoped_process.cc",
368 "services/scoped_process.h",
369 "services/yama.cc",
370 "services/yama.h",
371 "syscall_broker/broker_channel.cc",
372 "syscall_broker/broker_channel.h",
373 "syscall_broker/broker_client.cc",
374 "syscall_broker/broker_client.h",
375 "syscall_broker/broker_common.h",
376 "syscall_broker/broker_file_permission.cc",
377 "syscall_broker/broker_file_permission.h",
378 "syscall_broker/broker_host.cc",
379 "syscall_broker/broker_host.h",
380 "syscall_broker/broker_policy.cc",
381 "syscall_broker/broker_policy.h",
382 "syscall_broker/broker_process.cc",
383 "syscall_broker/broker_process.h",
384 ]
385 }
[email protected]75cd8f02014-05-29 20:56:02386}
387
388source_set("sandbox_services_headers") {
389 sources = [
jlnaedcc3e2015-02-12 03:18:10390 "system_headers/arm64_linux_syscalls.h",
hidehikoa926d0b2015-04-24 21:55:21391 "system_headers/arm64_linux_ucontext.h",
jlna65ffca2015-02-13 04:12:43392 "system_headers/arm_linux_syscalls.h",
hidehikoa926d0b2015-04-24 21:55:21393 "system_headers/arm_linux_ucontext.h",
394 "system_headers/i386_linux_ucontext.h",
dnicoara97178052015-04-15 17:44:04395 "system_headers/linux_futex.h",
jlna65ffca2015-02-13 04:12:43396 "system_headers/linux_seccomp.h",
hidehikoa926d0b2015-04-24 21:55:21397 "system_headers/linux_signal.h",
jlnaedcc3e2015-02-12 03:18:10398 "system_headers/linux_syscalls.h",
ben7598f462015-05-22 23:19:51399 "system_headers/linux_time.h",
hidehikoa926d0b2015-04-24 21:55:21400 "system_headers/linux_ucontext.h",
jlnaedcc3e2015-02-12 03:18:10401 "system_headers/x86_32_linux_syscalls.h",
402 "system_headers/x86_64_linux_syscalls.h",
[email protected]75cd8f02014-05-29 20:56:02403 ]
404}
405
phosek636bceb32015-10-27 03:36:48406if (compile_suid_client || is_nacl_nonsfi) {
James Robinson060f2e32014-09-10 22:31:37407 component("suid_sandbox_client") {
408 sources = [
James Robinson060f2e32014-09-10 22:31:37409 "suid/client/setuid_sandbox_client.cc",
410 "suid/client/setuid_sandbox_client.h",
mdempsky3cc942a2015-02-05 03:29:25411 "suid/client/setuid_sandbox_host.cc",
412 "suid/client/setuid_sandbox_host.h",
scottmg7c7296f42015-02-28 02:23:09413 "suid/common/sandbox.h",
414 "suid/common/suid_unsafe_environment_variables.h",
James Robinson060f2e32014-09-10 22:31:37415 ]
416 defines = [ "SANDBOX_IMPLEMENTATION" ]
[email protected]75cd8f02014-05-29 20:56:02417
James Robinson060f2e32014-09-10 22:31:37418 deps = [
419 ":sandbox_services",
420 "//base",
421 ]
phosek636bceb32015-10-27 03:36:48422
423 if (is_nacl_nonsfi) {
424 sources -= [
425 "suid/client/setuid_sandbox_host.cc",
426 "suid/client/setuid_sandbox_host.h",
427 "suid/common/sandbox.h",
428 "suid/common/suid_unsafe_environment_variables.h",
429 ]
430 }
James Robinson060f2e32014-09-10 22:31:37431 }
[email protected]75cd8f02014-05-29 20:56:02432}
433
434if (is_android) {
jbudorick7d704ad2015-10-27 23:30:56435 # TODO(GYP) enable this. Needs an android_strip wrapper python script.
436 #action("sandbox_linux_unittests_stripped") {
437 # script = "android_stip.py"
438 #
439 # in_file = "$root_out_dir/sandbox_linux_unittests"
440 #
441 # out_file = "$root_out_dir/sandbox_linux_unittests_stripped"
442 # outputs = [ out_file ]
443 #
444 # args = [
445 # rebase_path(in_file, root_build_dir),
446 # "-o", rebase_path(out_file, root_build_dir),
447 # ]
448 #
449 # deps = [
450 # ":sandbox_linux_unittests",
451 # ]
452 #}
[email protected]75cd8f02014-05-29 20:56:02453}