BUILD.gn 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419
  1. # Copyright 2014 The Chromium Authors. All rights reserved.
  2. # Use of this source code is governed by a BSD-style license that can be
  3. # found in the LICENSE file.
  4. import("//build/config/features.gni")
  5. import("//build/config/nacl/config.gni")
  6. import("//sandbox/features.gni")
  7. import("//testing/test.gni")
  8. if (is_android) {
  9. import("//build/config/android/rules.gni")
  10. }
  11. declare_args() {
  12. compile_suid_client = is_linux || is_chromeos
  13. compile_credentials = is_linux || is_chromeos
  14. # On Android, use plain GTest.
  15. use_base_test_suite = is_linux || is_chromeos
  16. }
  17. # We have two principal targets: sandbox and sandbox_linux_unittests
  18. # All other targets are listed as dependencies.
  19. # There is one notable exception: for historical reasons, chrome_sandbox is
  20. # the setuid sandbox and is its own target.
  21. group("sandbox") {
  22. public_deps = [ ":sandbox_services" ]
  23. if (compile_suid_client) {
  24. public_deps += [ ":suid_sandbox_client" ]
  25. }
  26. if (use_seccomp_bpf) {
  27. public_deps += [ ":seccomp_bpf" ]
  28. }
  29. if (is_android) {
  30. public_deps += [ ":seccomp_starter_android" ]
  31. }
  32. }
  33. source_set("sandbox_linux_test_utils") {
  34. testonly = true
  35. sources = [
  36. "tests/sandbox_test_runner.cc",
  37. "tests/sandbox_test_runner.h",
  38. "tests/sandbox_test_runner_function_pointer.cc",
  39. "tests/sandbox_test_runner_function_pointer.h",
  40. "tests/test_utils.cc",
  41. "tests/test_utils.h",
  42. "tests/unit_tests.cc",
  43. "tests/unit_tests.h",
  44. ]
  45. deps = [
  46. "//base",
  47. "//testing/gtest",
  48. ]
  49. if (use_seccomp_bpf) {
  50. sources += [
  51. "seccomp-bpf/bpf_tester_compatibility_delegate.h",
  52. "seccomp-bpf/bpf_tests.h",
  53. "seccomp-bpf/sandbox_bpf_test_runner.cc",
  54. "seccomp-bpf/sandbox_bpf_test_runner.h",
  55. ]
  56. deps += [ ":seccomp_bpf" ]
  57. }
  58. if (use_base_test_suite) {
  59. deps += [ "//base/test:test_support" ]
  60. defines = [ "SANDBOX_USES_BASE_TEST_SUITE" ]
  61. }
  62. }
  63. # Sources for sandbox_linux_unittests.
  64. source_set("sandbox_linux_unittests_sources") {
  65. testonly = true
  66. sources = [
  67. "services/proc_util_unittest.cc",
  68. "services/resource_limits_unittest.cc",
  69. "services/scoped_process_unittest.cc",
  70. "services/syscall_wrappers_unittest.cc",
  71. "services/thread_helpers_unittest.cc",
  72. "services/yama_unittest.cc",
  73. "syscall_broker/broker_file_permission_unittest.cc",
  74. "syscall_broker/broker_process_unittest.cc",
  75. "syscall_broker/broker_simple_message_unittest.cc",
  76. "syscall_broker/remote_syscall_arg_handler_unittest.cc",
  77. "tests/main.cc",
  78. "tests/scoped_temporary_file.cc",
  79. "tests/scoped_temporary_file.h",
  80. "tests/scoped_temporary_file_unittest.cc",
  81. "tests/test_utils_unittest.cc",
  82. "tests/unit_tests_unittest.cc",
  83. ]
  84. deps = [
  85. ":sandbox",
  86. ":sandbox_linux_test_utils",
  87. "//base",
  88. "//base/test:test_support",
  89. "//base/third_party/dynamic_annotations",
  90. "//build:chromeos_buildflags",
  91. "//testing/gtest",
  92. ]
  93. if (use_base_test_suite) {
  94. deps += [ "//base/test:test_support" ]
  95. defines = [ "SANDBOX_USES_BASE_TEST_SUITE" ]
  96. }
  97. if (compile_suid_client) {
  98. sources += [
  99. "suid/client/setuid_sandbox_client_unittest.cc",
  100. "suid/client/setuid_sandbox_host_unittest.cc",
  101. ]
  102. }
  103. if (use_seccomp_bpf) {
  104. sources += [
  105. "bpf_dsl/bpf_dsl_unittest.cc",
  106. "bpf_dsl/codegen_unittest.cc",
  107. "bpf_dsl/cons_unittest.cc",
  108. "bpf_dsl/dump_bpf.cc",
  109. "bpf_dsl/dump_bpf.h",
  110. "bpf_dsl/syscall_set_unittest.cc",
  111. "bpf_dsl/test_trap_registry.cc",
  112. "bpf_dsl/test_trap_registry.h",
  113. "bpf_dsl/test_trap_registry_unittest.cc",
  114. "bpf_dsl/verifier.cc",
  115. "bpf_dsl/verifier.h",
  116. "integration_tests/bpf_dsl_seccomp_unittest.cc",
  117. "integration_tests/seccomp_broker_process_unittest.cc",
  118. "seccomp-bpf-helpers/baseline_policy_unittest.cc",
  119. "seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc",
  120. "seccomp-bpf/bpf_tests_unittest.cc",
  121. "seccomp-bpf/sandbox_bpf_unittest.cc",
  122. "seccomp-bpf/syscall_unittest.cc",
  123. "seccomp-bpf/trap_unittest.cc",
  124. ]
  125. deps += [ ":bpf_dsl_golden" ]
  126. if (is_android) {
  127. sources += [ "seccomp-bpf-helpers/baseline_policy_android_unittest.cc" ]
  128. }
  129. }
  130. if (compile_credentials) {
  131. sources += [
  132. "integration_tests/namespace_unix_domain_socket_unittest.cc",
  133. "services/credentials_unittest.cc",
  134. "services/namespace_utils_unittest.cc",
  135. ]
  136. if (use_base_test_suite) {
  137. # Tests that use advanced features not available in stock GTest.
  138. sources += [ "services/namespace_sandbox_unittest.cc" ]
  139. }
  140. # For credentials_unittest.cc
  141. configs += [ "//build/config/linux:libcap" ]
  142. }
  143. }
  144. action("bpf_dsl_golden") {
  145. script = "bpf_dsl/golden/generate.py"
  146. inputs = [
  147. "bpf_dsl/golden/i386/ArgSizePolicy.txt",
  148. "bpf_dsl/golden/i386/BasicPolicy.txt",
  149. "bpf_dsl/golden/i386/ElseIfPolicy.txt",
  150. "bpf_dsl/golden/i386/MaskingPolicy.txt",
  151. "bpf_dsl/golden/i386/MoreBooleanLogicPolicy.txt",
  152. "bpf_dsl/golden/i386/NegativeConstantsPolicy.txt",
  153. "bpf_dsl/golden/i386/SwitchPolicy.txt",
  154. "bpf_dsl/golden/x86-64/ArgSizePolicy.txt",
  155. "bpf_dsl/golden/x86-64/BasicPolicy.txt",
  156. "bpf_dsl/golden/x86-64/BooleanLogicPolicy.txt",
  157. "bpf_dsl/golden/x86-64/ElseIfPolicy.txt",
  158. "bpf_dsl/golden/x86-64/MaskingPolicy.txt",
  159. "bpf_dsl/golden/x86-64/MoreBooleanLogicPolicy.txt",
  160. "bpf_dsl/golden/x86-64/NegativeConstantsPolicy.txt",
  161. "bpf_dsl/golden/x86-64/SwitchPolicy.txt",
  162. ]
  163. outputs = [ "$target_gen_dir/bpf_dsl/golden/golden_files.h" ]
  164. args =
  165. rebase_path(outputs, root_build_dir) + rebase_path(inputs, root_build_dir)
  166. }
  167. test("sandbox_linux_unittests") {
  168. deps = [
  169. ":sandbox_linux_unittests_sources",
  170. "//sandbox/policy:tests",
  171. ]
  172. data_deps = [ "//testing/buildbot/filters:sandbox_linux_unittests_filters" ]
  173. if (is_android) {
  174. use_raw_android_executable = true
  175. }
  176. }
  177. component("seccomp_bpf") {
  178. sources = [
  179. "bpf_dsl/bpf_dsl.cc",
  180. "bpf_dsl/bpf_dsl.h",
  181. "bpf_dsl/bpf_dsl_forward.h",
  182. "bpf_dsl/bpf_dsl_impl.h",
  183. "bpf_dsl/codegen.cc",
  184. "bpf_dsl/codegen.h",
  185. "bpf_dsl/cons.h",
  186. "bpf_dsl/errorcode.h",
  187. "bpf_dsl/linux_syscall_ranges.h",
  188. "bpf_dsl/policy.cc",
  189. "bpf_dsl/policy.h",
  190. "bpf_dsl/policy_compiler.cc",
  191. "bpf_dsl/policy_compiler.h",
  192. "bpf_dsl/seccomp_macros.h",
  193. "bpf_dsl/syscall_set.cc",
  194. "bpf_dsl/syscall_set.h",
  195. "bpf_dsl/trap_registry.h",
  196. "seccomp-bpf-helpers/baseline_policy.cc",
  197. "seccomp-bpf-helpers/baseline_policy.h",
  198. "seccomp-bpf-helpers/sigsys_handlers.cc",
  199. "seccomp-bpf-helpers/sigsys_handlers.h",
  200. "seccomp-bpf-helpers/syscall_parameters_restrictions.cc",
  201. "seccomp-bpf-helpers/syscall_parameters_restrictions.h",
  202. "seccomp-bpf-helpers/syscall_sets.cc",
  203. "seccomp-bpf-helpers/syscall_sets.h",
  204. "seccomp-bpf/die.cc",
  205. "seccomp-bpf/die.h",
  206. "seccomp-bpf/sandbox_bpf.cc",
  207. "seccomp-bpf/sandbox_bpf.h",
  208. "seccomp-bpf/syscall.cc",
  209. "seccomp-bpf/syscall.h",
  210. "seccomp-bpf/trap.cc",
  211. "seccomp-bpf/trap.h",
  212. ]
  213. defines = [ "SANDBOX_IMPLEMENTATION" ]
  214. public_deps = [
  215. ":sandbox_services_headers",
  216. "//sandbox:sandbox_export",
  217. ]
  218. deps = [
  219. ":sandbox_services",
  220. "//base",
  221. "//base/third_party/dynamic_annotations",
  222. "//build:chromeos_buildflags",
  223. "//sandbox:sandbox_buildflags",
  224. ]
  225. if (is_android) {
  226. sources += [
  227. "seccomp-bpf-helpers/baseline_policy_android.cc",
  228. "seccomp-bpf-helpers/baseline_policy_android.h",
  229. ]
  230. }
  231. }
  232. if (is_android) {
  233. # This target is available even if use_seccomp_bpf is disabled, but it also
  234. # works when it is enabled.
  235. component("seccomp_starter_android") {
  236. sources = [
  237. "seccomp-bpf-helpers/seccomp_starter_android.cc",
  238. "seccomp-bpf-helpers/seccomp_starter_android.h",
  239. ]
  240. defines = [ "SANDBOX_IMPLEMENTATION" ]
  241. deps = [
  242. "//base",
  243. "//sandbox:sandbox_buildflags",
  244. ]
  245. if (use_seccomp_bpf) {
  246. deps += [ ":seccomp_bpf" ]
  247. }
  248. visibility = [ ":*" ]
  249. }
  250. }
  251. if (is_linux || is_chromeos) {
  252. # The setuid sandbox for Linux.
  253. executable("chrome_sandbox") {
  254. sources = [
  255. "suid/common/sandbox.h",
  256. "suid/common/suid_unsafe_environment_variables.h",
  257. "suid/process_util.h",
  258. "suid/process_util_linux.c",
  259. "suid/sandbox.c",
  260. ]
  261. cflags = [
  262. # For ULLONG_MAX
  263. "-std=gnu99",
  264. "-fPIE",
  265. # These files have a suspicious comparison.
  266. # TODO fix this and re-enable this warning.
  267. "-Wno-sign-compare",
  268. ]
  269. ldflags = [
  270. "-pie",
  271. ]
  272. }
  273. }
  274. component("sandbox_services") {
  275. sources = [
  276. "services/init_process_reaper.cc",
  277. "services/init_process_reaper.h",
  278. "services/proc_util.cc",
  279. "services/proc_util.h",
  280. "services/resource_limits.cc",
  281. "services/resource_limits.h",
  282. "services/scoped_process.cc",
  283. "services/scoped_process.h",
  284. "services/syscall_wrappers.cc",
  285. "services/syscall_wrappers.h",
  286. "services/thread_helpers.cc",
  287. "services/thread_helpers.h",
  288. "services/yama.cc",
  289. "services/yama.h",
  290. "syscall_broker/broker_channel.cc",
  291. "syscall_broker/broker_channel.h",
  292. "syscall_broker/broker_client.cc",
  293. "syscall_broker/broker_client.h",
  294. "syscall_broker/broker_command.cc",
  295. "syscall_broker/broker_command.h",
  296. "syscall_broker/broker_file_permission.cc",
  297. "syscall_broker/broker_file_permission.h",
  298. "syscall_broker/broker_host.cc",
  299. "syscall_broker/broker_host.h",
  300. "syscall_broker/broker_permission_list.cc",
  301. "syscall_broker/broker_permission_list.h",
  302. "syscall_broker/broker_process.cc",
  303. "syscall_broker/broker_process.h",
  304. "syscall_broker/broker_sandbox_config.cc",
  305. "syscall_broker/broker_sandbox_config.h",
  306. "syscall_broker/broker_simple_message.cc",
  307. "syscall_broker/broker_simple_message.h",
  308. "syscall_broker/remote_syscall_arg_handler.cc",
  309. "syscall_broker/remote_syscall_arg_handler.h",
  310. "syscall_broker/syscall_dispatcher.cc",
  311. "syscall_broker/syscall_dispatcher.h",
  312. ]
  313. defines = [ "SANDBOX_IMPLEMENTATION" ]
  314. public_deps = [ "//sandbox:sandbox_export" ]
  315. deps = [
  316. "//base",
  317. "//base/third_party/dynamic_annotations",
  318. ]
  319. if (compile_credentials) {
  320. sources += [
  321. "services/credentials.cc",
  322. "services/credentials.h",
  323. "services/namespace_sandbox.cc",
  324. "services/namespace_sandbox.h",
  325. "services/namespace_utils.cc",
  326. "services/namespace_utils.h",
  327. ]
  328. public_deps += [ ":sandbox_services_headers" ]
  329. } else {
  330. deps += [ ":sandbox_services_headers" ]
  331. }
  332. if (!is_android) {
  333. sources += [
  334. "services/libc_interceptor.cc",
  335. "services/libc_interceptor.h",
  336. ]
  337. }
  338. }
  339. source_set("sandbox_services_headers") {
  340. sources = [
  341. "system_headers/arm64_linux_syscalls.h",
  342. "system_headers/arm_linux_syscalls.h",
  343. "system_headers/arm_linux_ucontext.h",
  344. "system_headers/i386_linux_ucontext.h",
  345. "system_headers/linux_filter.h",
  346. "system_headers/linux_futex.h",
  347. "system_headers/linux_prctl.h",
  348. "system_headers/linux_ptrace.h",
  349. "system_headers/linux_seccomp.h",
  350. "system_headers/linux_signal.h",
  351. "system_headers/linux_stat.h",
  352. "system_headers/linux_syscalls.h",
  353. "system_headers/linux_time.h",
  354. "system_headers/mips64_linux_syscalls.h",
  355. "system_headers/mips_linux_syscalls.h",
  356. "system_headers/x86_32_linux_syscalls.h",
  357. "system_headers/x86_64_linux_syscalls.h",
  358. ]
  359. }
  360. if (compile_suid_client) {
  361. component("suid_sandbox_client") {
  362. sources = [
  363. "suid/client/setuid_sandbox_client.cc",
  364. "suid/client/setuid_sandbox_client.h",
  365. "suid/client/setuid_sandbox_host.cc",
  366. "suid/client/setuid_sandbox_host.h",
  367. "suid/common/sandbox.h",
  368. "suid/common/suid_unsafe_environment_variables.h",
  369. ]
  370. defines = [ "SANDBOX_IMPLEMENTATION" ]
  371. public_deps = [ "//sandbox:sandbox_export" ]
  372. deps = [
  373. ":sandbox_services",
  374. "//base",
  375. "//base/third_party/dynamic_annotations",
  376. ]
  377. }
  378. }