BUILD.gn 9.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332
  1. # Copyright 2014 The Chromium Authors. All rights reserved.
  2. # Use of this source code is governed by a BSD-style license that can be
  3. # found in the LICENSE file.
  4. import("//testing/libfuzzer/fuzzer_test.gni")
  5. import("//testing/test.gni")
  6. # This needs to be a static library rather than a sources set because small
  7. # portions of this are used in some contexts (like chrome_elf), and it
  8. # doesn't seem to dead-code strip very well. This saves 12K on chrome_elf.dll,
  9. # over a source set, for example.
  10. static_library("sandbox") {
  11. sources = [
  12. "src/acl.cc",
  13. "src/acl.h",
  14. "src/app_container.h",
  15. "src/app_container_base.cc",
  16. "src/app_container_base.h",
  17. "src/broker_services.cc",
  18. "src/broker_services.h",
  19. "src/crosscall_client.h",
  20. "src/crosscall_params.h",
  21. "src/crosscall_server.cc",
  22. "src/crosscall_server.h",
  23. "src/eat_resolver.cc",
  24. "src/eat_resolver.h",
  25. "src/filesystem_dispatcher.cc",
  26. "src/filesystem_dispatcher.h",
  27. "src/filesystem_interception.cc",
  28. "src/filesystem_interception.h",
  29. "src/filesystem_policy.cc",
  30. "src/filesystem_policy.h",
  31. "src/handle_closer.cc",
  32. "src/handle_closer.h",
  33. "src/handle_closer_agent.cc",
  34. "src/handle_closer_agent.h",
  35. "src/heap_helper.cc",
  36. "src/heap_helper.h",
  37. "src/interception.cc",
  38. "src/interception.h",
  39. "src/interception_agent.cc",
  40. "src/interception_agent.h",
  41. "src/interception_internal.h",
  42. "src/interceptors.h",
  43. "src/internal_types.h",
  44. "src/ipc_args.cc",
  45. "src/ipc_args.h",
  46. "src/ipc_tags.h",
  47. "src/job.cc",
  48. "src/job.h",
  49. "src/named_pipe_dispatcher.cc",
  50. "src/named_pipe_dispatcher.h",
  51. "src/named_pipe_interception.cc",
  52. "src/named_pipe_interception.h",
  53. "src/named_pipe_policy.cc",
  54. "src/named_pipe_policy.h",
  55. "src/nt_internals.h",
  56. "src/policy_broker.cc",
  57. "src/policy_broker.h",
  58. "src/policy_engine_opcodes.cc",
  59. "src/policy_engine_opcodes.h",
  60. "src/policy_engine_params.h",
  61. "src/policy_engine_processor.cc",
  62. "src/policy_engine_processor.h",
  63. "src/policy_low_level.cc",
  64. "src/policy_low_level.h",
  65. "src/policy_params.h",
  66. "src/policy_target.cc",
  67. "src/policy_target.h",
  68. "src/process_mitigations.cc",
  69. "src/process_mitigations.h",
  70. "src/process_mitigations_win32k_dispatcher.cc",
  71. "src/process_mitigations_win32k_dispatcher.h",
  72. "src/process_mitigations_win32k_interception.cc",
  73. "src/process_mitigations_win32k_interception.h",
  74. "src/process_mitigations_win32k_policy.cc",
  75. "src/process_mitigations_win32k_policy.h",
  76. "src/process_thread_dispatcher.cc",
  77. "src/process_thread_dispatcher.h",
  78. "src/process_thread_interception.cc",
  79. "src/process_thread_interception.h",
  80. "src/process_thread_policy.cc",
  81. "src/process_thread_policy.h",
  82. "src/resolver.cc",
  83. "src/resolver.h",
  84. "src/restricted_token.cc",
  85. "src/restricted_token.h",
  86. "src/restricted_token_utils.cc",
  87. "src/restricted_token_utils.h",
  88. "src/sandbox.cc",
  89. "src/sandbox_factory.h",
  90. "src/sandbox_globals.cc",
  91. "src/sandbox_nt_types.h",
  92. "src/sandbox_nt_util.cc",
  93. "src/sandbox_nt_util.h",
  94. "src/sandbox_policy_base.cc",
  95. "src/sandbox_policy_base.h",
  96. "src/sandbox_policy_diagnostic.cc",
  97. "src/sandbox_policy_diagnostic.h",
  98. "src/sandbox_rand.cc",
  99. "src/sandbox_rand.h",
  100. "src/sandbox_utils.cc",
  101. "src/sandbox_utils.h",
  102. "src/security_capabilities.cc",
  103. "src/security_capabilities.h",
  104. "src/service_resolver.cc",
  105. "src/service_resolver.h",
  106. "src/sharedmem_ipc_client.cc",
  107. "src/sharedmem_ipc_client.h",
  108. "src/sharedmem_ipc_server.cc",
  109. "src/sharedmem_ipc_server.h",
  110. "src/signed_dispatcher.cc",
  111. "src/signed_dispatcher.h",
  112. "src/signed_interception.cc",
  113. "src/signed_interception.h",
  114. "src/signed_policy.cc",
  115. "src/signed_policy.h",
  116. "src/socket_dispatcher.cc",
  117. "src/socket_dispatcher.h",
  118. "src/startup_information_helper.cc",
  119. "src/startup_information_helper.h",
  120. "src/target_interceptions.cc",
  121. "src/target_interceptions.h",
  122. "src/target_process.cc",
  123. "src/target_process.h",
  124. "src/target_services.cc",
  125. "src/target_services.h",
  126. "src/threadpool.cc",
  127. "src/threadpool.h",
  128. "src/top_level_dispatcher.cc",
  129. "src/top_level_dispatcher.h",
  130. "src/win_utils.cc",
  131. "src/win_utils.h",
  132. "src/window.cc",
  133. "src/window.h",
  134. ]
  135. if (current_cpu == "x64" || current_cpu == "arm64") {
  136. sources += [
  137. "src/interceptors_64.cc",
  138. "src/interceptors_64.h",
  139. "src/resolver_64.cc",
  140. "src/service_resolver_64.cc",
  141. ]
  142. } else if (current_cpu == "x86") {
  143. sources += [
  144. "src/resolver_32.cc",
  145. "src/service_resolver_32.cc",
  146. ]
  147. }
  148. # Disable sanitizer coverage in the sandbox code. The sandbox code runs before
  149. # sanitizer coverage can initialize. http://crbug.com/484711
  150. configs -= [ "//build/config/sanitizers:default_sanitizer_flags" ]
  151. configs +=
  152. [ "//build/config/sanitizers:default_sanitizer_flags_but_coverage" ]
  153. configs += [ "//build/config:precompiled_headers" ]
  154. public_deps = [
  155. ":common",
  156. "//base",
  157. "//sandbox:common",
  158. ]
  159. deps = [
  160. ":maybe_set_appcontainer_acls",
  161. "//base:base_static",
  162. ]
  163. }
  164. test("sbox_integration_tests") {
  165. sources = [
  166. "src/address_sanitizer_test.cc",
  167. "src/app_container_test.cc",
  168. "src/file_policy_test.cc",
  169. "src/handle_closer_test.cc",
  170. "src/handle_inheritance_test.cc",
  171. "src/integrity_level_test.cc",
  172. "src/ipc_leak_test.cc",
  173. "src/ipc_ping_test.cc",
  174. "src/lpc_policy_test.cc",
  175. "src/named_pipe_policy_test.cc",
  176. "src/policy_target_test.cc",
  177. "src/process_mitigations_dyncode_unittest.cc",
  178. "src/process_mitigations_extensionpoints_unittest.cc",
  179. "src/process_mitigations_unittest.cc",
  180. "src/process_mitigations_win32k_unittest.cc",
  181. "src/process_policy_test.cc",
  182. "src/restricted_token_test.cc",
  183. "src/unload_dll_test.cc",
  184. "tests/common/controller.cc",
  185. "tests/common/test_utils.cc",
  186. "tests/common/test_utils.h",
  187. "tests/integration_tests/cfi_unittest.cc",
  188. "tests/integration_tests/integration_tests.cc",
  189. "tests/integration_tests/integration_tests_common.h",
  190. "tests/integration_tests/integration_tests_test.cc",
  191. ]
  192. deps = [
  193. ":sandbox",
  194. "//base/test:test_support",
  195. "//sandbox/policy:tests",
  196. "//testing/gtest",
  197. ]
  198. data_deps = [
  199. ":sbox_integration_test_hooking_dll",
  200. ":sbox_integration_test_win_proc",
  201. ]
  202. libs = [
  203. "ktmw32.lib",
  204. "iphlpapi.lib",
  205. ]
  206. }
  207. group("maybe_set_appcontainer_acls") {
  208. # NACL on 32-bit builds this target twice, once for 64-bit and once for 32-bit
  209. # so avoid this dep from running twice with the same output in that case.
  210. # Additionally, exclude setting ACLs when build is not happening on Windows.
  211. if (current_cpu == target_cpu && host_os == "win") {
  212. deps = [ ":set_appcontainer_acls" ]
  213. }
  214. }
  215. if (current_cpu == target_cpu && host_os == "win") {
  216. action("set_appcontainer_acls") {
  217. script = "//build/win/set_appcontainer_acls.py"
  218. stamp_file = "$target_out_dir/acls.stamp"
  219. inputs = [ script ]
  220. outputs = [ stamp_file ]
  221. args = [
  222. "--stamp=" + rebase_path(stamp_file, root_out_dir),
  223. "--dir=" + rebase_path(root_out_dir, root_out_dir),
  224. ]
  225. }
  226. }
  227. shared_library("sbox_integration_test_hooking_dll") {
  228. sources = [ "tests/integration_tests/hooking_dll.cc" ]
  229. deps = [ ":common_test" ]
  230. }
  231. executable("sbox_integration_test_win_proc") {
  232. sources = [ "tests/integration_tests/hooking_win_proc.cc" ]
  233. configs -= [ "//build/config/win:console" ]
  234. configs += [ "//build/config/win:windowed" ]
  235. deps = [ ":common_test" ]
  236. }
  237. test("sbox_validation_tests") {
  238. sources = [
  239. "tests/common/controller.cc",
  240. "tests/validation_tests/commands.cc",
  241. "tests/validation_tests/commands.h",
  242. "tests/validation_tests/suite.cc",
  243. "tests/validation_tests/unit_tests.cc",
  244. ]
  245. deps = [
  246. ":sandbox",
  247. "//base/test:test_support",
  248. "//testing/gtest",
  249. ]
  250. libs = [ "shlwapi.lib" ]
  251. }
  252. test("sbox_unittests") {
  253. sources = [
  254. "src/acl_unittest.cc",
  255. "src/app_container_unittest.cc",
  256. "src/interception_unittest.cc",
  257. "src/ipc_unittest.cc",
  258. "src/job_unittest.cc",
  259. "src/policy_engine_unittest.cc",
  260. "src/policy_low_level_unittest.cc",
  261. "src/policy_opcodes_unittest.cc",
  262. "src/restricted_token_unittest.cc",
  263. "src/sandbox_nt_util_unittest.cc",
  264. "src/service_resolver_unittest.cc",
  265. "src/threadpool_unittest.cc",
  266. "src/win_utils_unittest.cc",
  267. "tests/common/test_utils.cc",
  268. "tests/common/test_utils.h",
  269. "tests/unit_tests/unit_tests.cc",
  270. ]
  271. deps = [
  272. ":sandbox",
  273. "//base/test:test_support",
  274. "//testing/gtest",
  275. ]
  276. }
  277. # This fuzzer will only work on Windows, add fuzz targets which could run on
  278. # Linux to //sandbox/ directly.
  279. fuzzer_test("sandbox_policy_rule_fuzzer") {
  280. sources = [ "fuzzer/sandbox_policy_rule_fuzzer.cc" ]
  281. dict = "fuzzer/sandbox_policy_rule.dict"
  282. deps = [
  283. "//base",
  284. "//sandbox",
  285. ]
  286. }
  287. source_set("common") {
  288. sources = [
  289. "fuzzer/fuzzer_types.h",
  290. "src/sandbox.h",
  291. "src/sandbox_policy.h",
  292. "src/sandbox_types.h",
  293. "src/security_level.h",
  294. "tests/common/controller.h",
  295. ]
  296. deps = [ "//base" ]
  297. public_deps = [ ":common_test" ]
  298. }
  299. source_set("common_test") {
  300. sources = [
  301. "tests/integration_tests/hooking_dll.h",
  302. "tests/integration_tests/hooking_win_proc.h",
  303. ]
  304. }