Google Git
Sign in
android/platform/external/lfi/lfi-bind/1e9b1657c739a3e8458d72fb86eed4c0e1886a0e
commit
1e9b1657c739a3e8458d72fb86eed4c0e1886a0e
[log]
author
Sharjeel Khan <sharjeelkhan@google.com>
Fri Feb 13 21:09:39 2026 +0000
committer
Sharjeel Khan <sharjeelkhan@google.com>
Fri Mar 20 17:54:10 2026 +0000
tree
83753b2fd3c374aec1b94b40c9f55ed4ef6bd69b
parent
24011966623689c66d5a13827698d40458e04079 [diff]
Add presubmit LFI tests

We want to add presubmit tests whenever the external LFI repos are
updated. We define all presubmit tests in system/lfi and import them
into the external/lfi repos using TEST_MAPPING's import functionality.
This allows us to update the presubmit tests in one area and all repos
affecting LFI will run the same presubmit tests.

Bug: 494581279
Test: atest --test-mapping :presubmit
Change-Id: I47de5c28e0745041a072bd6f437262aa396094c3
1 file changed
tree: 83753b2fd3c374aec1b94b40c9f55ed4ef6bd69b
  1. embed/
  2. examples/
  3. subprojects/
  4. .gitignore
  5. Android.bp
  6. EXAMPLE.md
  7. go.mod
  8. go.sum
  9. LICENSE
  10. main.go
  11. meson.build
  12. METADATA
  13. MODULE_LICENSE_MIT
  14. OWNERS
  15. README.md
  16. TEST_MAPPING
README.md

LFI Bind

This program makes it easy to do library sandboxing with LFI. It generates routines to initialize the library sandbox, and trampolines for calling functions from the library.

Installation

go build

Examples

See examples for some basic examples. See ./EXAMPLE.md for a step-by-step guide to recreating the add example manually.

Usage

The process for creating a sandboxed library is the following:

  1. Compile your static library using the LFI compiler. This produces libfoo.a.
  2. Create a “LFI library” by compiling libfoo.a to a static PIE and linking with boxrt (startup code that runs in the sandbox). Usually this command looks like $(LFICC) -Wl,--whole-archive libfoo.a -Wl,--no-whole-archive -Wl,--export-dynamic -lboxrt -static-pie -o libfoo.lfi.
  3. Invoke lfi-bind, passing it libfoo.lfi and instructing it to generate an initialization file lib_init.c and trampoline file lib_trampolines.S.
  4. Compile lib_init.c and lib_trampolines.S into your host application, allowing you to use the sandboxed library.

See the examples directory for real examples that you can try out.

Usage of ./lfi-bind:
  -gen-init string
    	output file for initialization functions
  -gen-trampolines string
    	output file for trampolines
  -lib string
    	library name for function prefixes (default "lib")
  -lib-path string
    	path to library executable at runtime
  -lib-prefix string
    	prefix to put on library symbols
  -symbols-prefix string
    	prefix used to match exported symbols
  -symbols string
    	comma-separated list of exported symbols
  -symbols-file string
    	list of symbols in a file, one line per symbol