| tag | b27bf5ab0de8aa2c66684da6c23a87ff88a2d4d9 | |
|---|---|---|
| tagger | Jorge Lucangeli Obes <jorgelo@google.com> | Mon Jan 06 13:33:01 2020 -0500 |
| object | c90ec15cabe51bcd37767e81d264a8ef7e322b9b |
Minijail v12. New in this release: *Better error diagnostics in the seccomp compiler (lhchavez@google.com). *Small fixes.
| commit | c90ec15cabe51bcd37767e81d264a8ef7e322b9b | [log] [tgz] |
|---|---|---|
| author | Luis Hector Chavez <lhchavez@google.com> | Fri Dec 13 09:12:33 2019 -0800 |
| committer | Luis Hector Chavez <lhchavez@google.com> | Mon Dec 16 10:42:35 2019 -0800 |
| tree | 2f9dbc73e9f4ed58aa7e1c51334f5680913e62ed | |
| parent | f6f2625faebf784b9d335a58a7b71c8f33686d2c [diff] |
Add a way to compile .policy files at build-time
This change adds enough Android.bp rules and tools to make it possible
to compile .policy files at build-time, using the new optimizing
compiler.
This is achieved by compiling the libconstants.gen.c and
libsyscalls.gen.c into LLVM IR files (which are roughly
architecture-neutral for our purposes). These IR files are then parsed
by the `tools/generate_constants_json.py` script and produces an
architecture-specific `constants.json` file, which can be fed into
`tools/compile_seccomp_policy.py` to compile .policy files.
The last piece of the puzzle is to actually invoke the script. This
needs to be done from a cc_genrule due to the way that soong handles
target variations, and will produce artifacts that are
architecture-specific. One example to invoke the script is as follows:
cc_genrule {
name: "bpf_compilation",
host_supported: true,
vendor_available: true,
recovery_available: true,
tools: ["minijail_compile_seccomp_policy"],
cmd: "$(location minijail_compile_seccomp_policy) --arch-json $(in) $(out)",
srcs: [":minijail_constants_json", "my_seccomp.policy"],
out: ["my_seccomp.bpf"],
}
Bug: None
Test: mmma -j external/minijail
Test: make all
Change-Id: I835ee18c3ff515a6f3203ed86d20ad41d4f5d066
The Minijail homepage and main repo is https://android.googlesource.com/platform/external/minijail/.
There might be other copies floating around, but this is the official one!
Minijail is a sandboxing and containment tool used in Chrome OS and Android. It provides an executable that can be used to launch and sandbox other programs, and a library that can be used by code to sandbox itself.
You're one git clone away from happiness.
$ git clone https://android.googlesource.com/platform/external/minijail $ cd minijail
Releases are tagged as linux-vXX: https://android.googlesource.com/platform/external/minijail/+refs
See the HACKING.md document for more details.
See the RELEASE.md document for more details.
See the tools/README.md document for more details.
We've got a couple of contact points.
The following talk serves as a good introduction to Minijail and how it can be used.
The Chromium OS project has a comprehensive sandboxing document that is largely based on Minijail.
After you play with the simple examples below, you should check that out.
# id uid=0(root) gid=0(root) groups=0(root),128(pkcs11) # minijail0 -u jorgelo -g 5000 /usr/bin/id uid=72178(jorgelo) gid=5000(eng) groups=5000(eng)
# minijail0 -u jorgelo -c 3000 -- /bin/cat /proc/self/status Name: cat ... CapInh: 0000000000003000 CapPrm: 0000000000003000 CapEff: 0000000000003000 CapBnd: 0000000000003000