Add a Backend template parameter to the Sandbox class

To allow other sandbox backends, we move all sandbox2 specific code into its own
Sandbox2Backend class.

PiperOrigin-RevId: 869247483
Change-Id: I46bf7a828ed526257367f10135a1474a982c8234

Author: Sandboxed API Team

sandboxed_api/BUILD

@@ -69,6 +69,7 @@ cc_library(
     name = "sapi",
     srcs = [
         "sandbox.cc",
+        "sandbox2_backend.cc",
         "sandbox2_rpcchannel.cc",
         "sandbox2_rpcchannel.h",
         "transaction.cc",
@@ -78,6 +79,8 @@ cc_library(
         #                 supports this usecase.
         "embed_file.h",
         "sandbox.h",
+        "sandbox2_backend.h",
+        "sandbox_config.h",
         "transaction.h",
     ],
     copts = sapi_platform_copts(),

sandboxed_api/CMakeLists.txt

@@ -53,6 +53,9 @@ target_link_libraries(sapi_embed_file
 add_library(sapi_sapi ${SAPI_LIB_TYPE}
   sandbox.cc
   sandbox.h
+  sandbox2_backend.cc
+  sandbox2_backend.h
+  sandbox_config.h
   sandbox2_rpcchannel.cc
   sandbox2_rpcchannel.h
   transaction.cc

sandboxed_api/sandbox.cc

@@ -27,11 +27,7 @@
 #include <initializer_list>
 #include <memory>
 #include <string>
-#include <utility>
-#include <variant>
-#include <vector>
 
-#include "sandboxed_api/file_toc.h"
 #include "absl/base/dynamic_annotations.h"
 #include "absl/base/macros.h"
 #include "absl/log/check.h"
@@ -41,23 +37,14 @@
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/string_view.h"
-#include "absl/synchronization/mutex.h"
 #include "absl/time/time.h"
 #include "absl/types/span.h"
 #include "sandboxed_api/call.h"
 #include "sandboxed_api/config.h"
-#include "sandboxed_api/embed_file.h"
 #include "sandboxed_api/rpcchannel.h"
-#include "sandboxed_api/sandbox2/executor.h"
-#include "sandboxed_api/sandbox2/fork_client.h"
 #include "sandboxed_api/sandbox2/limits.h"
 #include "sandboxed_api/sandbox2/policy.h"
 #include "sandboxed_api/sandbox2/policybuilder.h"
-#include "sandboxed_api/sandbox2/result.h"
-#include "sandboxed_api/sandbox2/sandbox2.h"
-#include "sandboxed_api/sandbox2_rpcchannel.h"
-#include "sandboxed_api/util/path.h"
-#include "sandboxed_api/util/runfiles.h"
 #include "sandboxed_api/util/status_macros.h"
 #include "sandboxed_api/var_abstract.h"
 #include "sandboxed_api/var_array.h"
@@ -68,16 +55,6 @@
 
 namespace sapi {
 
-Sandbox::Sandbox(SandboxConfig config) : config_(std::move(config)) {
-  CHECK(config_.sandbox2.fork_client_context.has_value());
-}
-
-Sandbox::~Sandbox() {
-  Terminate();
-  // The forkserver will die automatically when the executor goes out of scope
-  // and closes the comms object.
-}
-
 // IMPORTANT: This policy must be safe to use with
 // `Allow(sandbox2::UnrestrictedNetworking())`.
 sandbox2::PolicyBuilder Sandbox2Config::DefaultPolicyBuilder() {
@@ -132,198 +109,21 @@ sandbox2::Limits Sandbox2Config::DefaultLimits() {
   return limits;
 }
 
-void Sandbox::Terminate(bool attempt_graceful_exit) {
-  if (!is_active()) {
-    return;
-  }
-
-  absl::StatusOr<sandbox2::Result> result;
-  if (attempt_graceful_exit) {
-    if (absl::Status requested_exit = rpc_channel_->Exit();
-        !requested_exit.ok()) {
-      LOG(WARNING)
-          << "rpc_channel->Exit() failed, calling AwaitResultWithTimeout(1) "
-          << requested_exit;
-    }
-    result = s2_->AwaitResultWithTimeout(absl::Seconds(1));
-    if (!result.ok()) {
-      LOG(WARNING) << "s2_->AwaitResultWithTimeout failed, status: "
-                   << result.status() << " Killing PID: " << pid();
-    }
-  }
-
-  if (!attempt_graceful_exit || !result.ok()) {
-    s2_->Kill();
-    result = s2_->AwaitResult();
-  }
-
-  if ((result->final_status() == sandbox2::Result::OK &&
-       result->reason_code() == 0) ||
-      (!attempt_graceful_exit &&
-       result->final_status() == sandbox2::Result::EXTERNAL_KILL)) {
-    VLOG(2) << "Sandbox2 finished with: " << result->ToString();
-  } else {
-    LOG(WARNING) << "Sandbox2 finished with: " << result->ToString();
-  }
-}
-
-static std::string PathToSAPILib(const std::string& lib_path) {
-  return file::IsAbsolutePath(lib_path) ? lib_path
-                                        : GetDataDependencyFilePath(lib_path);
-}
-
-void Sandbox::ApplySandbox2Config(sandbox2::Executor* executor) const {
-  const Sandbox2Config& config = config_.sandbox2;
-  if (config.enable_log_server) {
-    executor->ipc()->EnableLogServer();
-  }
-  if (config.cwd.has_value()) {
-    executor->set_cwd(*config.cwd);
-  }
-  if (config.limits.has_value()) {
-    *executor->limits() = *config.limits;
-  }
-}
-
-void Sandbox::MapFileDescriptors(sandbox2::Executor* executor) const {
-  if (!config_.fd_mappings.has_value()) {
-    return;
-  }
-  for (const auto& [host_fd, sandbox_fd] : *config_.fd_mappings) {
-    executor->ipc()->MapDupedFd(host_fd.get(), sandbox_fd);
-  }
-}
-
-absl::Status Sandbox::Init() {
-  // It's already initialized
-  if (is_active()) {
-    return absl::OkStatus();
-  }
-
-  std::shared_ptr<sandbox2::Executor> fork_client_executor;
-  std::shared_ptr<sandbox2::ForkClient> fork_client;
-  {
-    absl::MutexLock lock(fork_client_shared().mu_);
-    // Initialize the forkserver if it is not already running.
-    if (!fork_client_shared().client_) {
-      auto sandboxee_source = fork_client_context().sandboxee_source_;
-
-      std::string lib_path;
-      int embed_lib_fd = -1;
-      if (std::holds_alternative<const FileToc*>(sandboxee_source)) {
-        const FileToc* embed_lib_toc =
-            std::get<const FileToc*>(sandboxee_source);
-        embed_lib_fd = EmbedFile::instance()->GetDupFdForFileToc(embed_lib_toc);
-        if (embed_lib_fd == -1) {
-          PLOG(ERROR) << "Cannot create executable FD for TOC:'"
-                      << embed_lib_toc->name << "'";
-          return absl::UnavailableError("Could not create executable FD");
-        }
-        lib_path = embed_lib_toc->name;
-      } else {
-        lib_path = PathToSAPILib(std::get<std::string>(sandboxee_source));
-        if (lib_path.empty()) {
-          LOG(ERROR) << "SAPI library path is empty";
-          return absl::FailedPreconditionError("No SAPI library path given");
-        }
-      }
-      std::vector<std::string> args = {lib_path};
-      // Additional arguments, if needed.
-      auto flags =
-          config_.command_line_flags.value_or(SandboxConfig::DefaultFlags());
-      for (const auto& [key, value] : flags) {
-        args.push_back(absl::StrCat("--", key, "=", value));
-      }
-
-      fork_client_shared().executor_ =
-          (embed_lib_fd >= 0) ? std::make_shared<sandbox2::Executor>(
-                                    embed_lib_fd, args, EnvironmentVariables())
-                              : std::make_shared<sandbox2::Executor>(
-                                    lib_path, args, EnvironmentVariables());
-
-      fork_client_shared().client_ =
-          fork_client_shared().executor_->StartForkServer();
-
-      if (!fork_client_shared().client_) {
-        LOG(ERROR) << "Could not start forkserver";
-        return absl::UnavailableError("Could not start the forkserver");
-      }
-    }
-    fork_client_executor = fork_client_shared().executor_;
-    fork_client = fork_client_shared().client_;
-  }
-
-  std::unique_ptr<sandbox2::Policy> s2p;
-  if (config_.sandbox2.policy) {
-    s2p = std::make_unique<sandbox2::Policy>(*config_.sandbox2.policy);
-  } else {
-    sandbox2::PolicyBuilder policy_builder =
-        Sandbox2Config::DefaultPolicyBuilder();
-    if (config_.sandbox2.use_unotify_monitor) {
-      policy_builder.CollectStacktracesOnSignal(false);
-    }
-    s2p = policy_builder.BuildOrDie();
-  }
-
-  // Spawn new process from the forkserver.
-  auto executor = std::make_unique<sandbox2::Executor>(fork_client.get());
-
-  executor
-      // The client.cc code is capable of enabling sandboxing on its own.
-      ->set_enable_sandbox_before_exec(false)
-      // By default, set cwd to "/", can be changed in ModifyExecutor().
-      .set_cwd("/");
-  // Disable time limits.
-  *executor->limits() = Sandbox2Config::DefaultLimits();
-
-  // Modify the executor, e.g. by setting custom limits and IPC.
-  ApplySandbox2Config(executor.get());
-  MapFileDescriptors(executor.get());
-
-  s2_ = std::make_unique<sandbox2::Sandbox2>(std::move(executor),
-                                             std::move(s2p), CreateNotifier());
-  if (config_.sandbox2.use_unotify_monitor) {
-    SAPI_RETURN_IF_ERROR(s2_->EnableUnotifyMonitor());
-  }
-  s2_awaited_ = false;
-  auto res = s2_->RunAsync();
-
-  comms_ = s2_->comms();
-  pid_ = s2_->pid();
-
-  rpc_channel_ = std::make_unique<Sandbox2RPCChannel>(comms_, pid_);
-
-  if (!res) {
-    // Allow recovering from a bad fork client state.
-    {
-      absl::MutexLock lock(fork_client_shared().mu_);
-      fork_client_shared().client_.reset();
-    }
-    sandbox2::Result result = s2_->AwaitResult();
-    LOG(ERROR) << "Could not start the sandbox: " << result.ToString();
-    return absl::UnavailableError(
-        absl::StrCat("Could not start the sandbox: ", result.ToString()));
-  }
-  return absl::OkStatus();
-}
-
-bool Sandbox::is_active() const { return s2_ && !s2_->IsTerminated(); }
-
-absl::Status Sandbox::Allocate(v::Var* var, bool automatic_free) {
+absl::Status SandboxBase::Allocate(v::Var* var, bool automatic_free) {
   if (!is_active()) {
     return absl::UnavailableError("Sandbox not active");
   }
   return var->Allocate(rpc_channel(), automatic_free);
 }
 
-absl::Status Sandbox::Free(v::Var* var) {
+absl::Status SandboxBase::Free(v::Var* var) {
   if (!is_active()) {
     return absl::UnavailableError("Sandbox not active");
   }
   return var->Free(rpc_channel());
 }
 
-absl::Status Sandbox::SynchronizePtrBefore(v::Ptr* p) {
+absl::Status SandboxBase::SynchronizePtrBefore(v::Ptr* p) {
   if (!is_active()) {
     return absl::UnavailableError("Sandbox not active");
   }
@@ -352,7 +152,7 @@ absl::Status Sandbox::SynchronizePtrBefore(v::Ptr* p) {
   return p->GetPointedVar()->TransferToSandboxee(rpc_channel());
 }
 
-absl::Status Sandbox::SynchronizePtrAfter(v::Ptr* p) const {
+absl::Status SandboxBase::SynchronizePtrAfter(v::Ptr* p) const {
   if (!is_active()) {
     return absl::UnavailableError("Sandbox not active");
   }
@@ -377,7 +177,7 @@ absl::Status Sandbox::SynchronizePtrAfter(v::Ptr* p) const {
   return p->GetPointedVar()->TransferFromSandboxee(rpc_channel());
 }
 
-absl::Status Sandbox::Call(
+absl::Status SandboxBase::Call(
     const std::string& func, v::Callable* ret,
     std::initializer_list<internal::PtrOrCallable> args) {
   if (!is_active()) {
@@ -446,7 +246,7 @@ absl::Status Sandbox::Call(
   // Call & receive data.
   FuncRet fret;
   SAPI_RETURN_IF_ERROR(
-      rpc_channel_->Call(rfcall, comms::kMsgCall, &fret, rfcall.ret_type));
+      rpc_channel()->Call(rfcall, comms::kMsgCall, &fret, rfcall.ret_type));
 
   if (fret.ret_type == v::Type::kFloat) {
     memcpy(ret->GetLocal(), &fret.float_val,
@@ -473,38 +273,38 @@ absl::Status Sandbox::Call(
   return absl::OkStatus();
 }
 
-absl::Status Sandbox::Symbol(const char* symname, void** addr) {
+absl::Status SandboxBase::Symbol(const char* symname, void** addr) {
   if (!is_active()) {
     return absl::UnavailableError("Sandbox not active");
   }
-  return rpc_channel_->Symbol(symname, addr);
+  return rpc_channel()->Symbol(symname, addr);
 }
 
-absl::Status Sandbox::TransferToSandboxee(v::Var* var) {
+absl::Status SandboxBase::TransferToSandboxee(v::Var* var) {
   if (!is_active()) {
     return absl::UnavailableError("Sandbox not active");
   }
   return var->TransferToSandboxee(rpc_channel());
 }
 
-absl::Status Sandbox::TransferFromSandboxee(v::Var* var) {
+absl::Status SandboxBase::TransferFromSandboxee(v::Var* var) {
   if (!is_active()) {
     return absl::UnavailableError("Sandbox not active");
   }
   return var->TransferFromSandboxee(rpc_channel());
 }
 
 absl::StatusOr<std::unique_ptr<sapi::v::Array<const uint8_t>>>
-Sandbox::AllocateAndTransferToSandboxee(absl::Span<const uint8_t> buffer) {
+SandboxBase::AllocateAndTransferToSandboxee(absl::Span<const uint8_t> buffer) {
   auto sapi_buffer = std::make_unique<sapi::v::Array<const uint8_t>>(
       buffer.data(), buffer.size());
   SAPI_RETURN_IF_ERROR(Allocate(sapi_buffer.get(), /*automatic_free=*/true));
   SAPI_RETURN_IF_ERROR(TransferToSandboxee(sapi_buffer.get()));
   return sapi_buffer;
 }
 
-absl::StatusOr<std::string> Sandbox::GetCString(const v::RemotePtr& str,
-                                                size_t max_length) {
+absl::StatusOr<std::string> SandboxBase::GetCString(const v::RemotePtr& str,
+                                                    size_t max_length) {
   if (!is_active()) {
     return absl::UnavailableError("Sandbox not active");
   }
@@ -532,20 +332,4 @@ absl::StatusOr<std::string> Sandbox::GetCString(const v::RemotePtr& str,
   return buffer;
 }
 
-const sandbox2::Result& Sandbox::AwaitResult() {
-  if (s2_ && !s2_awaited_) {
-    result_ = s2_->AwaitResult();
-    s2_awaited_ = true;
-  }
-  return result_;
-}
-
-absl::Status Sandbox::SetWallTimeLimit(absl::Duration limit) const {
-  if (!is_active()) {
-    return absl::UnavailableError("Sandbox not active");
-  }
-  s2_->set_walltime_limit(limit);
-  return absl::OkStatus();
-}
-
 }  // namespace sapi