Automated rollback of commit 86155ba.

PiperOrigin-RevId: 811777386
Change-Id: I8137a57e9e6838a0feed46d84d2cdce8cc60720b

Author: Sandboxed API Team

sandboxed_api/sandbox2/BUILD

@@ -270,14 +270,14 @@ cc_library(
         ":comms",
         ":flags",
         ":fork_client",
-        ":forkserver",
         ":forkserver_bin_embed",
         ":forkserver_cc_proto",
         ":util",
         "//sandboxed_api:config",
         "//sandboxed_api:embed_file",
         "//sandboxed_api/util:fileops",
         "//sandboxed_api/util:raw_logging",
+        "//sandboxed_api/util:status",
         "@abseil-cpp//absl/base:core_headers",
         "@abseil-cpp//absl/cleanup",
         "@abseil-cpp//absl/flags:flag",
@@ -316,6 +316,7 @@ cc_library(
         ":limits",
         ":namespace",
         ":util",
+        "//sandboxed_api:config",
         "//sandboxed_api/util:fileops",
         "@abseil-cpp//absl/base:core_headers",
         "@abseil-cpp//absl/log",
@@ -638,7 +639,6 @@ cc_library(
         "//sandboxed_api/util:fileops",
         "//sandboxed_api/util:raw_logging",
         "//sandboxed_api/util:strerror",
-        "@abseil-cpp//absl/algorithm:container",
         "@abseil-cpp//absl/base:core_headers",
         "@abseil-cpp//absl/container:flat_hash_map",
         "@abseil-cpp//absl/container:flat_hash_set",

sandboxed_api/sandbox2/CMakeLists.txt

@@ -249,7 +249,6 @@ target_link_libraries(sandbox2_global_forkserver
           absl::log
           sandbox2::client
           sandbox2::flags
-          sandbox2::forkserver
           sandbox2::forkserver_bin_embed
           sandbox2::util
           sapi::strerror
@@ -258,6 +257,7 @@ target_link_libraries(sandbox2_global_forkserver
           sapi::embed_file
           sapi::fileops
           sapi::raw_logging
+          sapi::status
   PUBLIC absl::core_headers
          absl::flags
          absl::synchronization
@@ -301,6 +301,7 @@ target_link_libraries(sandbox2_executor
          absl::span
          absl::statusor
          absl::strings
+         sapi::config
          sapi::fileops
          sapi::status
          sandbox2::fork_client
@@ -594,8 +595,7 @@ add_library(sandbox2_forkserver ${SAPI_LIB_TYPE}
 )
 add_library(sandbox2::forkserver ALIAS sandbox2_forkserver)
 target_link_libraries(sandbox2_forkserver
-  PRIVATE absl::algorithm_container
-          absl::flat_hash_map
+  PRIVATE absl::flat_hash_map
           absl::flat_hash_set
           absl::status
           absl::statusor

sandboxed_api/sandbox2/executor.cc

@@ -20,6 +20,7 @@
 #include <sys/socket.h>
 #include <unistd.h>
 
+#include <algorithm>
 #include <cerrno>
 #include <cstdint>
 #include <memory>
@@ -29,8 +30,10 @@
 #include "absl/log/log.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
+#include "absl/strings/match.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
+#include "sandboxed_api/config.h"
 #include "sandboxed_api/sandbox2/fork_client.h"
 #include "sandboxed_api/sandbox2/forkserver.pb.h"
 #include "sandboxed_api/sandbox2/global_forkclient.h"
@@ -43,7 +46,40 @@ namespace sandbox2 {
 
 namespace file_util = ::sapi::file_util;
 
-namespace {}  // namespace
+namespace {
+void DisableCompressStackDepot(ForkRequest& request) {
+  auto disable_compress_stack_depot = [&request](absl::string_view sanitizer) {
+    auto prefix = absl::StrCat(sanitizer, "_OPTIONS=");
+    auto it = std::find_if(request.mutable_envs()->begin(),
+                           request.mutable_envs()->end(),
+                           [&prefix](const std::string& env) {
+                             return absl::StartsWith(env, prefix);
+                           });
+    constexpr absl::string_view option = "compress_stack_depot=0";
+    if (it != request.mutable_envs()->end()) {
+      // If it's already there, the last value will be used.
+      absl::StrAppend(&*it, ":", option);
+      return;
+    }
+    request.add_envs(absl::StrCat(prefix, option));
+  };
+  if constexpr (sapi::sanitizers::IsASan()) {
+    disable_compress_stack_depot("ASAN");
+  }
+  if constexpr (sapi::sanitizers::IsMSan()) {
+    disable_compress_stack_depot("MSAN");
+  }
+  if constexpr (sapi::sanitizers::IsLSan()) {
+    disable_compress_stack_depot("LSAN");
+  }
+  if constexpr (sapi::sanitizers::IsHwASan()) {
+    disable_compress_stack_depot("HWSAN");
+  }
+  if constexpr (sapi::sanitizers::IsTSan()) {
+    disable_compress_stack_depot("TSAN");
+  }
+}
+}  // namespace
 
 std::vector<std::string> Executor::CopyEnviron() {
   return util::CharPtrArray(environ).ToStringVector();
@@ -86,6 +122,11 @@ absl::StatusOr<SandboxeeProcess> Executor::StartSubProcess(
                                   file_util::fileops::StripBasename(path_)));
   }
 
+  // Disable optimization to avoid related syscalls.
+  if constexpr (sapi::sanitizers::IsAny()) {
+    DisableCompressStackDepot(request);
+  }
+
   // If neither the path, nor exec_fd is specified, just assume that we need to
   // send a fork request.
   //

sandboxed_api/sandbox2/forkserver.cc

@@ -40,7 +40,6 @@
 #include <utility>
 #include <vector>
 
-#include "absl/algorithm/container.h"
 #include "absl/base/attributes.h"
 #include "absl/container/flat_hash_map.h"
 #include "absl/container/flat_hash_set.h"
@@ -263,39 +262,6 @@ bool IsLikelyChrooted() {
   return *self_root_id != *init_root_id;
 }
 
-template <typename C, typename AddFn>
-void DisableCompressStackDepotImpl(C& envs, AddFn&& add_env) {
-  auto disable_compress_stack_depot = [&envs,
-                                       &add_env](absl::string_view sanitizer) {
-    auto prefix = absl::StrCat(sanitizer, "_OPTIONS=");
-    constexpr absl::string_view option = "compress_stack_depot=0";
-    auto it = absl::c_find_if(envs, [&prefix](const std::string& env) {
-      return absl::StartsWith(env, prefix);
-    });
-    if (it != envs.end()) {
-      // If it's already there, the last value will be used.
-      absl::StrAppend(&*it, ":", option);
-      return;
-    }
-    add_env(absl::StrCat(prefix, option));
-  };
-  if constexpr (sapi::sanitizers::IsASan()) {
-    disable_compress_stack_depot("ASAN");
-  }
-  if constexpr (sapi::sanitizers::IsMSan()) {
-    disable_compress_stack_depot("MSAN");
-  }
-  if constexpr (sapi::sanitizers::IsLSan()) {
-    disable_compress_stack_depot("LSAN");
-  }
-  if constexpr (sapi::sanitizers::IsHwASan()) {
-    disable_compress_stack_depot("HWSAN");
-  }
-  if constexpr (sapi::sanitizers::IsTSan()) {
-    disable_compress_stack_depot("TSAN");
-  }
-}
-
 }  // namespace
 
 void ForkServer::PrepareExecveArgs(const ForkRequest& request,
@@ -325,12 +291,6 @@ void ForkServer::PrepareExecveArgs(const ForkRequest& request,
                 absl::StrJoin(*envp, "', '").c_str());
 }
 
-void ForkServer::DisableCompressStackDepot(std::vector<std::string>& envs) {
-  DisableCompressStackDepotImpl(envs, [&envs](absl::string_view value) {
-    envs.push_back(std::string(value));
-  });
-}
-
 void ForkServer::LaunchChild(const ForkRequest& request, int execve_fd,
                              uid_t uid, gid_t gid, FDCloser signaling_fd,
                              FDCloser status_fd, bool avoid_pivot_root) const {
@@ -448,14 +408,6 @@ pid_t ForkServer::ServeRequest() {
     SAPI_RAW_CHECK(comms_->RecvFD(&exec_fd), "Failed to receive Exec FD");
   }
 
-  // Disable optimization to avoid related syscalls.
-  if constexpr (sapi::sanitizers::IsAny()) {
-    DisableCompressStackDepotImpl(*fork_request.mutable_envs(),
-                                  [&fork_request](absl::string_view value) {
-                                    fork_request.add_envs(value);
-                                  });
-  }
-
   // Make the kernel notify us with SIGCHLD when the process terminates.
   // We use sigaction(SIGCHLD, flags=SA_NOCLDWAIT) in combination with
   // this to make sure the zombie process is reaped immediately.

sandboxed_api/sandbox2/forkserver.h

@@ -52,8 +52,6 @@ class ForkServer {
   // Returns values defined as with fork() (-1 means error).
   pid_t ServeRequest();
 
-  static void DisableCompressStackDepot(std::vector<std::string>& envs);
-
  private:
   // Creates and launched the child process.
   void LaunchChild(const ForkRequest& request, int execve_fd, uid_t uid,

sandboxed_api/sandbox2/global_forkclient.cc

@@ -27,7 +27,6 @@
 #include <cstdlib>
 #include <memory>
 #include <string>
-#include <vector>
 
 #include "absl/base/const_init.h"
 #include "absl/cleanup/cleanup.h"
@@ -42,7 +41,6 @@
 #include "sandboxed_api/embed_file.h"
 #include "sandboxed_api/sandbox2/comms.h"
 #include "sandboxed_api/sandbox2/fork_client.h"
-#include "sandboxed_api/sandbox2/forkserver.h"
 #include "sandboxed_api/sandbox2/forkserver_bin_embed.h"
 #include "sandboxed_api/sandbox2/util.h"
 #include "sandboxed_api/util/fileops.h"
@@ -61,7 +59,6 @@ GlobalForkserverStartModeSet GetForkserverStartMode() {
 struct ForkserverArgs {
   int exec_fd;
   int comms_fd;
-  const char* const* envp;
 };
 
 int LaunchForkserver(void* vargs) {
@@ -81,7 +78,7 @@ int LaunchForkserver(void* vargs) {
 
   char proc_name[] = "S2-FORK-SERV";
   char* const argv[] = {proc_name, nullptr};
-  util::Execveat(args->exec_fd, "", argv, args->envp, AT_EMPTY_PATH);
+  util::Execveat(args->exec_fd, "", argv, environ, AT_EMPTY_PATH);
   SAPI_RAW_PLOG(FATAL, "Could not launch forkserver binary");
 }
 
@@ -131,13 +128,9 @@ absl::StatusOr<std::unique_ptr<GlobalForkClient>> StartGlobalForkServer() {
   absl::Cleanup stack_dealloc = [stack, stack_size] {
     munmap(stack, stack_size);
   };
-  std::vector<std::string> env = util::CharPtrArray(environ).ToStringVector();
-  ForkServer::DisableCompressStackDepot(env);
-  util::CharPtrArray envp = util::CharPtrArray::FromStringVector(env);
   ForkserverArgs args = {
       .exec_fd = exec_fd,
       .comms_fd = sv[0],
-      .envp = envp.data(),
   };
   pid_t pid = clone(LaunchForkserver, &stack[stack_size], clone_flags, &args,
                     nullptr, nullptr, nullptr);