Add cc_sandboxed_library rule

The rule is supposed to be complete transparent drop-in replacement
for cc_library rules.

Implementation outline:
1. Run clang generator tool in the new replacement mode.
    In this mode it takes all functions declared in the library public headers,
    and generates 3 files:
     - Guest header file with wrappers for the public library functions.
       These wrappers have similar signature to the original functions,
       but also have some differences. For example, absl::string_view would be passed
       as a (const char*, size_t) pair of arguments so that SAPI supports it.
     - Guest source file with implementation of the wrappers that call original functions.
       These wrappers will construct the string_view back from the pair of arguments.
     - Host source file with implementation of the public library functions.
       These implementations use SAPI sandbox to call the generated guest wrappers
       in the sandbox, and will deconstruct string_view into the pair of arguments.
 2. Build cc_library with the guest header and source files
    and dependency on the original library.
 3. Create a sapi_library for the guest library created at step 2.
    This library also links in the generated host source file,
    so that it implements the original library interface verbatim.
 4. Create a transparent replacement rule that pretends to be a cc_library
    by assembling CcInfo from compilation context of the original library
    and linking context of the sapi_library created at step 3.
    Using the compilation context of the original library ensures that during
    compilation the replacement library "looks" exactly as the original library
    (this includes any use of defines/includes and any other cc_library attributes).

PiperOrigin-RevId: 792088247
Change-Id: I1d641d75312a4e24d902347fab3a0ae828eb4159

Author: dvyukov

sandboxed_api/bazel/sapi.bzl

@@ -16,6 +16,7 @@
 
 load("@rules_cc//cc:cc_binary.bzl", "cc_binary")
 load("@rules_cc//cc:cc_library.bzl", "cc_library")
+load("@rules_cc//cc:cc_test.bzl", "cc_test")
 load("//sandboxed_api/bazel:build_defs.bzl", "sapi_platform_copts")
 load("//sandboxed_api/bazel:embed_data.bzl", "sapi_cc_embed_data")
 load(
@@ -72,6 +73,42 @@ def sort_deps(deps):
     other_deps = [x for x in deps if not x.startswith(":")]
     return sorted(colon_deps) + sorted(other_deps)
 
+def _clang_generator_flags(cc_ctx, cpp_toolchain):
+    flags = []
+
+    # TODO(cblichmann): Get language standard from the toolchain
+    flags.append("--extra-arg=-std=c++17")
+
+    # Disable warnings in parsed code
+    flags.append("--extra-arg=-Wno-everything")
+    flags += ["--extra-arg=-D{}".format(d) for d in cc_ctx.defines.to_list()]
+    flags += ["--extra-arg=-isystem{}".format(i) for i in cc_ctx.system_includes.to_list()]
+    flags += ["--extra-arg=-iquote{}".format(i) for i in cc_ctx.quote_includes.to_list()]
+    flags += ["--extra-arg=-I{}".format(d) for d in cc_ctx.includes.to_list()]
+    return flags
+
+def _lib_direct_headers(lib, cc_ctx):
+    headers = []
+    for h in cc_ctx.direct_headers:
+        if h.extension != "h" or "/PROTECTED/" in h.path:
+            continue
+
+        # Include only headers coming from the target
+        # not ones that it depends on by comparing the label packages.
+        if (h.owner.package == lib.label.package):
+            headers.append(h.path)
+
+    return headers
+
+def _clang_format_file(src, out, **kwargs):
+    native.genrule(
+        name = "_format_" + out,
+        srcs = [":" + src],
+        outs = [out],
+        cmd = "cp $< $@",
+        **kwargs
+    )
+
 def _sapi_interface_impl(ctx):
     cpp_toolchain = find_cpp_toolchain(ctx)
     generator = select_generator(ctx)
@@ -113,16 +150,7 @@ def _sapi_interface_impl(ctx):
 
     if use_clang_generator:
         input_files += cpp_toolchain.all_files.to_list()
-
-        # TODO(cblichmann): Get language standard from the toolchain
-        extra_flags.append("--extra-arg=-std=c++17")
-
-        # Disable warnings in parsed code
-        extra_flags.append("--extra-arg=-Wno-everything")
-        extra_flags += ["--extra-arg=-D{}".format(d) for d in cc_ctx.defines.to_list()]
-        extra_flags += ["--extra-arg=-isystem{}".format(i) for i in cc_ctx.system_includes.to_list()]
-        extra_flags += ["--extra-arg=-iquote{}".format(i) for i in cc_ctx.quote_includes.to_list()]
-        extra_flags += ["--extra-arg=-I{}".format(d) for d in cc_ctx.includes.to_list()]
+        extra_flags += _clang_generator_flags(cc_ctx, cpp_toolchain)
     else:
         append_all(extra_flags, "-D", cc_ctx.defines.to_list())
         append_all(extra_flags, "-isystem", cc_ctx.system_includes.to_list())
@@ -135,14 +163,7 @@ def _sapi_interface_impl(ctx):
             input_files_paths.append(f.path)
     else:
         # Try to find files automatically
-        for h in cc_ctx.direct_headers:
-            if h.extension != "h" or "/PROTECTED/" in h.path:
-                continue
-
-            # Include only headers coming from the target
-            # not ones that it depends on by comparing the label packages.
-            if (h.owner.package == ctx.attr.lib.label.package):
-                input_files_paths.append(h.path)
+        input_files_paths += _lib_direct_headers(ctx.attr.lib, cc_ctx)
 
     if use_clang_generator:
         args += extra_flags + input_files_paths
@@ -231,6 +252,16 @@ def symbol_list_gen(name, lib, out, **kwargs):
         **kwargs
     )
 
+def _common_kwargs(tags, visibility, compatible_with):
+    common = {
+        "tags": tags,
+    }
+    if visibility:
+        common["visibility"] = visibility
+    if compatible_with != None:
+        common["compatible_with"] = compatible_with
+    return common
+
 def sapi_library(
         name,
         lib,
@@ -298,15 +329,7 @@ def sapi_library(
       exec_properties: Dict of executable properties to be passed to the generated binary targets.
     """
 
-    common = {
-        "tags": tags,
-    }
-    if visibility:
-        common["visibility"] = visibility
-
-    if compatible_with != None:
-        common["compatible_with"] = compatible_with
-
+    common = _common_kwargs(tags, visibility, compatible_with)
     generated_header = name + ".sapi.h"
 
     # Reference (pull into the archive) required functions only. If the functions'
@@ -350,7 +373,7 @@ def sapi_library(
         **common
     )
 
-    native.cc_binary(
+    cc_binary(
         name = name + ".bin",
         linkopts = [
             "-ldl",  # For dlopen(), dlsym()
@@ -393,7 +416,7 @@ def sapi_library(
         lib = lib,
         functions = functions,
         input_files = input_files,
-        out = generated_header,
+        out = generated_header + ".unformatted",
         embed_name = embed_name,
         embed_dir = embed_dir,
         namespace = namespace,
@@ -402,3 +425,210 @@ def sapi_library(
         limit_scan_depth = limit_scan_depth,
         **common
     )
+
+    _clang_format_file(generated_header + ".unformatted", generated_header, **common)
+
+def cc_sandboxed_library(
+        name,
+        lib,
+        tags = [],
+        visibility = None,
+        compatible_with = None):
+    """Creates a sandboxed drop-in replacement cc_library.
+
+    NOTE: this functionality is experimental and may change in the future.
+
+    The resulting library can be used instead of the original cc_library
+    as dependency for other targets. The behavior is supposed to be identical
+    to the original library, except that the library is sandboxed with a single
+    global sandbox instance.
+
+    Only limited set of types is supported in signatures of the library public
+    functions. Any unsupported types will cause build failure.
+
+    Any crashes or violations in the sandbox process crash the host process.
+
+    Args:
+      name: Name of the target
+      lib: Label of the cc_library target to sandbox
+      tags: Same as cc_library.tags
+      visibility: Same as cc_library.visibility
+      compatible_with: Same as cc_library.compatible_with
+    """
+
+    # Implementation outline:
+    # 1. Run clang generator tool in sandboxed library mode.
+    #    In this mode it takes all functions declared in the library public headers,
+    #    and generates 3 files:
+    #     - Sandboxee header file with wrappers for the public library functions.
+    #       These wrappers have similar signature to the original functions,
+    #       but also have some differences. For example, absl::string_view would be passed
+    #       as a (const char*, size_t) pair of arguments so that SAPI supports it.
+    #     - Sandboxee source file with implementation of the wrappers that call original functions.
+    #       These wrappers will construct the string_view back from the pair of arguments.
+    #     - Host source file with implementation of the public library functions.
+    #       These implementations use SAPI sandbox to call the generated sandboxee wrappers
+    #       in the sandbox, and will deconstruct string_view into the pair of arguments.
+    # 2. Build cc_library with the sandboxee header and source files
+    #    and dependency on the original library.
+    # 3. Create a sapi_library for the sandboxee library created at step 2.
+    #    This library also links in the generated host source file,
+    #    so that it implements the original library interface verbatim.
+    # 4. Create a transparent replacement rule that pretends to be a cc_library
+    #    by assembling CcInfo from compilation context of the original library
+    #    and linking context of the sapi_library created at step 3.
+    #    Using the compilation context of the original library ensures that during
+    #    compilation the replacement library "looks" exactly as the original library
+    #    (this includes any use of defines/includes and any other cc_library attributes).
+
+    # Unique prefix for things generated by sapi_library (e.g. FooSandbox class name).
+    # TODO(dvyukov): add hash/flattening of the full library /path:name, just the name is not
+    # necessarily globally unique.
+    wrapper_name = "Sapi" + name
+    common = _common_kwargs(tags, visibility, compatible_with)
+
+    _sandboxed_library_gen(
+        name = "_sandboxed_library_gen_" + name,
+        lib = lib,
+        lib_name = wrapper_name,
+        sandboxee_hdr_out = name + ".sapi.sandboxee.h.unformatted",
+        sandboxee_src_out = name + ".sapi.sandboxee.cc.unformatted",
+        host_src_out = name + ".sapi.host.cc.unformatted",
+        sapi_hdr = native.package_name() + "/_sapi_" + name + ".sapi.h",
+        **common
+    )
+
+    _clang_format_file(name + ".sapi.sandboxee.h.unformatted", name + ".sapi.sandboxee.h", **common)
+    _clang_format_file(name + ".sapi.sandboxee.cc.unformatted", name + ".sapi.sandboxee.cc", **common)
+    _clang_format_file(name + ".sapi.host.cc.unformatted", name + ".sapi.host.cc", **common)
+
+    cc_library(
+        name = "_sapi_sandboxee_" + name,
+        hdrs = [":" + name + ".sapi.sandboxee.h"],
+        srcs = [":" + name + ".sapi.sandboxee.cc"],
+        # Work-around broken global sapi_library mode (when functions are empty).
+        # When functions are not empty, sapi_library adds -Wl,-u linker flags
+        # that force linking of the sandboxee library. In global mode, it won't be linked.
+        alwayslink = 1,
+        deps = [
+            lib,
+            "//sandboxed_api:lenval_core",
+        ],
+        **common
+    )
+
+    sapi_library(
+        name = "_sapi_" + name,
+        lib = ":_sapi_sandboxee_" + name,
+        lib_name = wrapper_name,
+        srcs = [name + ".sapi.host.cc"],
+        generator_version = 2,
+        deps = [
+            "//sandboxed_api:lenval_core",
+            "@abseil-cpp//absl/log:check",
+        ],
+        **common
+    )
+
+    _sandboxed_library(
+        name = name,
+        lib = lib,
+        sapi = ":_sapi_" + name,
+        **common
+    )
+
+_sandboxed_library = rule(
+    provides = [CcInfo],
+    attrs = {
+        "lib": attr.label(providers = [CcInfo]),
+        "sapi": attr.label(providers = [CcInfo]),
+    },
+    implementation = lambda ctx: [CcInfo(
+        compilation_context = ctx.attr.lib[CcInfo].compilation_context,
+        linking_context = ctx.attr.sapi[CcInfo].linking_context,
+    )],
+)
+
+def cc_sandboxed_library_test(
+        name,
+        lib,
+        sandboxed_lib,
+        deps = [],
+        **kwargs):
+    """Creates a pair of sandboxed/unsandboxed cc_test's for cc_sandboxed_library.
+
+    NOTE: this functionality is experimental and may change in the future.
+
+    This rule is supposed to be a replacement for any cc_test's for a library
+    that is used with cc_sandboxed_library. It creates a pair of cc_test's
+    that test both sandboxed and unsandboxed versions of the library.
+
+    Args:
+      name: Name of the target
+      lib: Label of the normal unsandboxed cc_library target
+      sandboxed_lib: Label of the cc_sandboxed_library target for the lib
+      deps: Same as cc_library.deps, must not include lib/sandboxed_lib
+      **kwargs: Passed to resulting cc_test's
+    """
+
+    cc_test(
+        name = name + "_unsandboxed",
+        deps = deps + [lib],
+        **kwargs
+    )
+
+    cc_test(
+        name = name + "_sandboxed",
+        deps = deps + [sandboxed_lib],
+        **kwargs
+    )
+
+    native.test_suite(
+        name = name,
+        tests = [
+            ":" + name + "_unsandboxed",
+            ":" + name + "_sandboxed",
+        ],
+    )
+
+def _sandboxed_library_gen_impl(ctx):
+    cpp_toolchain = find_cpp_toolchain(ctx)
+    cc_ctx = ctx.attr.lib[CcInfo].compilation_context
+
+    args = []
+    args.append("--sandboxed_library_gen")
+    args.append("--sapi_name={}".format(ctx.attr.lib_name))
+    args.append("--sandboxee_hdr_out={}".format(ctx.outputs.sandboxee_hdr_out.path))
+    args.append("--sandboxee_src_out={}".format(ctx.outputs.sandboxee_src_out.path))
+    args.append("--host_src_out={}".format(ctx.outputs.host_src_out.path))
+    args.append("--sapi_out={}".format(ctx.attr.sapi_hdr))
+    args.append("--sapi_limit_scan_depth")
+    args += _clang_generator_flags(cc_ctx, cpp_toolchain)
+    args += _lib_direct_headers(ctx.attr.lib, cc_ctx)
+
+    progress_msg = "Generating sandboxed library {}.".format(ctx.attr.lib_name)
+    ctx.actions.run(
+        inputs = cc_ctx.headers.to_list() + cpp_toolchain.all_files.to_list(),
+        outputs = [ctx.outputs.sandboxee_hdr_out, ctx.outputs.sandboxee_src_out, ctx.outputs.host_src_out],
+        arguments = args,
+        mnemonic = "SandboxedLibraryGen",
+        progress_message = progress_msg,
+        executable = ctx.executable._generator,
+    )
+
+# Build rule that generates SAPI interface.
+_sandboxed_library_gen = rule(
+    implementation = _sandboxed_library_gen_impl,
+    attrs = {
+        "lib": attr.label(providers = [CcInfo]),
+        "lib_name": attr.string(),
+        "sandboxee_hdr_out": attr.output(),
+        "sandboxee_src_out": attr.output(),
+        "host_src_out": attr.output(),
+        "sapi_hdr": attr.string(),
+        "_generator": make_exec_label(
+            "//sandboxed_api/tools/clang_generator:generator_tool",
+        ),
+    },
+    toolchains = use_cpp_toolchain(),
+)

sandboxed_api/testcases/BUILD

@@ -0,0 +1,48 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
+load("//sandboxed_api/bazel:sapi.bzl", "cc_sandboxed_library", "cc_sandboxed_library_test")
+
+package(default_visibility = ["//visibility:private"])
+
+licenses(["notice"])
+
+cc_library(
+    name = "replaced_library",
+    srcs = ["replaced_library.cc"],
+    hdrs = ["replaced_library.h"],
+    deps = [
+        "@abseil-cpp//absl/strings:string_view",
+    ],
+)
+
+cc_sandboxed_library(
+    name = "replacement_library",
+    lib = ":replaced_library",
+)
+
+cc_sandboxed_library_test(
+    name = "replaced_test",
+    srcs = ["replaced_library_test.cc"],
+    lib = ":replaced_library",
+    sandboxed_lib = ":replacement_library",
+    # TSan/MSan may change ABI and name mangling, but the clang tool is not invoked
+    # correctly (the same way as the actual build) and produces wrong symbol names.
+    tags = [
+        "nomsan",
+        "notsan",
+    ],
+    deps = ["@googletest//:gtest_main"],
+)