Prepare for auto-generating syscall policy for cc_sandboxed_library

PiperOrigin-RevId: 809027184
Change-Id: Ibedd9b969ccf78698e3dd50014a33ff6ebeba505

Author: dvyukov

sandboxed_api/bazel/sapi.bzl

@@ -510,10 +510,13 @@ def cc_sandboxed_library(
     #       in the sandbox, and will deconstruct string_view into the pair of arguments.
     # 2. Build cc_library with the sandboxee header and source files
     #    and dependency on the original library.
-    # 3. Create a sapi_library for the sandboxee library created at step 2.
+    # 3. Build fake cc_binary with main function that calls all sandbox entry functions
+    #    (and depends on the sandboxed library).
+    # 4. Run syscall extractor on the binary to extract the system call policy.
+    # 5. Create a sapi_library for the sandboxee library created at step 2.
     #    This library also links in the generated host source file,
     #    so that it implements the original library interface verbatim.
-    # 4. Create a transparent replacement rule that pretends to be a cc_library
+    # 6. Create a transparent replacement rule that pretends to be a cc_library
     #    by assembling CcInfo from compilation context of the original library
     #    and linking context of the sapi_library created at step 3.
     #    Using the compilation context of the original library ensures that during
@@ -562,10 +565,13 @@ def cc_sandboxed_library(
         name = "_sapi_" + name,
         lib = ":_sapi_sandboxee_" + name,
         lib_name = wrapper_name,
-        srcs = [name + ".sapi.host.cc"],
+        srcs = [
+            name + ".sapi.host.cc",
+        ],
         generator_version = 2,
         deps = [
             "//sandboxed_api:lenval_core",
+            "//sandboxed_api/sandbox2/util:bpf_helper",
             "@abseil-cpp//absl/log:check",
         ],
         **common

sandboxed_api/testcases/replaced_library.cc

@@ -14,12 +14,25 @@
 
 #include "sandboxed_api/testcases/replaced_library.h"
 
+#include <err.h>
+#include <errno.h>
+#include <sys/epoll.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+
 #include <cstddef>
 #include <cstdint>
 #include <string>
 
 #include "absl/strings/string_view.h"
 
+bool mylib_is_sandboxed() {
+  // Magic sandbox2 syscall number.
+  // Note: we don't use sandbox2::unit::IsRunningInSandbox2 b/c it pulls in
+  // too many dependencies and disturbs the policy too much.
+  return syscall(0xff000fdb) == -1 && errno == 0xfdb;
+}
+
 void mylib_scalar_types(int a0, float a1, double a2, int64_t a3, char a4,
                         bool a5, size_t a6) {}
 
@@ -30,3 +43,38 @@ void mylib_copy(absl::string_view src, std::string& dst) {
 }
 
 int mylib_add(int x, int y) { return x + y; }
+
+// Sanitizer instrumentation may break argument value tracking.
+// In particular, ASan emits a call to __asan_memset to zero ev.
+static __attribute__((noinline, disable_sanitizer_instrumentation)) void
+mylib_epoll_ctl(int cmd) {
+  // Use epoll_ctl as test syscall b/c it's not used otherwise (e.g. by libc)
+  // and has subcommands. Also uninline it to make allowed command tracking
+  // a bit more difficult.
+  epoll_event ev = {};
+  int ret = syscall(SYS_epoll_ctl, -1, cmd, -1, &ev);
+  if (ret == 0 || errno != EBADF)
+    errx(1, "epoll_ctl did not fail as expected: ret=%d, errno=%d", ret, errno);
+}
+
+void mylib_expected_syscall1() { mylib_epoll_ctl(EPOLL_CTL_ADD); }
+
+void mylib_expected_syscall2() { mylib_epoll_ctl(EPOLL_CTL_DEL); }
+
+void mylib_unexpected_syscall1() {
+  epoll_event ev = {};
+  // Hide the syscall number via a volatile access, syscall extractor won't
+  // discover it since it does not track memory accesses. So EPOLL_CTL_MOD
+  // should end up being prohibited (while ADD/DEL should be allowed).
+  static volatile int nr = SYS_epoll_ctl;
+  int ret = syscall(nr, -1, EPOLL_CTL_MOD, -1, &ev);
+  if (ret == 0 || errno != EBADF)
+    errx(1, "epoll_ctl did not fail as expected: ret=%d, errno=%d", ret, errno);
+}
+
+void mylib_unexpected_syscall2() {
+  // This syscall should be prohibited (nothing else in the binary should use
+  // this esoteric syscall).
+  static volatile int nr = SYS_ioprio_get;
+  if (syscall(nr, 1, 0)) errx(1, "ioprio_get failed");
+}

sandboxed_api/testcases/replaced_library.h

@@ -26,10 +26,17 @@
 
 #include "absl/strings/string_view.h"
 
+bool mylib_is_sandboxed();
+
 void mylib_scalar_types(int a0, float a1, double a2, int64_t a3, char a4,
                         bool a5, size_t a6);
 int mylib_add(int x, int y);
 std::string mylib_copy(const std::string& src);
 void mylib_copy(absl::string_view src, std::string& dst);
 
+void mylib_expected_syscall1();
+void mylib_expected_syscall2();
+void mylib_unexpected_syscall1();
+void mylib_unexpected_syscall2();
+
 #endif  // SANDBOXED_API_SANDBOX2_TESTCASES_REPLACED_LIBRARY_H_

sandboxed_api/tools/clang_generator/sandboxed_library_emitter.cc

@@ -77,10 +77,18 @@ constexpr absl::string_view kHeaderHeader =
 )";
 
 constexpr absl::string_view kHostHeader = R"(
+#include <memory>
+
 #include "$0absl/log/check.h"
 #include "$0sandboxed_api/vars.h"
 #include "$0sandboxed_api/sandbox.h"
 
+__attribute__((weak))
+std::unique_ptr<sandbox2::Policy> $1SandboxModifyPolicy(
+    sandbox2::PolicyBuilder* builder) {
+  return builder->BuildOrDie();
+}
+
 struct $1SandboxImpl : public $1Sandbox {
   static $1SandboxImpl* Instance() {
     static $1SandboxImpl instance;
@@ -92,6 +100,11 @@ struct $1SandboxImpl : public $1Sandbox {
   void Check(const absl::Status& status) {
     CHECK_OK(status) << "SAPI sandbox $1 failed";
   }
+
+  std::unique_ptr<sandbox2::Policy> ModifyPolicy(
+      sandbox2::PolicyBuilder* builder) override {
+    return $1SandboxModifyPolicy(builder);
+  }
 };
 
 )";