google / sandboxed-api Goto Github PK

we have a SDK has multi so and in different folder, and the SDK also dynamic load some so such as libssl.so, can framework support these case?

See title. Not everyone likes to/can use Bazel to develop their applications. CMake auto-generates build scripts and project files for various build tools, so it is a natural choice for C++ projects.

If a function uses fd_set as an argument, the generator generates bogus and syntactically incorrect code. It should fail with a better error message instead.

when follow the guide to build curl example, I find these has no curl submodule in oss-internship-2020/curl/curl_wrapper
git submodule update --init --recursive

SAPI provides nice abstraction for calling from the host into the sandbox. Is there a way to use same abstractions to facilitate calls in reverse direction - from sandbox into the host?
In my case that would allow sandbox to pull optional data from the host if it needs it.

Not sure what the best way to prevent that is.

I want to know

This causes linker errors:

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(ascii.cc.o)
>>> referenced by ascii.cc
>>>               ascii.cc.o:(absl::RemoveExtraAsciiWhitespace(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(ascii.cc.o)
>>> referenced by ascii.cc
>>>               ascii.cc.o:(absl::RemoveExtraAsciiWhitespace(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(ascii.cc.o)
>>> referenced by ascii.cc
>>>               ascii.cc.o:(absl::StripAsciiWhitespace(std::basic_string_view<char, std::char_traits<char> >)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(ascii.cc.o)
>>> referenced by ascii.cc
>>>               ascii.cc.o:(absl::StripAsciiWhitespace(std::basic_string_view<char, std::char_traits<char> >)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(str_cat.cc.o)
>>> referenced by str_cat.cc
>>>               str_cat.cc.o:(absl::StrAppend(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*, absl::AlphaNum const&)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(numbers.cc.o)
>>> referenced by numbers.cc
>>>               numbers.cc.o:(absl::SimpleAtob(std::basic_string_view<char, std::char_traits<char> >, bool*)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(numbers.cc.o)
>>> referenced by numbers.cc
>>>               numbers.cc.o:(absl::SimpleAtob(std::basic_string_view<char, std::char_traits<char> >, bool*)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(numbers.cc.o)
>>> referenced by numbers.cc
>>>               numbers.cc.o:(absl::SimpleAtob(std::basic_string_view<char, std::char_traits<char> >, bool*)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(numbers.cc.o)
>>> referenced by numbers.cc
>>>               numbers.cc.o:(absl::SimpleAtob(std::basic_string_view<char, std::char_traits<char> >, bool*)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(numbers.cc.o)
>>> referenced by numbers.cc
>>>               numbers.cc.o:(absl::SimpleAtob(std::basic_string_view<char, std::char_traits<char> >, bool*)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(numbers.cc.o)
>>> referenced by numbers.cc
>>>               numbers.cc.o:(absl::SimpleAtob(std::basic_string_view<char, std::char_traits<char> >, bool*)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(numbers.cc.o)
>>> referenced by numbers.cc
>>>               numbers.cc.o:(absl::SimpleAtob(std::basic_string_view<char, std::char_traits<char> >, bool*)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(numbers.cc.o)
>>> referenced by numbers.cc
>>>               numbers.cc.o:(absl::SimpleAtob(std::basic_string_view<char, std::char_traits<char> >, bool*)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(numbers.cc.o)
>>> referenced by numbers.cc
>>>               numbers.cc.o:(absl::SimpleAtob(std::basic_string_view<char, std::char_traits<char> >, bool*)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(numbers.cc.o)
>>> referenced by numbers.cc
>>>               numbers.cc.o:(absl::SimpleAtob(std::basic_string_view<char, std::char_traits<char> >, bool*)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(numbers.cc.o)
>>> referenced by numbers.cc
>>>               numbers.cc.o:(absl::SimpleAtob(std::basic_string_view<char, std::char_traits<char> >, bool*)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(numbers.cc.o)
>>> referenced by numbers.cc
>>>               numbers.cc.o:(absl::SimpleAtob(std::basic_string_view<char, std::char_traits<char> >, bool*)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32 against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(numbers.cc.o)
>>> referenced by numbers.cc
>>>               numbers.cc.o:(absl::SimpleAtob(std::basic_string_view<char, std::char_traits<char> >, bool*)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32S against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(numbers.cc.o)
>>> referenced by numbers.cc
>>>               numbers.cc.o:(absl::numbers_internal::FastIntToBuffer(unsigned int, char*)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

ld: error: can't create dynamic relocation R_X86_64_32S against local symbol in readonly segment; recompile object files with -fPIC or pass '-Wl,-z,notext' to allow text relocations in the output
>>> defined in _deps/absl-build/absl/strings/libabsl_strings.a(numbers.cc.o)
>>> referenced by numbers.cc
>>>               numbers.cc.o:(absl::numbers_internal::FastIntToBuffer(unsigned long, char*)) in archive _deps/absl-build/absl/strings/libabsl_strings.a

My workspace configurations are the following: Kubuntu 20.04, GNU GCC 9.3, CMake 3.16.3.

I tried to build and install the library using CMake. For that I run the following commands:

cmake .
make
make install

The build was successful, but when I ran make install did nothing but printed the following:

As far as I understand make install should've put header files and shared objects to /usr/local folder by default, isn't it right? If so, how can I fix this issue?

See relevant bazelbuild/bazel#5816. For now our OSS builds need do set --incompatible_depset_is_not_iterable=false.

I use master version to test curl, there has build error

mkdir -p build
cd build 
cmake .. -G Ninja -D SAPI_ROOT=/home/user/sandbox/curl/sandboxed-api
cmake --build .

sandbox/curl/sandboxed-api/oss-internship-2020/curl/build$ cmake --build .
[2/4] Building CXX object tests/CMakeFiles/tests.dir/tests.cc.o
FAILED: tests/CMakeFiles/tests.dir/tests.cc.o 
/usr/bin/c++  -DGOOGLE_GLOG_DLL_DECL="" -I. -Iabsl-src -Iprotobuf-src/src -Iglog-build -Iglog-src/src -Igflags-build/include -Isandboxed-api-build -I/home/user/sandbox/curl/sandboxed-api -isystem googletest-src/googletest/include -isystem googletest-src/googletest -isystem googletest-src/googlemock/include -isystem googletest-src/googlemock -fPIE   -pthread -Wno-deprecated -Wno-deprecated-declarations -Wno-psabi -std=gnu++17 -MD -MT tests/CMakeFiles/tests.dir/tests.cc.o -MF tests/CMakeFiles/tests.dir/tests.cc.o.d -o tests/CMakeFiles/tests.dir/tests.cc.o -c ../tests/tests.cc
In file included from ../tests/test_utils.h:23,
                 from ../tests/tests.cc:15:
../tests/tests.cc: In member function 'virtual void {anonymous}::CurlTest_EffectivePort_Test::TestBody()':
../tests/tests.cc:63:59: error: 'CURLINFO_PRIMARY_PORT' was not declared in this scope
                                              curl_.get(), CURLINFO_PRIMARY_PORT,
                                                           ^~~~~~~~~~~~~~~~~~~~~
/home/user/sandbox/curl/sandboxed-api/sandboxed_api/util/status_matchers.h:31:20: note: in definition of macro 'SAPI_ASSERT_OK_AND_ASSIGN_IMPL'
   auto statusor = (rexpr);                                   \
                    ^~~~~
../tests/tests.cc:62:3: note: in expansion of macro 'SAPI_ASSERT_OK_AND_ASSIGN'
   SAPI_ASSERT_OK_AND_ASSIGN(int getinfo_code, api_->curl_easy_getinfo_ptr(
   ^~~~~~~~~~~~~~~~~~~~~~~~~
../tests/tests.cc:63:59: note: suggested alternative:
                                              curl_.get(), CURLINFO_PRIMARY_PORT,
                                                           ^~~~~~~~~~~~~~~~~~~~~
/home/user/sandbox/curl/sandboxed-api/sandboxed_api/util/status_matchers.h:31:20: note: in definition of macro 'SAPI_ASSERT_OK_AND_ASSIGN_IMPL'
   auto statusor = (rexpr);                                   \
                    ^~~~~
../tests/tests.cc:62:3: note: in expansion of macro 'SAPI_ASSERT_OK_AND_ASSIGN'
   SAPI_ASSERT_OK_AND_ASSIGN(int getinfo_code, api_->curl_easy_getinfo_ptr(
   ^~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../tests/../sandbox.h:24,
                 from ../tests/test_utils.h:18,
                 from ../tests/tests.cc:15:
./curl_sapi.sapi.h:187:2: note:   'CURLINFO_PRIMARY_PORT'
  CURLINFO_PRIMARY_PORT = CURLINFO_LONG + 40 ,
  ^~~~~~~~~~~~~~~~~~~~~
In file included from googletest-src/googletest/include/gtest/gtest.h:384,
                 from ../tests/test_utils.h:20,
                 from ../tests/tests.cc:15:
../tests/tests.cc:65:27: error: 'CURLE_OK' was not declared in this scope
   ASSERT_EQ(getinfo_code, CURLE_OK);
                           ^~~~~~~~
../tests/tests.cc:65:27: note: suggested alternative:
In file included from ../tests/../sandbox.h:24,
                 from ../tests/test_utils.h:18,
                 from ../tests/tests.cc:15:
./curl_sapi.sapi.h:39:2: note:   'CURLE_OK'
  CURLE_OK = 0 ,
  ^~~~~~~~
In file included from ../tests/test_utils.h:23,
                 from ../tests/tests.cc:15:
../tests/tests.cc: In member function 'virtual void {anonymous}::CurlTest_ContentType_Test::TestBody()':
../tests/tests.cc:94:59: error: 'CURLINFO_CONTENT_TYPE' was not declared in this scope
                                              curl_.get(), CURLINFO_CONTENT_TYPE,
                                                           ^~~~~~~~~~~~~~~~~~~~~
/home/user/sandbox/curl/sandboxed-api/sandboxed_api/util/status_matchers.h:31:20: note: in definition of macro 'SAPI_ASSERT_OK_AND_ASSIGN_IMPL'
   auto statusor = (rexpr);                                   \
                    ^~~~~
../tests/tests.cc:93:3: note: in expansion of macro 'SAPI_ASSERT_OK_AND_ASSIGN'
   SAPI_ASSERT_OK_AND_ASSIGN(int getinfo_code, api_->curl_easy_getinfo_ptr(
   ^~~~~~~~~~~~~~~~~~~~~~~~~
../tests/tests.cc:94:59: note: suggested alternative:
                                              curl_.get(), CURLINFO_CONTENT_TYPE,
                                                           ^~~~~~~~~~~~~~~~~~~~~
/home/user/sandbox/curl/sandboxed-api/sandboxed_api/util/status_matchers.h:31:20: note: in definition of macro 'SAPI_ASSERT_OK_AND_ASSIGN_IMPL'
   auto statusor = (rexpr);                                   \
                    ^~~~~
../tests/tests.cc:93:3: note: in expansion of macro 'SAPI_ASSERT_OK_AND_ASSIGN'
   SAPI_ASSERT_OK_AND_ASSIGN(int getinfo_code, api_->curl_easy_getinfo_ptr(
   ^~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../tests/../sandbox.h:24,
                 from ../tests/test_utils.h:18,
                 from ../tests/tests.cc:15:
./curl_sapi.sapi.h:165:2: note:   'CURLINFO_CONTENT_TYPE'
  CURLINFO_CONTENT_TYPE = CURLINFO_STRING + 18 ,
  ^~~~~~~~~~~~~~~~~~~~~
In file included from googletest-src/googletest/include/gtest/gtest.h:384,
                 from ../tests/test_utils.h:20,
                 from ../tests/tests.cc:15:
../tests/tests.cc:96:27: error: 'CURLE_OK' was not declared in this scope
   ASSERT_EQ(getinfo_code, CURLE_OK);
                           ^~~~~~~~
../tests/tests.cc:96:27: note: suggested alternative:
In file included from ../tests/../sandbox.h:24,
                 from ../tests/test_utils.h:18,
                 from ../tests/tests.cc:15:
./curl_sapi.sapi.h:39:2: note:   'CURLE_OK'
  CURLE_OK = 0 ,
  ^~~~~~~~
In file included from ../tests/test_utils.h:23,
                 from ../tests/tests.cc:15:
../tests/tests.cc: In member function 'virtual void {anonymous}::CurlTest_POSTResponse_Test::TestBody()':
../tests/tests.cc:119:58: error: 'CURLOPT_POST' was not declared in this scope
                                             curl_.get(), CURLOPT_POST, 1l));
                                                          ^~~~~~~~~~~~
/home/user/sandbox/curl/sandboxed-api/sandboxed_api/util/status_matchers.h:31:20: note: in definition of macro 'SAPI_ASSERT_OK_AND_ASSIGN_IMPL'
   auto statusor = (rexpr);                                   \
                    ^~~~~
../tests/tests.cc:118:3: note: in expansion of macro 'SAPI_ASSERT_OK_AND_ASSIGN'
   SAPI_ASSERT_OK_AND_ASSIGN(int setopt_post, api_->curl_easy_setopt_long(
   ^~~~~~~~~~~~~~~~~~~~~~~~~
../tests/tests.cc:119:58: note: suggested alternative:
                                             curl_.get(), CURLOPT_POST, 1l));
                                                          ^~~~~~~~~~~~
/home/user/sandbox/curl/sandboxed-api/sandboxed_api/util/status_matchers.h:31:20: note: in definition of macro 'SAPI_ASSERT_OK_AND_ASSIGN_IMPL'
   auto statusor = (rexpr);                                   \
                    ^~~~~
../tests/tests.cc:118:3: note: in expansion of macro 'SAPI_ASSERT_OK_AND_ASSIGN'
   SAPI_ASSERT_OK_AND_ASSIGN(int setopt_post, api_->curl_easy_setopt_long(
   ^~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../tests/../sandbox.h:24,
                 from ../tests/test_utils.h:18,
                 from ../tests/tests.cc:15:
./curl_sapi.sapi.h:253:11: note:   'CURLOPT_POST'
  CURLOPT( CURLOPT_POST , CURLOPTTYPE_LONG , 47 ) ,
           ^~~~~~~~~~~~
./curl_sapi.sapi.h:21:32: note: in definition of macro 'CURLOPT'
 #define CURLOPT( na , t , nu ) na = t + nu
                                ^~
In file included from googletest-src/googletest/include/gtest/gtest.h:384,
                 from ../tests/test_utils.h:20,
                 from ../tests/tests.cc:15:
../tests/tests.cc:120:26: error: 'CURLE_OK' was not declared in this scope
   ASSERT_EQ(setopt_post, CURLE_OK);
                          ^~~~~~~~
../tests/tests.cc:120:26: note: suggested alternative:
In file included from ../tests/../sandbox.h:24,
                 from ../tests/test_utils.h:18,
                 from ../tests/tests.cc:15:
./curl_sapi.sapi.h:39:2: note:   'CURLE_OK'
  CURLE_OK = 0 ,
  ^~~~~~~~
[3/4] Building CXX object tests/CMakeFiles/tests.dir/test_utils.cc.o
FAILED: tests/CMakeFiles/tests.dir/test_utils.cc.o 
/usr/bin/c++  -DGOOGLE_GLOG_DLL_DECL="" -I. -Iabsl-src -Iprotobuf-src/src -Iglog-build -Iglog-src/src -Igflags-build/include -Isandboxed-api-build -I/home/user/sandbox/curl/sandboxed-api -isystem googletest-src/googletest/include -isystem googletest-src/googletest -isystem googletest-src/googlemock/include -isystem googletest-src/googlemock -fPIE   -pthread -Wno-deprecated -Wno-deprecated-declarations -Wno-psabi -std=gnu++17 -MD -MT tests/CMakeFiles/tests.dir/test_utils.cc.o -MF tests/CMakeFiles/tests.dir/test_utils.cc.o.d -o tests/CMakeFiles/tests.dir/test_utils.cc.o -c ../tests/test_utils.cc
../tests/test_utils.cc:30:5: error: 'CurlTestUtils' has not been declared
 int CurlTestUtils::port_;
     ^~~~~~~~~~~~~
../tests/test_utils.cc:31:13: error: 'CurlTestUtils' has not been declared
 std::thread CurlTestUtils::server_thread_;
             ^~~~~~~~~~~~~
ninja: build stopped: subcommand failed.

I use below test code, and the test code is:
StringopSapiSandbox sandbox;
ASSERT_THAT(sandbox.Init(), IsOk());
StringopApi api(&sandbox);
stringop::StringReverse proto;
proto.set_input("Hello");
sapi::v::Protostringop::StringReverse pp(proto);
SAPI_ASSERT_OK_AND_ASSIGN(int return_value, api.pb_reverse_string(pp.PtrBoth()));
EXPECT_THAT(return_value, Ne(0)) << "pb_reverse_string() failed";
SAPI_ASSERT_OK_AND_ASSIGN(auto pb_result, pp.GetMessage());
LOG(INFO) << "Result PB: " << pb_result.DebugString();
EXPECT_THAT(pb_result.output(), StrEq("olleH"));

I find the framework will create 4 process:
user 13114 1174 0 01:40 pts/1 00:00:00 ./main_stringop
user 13115 13114 0 01:40 pts/1 00:00:00 S2-FORK-SERV
user 13116 13115 0 01:40 ? 00:00:00 stringop-sapi.bin --logtostderr=true
user 13120 13116 0 01:40 ? 00:00:00 stringop-sapi.bin --logtostderr=true
user 13121 13120 0 01:40 ? 00:00:00 stringop-sapi.bin --logtostderr=true
why need 3 worker process

This breaks libxslt.

I feel that the sandboxed-api/sandbox2 is mainly a subset of docker-like containers, the container have more features like CRI for k8s.....

If i'am wrong, Could you explain it in detail?

[412/505] Building CXX object sandboxed-api-build/sandboxed_api/sandbox2/CMakeFiles/sandbox2_syscall.dir/syscall_defs.cc.o
FAILED: sandboxed-api-build/sandboxed_api/sandbox2/CMakeFiles/sandbox2_syscall.dir/syscall_defs.cc.o 
/usr/bin/clang++ -DGOOGLE_GLOG_DLL_DECL="" -I/home/user/sandboxed-api/build/contrib/turbojpeg/_deps/absl-src -I/home/user/sandboxed-api/build/contrib/turbojpeg/sandboxed-api-build -I/home/user/sandboxed-api -I/home/user/sandboxed-api/build/contrib/turbojpeg/_deps/protobuf-src/src -I/home/user/sandboxed-api/build/contrib/turbojpeg/_deps/glog-build -I/home/user/sandboxed-api/build/contrib/turbojpeg/_deps/glog-src/src -I/home/user/sandboxed-api/build/contrib/turbojpeg/_deps/gflags-build/include -I/home/user/sandboxed-api/build/contrib/turbojpeg/_deps/gflags-build -fsanitize=address,undefined -g -fcolor-diagnostics -fno-exceptions -Wno-deprecated -Wframe-larger-than=40960 -Wno-deprecated-declarations -Wno-psabi -std=gnu++17 -MD -MT sandboxed-api-build/sandboxed_api/sandbox2/CMakeFiles/sandbox2_syscall.dir/syscall_defs.cc.o -MF sandboxed-api-build/sandboxed_api/sandbox2/CMakeFiles/sandbox2_syscall.dir/syscall_defs.cc.o.d -o sandboxed-api-build/sandboxed_api/sandbox2/CMakeFiles/sandbox2_syscall.dir/syscall_defs.cc.o -c /home/user/sandboxed-api/sandboxed_api/sandbox2/syscall_defs.cc
In file included from /home/user/sandboxed-api/sandboxed_api/sandbox2/syscall_defs.cc:1:
In file included from /home/user/sandboxed-api/sandboxed_api/sandbox2/syscall_defs.h:10:
In file included from /home/user/sandboxed-api/build/contrib/turbojpeg/_deps/absl-src/absl/strings/string_view.h:30:
In file included from /usr/bin/../lib/gcc/x86_64-redhat-linux/11/../../../../include/c++/11/algorithm:74:
In file included from /usr/bin/../lib/gcc/x86_64-redhat-linux/11/../../../../include/c++/11/pstl/glue_algorithm_defs.h:13:
In file included from /usr/bin/../lib/gcc/x86_64-redhat-linux/11/../../../../include/c++/11/functional:54:
In file included from /usr/bin/../lib/gcc/x86_64-redhat-linux/11/../../../../include/c++/11/tuple:39:
/usr/bin/../lib/gcc/x86_64-redhat-linux/11/../../../../include/c++/11/array:268:52: fatal error: instantiating fold expression with 334 arguments exceeded expression nesting limit of 256
      -> array<enable_if_t<(is_same_v<_Tp, _Up> && ...), _Tp>,
                           ~~~~~~~~~~~~~~~~~~~~~~~~^~~~
/home/user/sandboxed-api/sandboxed_api/sandbox2/syscall_defs.cc:155:22: note: while substituting deduced template arguments into function template '<deduction guide for array>' [with _Tp = sandbox2::SyscallTable::Entry, _Up = <sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry, sandbox2::SyscallTable::Entry>]

Bazel 0.27.0 warns about PY2 vs. PY3. We should update the Bazel build files to exclusively use Python3.
Workaround for now is to specify --host_force_python=PY2

How it works links to a missing page in the documentation
https://github.com/google/sandboxed-api/blame/master/sandboxed_api/docs/howitworks.md#L21

I can build on Debian 10 for libuv, but the example can't work
user@debian10:~/sandbox/sandboxed-api/oss-internship-2020/libuv/build/examples$ ./helloworld [util.cc : 140] RAW: clone(): Operation not permitted [1] [forkserver.cc : 496] RAW: Check pid != -1 failed: failed to fork initial namespaces process: Operation not permitted [1] [fork_client.cc : 60] RAW: Receiving init PID from the ForkServer failed E20210104 04:59:55.649554 32539 executor.cc:163] Could not obtain init PID E20210104 04:59:55.650148 32536 helloworld.cc:85] HelloWorld failed: UNAVAILABLE: Could not start the sandbox user@debian10:~/sandbox/sandboxed-api/oss-internship-2020/libuv/build/examples$

C’s _Bool needs to be converted to C++’s bool. This breaks the libzip build after some other patches have been applied to fix other errors.

The test suite fails on Fedora. Build script and log output attached.
log.txt
build.txt

1. I know the policybuilder supply a lot of allow rules, But Which rules should I choose to ensure safety？
2. The AllowSystemMalloc interface, it's implemented very complexed，not only limit the system call， but also limit the args. why? What references do you have? or have some evidence ？

CMake Error at build/_deps/jsonnet-build/googletest-src/googletest/cmake/internal_utils.cmake:152 (add_library):
  add_library cannot create target "gtest" because another target with the
  same name already exists.  The existing target is a static library created
  in source directory
  "/home/user/sandboxed-api/build/_deps/googletest-src/googletest".  See
  documentation for policy CMP0002 for more details.
Call Stack (most recent call first):
  build/_deps/jsonnet-build/googletest-src/googletest/cmake/internal_utils.cmake:209 (cxx_library_with_type)
  build/_deps/jsonnet-build/googletest-src/googletest/CMakeLists.txt:131 (cxx_library)


CMake Error at build/_deps/jsonnet-build/googletest-src/googletest/cmake/internal_utils.cmake:152 (add_library):
  add_library cannot create target "gtest_main" because another target with
  the same name already exists.  The existing target is a static library
  created in source directory
  "/home/user/sandboxed-api/build/_deps/googletest-src/googletest".  See
  documentation for policy CMP0002 for more details.
Call Stack (most recent call first):
  build/_deps/jsonnet-build/googletest-src/googletest/cmake/internal_utils.cmake:209 (cxx_library_with_type)
  build/_deps/jsonnet-build/googletest-src/googletest/CMakeLists.txt:133 (cxx_library)


CMake Error at build/_deps/jsonnet-build/googletest-src/googletest/CMakeLists.txt:146 (target_link_libraries):
  Attempt to add link library "gtest" to target "gtest_main" which is not
  built in this directory.

  This is allowed only when policy CMP0079 is set to NEW.


CMake Error at build/_deps/jsonnet-build/googletest-src/googletest/cmake/internal_utils.cmake:152 (add_library):
  add_library cannot create target "gmock" because another target with the
  same name already exists.  The existing target is a static library created
  in source directory
  "/home/user/sandboxed-api/build/_deps/googletest-src/googlemock".  See
  documentation for policy CMP0002 for more details.
Call Stack (most recent call first):
  build/_deps/jsonnet-build/googletest-src/googletest/cmake/internal_utils.cmake:209 (cxx_library_with_type)
  build/_deps/jsonnet-build/googletest-src/googlemock/CMakeLists.txt:101 (cxx_library)


CMake Error at build/_deps/jsonnet-build/googletest-src/googlemock/CMakeLists.txt:102 (target_link_libraries):
  Attempt to add link library "gtest" to target "gmock" which is not built in
  this directory.

  This is allowed only when policy CMP0079 is set to NEW.


CMake Error at build/_deps/jsonnet-build/googletest-src/googletest/cmake/internal_utils.cmake:152 (add_library):
  add_library cannot create target "gmock_main" because another target with
  the same name already exists.  The existing target is a static library
  created in source directory
  "/home/user/sandboxed-api/build/_deps/googletest-src/googlemock".  See
  documentation for policy CMP0002 for more details.
Call Stack (most recent call first):
  build/_deps/jsonnet-build/googletest-src/googletest/cmake/internal_utils.cmake:209 (cxx_library_with_type)
  build/_deps/jsonnet-build/googletest-src/googlemock/CMakeLists.txt:104 (cxx_library)


CMake Error at build/_deps/jsonnet-build/googletest-src/googlemock/CMakeLists.txt:105 (target_link_libraries):
  Attempt to add link library "gmock" to target "gmock_main" which is not
  built in this directory.

  This is allowed only when policy CMP0079 is set to NEW.

In containerized environments, kernel-based sandboxing usually does not work (this is #47). An alternative is to use WebAssembly for sandboxing.

To reproduce:

Create and run a docker container with ubuntu 18.04 (also tried running with --privileged). Then, follow the quick start from the sandboxed api main page https://developers.google.com/sandboxed-api/docs/overview. The run fails at the following command (from the quick start):

bazel run //sandboxed_api/examples/stringop:main_stringop

The error is:

`[==========] Running 6 tests from 1 test suite.
[----------] Global test environment set-up.
[----------] 6 tests from StringopTest
[ RUN ] StringopTest.ProtobufStringDuplication
[sandboxed_api/sandbox2/util.cc : 138] RAW: clone(): Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 559] RAW: Check (pid != -1) failed: failed to fork initial namespaces process: Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 219] RAW: Receiving init PID from the ForkServer failed
WARNING: Logging before InitGoogleLogging() is written to STDERR
E20200710 03:08:35.924361 4259 executor.cc:162] Could not obtain init PID
[sandboxed_api/sandbox2/comms.cc : 535] RAW: write: Bad file descriptor [9]
[sandboxed_api/sandbox2/forkserver.cc : 188] RAW: Sending PB to the ForkServer failed
E20200710 03:08:35.925424 4260 executor.cc:162] Could not obtain init PID
E20200710 03:08:35.925566 4247 transaction.cc:61] Tried 2 times to run the transaction, but it failed. SAPI error: 'UNAVAILABLE: Could not start the sandbox'. Latest sandbox error: 'SETUP_ERROR - Code: FAILED_SUBPROCESS'
sandboxed_api/examples/stringop/main_stringop.cc:61: Failure
Value of: st.Run([](sapi::Sandbox* sandbox) -> absl::Status { StringopApi api(sandbox); stringop::StringDuplication proto; proto.set_input("Hello"); sapi:✌️:Protostringop::StringDuplication pp(proto); { auto _sapi_statusor61 = (api.pb_duplicate_string(pp.PtrBoth())); if ((__builtin_expect(!_sapi_statusor61.ok(), 0))) { return _sapi_statusor61.status(); } int return_value = std::move(_sapi_statusor61).ValueOrDie();; if (!(return_value)) { return absl::FailedPreconditionError("pb_duplicate_string() failed"); }; } auto _sapi_statusor61 = (pp.GetMessage()); if ((__builtin_expect(!_sapi_statusor61.ok(), 0))) { return _sapi_statusor61.status(); } auto pb_result = std::move(_sapi_statusor61).ValueOrDie();; google::LogMessage( "sandboxed_api/examples/stringop/main_stringop.cc", 61).stream() << "Result PB: " << pb_result.DebugString(); if (!(pb_result.output() == "HelloHello")) { return absl::FailedPreconditionError("Incorrect output"); }; return absl::OkStatus(); })
Expected: is OK
Actual: UNAVAILABLE: Could not start the sandbox (of type absl::Status), which is not OK
[ FAILED ] StringopTest.ProtobufStringDuplication (19 ms)
[ RUN ] StringopTest.ProtobufStringReversal
[sandboxed_api/sandbox2/util.cc : 138] RAW: clone(): Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 559] RAW: Check (pid != -1) failed: failed to fork initial namespaces process: Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 219] RAW: Receiving init PID from the ForkServer failed
E20200710 03:08:35.932246 4262 executor.cc:162] Could not obtain init PID
sandboxed_api/examples/stringop/main_stringop.cc:66: Failure
Value of: sandbox.Init()
Expected: is OK
Actual: UNAVAILABLE: Could not start the sandbox (of type absl::Status), which is not OK
[ FAILED ] StringopTest.ProtobufStringReversal (7 ms)
[ RUN ] StringopTest.RawStringDuplication
[sandboxed_api/sandbox2/util.cc : 138] RAW: clone(): Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 559] RAW: Check (pid != -1) failed: failed to fork initial namespaces process: Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 219] RAW: Receiving init PID from the ForkServer failed
E20200710 03:08:35.938766 4264 executor.cc:162] Could not obtain init PID
sandboxed_api/examples/stringop/main_stringop.cc:82: Failure
Value of: sandbox.Init()
Expected: is OK
Actual: UNAVAILABLE: Could not start the sandbox (of type absl::Status), which is not OK
[ FAILED ] StringopTest.RawStringDuplication (7 ms)
[ RUN ] StringopTest.RawStringReversal
[sandboxed_api/sandbox2/util.cc : 138] RAW: clone(): Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 559] RAW: Check (pid != -1) failed: failed to fork initial namespaces process: Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 219] RAW: Receiving init PID from the ForkServer failed
E20200710 03:08:35.945513 4266 executor.cc:162] Could not obtain init PID
sandboxed_api/examples/stringop/main_stringop.cc:98: Failure
Value of: sandbox.Init()
Expected: is OK
Actual: UNAVAILABLE: Could not start the sandbox (of type absl::Status), which is not OK
[ FAILED ] StringopTest.RawStringReversal (6 ms)
[ RUN ] StringopTest.RawStringLength
[sandboxed_api/sandbox2/util.cc : 138] RAW: clone(): Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 559] RAW: Check (pid != -1) failed: failed to fork initial namespaces process: Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 219] RAW: Receiving init PID from the ForkServer failed
E20200710 03:08:35.952450 4268 executor.cc:162] Could not obtain init PID
sandboxed_api/examples/stringop/main_stringop.cc:134: Failure
Value of: sandbox.Init()
Expected: is OK
Actual: UNAVAILABLE: Could not start the sandbox (of type absl::Status), which is not OK
[ FAILED ] StringopTest.RawStringLength (7 ms)
[ RUN ] StringopTest.RawStringReading
[sandboxed_api/sandbox2/util.cc : 138] RAW: clone(): Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 559] RAW: Check (pid != -1) failed: failed to fork initial namespaces process: Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 219] RAW: Receiving init PID from the ForkServer failed
E20200710 03:08:35.958746 4270 executor.cc:162] Could not obtain init PID
sandboxed_api/examples/stringop/main_stringop.cc:144: Failure
Value of: sandbox.Init()
Expected: is OK
Actual: UNAVAILABLE: Could not start the sandbox (of type absl::Status), which is not OK
[ FAILED ] StringopTest.RawStringReading (7 ms)
[----------] 6 tests from StringopTest (53 ms total)

[----------] Global test environment tear-down
[==========] 6 tests from 1 test suite ran. (53 ms total)
[ PASSED ] 0 tests.
[ FAILED ] 6 tests, listed below:
[ FAILED ] StringopTest.ProtobufStringDuplication
[ FAILED ] StringopTest.ProtobufStringReversal
[ FAILED ] StringopTest.RawStringDuplication
[ FAILED ] StringopTest.RawStringReversal
[ FAILED ] StringopTest.RawStringLength
[ FAILED ] StringopTest.RawStringReading

6 FAILED TESTS`

[user@sandboxed-api]~/sandboxed-api% ./build.sh  --configure
-- LLVM FileCheck Found: /usr/bin/FileCheck
-- git version: v1.6.0-47-g3b3de694 normalized to 1.6.0.47
-- Version: 1.6.0.47
-- Performing Test HAVE_THREAD_SAFETY_ATTRIBUTES -- failed to compile
-- Performing Test HAVE_STD_REGEX -- success
-- Performing Test HAVE_GNU_POSIX_REGEX -- failed to compile
-- Performing Test HAVE_POSIX_REGEX -- success
-- Performing Test HAVE_STEADY_CLOCK -- success
-- 
-- 3.15.8.0
CMake Warning at /usr/share/cmake/Modules/FindProtobuf.cmake:524 (message):
  Protobuf compiler version 3.14.0 doesn't match library version 3.15.8
Call Stack (most recent call first):
  cmake/SapiDeps.cmake:100 (find_package)
  CMakeLists.txt:66 (include)


-- Configuring done
-- Generating done
-- Build files have been written to: /home/user/sandboxed-api/build
[81/258] Linking CXX executable sandboxed_api/sandbox2/testcases/add_policy_on_syscalls
clang-13: warning: argument unused during compilation: '-pie' [-Wunused-command-line-argument]
[85/258] Linking CXX executable sandboxed_api/sandbox2/testcases/personality
clang-13: warning: argument unused during compilation: '-pie' [-Wunused-command-line-argument]
[88/258] Linking CXX executable sandboxed_api/sandbox2/testcases/malloc_system
clang-13: warning: argument unused during compilation: '-pie' [-Wunused-command-line-argument]
[89/258] Linking CXX executable sandboxed_api/sandbox2/testcases/minimal
clang-13: warning: argument unused during compilation: '-pie' [-Wunused-command-line-argument]
[91/258] Linking CXX executable sandboxed_api/sandbox2/testcases/policy
clang-13: warning: argument unused during compilation: '-pie' [-Wunused-command-line-argument]
[93/258] Linking CXX executable sandboxed_api/sandbox2/testcases/sleep
clang-13: warning: argument unused during compilation: '-pie' [-Wunused-command-line-argument]
[97/258] Linking CXX executable sandboxed_api/sandbox2/testcases/hostname
clang-13: warning: argument unused during compilation: '-pie' [-Wunused-command-line-argument]
[98/258] Linking CXX executable sandboxed_api/sandbox2/testcases/namespace
clang-13: warning: argument unused during compilation: '-pie' [-Wunused-command-line-argument]
[135/258] Building CXX object sandboxed_api/sandbox2/CMakeFiles/sandbox2_namespace.dir/namespace.cc.o
/home/user/sandboxed-api/sandboxed_api/sandbox2/namespace.cc:214:17: warning: stack frame size (76264) exceeds limit (40960) in function 'sandbox2::Namespace::InitializeNamespaces' [-Wframe-larger-than]
void Namespace::InitializeNamespaces(uid_t uid, gid_t gid, int32_t clone_flags,
                ^
1 warning generated.
[245/258] Generating interface
FAILED: sandboxed_api/examples/stringop/stringop-sapi.sapi.h sandboxed_api/examples/stringop/stringop-sapi.isystem /home/user/sandboxed-api/build/sandboxed_api/examples/stringop/stringop-sapi.sapi.h /home/user/sandboxed-api/build/sandboxed_api/examples/stringop/stringop-sapi.isystem 
cd /home/user/sandboxed-api/build/sandboxed_api/examples/stringop && sh -c "/usr/bin/clang++ -E -x c++ -v /dev/null 2>&1 |              awk '/> search starts here:/{f=1;next}/^End of search/{f=0}f{print \$1}'              > \"stringop-sapi.isystem\"" && /home/user/sandboxed-api/build/sandboxed_api/tools/clang_generator/sapi_generator_tool -p /home/user/sandboxed-api/build/sandboxed_api/examples/stringop --sapi_name=Stringop --sapi_out=stringop-sapi.sapi.h --sapi_embed_dir=/home/user/sandboxed-api/build/sandboxed_api/examples/stringop --sapi_embed_name=stringop-sapi --sapi_functions=duplicate_string,reverse_string,pb_duplicate_string,pb_reverse_string,nop,violate,get_raw_c_string --sapi_ns= --sapi_isystem=stringop-sapi.isystem /home/user/sandboxed-api/sandboxed_api/examples/stringop/stringop.cc
Failure value returned from cantFail wrapped call
sapi_generator_tool: Unknown command line argument '--sapi_name=Stringop'.  Try: '/home/user/sandboxed-api/build/sandboxed_api/tools/clang_generator/sapi_generator_tool --help'
sapi_generator_tool: Did you mean '--p=Stringop'?
sapi_generator_tool: Unknown command line argument '--sapi_out=stringop-sapi.sapi.h'.  Try: '/home/user/sandboxed-api/build/sandboxed_api/tools/clang_generator/sapi_generator_tool --help'
sapi_generator_tool: Did you mean '--p=stringop-sapi.sapi.h'?
sapi_generator_tool: Unknown command line argument '--sapi_embed_dir=/home/user/sandboxed-api/build/sandboxed_api/examples/stringop'.  Try: '/home/user/sandboxed-api/build/sandboxed_api/tools/clang_generator/sapi_generator_tool --help'
sapi_generator_tool: Did you mean '--p=/home/user/sandboxed-api/build/sandboxed_api/examples/stringop'?
sapi_generator_tool: Unknown command line argument '--sapi_embed_name=stringop-sapi'.  Try: '/home/user/sandboxed-api/build/sandboxed_api/tools/clang_generator/sapi_generator_tool --help'
sapi_generator_tool: Did you mean '--extra-arg=stringop-sapi'?
sapi_generator_tool: Unknown command line argument '--sapi_functions=duplicate_string,reverse_string,pb_duplicate_string,pb_reverse_string,nop,violate,get_raw_c_string'.  Try: '/home/user/sandboxed-api/build/sandboxed_api/tools/clang_generator/sapi_generator_tool --help'
sapi_generator_tool: Did you mean '--print-options=duplicate_string,reverse_string,pb_duplicate_string,pb_reverse_string,nop,violate,get_raw_c_string'?
sapi_generator_tool: Unknown command line argument '--sapi_ns='.  Try: '/home/user/sandboxed-api/build/sandboxed_api/tools/clang_generator/sapi_generator_tool --help'
sapi_generator_tool: Did you mean '-p'?
sapi_generator_tool: Unknown command line argument '--sapi_isystem=stringop-sapi.isystem'.  Try: '/home/user/sandboxed-api/build/sandboxed_api/tools/clang_generator/sapi_generator_tool --help'
sapi_generator_tool: Did you mean '--p=stringop-sapi.isystem'?

UNREACHABLE executed at /usr/include/llvm/Support/Error.h:751!
[252/258] Generating interface
FAILED: sandboxed_api/examples/sum/sum-sapi.sapi.h sandboxed_api/examples/sum/sum-sapi.isystem /home/user/sandboxed-api/build/sandboxed_api/examples/sum/sum-sapi.sapi.h /home/user/sandboxed-api/build/sandboxed_api/examples/sum/sum-sapi.isystem 
cd /home/user/sandboxed-api/build/sandboxed_api/examples/sum && sh -c "/usr/bin/clang++ -E -x c++ -v /dev/null 2>&1 |              awk '/> search starts here:/{f=1;next}/^End of search/{f=0}f{print \$1}'              > \"sum-sapi.isystem\"" && /home/user/sandboxed-api/build/sandboxed_api/tools/clang_generator/sapi_generator_tool -p /home/user/sandboxed-api/build/sandboxed_api/examples/sum --sapi_name=Sum --sapi_out=sum-sapi.sapi.h --sapi_embed_dir=/home/user/sandboxed-api/build/sandboxed_api/examples/sum --sapi_embed_name=sum-sapi --sapi_functions=sum,sums,addf,sub,mul,divs,muld,crash,violate,sumarr,testptr,read_int,sleep_for_sec,sumproto --sapi_ns= --sapi_isystem=sum-sapi.isystem /home/user/sandboxed-api/sandboxed_api/examples/sum/sum.c /home/user/sandboxed-api/sandboxed_api/examples/sum/sum_cpp.cc
Failure value returned from cantFail wrapped call
sapi_generator_tool: Unknown command line argument '--sapi_name=Sum'.  Try: '/home/user/sandboxed-api/build/sandboxed_api/tools/clang_generator/sapi_generator_tool --help'
sapi_generator_tool: Did you mean '--p=Sum'?
sapi_generator_tool: Unknown command line argument '--sapi_out=sum-sapi.sapi.h'.  Try: '/home/user/sandboxed-api/build/sandboxed_api/tools/clang_generator/sapi_generator_tool --help'
sapi_generator_tool: Did you mean '--p=sum-sapi.sapi.h'?
sapi_generator_tool: Unknown command line argument '--sapi_embed_dir=/home/user/sandboxed-api/build/sandboxed_api/examples/sum'.  Try: '/home/user/sandboxed-api/build/sandboxed_api/tools/clang_generator/sapi_generator_tool --help'
sapi_generator_tool: Did you mean '--p=/home/user/sandboxed-api/build/sandboxed_api/examples/sum'?
sapi_generator_tool: Unknown command line argument '--sapi_embed_name=sum-sapi'.  Try: '/home/user/sandboxed-api/build/sandboxed_api/tools/clang_generator/sapi_generator_tool --help'
sapi_generator_tool: Did you mean '--extra-arg=sum-sapi'?
sapi_generator_tool: Unknown command line argument '--sapi_functions=sum,sums,addf,sub,mul,divs,muld,crash,violate,sumarr,testptr,read_int,sleep_for_sec,sumproto'.  Try: '/home/user/sandboxed-api/build/sandboxed_api/tools/clang_generator/sapi_generator_tool --help'
sapi_generator_tool: Did you mean '--print-options=sum,sums,addf,sub,mul,divs,muld,crash,violate,sumarr,testptr,read_int,sleep_for_sec,sumproto'?
sapi_generator_tool: Unknown command line argument '--sapi_ns='.  Try: '/home/user/sandboxed-api/build/sandboxed_api/tools/clang_generator/sapi_generator_tool --help'
sapi_generator_tool: Did you mean '-p'?
sapi_generator_tool: Unknown command line argument '--sapi_isystem=sum-sapi.isystem'.  Try: '/home/user/sandboxed-api/build/sandboxed_api/tools/clang_generator/sapi_generator_tool --help'
sapi_generator_tool: Did you mean '--p=sum-sapi.isystem'?

UNREACHABLE executed at /usr/include/llvm/Support/Error.h:751!
ninja: build stopped: cannot make progress due to previous errors.

Building on Debian 10 "Buster". Shout out to #29, which will also touch this.

Confirmed working with"

• libclang1-6.0/libclang-6.0-dev
• libclang1-7/libclang-7-dev

Could not test with version 8.

With libclang1-9//libclang-9-dev, build fails with:

$ ninja                                                                      
[658/688] Generating interface                                                                                          
FAILED: sandboxed_api/examples/sum/lib/sum-sapi.sapi.h                                                                 
cd /home/REDACTED/sandboxed-api_cb_build/sandboxed_api/examples/sum/lib && /usr/bin/python3.7 -B /home/REDACTED/sandboxed-api_cb/sandboxed_api/tools/generator2/sapi_generator.py --sapi_name=Sum --sapi_out=sum-sapi.sapi.h --sapi_embed
_dir=/home/REDACTED/sandboxed-api_cb_build/sandboxed_api/examples/sum/lib --sapi_embed_name=sum-sapi --sapi_functions=sum,sums,addf,sub,mul,divs,muld,crash,violate,sumarr,testptr,read_int,sleep_for_sec,sumproto --sapi_ns= --sapi_in=/hom
e/REDACTED/sandboxed-api_cb/sandboxed_api/examples/sum/lib/sum.c,/home/REDACTED/sandboxed-api_cb/sandboxed_api/examples/sum/lib/sum_cpp.cc
Traceback (most recent call last):            
  File "/home/REDACTED/sandboxed-api_cb/sandboxed_api/tools/generator2/sapi_generator.py", line 73, in <module>                                                                                                                             
    app.run(main)                       
  File "/home/nomad/.local/lib/python3.7/site-packages/absl/app.py", line 299, in run
    _run_main(main, args)
  File "/home/nomad/.local/lib/python3.7/site-packages/absl/app.py", line 250, in _run_main
    sys.exit(main(argv))
  File "/home/REDACTED/sandboxed-api_cb/sandboxed_api/tools/generator2/sapi_generator.py", line 62, in main
    FLAGS.sapi_embed_dir, FLAGS.sapi_embed_name)
  File "/home/REDACTED/sandboxed-api_cb/sandboxed_api/tools/generator2/code.py", line 725, in generate
    related_types = self._get_related_types(function_names) 
  File "/home/REDACTED/sandboxed-api_cb/sandboxed_api/tools/generator2/code.py", line 784, in _get_related_types
    for f in self._get_functions(func_names):
  File "/home/REDACTED/sandboxed-api_cb/sandboxed_api/tools/generator2/code.py", line 751, in _get_functions
    f for f in translation_unit.get_functions()
  File "/home/REDACTED/sandboxed-api_cb/sandboxed_api/tools/generator2/code.py", line 605, in get_functions
    self._process()
  File "/home/REDACTED/sandboxed-api_cb/sandboxed_api/tools/generator2/code.py", line 582, in _process
    if cursor.kind.is_declaration():
  File "/usr/local/lib/python3.7/dist-packages/clang/cindex.py", line 1517, in kind
    return CursorKind.from_id(self._kind_id)
  File "/usr/local/lib/python3.7/dist-packages/clang/cindex.py", line 636, in from_id
    raise ValueError('Unknown template argument kind %d' % id)
ValueError: Unknown template argument kind 440

The third argument should be checked to be a valid C++ identifier.

It would be useful to have a class which can represents remote cstr of unknown size.
This can simplify and make it nicer to fetch an array of cstr's.

new to bazel, how can i run examples

[1/13] Generating interface
FAILED: contrib/libxslt/libxslt_sapi.sapi.h /home/user/sandboxed-api/build/contrib/libxslt/libxslt_sapi.sapi.h 
cd /home/user/sandboxed-api/build/contrib/libxslt && /home/user/sandboxed-api/build/sandboxed_api/tools/clang_generator/sapi_generator_tool -p /home/user/sandboxed-api/build/contrib/libxslt --sapi_name=LibXSLT --sapi_out=libxslt_sapi.sapi.h --sapi_embed_dir=/home/user/sandboxed-api/build/contrib/libxslt --sapi_embed_name=libxslt_sapi --sapi_functions=xmlInitParser,sapi_xsltParseStylesheetDoc,xmlReadFd,xsltApplyStylesheet,xsltSaveResultToFile,xsltFreeStylesheet,xmlFreeDoc,xmlSaveToFd,xmlSaveDoc,xmlSaveFlush,xmlSaveClose --sapi_ns=sapi::contrib::libxslt /home/user/sandboxed-api/contrib/libxslt/wrapper.h
In file included from /home/user/sandboxed-api/contrib/libxslt/wrapper.h:4:
In file included from /usr/include/libxml2/libxml/SAX.h:15:
/usr/include/stdio.h:33:10: fatal error: 'stddef.h' file not found
#include <stddef.h>
         ^~~~~~~~~~
1 error generated.
Error while processing /home/user/sandboxed-api/contrib/libxslt/wrapper.h.
header generation failed

It looks like libtooling isn’t finding stddef.h, which is under /usr/lib/gcc/x86_64-redhat-linux/11/include on my system.

Hello, Superman, I want to learn about Android's sandbox technology, how to run third-party applications in my own application, what should I do?

We want use the library to call third pary SDK, and the SDK process will live all the time when the task in on-going. and will will be multi instance process to do the task. can the sandbox SDK support this case ?

The way CC compilation units are handled in Skylark rules has changed, which leads to passing 0 arguments to it:

ERROR: /home/cblichmann/tmp/sandboxed_api/tools/generator2/BUILD:61:1: Generating sandboxed_api/tools/generator2/tests_sapi_generator.sapi.h from 0 header files. failed (Exit 1)
sapi_generator failed: error executing command bazel-out/host/bin/sandboxed_api/tools/generator2/sapi_generator --sapi_name Tests --sapi_out bazel-out/k8-fastbuild/bin/sandboxed_api/tools/generator2/tests_sapi_generator.sapi.h --sapi_embed_dir ... (remaining 7 argument(s) skipped)

The PARSE_ARGV mode of cmake_parse_arguments handles special characters in arguments correctly.

i.e. Can a Linux distribution provide this as a package, or must users download it to and run it out of their user directory? (I'm working on adding this to the Arch User Repository.)

I was able to compile this on Arch Linux, using bazel build ...

What are the next steps? The few Arch packages for projects using Bazel have a handful of things manually copied, but I see there are 3700+ entries in bazel-bin/, in _solib_k8/, external, and sandboxed_api.

bazel query //... doesn't show anything that looks like an install target.

In the sapi_library, one of the parameters is a list of sandboxed functions.
Currently, when a symbol doesn't exist in the library, it's silently ignored.

I think this behavior is misleading.
If the API of the library is changed, there won't be any indication while building the SAPI library.
In some cases, this also may lead to extensive debugging from users why such function is not exposed in API class.

We should throw an error when a function can't be found in the library.

[246/359] Generating interface
FAILED: contrib/dav1d/dav1d_sapi.sapi.h contrib/dav1d/dav1d_sapi.isystem /home/user/sandboxed-api/build/contrib/dav1d/dav1d_sapi.sapi.h /home/user/sandboxed-api/build/contrib/dav1d/dav1d_sapi.isystem 
cd /home/user/sandboxed-api/build/contrib/dav1d && sh -c "/usr/bin/clang++ -E -x c++ -v /dev/null 2>&1 |              awk '/> search starts here:/{f=1;next}/^End of search/{f=0}f{print \$1}'              > \"dav1d_sapi.isystem\"" && /usr/bin/python3.10 -B /home/user/sandboxed-api/sandboxed_api/tools/generator2/sapi_generator.py --sapi_name=dav1d --sapi_out=dav1d_sapi.sapi.h --sapi_embed_dir=/home/user/sandboxed-api/build/contrib/dav1d --sapi_embed_name=dav1d_sapi --sapi_functions= --sapi_ns=dav1d_sapi --sapi_isystem=dav1d_sapi.isystem --sapi_in=/usr/include/dav1d/dav1d.h
Traceback (most recent call last):
  File "/home/user/sandboxed-api/sandboxed_api/tools/generator2/sapi_generator.py", line 73, in <module>
    app.run(main)
  File "/usr/lib/python3.10/site-packages/absl/app.py", line 312, in run
    _run_main(main, args)
  File "/usr/lib/python3.10/site-packages/absl/app.py", line 258, in _run_main
    sys.exit(main(argv))
  File "/home/user/sandboxed-api/sandboxed_api/tools/generator2/sapi_generator.py", line 60, in main
    result = generator.generate(FLAGS.sapi_name, FLAGS.sapi_functions,
  File "/home/user/sandboxed-api/sandboxed_api/tools/generator2/code.py", line 729, in generate
    related_types = self._get_related_types(function_names)
  File "/home/user/sandboxed-api/sandboxed_api/tools/generator2/code.py", line 790, in _get_related_types
    types += sorted(r for r in fn_related_types if r not in processed)
  File "/home/user/sandboxed-api/sandboxed_api/tools/generator2/code.py", line 145, in __lt__
    return (self._tu.order[self._get_declaration().hash] <
KeyError: 2210228446
[249/359] Generating interface
FAILED: contrib/c-ares/cares_sapi.sapi.h contrib/c-ares/cares_sapi.isystem /home/user/sandboxed-api/build/contrib/c-ares/cares_sapi.sapi.h /home/user/sandboxed-api/build/contrib/c-ares/cares_sapi.isystem 
cd /home/user/sandboxed-api/build/contrib/c-ares && sh -c "/usr/bin/clang++ -E -x c++ -v /dev/null 2>&1 |              awk '/> search starts here:/{f=1;next}/^End of search/{f=0}f{print \$1}'              > \"cares_sapi.isystem\"" && /usr/bin/python3.10 -B /home/user/sandboxed-api/sandboxed_api/tools/generator2/sapi_generator.py --sapi_name=cares --sapi_out=cares_sapi.sapi.h --sapi_embed_dir=/home/user/sandboxed-api/build/contrib/c-ares --sapi_embed_name=cares_sapi --sapi_functions= --sapi_ns=c_ares_sapi --sapi_isystem=cares_sapi.isystem --sapi_in=/usr/include/ares.h
Traceback (most recent call last):
  File "/home/user/sandboxed-api/sandboxed_api/tools/generator2/sapi_generator.py", line 73, in <module>
    app.run(main)
  File "/usr/lib/python3.10/site-packages/absl/app.py", line 312, in run
    _run_main(main, args)
  File "/usr/lib/python3.10/site-packages/absl/app.py", line 258, in _run_main
    sys.exit(main(argv))
  File "/home/user/sandboxed-api/sandboxed_api/tools/generator2/sapi_generator.py", line 60, in main
    result = generator.generate(FLAGS.sapi_name, FLAGS.sapi_functions,
  File "/home/user/sandboxed-api/sandboxed_api/tools/generator2/code.py", line 744, in generate
    return self.format_template(**api)
  File "/home/user/sandboxed-api/sandboxed_api/tools/generator2/code.py", line 945, in format_template
    result.append(self._format_function(f))
  File "/home/user/sandboxed-api/sandboxed_api/tools/generator2/code.py", line 856, in _format_function
    argument_types.append(a.wrapped + ';')
  File "/home/user/sandboxed-api/sandboxed_api/tools/generator2/code.py", line 412, in wrapped
    return '{} {name}_(({name}))'.format(self.mapped_type, name=self.name)
  File "/home/user/sandboxed-api/sandboxed_api/tools/generator2/code.py", line 443, in mapped_type
    raise ValueError('Elaborate type (eg. struct) in mapped_type is not '
ValueError: Elaborate type (eg. struct) in mapped_type is not supported: function getipv4sourcefilter, arg 1, type struct in_addr, location <SourceLocation file '/usr/include/netinet/in.h', line 607, column 12>
[251/359] Building CXX object sandboxed_api/examples/zlib/CMakeFiles/sapi_main_zlib.dir/main_zlib.cc.o
ninja: build stopped: subcommand failed.

The fix for #154 doesn’t work for functions that return _Bool. I still need a typedef bool _Bool; in the libzip contrib.

Sandboxed API should build/work on all major Linux distributions.
We should provide at least some basic instructions for distributions other than Debian/Ubuntu:

• Fedora
• Arch Linux
• openSUSE
• Gentoo
  This also applies for their derivatives (CentOS, Manjaro, etc.)

[329/428] Linking C executable _deps/libblosc-build/tests/test_api
FAILED: _deps/libblosc-build/tests/test_api 
: && /usr/bin/clang -O3 -DNDEBUG -rdynamic _deps/libblosc-build/tests/CMakeFiles/test_api.dir/test_api.c.o -o _deps/libblosc-build/tests/test_api -L/home/user/sandboxed-api/build/_deps/libblosc-build/blosc _deps/libblosc-build/blosc/libblosc_testing.so && :
ld: error: _deps/libblosc-build/blosc/libblosc_testing.so: undefined reference to compress2 [--no-allow-shlib-undefined]
ld: error: _deps/libblosc-build/blosc/libblosc_testing.so: undefined reference to uncompress [--no-allow-shlib-undefined]
clang-13: error: linker command failed with exit code 1 (use -v to see invocation)
[334/428] Building C object _deps/libblosc-build/blosc/CMakeFiles/blosc_static.dir/__/internal-complibs/zstd-1.5.0/compress/zstd_lazy.c.o
ninja: build stopped: subcommand failed.

I feel that the sandboxed-api/sandbox2 is mainly a subset of docker-like containers, the container have more features like CRI for k8s.....

If i'am wrong, Could you explain it in detail?

Fedora doesn’t ship Bazel, and cmake complains about various missing targets.

filewrapper a b $'\n' s.h s.cc /dev core dumps. I expect a non-zero exit code and an error message, but no core dump.

Clang's libtooling is the preferred way to access the C++ AST and is much more precise than libclang, which we currently use. libclang deals poorly with macros and has an additional abstraction for source code regions that is convenient, but buggy. On top of this, the LLVM team said that libclang's deficiencies are unlikely to be fixed because fixing them would break the API.
Since libtooling is C++, the generator should also be implemented in C++.

I test the curl examle1 on debian 10. and has UNAVAILABLE: Receiving TLV value failed`?

root@debian10:/home/user/sandbox/sandboxed-api/oss-internship-2020/curl/build/examples# ./example1 E20210105 04:15:27.784305 1281 monitor.cc:755] SANDBOX VIOLATION : PID: 1285, PROG: 'memfd:curl_sapi.bin (deleted)' : [X86-64] sysinfo [99](0x7ffc1e6c3270) IP: 0x7f0ffdccb137, STACK: 0x7ffc1e6c3268 [mounts.cc : 230] RAW: Inserting /lib with the same value twice E20210105 04:15:27.936887 1278 example1.cc:81] Example1 failed: UNAVAILABLE: Receiving TLV value failed

Traceback (most recent call last):
  File "/home/user/sandboxed-api/sandboxed_api/tools/generator2/sapi_generator.py", line 73, in <module>
    app.run(main)
  File "/usr/lib/python3.10/site-packages/absl/app.py", line 312, in run
    _run_main(main, args)
  File "/usr/lib/python3.10/site-packages/absl/app.py", line 258, in _run_main
    sys.exit(main(argv))
  File "/home/user/sandboxed-api/sandboxed_api/tools/generator2/sapi_generator.py", line 60, in main
    result = generator.generate(FLAGS.sapi_name, FLAGS.sapi_functions,
  File "/home/user/sandboxed-api/sandboxed_api/tools/generator2/code.py", line 729, in generate
    related_types = self._get_related_types(function_names)
  File "/home/user/sandboxed-api/sandboxed_api/tools/generator2/code.py", line 790, in _get_related_types
    types += sorted(r for r in fn_related_types if r not in processed)
  File "/home/user/sandboxed-api/sandboxed_api/tools/generator2/code.py", line 165, in __gt__
    self._tu.order[other._get_declaration().hash])  # pylint: disable=protected-access
KeyError: 3995101709

The key depends on the set of headers chosen. Not all of the headers cause this, but many do.

Hello! Correct me if I'm wrong, but the examples won't work in external Bazel projects due to sandboxed_api/sandbox2/util:runfiles not having public visibility.

From my understanding the correct way to load files for sandboxing is to use GetDataDependencyFilePath (instead of GetInternalDataDependencyFilePath) which exists in sandboxed_api/sandbox2/util/runfiles.h, demonstrated by the examples. However sandboxed_api/sandbox2/util:runfiles can't be added to BUILD files in external bazel projects because it doesn't have "//visibility:public".

Currently, only the Bazel version sownloads and compiles libffi. We should have the same functionality for CMake.
This is especially relevant for distributions that do not have a libffi-dev package with a libffi.a needed for static linking.