Seccomp BPF: initial structure for unittests

sandbox/sandbox_linux.gypi

 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 {
   'targets': [
+    # We have two principal targets: sandbox and sandbox_linux_unittests
+    # All other targets are listed as dependencies.
+    # FIXME(jln): for historial reasons, sandbox_linux is the setuid sandbox
+    # and is its own target.

[Markus (顧孟勤), 2012/06/21 21:01:07]

I am really not a GYP expert by a long shot, so you probably need somebody else
to think about the implications what we are doing here.

But I just want to double-check that we can ultimately extend this test so that
it tests all of the different sandboxes on Linux with just a single unittest
binary.

This could include seccomp mode 1, seccomp mode 2, suid, SELinux and possibly
others.

Also check with somebody like tc whether it is OK to have a Linux-specific
unittest. Or whether there should be single binary for all platforms.

I guess, this really depends on whether we think this test will ever be run
automatically by the buildbots. For seccomp/BPF that might actually be possible
at some point, whereas for setuid and SELinux that probably won't ever be the
case.

[jln (very slow on Chromium), 2012/06/21 21:10:45]

Yes, this is what this does: we always build tests/unit_tests.cc and, depending
on conditions, we sometimes link specific unittests to it.

It's fine to have our own unittest binary, this is what most people do. Note
that with just this change, this won't run automatically on build bots just yet
(build bots don't even have BPF support so it's not urgent ATM), but at least
it'll get built.

If that's fine with you, I'll land this as-is when I can (this depends on a
bunch of CLs that have been reverted), and I'll look into how getting the test
to actually run automatically on the buildbots later. The sandbox GYP is a bit
of a nightmare ATM, I'm trying to clean things up and I need to move very
slowly.

     {
       'target_name': 'sandbox',
       'type': 'none',
       'conditions': [
         # Only compile in the seccomp mode 1 code for the flag combination
         # where we support it.
         [ 'OS=="linux" and (target_arch=="ia32" or target_arch=="x64") '
           'and toolkit_views==0 and selinux==0', {
           'dependencies': [
             '../seccompsandbox/seccomp.gyp:seccomp_sandbox',
           ],
         }],
-        # This does not include Android.
+        # Similarly, compile seccomp BPF when we support it
         [ 'OS=="linux" and (target_arch=="ia32" or target_arch=="x64")', {
           'type': 'static_library',
-          # Compile seccomp mode 2 code on Linux
-          'sources': [
-            'linux/seccomp-bpf/sandbox_bpf.cc',
-            'linux/seccomp-bpf/sandbox_bpf.h',
-            'linux/seccomp-bpf/verifier.cc',
-            'linux/seccomp-bpf/verifier.h',
-          ],
           'dependencies': [
-            '../base/base.gyp:base',
-          ],
-          'include_dirs': [
-            '..',
+            'seccomp_bpf',
           ],
         }],
       ],
     },
     {
+      'target_name': 'sandbox_linux_unittests',
+      'type': 'executable',
+      'dependencies': [
+        'sandbox',
+        '../testing/gtest.gyp:gtest',
+      ],
+      'sources': [
+        'linux/tests/unit_tests.cc',
+      ],
+      'include_dirs': [
+        '..',
+      ],
+      'conditions': [
+        [ 'OS=="linux" and (target_arch=="ia32" or target_arch=="x64")', {
+          'sources': [
+            'linux/seccomp-bpf/sandbox_bpf_unittest.cc'
+          ],
+        }],
+      ],
+    },
+    {
+      'target_name': 'seccomp_bpf',
+      'type': 'static_library',
+      'sources': [
+        'linux/seccomp-bpf/sandbox_bpf.cc',
+        'linux/seccomp-bpf/sandbox_bpf.h',
+        'linux/seccomp-bpf/verifier.cc',
+        'linux/seccomp-bpf/verifier.h',
+      ],
+      'dependencies': [
+        '../base/base.gyp:base',
+      ],
+      'include_dirs': [
+        '..',
+      ],
+    },
+    {
       # The setuid sandbox, for Linux
       'target_name': 'chrome_sandbox',
       'type': 'executable',
       'sources': [
         'linux/suid/linux_util.c',
         'linux/suid/linux_util.h',
         'linux/suid/process_util.h',
         'linux/suid/process_util_linux.c',
         'linux/suid/sandbox.h',
         'linux/suid/sandbox.c',
       ],
       'cflags': [
         # For ULLONG_MAX
         '-std=gnu99',
       ],
       'include_dirs': [
         '..',
       ],
     },
   ],
 }