Seccomp BPF: initial structure for unittests

sandbox/sandbox_linux.gypi

Index: sandbox/sandbox_linux.gypi
diff --git a/sandbox/sandbox_linux.gypi b/sandbox/sandbox_linux.gypi
index e03c5b501a942731edb698d9a91d11748489640a..fb313a695236bd30228dd6b8ab384a345f5bc1a4 100644
--- a/sandbox/sandbox_linux.gypi
+++ b/sandbox/sandbox_linux.gypi
@@ -4,6 +4,10 @@
 
 {
   'targets': [
+    # We have two principal targets: sandbox and sandbox_linux_unittests
+    # All other targets are listed as dependencies.
+    # FIXME(jln): for historial reasons, sandbox_linux is the setuid sandbox
+    # and is its own target.

[Markus (顧孟勤), 2012/06/21 21:01:07]

I am really not a GYP expert by a long shot, so you probably need somebody else
to think about the implications what we are doing here.

But I just want to double-check that we can ultimately extend this test so that
it tests all of the different sandboxes on Linux with just a single unittest
binary.

This could include seccomp mode 1, seccomp mode 2, suid, SELinux and possibly
others.

Also check with somebody like tc whether it is OK to have a Linux-specific
unittest. Or whether there should be single binary for all platforms.

I guess, this really depends on whether we think this test will ever be run
automatically by the buildbots. For seccomp/BPF that might actually be possible
at some point, whereas for setuid and SELinux that probably won't ever be the
case.

[jln (very slow on Chromium), 2012/06/21 21:10:45]

Yes, this is what this does: we always build tests/unit_tests.cc and, depending
on conditions, we sometimes link specific unittests to it.

It's fine to have our own unittest binary, this is what most people do. Note
that with just this change, this won't run automatically on build bots just yet
(build bots don't even have BPF support so it's not urgent ATM), but at least
it'll get built.

If that's fine with you, I'll land this as-is when I can (this depends on a
bunch of CLs that have been reverted), and I'll look into how getting the test
to actually run automatically on the buildbots later. The sandbox GYP is a bit
of a nightmare ATM, I'm trying to clean things up and I need to move very
slowly.

     {
       'target_name': 'sandbox',
       'type': 'none',
@@ -16,26 +20,53 @@
             '../seccompsandbox/seccomp.gyp:seccomp_sandbox',
           ],
         }],
-        # This does not include Android.
+        # Similarly, compile seccomp BPF when we support it
         [ 'OS=="linux" and (target_arch=="ia32" or target_arch=="x64")', {
           'type': 'static_library',
-          # Compile seccomp mode 2 code on Linux
-          'sources': [
-            'linux/seccomp-bpf/sandbox_bpf.cc',
-            'linux/seccomp-bpf/sandbox_bpf.h',
-            'linux/seccomp-bpf/verifier.cc',
-            'linux/seccomp-bpf/verifier.h',
-          ],
           'dependencies': [
-            '../base/base.gyp:base',
+            'seccomp_bpf',
           ],
-          'include_dirs': [
-            '..',
+        }],
+      ],
+    },
+    {
+      'target_name': 'sandbox_linux_unittests',
+      'type': 'executable',
+      'dependencies': [
+        'sandbox',
+        '../testing/gtest.gyp:gtest',
+      ],
+      'sources': [
+        'linux/tests/unit_tests.cc',
+      ],
+      'include_dirs': [
+        '..',
+      ],
+      'conditions': [
+        [ 'OS=="linux" and (target_arch=="ia32" or target_arch=="x64")', {
+          'sources': [
+            'linux/seccomp-bpf/sandbox_bpf_unittest.cc'
           ],
         }],
       ],
     },
     {
+      'target_name': 'seccomp_bpf',
+      'type': 'static_library',
+      'sources': [
+        'linux/seccomp-bpf/sandbox_bpf.cc',
+        'linux/seccomp-bpf/sandbox_bpf.h',
+        'linux/seccomp-bpf/verifier.cc',
+        'linux/seccomp-bpf/verifier.h',
+      ],
+      'dependencies': [
+        '../base/base.gyp:base',
+      ],
+      'include_dirs': [
+        '..',
+      ],
+    },
+    {
       # The setuid sandbox, for Linux
       'target_name': 'chrome_sandbox',
       'type': 'executable',