Merge branch 'sandbox_refactor'

.gitignore

@@ -185,6 +185,8 @@ uptime-*.json
 /src/lib/libtor-malloc-testing.a
 /src/lib/libtor-net.a
 /src/lib/libtor-net-testing.a
+/src/lib/libtor-sandbox.a
+/src/lib/libtor-sandbox-testing.a
 /src/lib/libtor-string.a
 /src/lib/libtor-string-testing.a
 /src/lib/libtor-smartlist-core.a

Makefile.am

@@ -40,6 +40,7 @@ endif
 # "Common" libraries used to link tor's utility code.
 TOR_UTIL_LIBS = \
 	src/common/libor.a \
+        src/lib/libtor-sandbox.a \
 	src/lib/libtor-container.a \
 	src/lib/libtor-net.a \
         src/lib/libtor-log.a \
@@ -57,6 +58,7 @@ TOR_UTIL_LIBS = \
 # and tests)
 TOR_UTIL_TESTING_LIBS = \
 	src/common/libor-testing.a \
+        src/lib/libtor-sandbox-testing.a \
 	src/lib/libtor-container-testing.a \
 	src/lib/libtor-net-testing.a \
         src/lib/libtor-log-testing.a \

src/common/compat.c

@@ -129,7 +129,7 @@ SecureZeroMemory(PVOID ptr, SIZE_T cnt)
 #include "lib/container/smartlist.h"
 #include "lib/wallclock/tm_cvt.h"
 #include "lib/net/address.h"
-#include "common/sandbox.h"
+#include "lib/sandbox/sandbox.h"
 
 /** As open(path, flags, mode), but return an fd with the close-on-exec mode
  * set. */

src/common/include.am

@@ -41,7 +41,6 @@ LIBOR_A_SRC = \
   src/common/util.c					\
   src/common/util_format.c				\
   src/common/util_process.c				\
-  src/common/sandbox.c					\
   src/common/storagedir.c				\
   src/common/token_bucket.c				\
   src/common/workqueue.c				\
@@ -84,9 +83,7 @@ COMMONHEADERS = \
   src/common/confline.h				\
   src/common/handles.h				\
   src/common/memarea.h				\
-  src/common/linux_syscalls.inc			\
   src/common/procmon.h				\
-  src/common/sandbox.h				\
   src/common/storagedir.h			\
   src/common/timers.h				\
   src/common/token_bucket.h			\

src/common/storagedir.c

@@ -5,7 +5,7 @@
 #include "common/compat.h"
 #include "common/confline.h"
 #include "common/memarea.h"
-#include "common/sandbox.h"
+#include "lib/sandbox/sandbox.h"
 #include "common/storagedir.h"
 #include "lib/log/torlog.h"
 #include "common/util.h"

src/common/util.c

@@ -21,7 +21,7 @@
 #include "lib/container/smartlist.h"
 #include "lib/fdio/fdio.h"
 #include "lib/net/address.h"
-#include "common/sandbox.h"
+#include "lib/sandbox/sandbox.h"
 #include "lib/err/backtrace.h"
 #include "common/util_process.h"
 #include "common/util_format.h"

src/include.am

@@ -13,6 +13,7 @@ include src/lib/lock/include.am
 include src/lib/log/include.am
 include src/lib/malloc/include.am
 include src/lib/net/include.am
+include src/lib/sandbox/include.am
 include src/lib/string/include.am
 include src/lib/smartlist_core/include.am
 include src/lib/testsupport/include.am

src/lib/crypt_ops/.may_include

@@ -7,6 +7,7 @@ lib/defs/*.h
 lib/malloc/*.h
 lib/err/*.h
 lib/intmath/*.h
+lib/sandbox/*.h
 lib/string/*.h
 lib/testsupport/testsupport.h
 lib/log/*.h

src/lib/crypt_ops/crypto.c

@@ -67,7 +67,6 @@ ENABLE_GCC_WARNING(redundant-decls)
 #include "lib/crypt_ops/aes.h"
 #include "common/util.h"
 #include "common/compat.h"
-#include "common/sandbox.h"
 #include "common/util_format.h"
 
 #include "keccak-tiny/keccak-tiny.h"

src/lib/crypt_ops/crypto_rand.c

@@ -25,7 +25,7 @@
 #include "common/compat.h"
 #include "lib/crypt_ops/compat_openssl.h"
 #include "lib/crypt_ops/crypto_util.h"
-#include "common/sandbox.h"
+#include "lib/sandbox/sandbox.h"
 #include "lib/testsupport/testsupport.h"
 #include "lib/log/torlog.h"
 #include "common/util.h"

src/lib/sandbox/.may_include

@@ -0,0 +1,15 @@
+orconfig.h
+
+lib/cc/*.h
+lib/container/*.h
+lib/err/*.h
+lib/log/*.h
+lib/malloc/*.h
+lib/net/*.h
+lib/sandbox/*.h
+lib/sandbox/*.inc
+lib/string/*.h
+
+ht.h
+siphash.h
+tor_queue.h

src/lib/sandbox/include.am

@@ -0,0 +1,18 @@
+
+noinst_LIBRARIES += src/lib/libtor-sandbox.a
+
+if UNITTESTS_ENABLED
+noinst_LIBRARIES += src/lib/libtor-sandbox-testing.a
+endif
+
+src_lib_libtor_sandbox_a_SOURCES =			\
+	src/lib/sandbox/sandbox.c
+
+src_lib_libtor_sandbox_testing_a_SOURCES = \
+	$(src_lib_libtor_sandbox_a_SOURCES)
+src_lib_libtor_sandbox_testing_a_CPPFLAGS = $(AM_CPPFLAGS) $(TEST_CPPFLAGS)
+src_lib_libtor_sandbox_testing_a_CFLAGS = $(AM_CFLAGS) $(TEST_CFLAGS)
+
+noinst_HEADERS +=					\
+	src/lib/sandbox/linux_syscalls.inc		\
+	src/lib/sandbox/sandbox.h

src/common/sandbox.c → src/lib/sandbox/sandbox.c

@@ -31,18 +31,19 @@
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
+#include <errno.h>
 
-#include "common/sandbox.h"
+#include "lib/sandbox/sandbox.h"
 #include "lib/container/map.h"
 #include "lib/err/torerr.h"
 #include "lib/log/torlog.h"
 #include "lib/cc/torint.h"
 #include "lib/net/resolve.h"
-#include "common/util.h"
-#include "tor_queue.h"
+#include "lib/malloc/util_malloc.h"
+#include "lib/string/scanf.h"
 
+#include "tor_queue.h"
 #include "ht.h"
-
 #include "siphash.h"
 
 #define DEBUGGING_CLOSE
@@ -1558,7 +1559,8 @@ install_syscall_filter(sandbox_cfg_t* cfg)
   return (rc < 0 ? -rc : rc);
 }
 
-#include "linux_syscalls.inc"
+#include "lib/sandbox/linux_syscalls.inc"
+
 static const char *
 get_syscall_name(int syscall_num)
 {

src/or/config.c

@@ -98,7 +98,7 @@
 #include "or/hs_config.h"
 #include "or/rephist.h"
 #include "or/router.h"
-#include "common/sandbox.h"
+#include "lib/sandbox/sandbox.h"
 #include "common/util.h"
 #include "or/routerlist.h"
 #include "or/routerset.h"

src/or/connection.c

@@ -102,7 +102,7 @@
 #include "or/routerlist.h"
 #include "or/transports.h"
 #include "or/routerparse.h"
-#include "common/sandbox.h"
+#include "lib/sandbox/sandbox.h"
 
 #ifdef HAVE_PWD_H
 #include <pwd.h>

src/or/dns.c

@@ -63,7 +63,7 @@
 #include "or/relay.h"
 #include "or/router.h"
 #include "ht.h"
-#include "common/sandbox.h"
+#include "lib/sandbox/sandbox.h"
 
 #include "or/edge_connection_st.h"
 #include "or/or_circuit_st.h"

src/or/main.c

@@ -111,7 +111,7 @@
 #include "common/util_process.h"
 #include "or/ext_orport.h"
 #include "common/memarea.h"
-#include "common/sandbox.h"
+#include "lib/sandbox/sandbox.h"
 
 #include <event2/event.h>
 

src/or/routerlist.c

@@ -119,7 +119,7 @@
 #include "or/routerlist.h"
 #include "or/routerparse.h"
 #include "or/routerset.h"
-#include "common/sandbox.h"
+#include "lib/sandbox/sandbox.h"
 #include "or/torcert.h"
 
 #include "or/dirauth/dirvote.h"

src/or/routerparse.c

@@ -74,7 +74,7 @@
 #include "or/routerkeys.h"
 #include "or/routerlist.h"
 #include "or/routerparse.h"
-#include "common/sandbox.h"
+#include "lib/sandbox/sandbox.h"
 #include "or/shared_random_client.h"
 #include "or/torcert.h"
 #include "or/voting_schedule.h"

src/or/statefile.c

@@ -40,7 +40,7 @@
 #include "or/main.h"
 #include "or/rephist.h"
 #include "or/router.h"
-#include "common/sandbox.h"
+#include "lib/sandbox/sandbox.h"
 #include "or/statefile.h"
 
 /** A list of state-file "abbreviations," for compatibility. */

src/rust/build.rs

@@ -151,6 +151,7 @@ pub fn main() {
             // moving forward!
             cfg.component("tor-crypt-ops-testing");
             cfg.component("or-testing");
+            cfg.component("tor-sandbox");
             cfg.component("tor-net");
             cfg.component("tor-log");
             cfg.component("tor-lock");

src/test/test_options.c

@@ -15,7 +15,7 @@
 #include "or/main.h"
 #include "test/log_test_helpers.h"
 
-#include "common/sandbox.h"
+#include "lib/sandbox/sandbox.h"
 #include "common/memarea.h"
 #include "or/policies.h"
 #include "test/test_helpers.h"

src/tools/tor-resolve.c

@@ -8,7 +8,7 @@
 #include "common/util.h"
 #include "lib/net/address.h"
 #include "lib/log/torlog.h"
-#include "common/sandbox.h"
+#include "lib/sandbox/sandbox.h"
 
 #include <stdio.h>
 #include <stdlib.h>