Introduce shared memory comms in Sandbox2.

This change adds a new communication channel based on shared memory (memfd) between the sandboxer and the sandboxee. When this feature is enabled, a memfd is created and passed to the sandboxee via the forkserver. The Comms object in both the sandboxer and sandboxee can then be initialized with this shared memory buffer, allowing for potentially faster data transfer.

PiperOrigin-RevId: 912036443
Change-Id: I3a1fd96f1f17a72d6c98e071b2df657cdd4e37e1

Author: Sandboxed API Team

sandboxed_api/sandbox2/BUILD

@@ -836,7 +836,6 @@ cc_library(
     deps = [
         ":util",
         "//sandboxed_api/util:fileops",
-        "//sandboxed_api/util:status",
         "@abseil-cpp//absl/base:core_headers",
         "@abseil-cpp//absl/memory",
         "@abseil-cpp//absl/status",
@@ -882,18 +881,13 @@ cc_library(
     copts = sapi_platform_copts(),
     visibility = ["//visibility:public"],
     deps = [
-        ":buffer",
         ":util",
-        "//sandboxed_api/sandbox2/util:asynchronous_byte_transport",
-        "//sandboxed_api/sandbox2/util:potentially_blocking_region",
         "//sandboxed_api/util:fileops",
         "//sandboxed_api/util:raw_logging",
         "//sandboxed_api/util:status",
         "//sandboxed_api/util:status_cc_proto",
-        "//sandboxed_api/util:thread",
         "@abseil-cpp//absl/base:core_headers",
         "@abseil-cpp//absl/base:dynamic_annotations",
-        "@abseil-cpp//absl/log",
         "@abseil-cpp//absl/status",
         "@abseil-cpp//absl/status:statusor",
         "@abseil-cpp//absl/strings",

sandboxed_api/sandbox2/CMakeLists.txt

@@ -773,7 +773,6 @@ target_link_libraries(sandbox2_buffer
           absl::status
           absl::strings
           sapi::base
-          sapi::status
           sandbox2::util
   PUBLIC absl::core_headers
          absl::statusor
@@ -816,13 +815,10 @@ add_library(sandbox2_comms ${SAPI_LIB_TYPE}
 )
 add_library(sandbox2::comms ALIAS sandbox2_comms)
 target_link_libraries(sandbox2_comms
-  PRIVATE absl::log
-          absl::status
+  PRIVATE absl::status
           absl::statusor
           absl::str_format
           absl::strings
-          sandbox2::asynchronous_byte_transport
-          sandbox2::potentially_blocking_region
           sandbox2::util
           sapi::base
           sapi::raw_logging

sandboxed_api/sandbox2/buffer.cc

@@ -32,7 +32,6 @@
 #include "absl/strings/str_cat.h"
 #include "sandboxed_api/sandbox2/util.h"
 #include "sandboxed_api/util/fileops.h"
-#include "sandboxed_api/util/status_macros.h"
 
 namespace sandbox2 {
 
@@ -98,8 +97,14 @@ absl::StatusOr<std::unique_ptr<Buffer>> Buffer::Expand(
 // will be immediately deleted.
 absl::StatusOr<std::unique_ptr<Buffer>> Buffer::CreateWithSize(
     size_t size, const char* name) {
-  SAPI_ASSIGN_OR_RETURN(FDCloser fd, util::CreateMemFdWithSize(size, name));
-  return CreateFromFd(std::move(fd), size);
+  absl::StatusOr<FDCloser> fd = util::CreateMemFd(name);
+  if (!fd.ok()) {
+    return fd.status();
+  }
+  if (ftruncate(fd->get(), size) != 0) {
+    return absl::ErrnoToStatus(errno, "Could not extend buffer fd");
+  }
+  return CreateFromFd(*std::move(fd), size);
 }
 
 std::string Buffer::GetName() const {

sandboxed_api/sandbox2/client.cc

@@ -198,14 +198,8 @@ void Client::EnableSandbox() {
   ApplyPolicyAndBecomeTracee();
 }
 
-void Client::ReceiveCommsUpgrade() {
-  auto status = comms_->RecvSharedMemUpgrade();
-  SAPI_RAW_CHECK(status.ok(), "receiving comms upgrade");
-}
-
 void Client::SandboxMeHere() {
   PrepareEnvironment();
-  ReceiveCommsUpgrade();
   EnableSandbox();
 }
 

sandboxed_api/sandbox2/client.h

@@ -135,7 +135,6 @@ class Client {
 
   void PrepareEnvironment(int* preserved_fd = nullptr);
   void EnableSandbox();
-  void ReceiveCommsUpgrade();
 };
 
 }  // namespace sandbox2