Introduce shared memory comms in Sandbox2.

This change adds a new communication channel based on shared memory (memfd) between the sandboxer and the sandboxee. When this feature is enabled, a memfd is created and passed to the sandboxee via the forkserver. The Comms object in both the sandboxer and sandboxee can then be initialized with this shared memory buffer, allowing for potentially faster data transfer.

PiperOrigin-RevId: 912007765
Change-Id: If5fbe5b9687f2d5e7ebe66aaa265b8ae3d27edc6

Author: paulsemel

sandboxed_api/sandbox2/BUILD

@@ -836,6 +836,7 @@ cc_library(
     deps = [
         ":util",
         "//sandboxed_api/util:fileops",
+        "//sandboxed_api/util:status",
         "@abseil-cpp//absl/base:core_headers",
         "@abseil-cpp//absl/memory",
         "@abseil-cpp//absl/status",
@@ -881,13 +882,18 @@ cc_library(
     copts = sapi_platform_copts(),
     visibility = ["//visibility:public"],
     deps = [
+        ":buffer",
         ":util",
+        "//sandboxed_api/sandbox2/util:asynchronous_byte_transport",
+        "//sandboxed_api/sandbox2/util:potentially_blocking_region",
         "//sandboxed_api/util:fileops",
         "//sandboxed_api/util:raw_logging",
         "//sandboxed_api/util:status",
         "//sandboxed_api/util:status_cc_proto",
+        "//sandboxed_api/util:thread",
         "@abseil-cpp//absl/base:core_headers",
         "@abseil-cpp//absl/base:dynamic_annotations",
+        "@abseil-cpp//absl/log",
         "@abseil-cpp//absl/status",
         "@abseil-cpp//absl/status:statusor",
         "@abseil-cpp//absl/strings",

sandboxed_api/sandbox2/CMakeLists.txt

@@ -773,6 +773,7 @@ target_link_libraries(sandbox2_buffer
           absl::status
           absl::strings
           sapi::base
+          sapi::status
           sandbox2::util
   PUBLIC absl::core_headers
          absl::statusor
@@ -815,10 +816,13 @@ add_library(sandbox2_comms ${SAPI_LIB_TYPE}
 )
 add_library(sandbox2::comms ALIAS sandbox2_comms)
 target_link_libraries(sandbox2_comms
-  PRIVATE absl::status
+  PRIVATE absl::log
+          absl::status
           absl::statusor
           absl::str_format
           absl::strings
+          sandbox2::asynchronous_byte_transport
+          sandbox2::potentially_blocking_region
           sandbox2::util
           sapi::base
           sapi::raw_logging

sandboxed_api/sandbox2/buffer.cc

@@ -32,6 +32,7 @@
 #include "absl/strings/str_cat.h"
 #include "sandboxed_api/sandbox2/util.h"
 #include "sandboxed_api/util/fileops.h"
+#include "sandboxed_api/util/status_macros.h"
 
 namespace sandbox2 {
 
@@ -97,14 +98,8 @@ absl::StatusOr<std::unique_ptr<Buffer>> Buffer::Expand(
 // will be immediately deleted.
 absl::StatusOr<std::unique_ptr<Buffer>> Buffer::CreateWithSize(
     size_t size, const char* name) {
-  absl::StatusOr<FDCloser> fd = util::CreateMemFd(name);
-  if (!fd.ok()) {
-    return fd.status();
-  }
-  if (ftruncate(fd->get(), size) != 0) {
-    return absl::ErrnoToStatus(errno, "Could not extend buffer fd");
-  }
-  return CreateFromFd(*std::move(fd), size);
+  SAPI_ASSIGN_OR_RETURN(FDCloser fd, util::CreateMemFdWithSize(size, name));
+  return CreateFromFd(std::move(fd), size);
 }
 
 std::string Buffer::GetName() const {

sandboxed_api/sandbox2/client.cc

@@ -198,8 +198,14 @@ void Client::EnableSandbox() {
   ApplyPolicyAndBecomeTracee();
 }
 
+void Client::ReceiveCommsUpgrade() {
+  auto status = comms_->RecvSharedMemUpgrade();
+  SAPI_RAW_CHECK(status.ok(), "receiving comms upgrade");
+}
+
 void Client::SandboxMeHere() {
   PrepareEnvironment();
+  ReceiveCommsUpgrade();
   EnableSandbox();
 }
 

sandboxed_api/sandbox2/client.h

@@ -135,6 +135,7 @@ class Client {
 
   void PrepareEnvironment(int* preserved_fd = nullptr);
   void EnableSandbox();
+  void ReceiveCommsUpgrade();
 };
 
 }  // namespace sandbox2