nsjail/Makefile

#
#   nsjail - Makefile
#   -----------------------------------------
#
#   Copyright 2014 Google Inc. All Rights Reserved.
#
#   Licensed under the Apache License, Version 2.0 (the "License");
#   you may not use this file except in compliance with the License.
#   You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
#   Unless required by applicable law or agreed to in writing, software
#   distributed under the License is distributed on an "AS IS" BASIS,
#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#   See the License for the specific language governing permissions and
#   limitations under the License.
#

CC ?= gcc
CXX ?= g++

COMMON_FLAGS += -O2 -c \
	-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 \
	-Wformat -Wformat=2 -Wformat-security -fPIE \
	-Wno-format-nonliteral \
	-Wall -Wextra -Werror \
	-Ikafel/include

CFLAGS += $(COMMON_FLAGS) -std=gnu11
CXXFLAGS += $(COMMON_FLAGS) $(shell pkg-config --cflags protobuf) -std=c++11 -Wno-unused
LDFLAGS += -Wl,-z,now -Wl,-z,relro -pie -Wl,-z,noexecstack -lpthread -lcap $(shell pkg-config --libs protobuf)

BIN = nsjail
LIBS = kafel/libkafel.a
SRCS_C = nsjail.c caps.c cmdline.c contain.c log.c cgroup.c mount.c net.c pid.c sandbox.c subproc.c user.c util.c uts.c cpu.c
SRCS_CXX = config.cc
SRCS_PROTO = config.proto
SRCS_PB_CXX = $(SRCS_PROTO:.proto=.pb.cc)
SRCS_PB_H = $(SRCS_PROTO:.proto=.pb.h)
SRCS_PB_O = $(SRCS_PROTO:.proto=.pb.o)
OBJS = $(SRCS_C:.c=.o) $(SRCS_CXX:.cc=.o) $(SRCS_PB_CXX:.cc=.o)

ifdef DEBUG
	CFLAGS += -g -ggdb -gdwarf-4
	CXXFLAGS += -g -ggdb -gdwarf-4
endif

USE_NL3 ?= yes
ifeq ($(USE_NL3), yes)
NL3_EXISTS := $(shell pkg-config --exists libnl-route-3.0 && echo yes)
ifeq ($(NL3_EXISTS), yes)
	CFLAGS += -DNSJAIL_NL3_WITH_MACVLAN $(shell pkg-config --cflags libnl-route-3.0)
	LDFLAGS += $(shell pkg-config --libs libnl-route-3.0)
endif
endif

.PHONY: all clear depend indent

.c.o: %.c
	$(CC) $(CFLAGS) $< -o $@

.cc.o: %.cc
	$(CXX) $(CXXFLAGS) $< -o $@

all: $(BIN)

$(BIN): $(LIBS) $(OBJS)
	$(CXX) -o $(BIN) $(OBJS) $(LIBS) $(LDFLAGS)

kafel/libkafel.a:
ifeq ("$(wildcard kafel/Makefile)","")
	git submodule update --init
endif
	$(MAKE) -C kafel

$(SRCS_PB_O): $(SRCS_PB_CXX) $(SRCS_PB_H)

$(SRCS_PB_CXX) $(SRCS_PB_H): $(SRCS_PROTO)
	protoc --cpp_out=. $(SRCS_PROTO)

clean:
	$(RM) core Makefile.bak $(OBJS) $(SRCS_PB_CXX) $(SRCS_PB_H) $(BIN)
ifneq ("$(wildcard kafel/Makefile)","")
	$(MAKE) -C kafel clean
endif

depend:
	makedepend -Y -Ykafel/include -- -- $(SRCS_C) $(SRCS_CXX) $(SRCS_PB)

indent:
	clang-format --style=WebKit -i -sort-includes *.c *.h $(SRCS_CXX)
	indent -linux -l100 -lc100 *.c *.h; rm -f *~

# DO NOT DELETE THIS LINE -- make depend depends on it.

nsjail.o: nsjail.h common.h caps.h cmdline.h log.h net.h subproc.h util.h
caps.o: caps.h common.h log.h util.h
cmdline.o: cmdline.h common.h caps.h config.h log.h mount.h user.h util.h
contain.o: contain.h common.h caps.h cgroup.h cpu.h log.h mount.h net.h pid.h
contain.o: user.h util.h uts.h
log.o: log.h common.h
cgroup.o: cgroup.h common.h log.h util.h
mount.o: mount.h common.h log.h subproc.h util.h
net.o: net.h common.h log.h subproc.h
pid.o: pid.h common.h log.h subproc.h
sandbox.o: sandbox.h common.h kafel/include/kafel.h log.h
subproc.o: subproc.h common.h cgroup.h contain.h log.h net.h sandbox.h user.h
subproc.o: util.h
user.o: user.h common.h log.h subproc.h util.h
util.o: util.h common.h log.h
uts.o: uts.h common.h log.h
cpu.o: cpu.h common.h log.h util.h
config.o: common.h caps.h config.h log.h mount.h user.h util.h config.pb.h
config.pb.o: config.pb.h
Initial import 2015-05-15 05:44:48 +08:00			`#`
			`# nsjail - Makefile`
Check for gcc in Makefile 2016-03-09 07:56:20 +08:00			`# -----------------------------------------`
Initial import 2015-05-15 05:44:48 +08:00			`#`
			`# Copyright 2014 Google Inc. All Rights Reserved.`
			`#`
			`# Licensed under the Apache License, Version 2.0 (the "License");`
			`# you may not use this file except in compliance with the License.`
			`# You may obtain a copy of the License at`
			`#`
			`# http://www.apache.org/licenses/LICENSE-2.0`
			`#`
			`# Unless required by applicable law or agreed to in writing, software`
			`# distributed under the License is distributed on an "AS IS" BASIS,`
			`# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.`
			`# See the License for the specific language governing permissions and`
			`# limitations under the License.`
			`#`

Make it possible to compile with clang 2016-03-01 02:09:39 +08:00			`CC ?= gcc`
config: Initial work on converting config.c to c++ protobuf lib config: Initial work on converting config.c to c++ protobuf lib #2 config: Initial work on converting config.c to c++ protobuf lib #3 config: Initial work on converting config.c to c++ protobuf lib #4 config: Initial work on converting config.c to c++ protobuf lib #5 config: Initial work on converting config.c to c++ protobuf lib #6 2017-09-14 04:03:21 +08:00			`CXX ?= g++`
Implement defer() 2016-03-09 01:22:50 +08:00
config: Initial work on converting config.c to c++ protobuf lib config: Initial work on converting config.c to c++ protobuf lib #2 config: Initial work on converting config.c to c++ protobuf lib #3 config: Initial work on converting config.c to c++ protobuf lib #4 config: Initial work on converting config.c to c++ protobuf lib #5 config: Initial work on converting config.c to c++ protobuf lib #6 2017-09-14 04:03:21 +08:00			`COMMON_FLAGS += -O2 -c \`
Makefile: add -D_FILE_OFFSET_BITS=64 to CFLAGS 2017-07-15 21:04:25 +08:00			`-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 \`
Makefile: remove stack-protector from CFLAGS 2017-05-29 00:37:50 +08:00			`-Wformat -Wformat=2 -Wformat-security -fPIE \`
Allow to specify multiple uid/gid maps 2017-02-08 07:36:32 +08:00			`-Wno-format-nonliteral \`
Use kafel unconditionally 2017-05-08 21:50:29 +08:00			`-Wall -Wextra -Werror \`
Makefile: make compiling with libprotobuf-c more robust under different systems 2017-05-29 22:22:31 +08:00			`-Ikafel/include`
Initial import 2015-05-15 05:44:48 +08:00
Makefile: remove space 2017-09-16 00:12:18 +08:00			`CFLAGS += $(COMMON_FLAGS) -std=gnu11`
config: Initial work on converting config.c to c++ protobuf lib config: Initial work on converting config.c to c++ protobuf lib #2 config: Initial work on converting config.c to c++ protobuf lib #3 config: Initial work on converting config.c to c++ protobuf lib #4 config: Initial work on converting config.c to c++ protobuf lib #5 config: Initial work on converting config.c to c++ protobuf lib #6 2017-09-14 04:03:21 +08:00			`CXXFLAGS += $(COMMON_FLAGS) $(shell pkg-config --cflags protobuf) -std=c++11 -Wno-unused`
			`LDFLAGS += -Wl,-z,now -Wl,-z,relro -pie -Wl,-z,noexecstack -lpthread -lcap $(shell pkg-config --libs protobuf)`
Implement defer() 2016-03-09 01:22:50 +08:00
+protobuf-c-text 2017-05-26 10:15:45 +08:00			`BIN = nsjail`
+protobuf-c-text: parsing from text file 2017-05-26 10:25:55 +08:00			`LIBS = kafel/libkafel.a`
config: Initial work on converting config.c to c++ protobuf lib config: Initial work on converting config.c to c++ protobuf lib #2 config: Initial work on converting config.c to c++ protobuf lib #3 config: Initial work on converting config.c to c++ protobuf lib #4 config: Initial work on converting config.c to c++ protobuf lib #5 config: Initial work on converting config.c to c++ protobuf lib #6 2017-09-14 04:03:21 +08:00			`SRCS_C = nsjail.c caps.c cmdline.c contain.c log.c cgroup.c mount.c net.c pid.c sandbox.c subproc.c user.c util.c uts.c cpu.c`
			`SRCS_CXX = config.cc`
makefile: deal with .proto better 2017-09-16 06:31:53 +08:00			`SRCS_PROTO = config.proto`
makefile: proper deps for protos 2017-09-16 22:39:55 +08:00			`SRCS_PB_CXX = $(SRCS_PROTO:.proto=.pb.cc)`
			`SRCS_PB_H = $(SRCS_PROTO:.proto=.pb.h)`
makefile: proper deps for protos #2 2017-09-16 22:43:01 +08:00			`SRCS_PB_O = $(SRCS_PROTO:.proto=.pb.o)`
makefile: proper deps for protos 2017-09-16 22:39:55 +08:00			`OBJS = $(SRCS_C:.c=.o) $(SRCS_CXX:.cc=.o) $(SRCS_PB_CXX:.cc=.o)`
DEBUG only of requested 2016-03-10 06:51:13 +08:00
			`ifdef DEBUG`
			`CFLAGS += -g -ggdb -gdwarf-4`
config: Initial work on converting config.c to c++ protobuf lib config: Initial work on converting config.c to c++ protobuf lib #2 config: Initial work on converting config.c to c++ protobuf lib #3 config: Initial work on converting config.c to c++ protobuf lib #4 config: Initial work on converting config.c to c++ protobuf lib #5 config: Initial work on converting config.c to c++ protobuf lib #6 2017-09-14 04:03:21 +08:00			`CXXFLAGS += -g -ggdb -gdwarf-4`
DEBUG only of requested 2016-03-10 06:51:13 +08:00			`endif`
Stricter check for clang 2016-03-09 01:49:06 +08:00
Make it possible to build w/o kafel and nl3 2017-02-14 05:59:24 +08:00			`USE_NL3 ?= yes`
Makefile: Make it possible to disable kafel and libnl3 from envvar 2016-11-21 06:37:38 +08:00			`ifeq ($(USE_NL3), yes)`
Makefile: use pkg-config for nl3-route and protobuf-c 2017-05-26 07:22:29 +08:00			`NL3_EXISTS := $(shell pkg-config --exists libnl-route-3.0 && echo yes)`
			`ifeq ($(NL3_EXISTS), yes)`
			`CFLAGS += -DNSJAIL_NL3_WITH_MACVLAN $(shell pkg-config --cflags libnl-route-3.0)`
			`LDFLAGS += $(shell pkg-config --libs libnl-route-3.0)`
			`endif`
			`endif`

Makefile: simplify kafel and protobuf-c-text building rules 2017-05-29 06:29:52 +08:00			`.PHONY: all clear depend indent`
Simplify cloning/building. Kafel submodule will be automatically initialized if not done manually before invoking `make`. 2017-05-16 01:39:12 +08:00
Initial import 2015-05-15 05:44:48 +08:00			`.c.o: %.c`
			`$(CC) $(CFLAGS) $< -o $@`

config: Initial work on converting config.c to c++ protobuf lib config: Initial work on converting config.c to c++ protobuf lib #2 config: Initial work on converting config.c to c++ protobuf lib #3 config: Initial work on converting config.c to c++ protobuf lib #4 config: Initial work on converting config.c to c++ protobuf lib #5 config: Initial work on converting config.c to c++ protobuf lib #6 2017-09-14 04:03:21 +08:00			`.cc.o: %.cc`
			`$(CXX) $(CXXFLAGS) $< -o $@`

makefile: deal with .proto better 2017-09-16 06:31:53 +08:00			`all: $(BIN)`
Initial import 2015-05-15 05:44:48 +08:00
Makefile: simplify kafel and protobuf-c-text building rules 2017-05-29 06:29:52 +08:00			`$(BIN): $(LIBS) $(OBJS)`
config: Initial work on converting config.c to c++ protobuf lib config: Initial work on converting config.c to c++ protobuf lib #2 config: Initial work on converting config.c to c++ protobuf lib #3 config: Initial work on converting config.c to c++ protobuf lib #4 config: Initial work on converting config.c to c++ protobuf lib #5 config: Initial work on converting config.c to c++ protobuf lib #6 2017-09-14 04:03:21 +08:00			`$(CXX) -o $(BIN) $(OBJS) $(LIBS) $(LDFLAGS)`
Kafel support 2016-09-13 18:10:15 +08:00
Makefile: simplify kafel and protobuf-c-text building rules 2017-05-29 06:29:52 +08:00			`kafel/libkafel.a:`
Simplify cloning/building. Kafel submodule will be automatically initialized if not done manually before invoking `make`. 2017-05-16 01:39:12 +08:00			`ifeq ("$(wildcard kafel/Makefile)","")`
			`git submodule update --init`
			`endif`
Makefile: simplify kafel and protobuf-c-text building rules 2017-05-29 06:29:52 +08:00			`$(MAKE) -C kafel`
Simplify cloning/building. Kafel submodule will be automatically initialized if not done manually before invoking `make`. 2017-05-16 01:39:12 +08:00
makefile: proper deps for protos #2 2017-09-16 22:43:01 +08:00			`$(SRCS_PB_O): $(SRCS_PB_CXX) $(SRCS_PB_H)`
makefile: proper deps for protos 2017-09-16 22:39:55 +08:00
makefile: proper deps for protos #2 2017-09-16 22:43:01 +08:00			`$(SRCS_PB_CXX) $(SRCS_PB_H): $(SRCS_PROTO)`
makefile: deal with .proto better 2017-09-16 06:31:53 +08:00			`protoc --cpp_out=. $(SRCS_PROTO)`
config: initial proto generated files 2017-05-26 07:55:02 +08:00
Initial import 2015-05-15 05:44:48 +08:00			`clean:`
makefile: proper deps for protos 2017-09-16 22:39:55 +08:00			`$(RM) core Makefile.bak $(OBJS) $(SRCS_PB_CXX) $(SRCS_PB_H) $(BIN)`
Makefile: surround make -C kafel clean with ifdefs 2017-05-27 08:32:39 +08:00			`ifneq ("$(wildcard kafel/Makefile)","")`
Kafel support 2016-09-13 18:10:15 +08:00			`$(MAKE) -C kafel clean`
Makefile: surround make -C kafel clean with ifdefs 2017-05-27 08:32:39 +08:00			`endif`
Initial import 2015-05-15 05:44:48 +08:00
			`depend:`
makefile: deal with .proto better 2017-09-16 06:31:53 +08:00			`makedepend -Y -Ykafel/include -- -- $(SRCS_C) $(SRCS_CXX) $(SRCS_PB)`
Initial import 2015-05-15 05:44:48 +08:00
			`indent:`
config: Initial work on converting config.c to c++ protobuf lib config: Initial work on converting config.c to c++ protobuf lib #2 config: Initial work on converting config.c to c++ protobuf lib #3 config: Initial work on converting config.c to c++ protobuf lib #4 config: Initial work on converting config.c to c++ protobuf lib #5 config: Initial work on converting config.c to c++ protobuf lib #6 2017-09-14 04:03:21 +08:00			`clang-format --style=WebKit -i -sort-includes .c .h $(SRCS_CXX)`
Remove bpf-helper as it's not needed since kafel/ 2017-01-09 19:49:30 +08:00			`indent -linux -l100 -lc100 .c .h; rm -f *~`
Initial import 2015-05-15 05:44:48 +08:00
			`# DO NOT DELETE THIS LINE -- make depend depends on it.`

caps: move capability-setting code to caps.* 2017-07-05 19:03:14 +08:00			`nsjail.o: nsjail.h common.h caps.h cmdline.h log.h net.h subproc.h util.h`
caps: shorter debug messages 2017-07-06 17:37:41 +08:00			`caps.o: caps.h common.h log.h util.h`
config: Initial work on converting config.c to c++ protobuf lib config: Initial work on converting config.c to c++ protobuf lib #2 config: Initial work on converting config.c to c++ protobuf lib #3 config: Initial work on converting config.c to c++ protobuf lib #4 config: Initial work on converting config.c to c++ protobuf lib #5 config: Initial work on converting config.c to c++ protobuf lib #6 2017-09-14 04:03:21 +08:00			`cmdline.o: cmdline.h common.h caps.h config.h log.h mount.h user.h util.h`
caps: move capability-setting code to caps.* 2017-07-05 19:03:14 +08:00			`contain.o: contain.h common.h caps.h cgroup.h cpu.h log.h mount.h net.h pid.h`
			`contain.o: user.h util.h uts.h`
Initial import 2015-05-15 05:44:48 +08:00			`log.o: log.h common.h`
More memory cgroup controls 2016-06-19 19:54:36 +08:00			`cgroup.o: cgroup.h common.h log.h util.h`
setjmp/longjmp: don't use stack-based jmp_buf, use TLS one 2016-11-03 10:53:52 +08:00			`mount.o: mount.h common.h log.h subproc.h util.h`
Comment type + make indent 2016-10-18 04:53:31 +08:00			`net.o: net.h common.h log.h subproc.h`
			`pid.o: pid.h common.h log.h subproc.h`
Remove unnecessary includes 2017-05-09 00:40:21 +08:00			`sandbox.o: sandbox.h common.h kafel/include/kafel.h log.h`
Init cgroups from parent 2016-06-19 21:50:25 +08:00			`subproc.o: subproc.h common.h cgroup.h contain.h log.h net.h sandbox.h user.h`
			`subproc.o: util.h`
Comment type + make indent 2016-10-18 04:53:31 +08:00			`user.o: user.h common.h log.h subproc.h util.h`
Separate mount.c module 2016-03-03 22:37:04 +08:00			`util.o: util.h common.h log.h`
Separate uts.* module 2016-03-03 23:09:25 +08:00			`uts.o: uts.h common.h log.h`
cmdline: implement affinity setting, to limit jailed process to n max cpus 2017-06-19 23:01:50 +08:00			`cpu.o: cpu.h common.h log.h util.h`
makefile: deal with .proto better 2017-09-16 06:31:53 +08:00			`config.o: common.h caps.h config.h log.h mount.h user.h util.h config.pb.h`
			`config.pb.o: config.pb.h`