[all-commits] [llvm/llvm-project] 8e999e: [llvm][clang] Sandbox filesystem reads (#165350)

[Jan Svoboda via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 8e999e3d7857ce131d03bab4fd5c42b0e8edd980
      https://github.com/llvm/llvm-project/commit/8e999e3d7857ce131d03bab4fd5c42b0e8edd980
  Author: Jan Svoboda <jan_svoboda at apple.com>
  Date:   2025-12-11 (Thu, 11 Dec 2025)

  Changed paths:
    M clang/lib/Basic/FileManager.cpp
    M clang/lib/CodeGen/BackendUtil.cpp
    M clang/lib/Driver/Driver.cpp
    M clang/lib/Driver/Job.cpp
    M clang/lib/Serialization/GlobalModuleIndex.cpp
    M clang/lib/Serialization/ModuleCache.cpp
    M clang/lib/StaticAnalyzer/Core/HTMLDiagnostics.cpp
    M clang/tools/driver/cc1_main.cpp
    M clang/tools/driver/cc1as_main.cpp
    M llvm/CMakeLists.txt
    M llvm/include/llvm/CodeGen/AsmPrinter.h
    M llvm/include/llvm/Config/llvm-config.h.cmake
    A llvm/include/llvm/Support/IOSandbox.h
    M llvm/include/llvm/Support/VirtualFileSystem.h
    M llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp
    M llvm/lib/CodeGen/AsmPrinter/AsmPrinterInlineAsm.cpp
    M llvm/lib/Support/LockFileManager.cpp
    M llvm/lib/Support/MemoryBuffer.cpp
    M llvm/lib/Support/Path.cpp
    M llvm/lib/Support/Signals.cpp
    M llvm/lib/Support/Unix/Path.inc
    M llvm/lib/Support/Unix/Signals.inc
    M llvm/lib/Support/VirtualFileSystem.cpp
    M llvm/lib/Support/VirtualOutputBackends.cpp
    M llvm/lib/Support/Windows/Path.inc
    M llvm/lib/Support/Windows/Signals.inc
    M llvm/lib/Support/raw_ostream.cpp
    M llvm/lib/Target/BPF/BTFDebug.cpp

  Log Message:
  -----------
  [llvm][clang] Sandbox filesystem reads (#165350)

This PR introduces a new mechanism for enforcing a sandbox around
filesystem reads coming from the compiler. A fatal error is raised
whenever the `llvm::sys::fs`, `llvm::MemoryBuffer::getFile*()` APIs get
used directly instead of going through the "blessed" virtual interface
of `llvm::vfs::FileSystem`.



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications