1) Fixed handling of calls into another sandbox. Previously, a callee sandbox entry point was treated as executing in the caller's sandbox but actually this is a cross-domain call so it should be recorded as executing in the callee sandbox context.

2) Fixed the definitions of __declare_callgates and __declare_callgates_helper in soaap.h so that they actually appear in the llvm bitcode file.

3) Implemented support for detecting leakage via callgates.

Example error:

*** Sandboxed method dostuff executing in sandboxes: [box] may leak private data through callgate privfunc
+++ Line 17 of file test-sandboxprivate-leakviacallgates.c

Example code:

  1 #include "soaap.h"
  2 #include <string.h>
  3
  4 void dostuff();
  5 void privfunc(int p1);
  6
  7 __soaap_callgates(privfunc);
  8
  9 int main() {
 10   dostuff();
 11   return 0;
 12 }
 13
 14 __soaap_sandbox_persistent_named("box")
 15 void dostuff() {
 16   int key __soaap_sandbox_private("box");
 17   privfunc(key);
 18 }
 19
 20 void privfunc(int p1) {
 21   printf("p1: %d\n", p1);
 22 }

4) Implemented support for detecting leakage via a call into another sandbox:

*** Sandboxed method dostuff1 executing in sandboxes: [get] may leak private data through a cross-sandbox call into: [auth]
+++ Line 16 of file test-sandboxprivate-leakviacrosssand.c

Example code:

  1 #include "soaap.h"
  2 #include <string.h>
  3
  4 void dostuff1();
  5 void dostuff2(int x);
  6
  7 int main() {
  8   dostuff1();
  9   return 0;
 10 }
 11
 12 __soaap_sandbox_persistent_named("get")
 13 void dostuff1() {
 14   int key = 813;
 15   printf("leaking sandbox-private password to another sandbox\n");
 16   dostuff2(key);
 17 }
 18
 19 __soaap_sandbox_persistent_named("auth")
 20 void dostuff2(int x) {
 21   printf("x: %d\n", x);
 22 }