Fixed Soaap now to work when the definitions of the soaap_* functions are in the separate soaap_valgrind.c file and thus cannot be found by the LLVM pass. My changes adds declarations for these functions programatically during the LLVM pass. The second major change is decoupling the runtime functions from the LLVM pass - the runtime functions are now in a separate library libsoaap_rt.
Fixed dummy call instruction in dot-dynamic-callgraph pass
Added basic support for static checking of file descriptors. The analysis starts from the annotations and then propagates them through the callgraph, including through dereferences, assignments and parameter passing. This can currently detect unauthorized reads and writes.
Modified the dynamic callgraph profiling stuff to record (call site, callee func, count) triples rather than (caller func, callee func, count), otherwise we can't map this dynamic information back to actual calls in the program
Implemented static checking of file descriptors. It works like a static taint analysis, by propagating annotated permissions through the relevant parts of the callgraph and checking for all system calls whether the necessary permissions are held.
Added #include
Modified DOTDynCG.cpp to use the new getDynamicCallees function
Switched to c++11 and libc++
Implemented static tracking of data between the privileged parent and unprivileged sandbox. This again works like a kind of taint analysis whereby taint is propagated along def-use chains. Once a fixed point is computed, this origin of data information is used to find potential security vulnerabilities in the parent. Currently, untrusted function pointer calls are identified.
First cut at generating stack traces to potential security vulnerabilities. This current implementation fails to get the path along which the vulnerability actually occrs (it just finds a possible path there). The next step is to refine this to take taint sources into account
Prefixed SOAAP annotations with soaap
Fixed stack-trace-finding algorithm for untrusted ffunction pointer calls. The algorithm identifies the function F calling a untrusted sandboxed method S, and finds all stack traces that a) go through F and b) where all calls after F() contain at least one tainted arg
Removed dependence on valgrind, updated header file paths for llvm HEAD and also eliminated the dependence on libc++ by removing lambda functions in favour of inner classes
Fixed include paths to take into account LLVM/Clang rollback
Changed include paths back
added -fPIC to C_FLAGS AND CXX_FLAGS to fix linker error
Merged perf_analysis into master
One more merge conflict
Forgot to remove <<<<<HEAD
Some things I forgot to include in the merge