Add mitigate command to runsc

PiperOrigin-RevId: 356772367

1 files changed, 72 insertions, 0 deletions

diff --git a/runsc/cmd/mitigate.go b/runsc/cmd/mitigate.go
new file mode 100644
index 000000000..9052f091d
--- /dev/null
+++ b/runsc/cmd/mitigate.go
@@ -0,0 +1,72 @@
+// Copyright 2021 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cmd
+
+import (
+	"context"
+	"io/ioutil"
+
+	"github.com/google/subcommands"
+	"gvisor.dev/gvisor/pkg/log"
+	"gvisor.dev/gvisor/runsc/flag"
+	"gvisor.dev/gvisor/runsc/mitigate"
+)
+
+// Mitigate implements subcommands.Command for the "mitigate" command.
+type Mitigate struct {
+	mitigate mitigate.Mitigate
+}
+
+// Name implements subcommands.command.name.
+func (*Mitigate) Name() string {
+	return "mitigate"
+}
+
+// Synopsis implements subcommands.Command.Synopsis.
+func (*Mitigate) Synopsis() string {
+	return "mitigate mitigates the underlying system against side channel attacks"
+}
+
+// Usage implements subcommands.Command.Usage.
+func (m *Mitigate) Usage() string {
+	return m.mitigate.Usage()
+}
+
+// SetFlags implements subcommands.Command.SetFlags.
+func (m *Mitigate) SetFlags(f *flag.FlagSet) {
+	m.mitigate.SetFlags(f)
+}
+
+// Execute implements subcommands.Command.Execute.
+func (m *Mitigate) Execute(_ context.Context, f *flag.FlagSet, args ...interface{}) subcommands.ExitStatus {
+	if f.NArg() != 0 {
+		f.Usage()
+		return subcommands.ExitUsageError
+	}
+
+	const path = "/proc/cpuinfo"
+	data, err := ioutil.ReadFile(path)
+	if err != nil {
+		log.Warningf("Failed to read %s: %v", path, err)
+		return subcommands.ExitFailure
+	}
+
+	if err := m.mitigate.Execute(data); err != nil {
+		log.Warningf("Execute failed: %v", err)
+		return subcommands.ExitFailure
+	}
+
+	return subcommands.ExitSuccess
+}