6 files changed, 83 insertions, 5 deletions
diff --git a/tools/checkunsafe/BUILD b/tools/checkunsafe/BUILD
new file mode 100644
index 000000000..d85c56131
--- /dev/null
+++ b/tools/checkunsafe/BUILD
@@ -0,0 +1,13 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_tool_library")
+
+package(licenses = ["notice"])
+
+go_tool_library(
+    name = "checkunsafe",
+    srcs = ["check_unsafe.go"],
+    importpath = "checkunsafe",
+    visibility = ["//visibility:public"],
+    deps = [
+        "@org_golang_x_tools//go/analysis:go_tool_library",
+    ],
+)
diff --git a/tools/checkunsafe/check_unsafe.go b/tools/checkunsafe/check_unsafe.go
new file mode 100644
index 000000000..4ccd7cc5a
--- /dev/null
+++ b/tools/checkunsafe/check_unsafe.go
@@ -0,0 +1,56 @@
+// Copyright 2019 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package checkunsafe allows unsafe imports only in files named appropriately.
+package checkunsafe
+
+import (
+	"fmt"
+	"path"
+	"strconv"
+	"strings"
+
+	"golang.org/x/tools/go/analysis"
+)
+
+// Analyzer defines the entrypoint.
+var Analyzer = &analysis.Analyzer{
+	Name: "checkunsafe",
+	Doc:  "allows unsafe use only in specified files",
+	Run:  run,
+}
+
+func run(pass *analysis.Pass) (interface{}, error) {
+	for _, f := range pass.Files {
+		for _, imp := range f.Imports {
+			// Is this an unsafe import?
+			pkg, err := strconv.Unquote(imp.Path.Value)
+			if err != nil || pkg != "unsafe" {
+				continue
+			}
+
+			// Extract the filename.
+			filename := pass.Fset.File(imp.Pos()).Name()
+
+			// Allow files named _unsafe.go or _test.go to opt out.
+			if strings.HasSuffix(filename, "_unsafe.go") || strings.HasSuffix(filename, "_test.go") {
+				continue
+			}
+
+			// Throw the error.
+			pass.Reportf(imp.Pos(), fmt.Sprintf("package unsafe imported by %s; must end with _unsafe.go", path.Base(filename)))
+		}
+	}
+	return nil, nil
+}
diff --git a/tools/go_generics/defs.bzl b/tools/go_generics/defs.bzl
index 596bf51be..c5be52ecd 100644
--- a/tools/go_generics/defs.bzl
+++ b/tools/go_generics/defs.bzl
@@ -132,7 +132,7 @@ go_template_instance = rule(
         "types": attr.string_dict(),
         "consts": attr.string_dict(),
         "imports": attr.string_dict(),
-        "anon": attr.bool(mandatory=False, default=False),
+        "anon": attr.bool(mandatory = False, default = False),
         "package": attr.string(mandatory = True),
         "out": attr.output(mandatory = True),
         "_tool": attr.label(executable = True, cfg = "host", default = Label("//tools/go_generics")),
diff --git a/tools/go_generics/generics.go b/tools/go_generics/generics.go
index e3912ef2a..e9cc2c753 100644
--- a/tools/go_generics/generics.go
+++ b/tools/go_generics/generics.go
@@ -82,9 +82,10 @@
 // Note that the second call to g() kept "b" as an argument because it refers to
 // the local variable "b".
 //
-// Note that go_generics can handle anonymous fields with renamed types if -anon is passed in,
-// however it does not perform strict checking on parameter types that share the same name
-// as the global type and therefore will rename them as well.
+// Note that go_generics can handle anonymous fields with renamed types if
+// -anon is passed in, however it does not perform strict checking on parameter
+// types that share the same name as the global type and therefore will rename
+// them as well.
 //
 // You can see an example in the tools/go_generics/generics_tests/interface test.
 package main
diff --git a/tools/nogo.js b/tools/nogo.js
new file mode 100644
index 000000000..fc0a4d1f0
--- /dev/null
+++ b/tools/nogo.js
@@ -0,0 +1,7 @@
+{
+  "checkunsafe": {
+    "exclude_files": {
+      "/external/": "not subject to constraint"
+    }
+  }
+}
diff --git a/tools/run_tests.sh b/tools/run_tests.sh
index d1669b343..483b9cb50 100755
--- a/tools/run_tests.sh
+++ b/tools/run_tests.sh
@@ -45,7 +45,8 @@ readonly TEST_PACKAGES=("//pkg/..." "//runsc/..." "//tools/...")
 #######################
 
 # Install the latest version of Bazel and log the version.
-(which use_bazel.sh && use_bazel.sh latest) || which bazel
+# FIXME(b/137285694): Unable to build runsc with bazel 0.28.0.
+(which use_bazel.sh && use_bazel.sh 0.27.1) || which bazel
 bazel version
 
 # Load the kvm module.