summaryrefslogtreecommitdiffhomepage
path: root/pkg/sentry
AgeCommit message (Collapse)Author
2020-01-08Built dead-simple traversal, but now getting depedency cycle error :'(Kevin Krakauer
2020-01-08First commit -- re-adding DROPKevin Krakauer
2020-01-08Comment cleanup.Kevin Krakauer
2020-01-08Minor fixes to comments and loggingKevin Krakauer
2020-01-08Write simple ACCEPT rules to the filter table.Kevin Krakauer
This gets us closer to passing the iptables tests and opens up iptables so it can be worked on by multiple people. A few restrictions are enforced for security (i.e. we don't want to let users write a bunch of iptables rules and then just not enforce them): - Only the filter table is writable. - Only ACCEPT rules with no matching criteria can be added.
2020-01-07fs/splice: don't report a partialResult error if there is no data lossAndrei Vagin
PiperOrigin-RevId: 288642552
2020-01-06platform/syscall: use syscall + int3 to execute a system call in a stub processAndrei Vagin
Right now, we need to call ptrace(PTRACE_SYSCALL) and wait() twice to execute one system call in a stub process. With these changes, we will need to call ptrace + wait only once. In addition, this allows to workaround the kernel bug when a stub process doesn't stop on syscall-exit-stop and starts executing the next system call. Reported-by: syzbot+37143cafa8dc3b5008ee@syzkaller.appspotmail.com PiperOrigin-RevId: 288393029
2020-01-06Convert memfs into proto-tmpfs.Nicolas Lacasse
- Renamed memfs to tmpfs. - Copied fileRangeSet bits from fs/fsutil/ to fsimpl/tmpfs/ - Changed tmpfs to be backed by filemem instead of byte slice. - regularFileReadWriter uses a sync.Pool, similar to gofer client. PiperOrigin-RevId: 288356380
2020-01-06Implement rseq(2)Michael Pratt
PiperOrigin-RevId: 288342928
2020-01-06Cleanup Shm reference handlingMichael Pratt
Currently, shm.Registry.FindByID will return Shm instances without taking an additional reference on them, making it possible for them to disappear. More explicitly handle references. All callers hold a reference for the duration that they hold the instance. Registry.shms may transitively hold Shms with no references, so it must TryIncRef to determine if they are still valid. PiperOrigin-RevId: 288314529
2020-01-03Remove FIXME comments to close old bug.Zach Koopmans
PiperOrigin-RevId: 288075400
2019-12-30Add VFS2 support for device special files.Jamie Liu
- Add FileDescriptionOptions.UseDentryMetadata, which reduces the amount of boilerplate needed for device FDs and the like between filesystems. - Switch back to having FileDescription.Init() take references on the Mount and Dentry; otherwise managing refcounts around failed calls to OpenDeviceSpecialFile() / Device.Open() is tricky. PiperOrigin-RevId: 287575574
2019-12-27Add VFS2 support for /proc/filesystems.Jamie Liu
Updates #1195 PiperOrigin-RevId: 287269106
2019-12-26Initial procfs implementation in VFSv2Fabricio Voznika
Updates #1195 PiperOrigin-RevId: 287227722
2019-12-26Merge pull request #1461 from xiaobo55x:ptrace_sysemugVisor bot
PiperOrigin-RevId: 287225250
2019-12-26Merge pull request #1460 from lubinszARM:pr_clean_code1gVisor bot
PiperOrigin-RevId: 287221280
2019-12-26Automated rollback of changelist 287029703gVisor bot
PiperOrigin-RevId: 287217899
2019-12-24Enable IP_RECVTOS socket option for datagram socketsRyan Heacock
Added the ability to get/set the IP_RECVTOS socket option on UDP endpoints. If enabled, TOS from the incoming Network Header passed as ancillary data in the ControlMessages. Test: * Added unit test to udp_test.go that tests getting/setting as well as verifying that we receive expected TOS from incoming packet. * Added a syscall test PiperOrigin-RevId: 287029703
2019-12-24slight changes to ring0&pagetables for Arm64Bin Lu
There are 2 jobs have been finished in this patch: 1, a comment was added to explain the purpose of the extra NOPs in Vectors(). 2, some merge errors were fixed. Signed-off-by: Bin Lu <bin.lu@arm.com>
2019-12-23Fix deadlock in kernfs.Filesystem.revalidateChildLockedFabricio Voznika
It was calling Dentry.InsertChild with the dentry's mutex already locked. Updates #1035 PiperOrigin-RevId: 286962742
2019-12-23Clean up vfs.FilesystemImpl methods that operate on parent directories.Jamie Liu
- Make FilesystemImpl methods that operate on parent directories require !rp.Done() (i.e. there is at least one path component to resolve) as precondition and postcondition (in cases where they do not finish path resolution due to mount boundary / absolute symlink), and require that they do not need to follow the last path component (the file being created / deleted) as a symlink. Check for these in VFS. - Add FilesystemImpl.GetParentDentryAt(), which is required to obtain the old parent directory for VFS.RenameAt(). (Passing the Dentry to be renamed instead has the wrong semantics if the file named by the old path is a mount point since the Dentry will be on the wrong Mount.) - Update memfs to implement these methods correctly (?), including RenameAt. - Change fspath.Parse() to allow empty paths (to simplify implementation of AT_EMPTY_PATH). - Change vfs.PathOperation to take a fspath.Path instead of a raw pathname; non-test callers will need to fspath.Parse() pathnames themselves anyway in order to detect absolute paths and select PathOperation.Start accordingly. PiperOrigin-RevId: 286934941
2019-12-23Replace syscall.PTRACE_SYSEMU with unix.PTRACE_SYSEMUHaibo Xu
Linux PTRACE_SYSEMU support on arm64 was merged to mainline from V5.3, and the corresponding support in go also enabled recently. Since the "syscall" package is locked down from go 1.4, so the ptrace PTRACE_SYSEMU definition can't be added to package "syscall" on arm64. According to the golang community, updates required by new systems or versions should use the corresponding package in the golang.org/x/sys repository instead(https://golang.org/pkg/syscall/). Signed-off-by: Haibo Xu <haibo.xu@arm.com> Change-Id: I2f917bb2be62f990c3e158e2bb99e094ea03f751
2019-12-20Add vfs.ResolvingPath.HandleJump().Jamie Liu
PiperOrigin-RevId: 286666533
2019-12-20Add vfs.Dentry.Children().Jamie Liu
PiperOrigin-RevId: 286660774
2019-12-20Move VFS2 file description status flags to vfs.FileDescription.Jamie Liu
PiperOrigin-RevId: 286616668
2019-12-20Check for valid nfds before copying in an fd set.Dean Deng
Otherwise, CopyInFDSet will try to allocate a negative-length slice. PiperOrigin-RevId: 286584907
2019-12-19futex: wake one waiter if futex_wake is called with a non-positive valueAndrei Vagin
This change is needed to be compatible with the Linux kernel. There is no glibc wrapper for the futex system call, so it is easy to make a mistake and call syscall(__NR_futex, FUTEX_WAKE, addr) without the fourth argument. This works on Linux, because it wakes one waiter even if val is nonpositive. PiperOrigin-RevId: 286494396
2019-12-19Make masterInodeOperations.Truncate take a pointer receiver.Nicolas Lacasse
Otherwise a copy happens, which triggers a data race when reading masterInodeOperations.SimpleFileOperations.uattr, which must be accessed with a lock held. PiperOrigin-RevId: 286464473
2019-12-18Merge pull request #890 from lubinszARM:pr_phyapgVisor bot
PiperOrigin-RevId: 286299056
2019-12-18Add VFS2 plumbing for extended attributes.Jamie Liu
PiperOrigin-RevId: 286281274
2019-12-18Merge pull request #1322 from lubinszARM:pr_vfp_ring0gVisor bot
PiperOrigin-RevId: 286259750
2019-12-18Add Mems_allowed to /proc/PID/statusMichael Pratt
PiperOrigin-RevId: 286248378
2019-12-18supporting lazy-fpsimd in guest on Arm64Bin Lu
Several jobs were finished in this patch: 1, provide functions to get/set fpcr/fpsr/vregs 2, support lazy-fpsimd-context-switch in el1 Signed-off-by: Bin Lu <bin.lu@arm.com>
2019-12-17Mark enableCpuidFault nosplitMichael Pratt
This is called after fork, so it must be nosplit. Updates #1408 PiperOrigin-RevId: 286053054
2019-12-17Merge pull request #1394 from zhuangel:bindlockgVisor bot
PiperOrigin-RevId: 286051631
2019-12-17Merge pull request #1321 from lubinszARM:pr_testutils_vfpgVisor bot
PiperOrigin-RevId: 286042427
2019-12-16Merge pull request #1392 from zhuangel:bindleakgVisor bot
PiperOrigin-RevId: 285874181
2019-12-16Drop unnecessary cast.Dean Deng
Bitshift operators with signed int is supported in Go 1.13. PiperOrigin-RevId: 285853622
2019-12-16Implement checks for get/setxattr at the syscall layer.Dean Deng
Add checks for input arguments, file type, permissions, etc. that match the Linux implementation. A call to get/setxattr that passes all the checks will still currently return EOPNOTSUPP. Actual support will be added in following commits. Only allow user.* extended attributes for the time being. PiperOrigin-RevId: 285835159
2019-12-16Fix deadlock in overlay bindYong He
Copy up parent when binding UDS on overlayfs is supported in commit 02ab1f187cd24c67b754b004229421d189cee264. But the using of copyUp in overlayBind will cause sentry stuck, reason is dead lock in renameMu. 1 [Process A] Invoke a Unix socket bind operation renameMu is hold in fs.(*Dirent).genericCreate by process A 2 [Process B] Invoke a read syscall on /proc/task/mounts waitng on Lock of renameMu in fs.(*MountNamespace).FindMount 3 [Process A] Continue Unix socket bind operation wating on RLock of renameMu in fs.copyUp Root cause is recursive reading lock of reanmeMu in bind call trace, if there are writing lock between the two reading lock, then deadlock occured. Fixes #1397
2019-12-16Fix UDS bind cause fd leak in goferYong He
After the finalizer optimize in 76039f895995c3fe0deef5958f843868685ecc38 commit, clientFile needs to closed before finalizer release it. The clientFile is not closed if it is created via gofer.(*inodeOperations).Bind, this will cause fd leak which is hold by gofer process. Fixes #1396 Signed-off-by: Yong He <chenglang.hy@antfin.com> Signed-off-by: Jianfeng Tan <henry.tjf@antfin.com>
2019-12-13enable kvm to support arm64lubinszARM
There are 4 jobs were finished in this package: 1, Virtual machine initialization. 2, Bluepill implementation. 3, Move ring0.Vectors() into the address with 11-bits alignment. 4, Basic support for "SwitchToUser". Signed-off-by: Bin Lu <bin.lu@arm.com> COPYBARA_INTEGRATE_REVIEW=https://github.com/google/gvisor/pull/919 from lubinszARM:pr_kvm eedea52db451bf62722759009a9f14c54a69c55f PiperOrigin-RevId: 285501256
2019-12-12Implement memmap.MappingIdentity for vfs.FileDescription.Jamie Liu
PiperOrigin-RevId: 285255855
2019-12-12Implement kernfs.Rahat Mahmood
PiperOrigin-RevId: 285231002
2019-12-12unix: allow to bind unix sockets only to AF_UNIX addressesAndrei Vagin
Reported-by: syzbot+2c0bcfd87fb4e8b7b009@syzkaller.appspotmail.com PiperOrigin-RevId: 285228312
2019-12-11Add support for TCP_USER_TIMEOUT option.Bhasker Hariharan
The implementation follows the linux behavior where specifying a TCP_USER_TIMEOUT will cause the resend timer to honor the user specified timeout rather than the default rto based timeout. Further it alters when connections are timedout due to keepalive failures. It does not alter the behavior of when keepalives are sent. This is as per the linux behavior. PiperOrigin-RevId: 285099795
2019-12-11Add vfs.Pathname{WithDeleted,ForGetcwd}.Jamie Liu
The former is needed for vfs.FileDescription to implement memmap.MappingIdentity, and the latter is needed to implement getcwd(2). PiperOrigin-RevId: 285051855
2019-12-11Merge pull request #1248 from xiaobo55x:ptracegVisor bot
PiperOrigin-RevId: 285038987
2019-12-11runsc/debug: add an option to list all processesAndrei Vagin
runsc debug --ps list all processes with all threads. This option is added to the debug command but not to the ps command, because it is going to be used for debug purposes and we want to add any useful information without thinking about backward compatibility. This will help to investigate syzkaller issues. PiperOrigin-RevId: 285013668
2019-12-10Deduplicate and simplify control message processing for recvmsg and sendmsg.Dean Deng
Also, improve performance by calculating how much space is needed before making an allocation for sendmsg in hostinet. PiperOrigin-RevId: 284898581
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-26 00:36:56 +0000