summaryrefslogtreecommitdiffhomepage
path: root/pkg/sentry
AgeCommit message (Collapse)Author
2020-04-21Merge release-20200323.0-199-g120d3b5 (automated)gVisor bot
2020-04-21Automated rollback of changelist 307477185gVisor bot
PiperOrigin-RevId: 307598974
2020-04-21Merge release-20200323.0-198-gc615aaf (automated)gVisor bot
2020-04-20Merge release-20200323.0-195-g07b1b4c (automated)gVisor bot
2020-04-20Merge pull request #2313 from kevinGC:firstngVisor bot
PiperOrigin-RevId: 307477185
2020-04-20Merge release-20200323.0-189-ge72ce8c (automated)gVisor bot
2020-04-20Change lingering uses of "memfs" in fsimpl/tmpfs to "tmpfs".Jamie Liu
PiperOrigin-RevId: 307422746
2020-04-20Merge release-20200323.0-188-g1a940f2 (automated)gVisor bot
2020-04-20Resolve issue with file mode for host fds.Dean Deng
Instead of plumbing error through kernfs.Inode.Mode, panic if err != nil. The errors that can result from an fstat syscall all indicate that something is fundamentally wrong, and panicking should be acceptable. PiperOrigin-RevId: 307406847
2020-04-18Merge release-20200323.0-185-gea9bb1c (automated)gVisor bot
2020-04-17Merge pull request #2235 from xiaobo55x:pcidgVisor bot
PiperOrigin-RevId: 307166482
2020-04-18Merge release-20200323.0-183-g9a233c9 (automated)gVisor bot
2020-04-17Fix watchdog skipStack: the meaning was reversed.Adin Scannell
PiperOrigin-RevId: 307166317
2020-04-17Merge release-20200323.0-182-ge838290 (automated)gVisor bot
2020-04-17prlimit: don't check credentials on selfKevin Krakauer
prlimit was erroneously comparing UIDs and GIDs when getting/setting a process' own limits. From the manpage: To set or get the resources of a process other than itself, the caller must have the CAP_SYS_RESOURCE capability, or the real, effective, and saved set user IDs of the target process must match the real user ID of the caller and the real, effective, and saved set group IDs of the target process must match the real group ID of the caller. PiperOrigin-RevId: 307127266
2020-04-17Remove View.First() and View.RemoveFirst()Kevin Krakauer
These methods let users eaily break the VectorisedView abstraction, and allowed netstack to slip into pseudo-enforcement of the "all headers are in the first View" invariant. Removing them and replacing with PullUp(n) breaks this reliance and will make it easier to add iptables support and rework network buffer management. The new View.PullUp(n) method is low cost in the common case, when when all the headers fit in the first View.
2020-04-17Merge release-20200323.0-179-g80deebb (automated)gVisor bot
2020-04-17Merge pull request #1978 from lubinszARM:pr_signal_mmgVisor bot
PiperOrigin-RevId: 307078788
2020-04-17Merge release-20200323.0-177-g12bde95 (automated)gVisor bot
2020-04-17Get /bin/true to run on VFS2Zach Koopmans
Included: - loader_test.go RunTest and TestStartSignal VFS2 - container_test.go TestAppExitStatus on VFS2 - experimental flag added to runsc to turn on VFS2 Note: shared mounts are not yet supported. PiperOrigin-RevId: 307070753
2020-04-17Merge release-20200323.0-174-gb4de018 (automated)gVisor bot
2020-04-17Permit setting unknown optionsTamir Duberstein
This previously changed in 305699233, but this behaviour turned out to be load bearing. PiperOrigin-RevId: 307033802
2020-04-17Merge release-20200323.0-173-gf03996c (automated)gVisor bot
2020-04-16Implement pipe(2) and pipe2(2) for VFS2.Jamie Liu
Updates #1035 PiperOrigin-RevId: 306968644
2020-04-16Merge release-20200323.0-164-g2839981 (automated)gVisor bot
2020-04-16Make ExtractErrno a functionFabricio Voznika
PiperOrigin-RevId: 306891171
2020-04-14Merge release-20200323.0-154-g2dd6384 (automated)gVisor bot
2020-04-14Fix cleanup around socketpair() failure to copy out FDs.Jamie Liu
- Use the fs.File, rather than the vfs.FileDescription, in the VFS1 version. - Check for a nil fs.File/vfs.FileDescription before calling DecRef, which is possible if a racing dup2() or dup3() replaces the file descriptor between when it is installed and when it is returned. (This is not possible in Linux because Linux separates allocation of a file descriptor from binding an allocated file descriptor to a struct file, and dup2/dup3 return EBUSY if asked to replace an allocated but unbound file descriptor.) PiperOrigin-RevId: 306517101
2020-04-14Merge release-20200323.0-153-g52b4b19 (automated)gVisor bot
2020-04-14Pass O_LARGEFILE in syscalls/linux/vfs2.openat.Jamie Liu
Needed for PipeTest_Flags: files opened by open() and openat() get O_LARGEFILE (on architectures with 64-bit off_t), but not FDs created by other syscalls such as pipe(). Updates #1035 PiperOrigin-RevId: 306504788
2020-04-14Merge release-20200323.0-146-g71e6ac3 (automated)gVisor bot
2020-04-13Don't allow read/write when offset+size overflows.Nicolas Lacasse
PiperOrigin-RevId: 306348346
2020-04-13Merge release-20200323.0-144-g7e5d67e (automated)gVisor bot
2020-04-13Merge pull request #2168 from xiaobo55x:ptrace_testgVisor bot
PiperOrigin-RevId: 306306809
2020-04-13Merge release-20200323.0-138-ge1959f5 (automated)gVisor bot
2020-04-13Merge pull request #2321 from lubinszARM:pr_nogogVisor bot
PiperOrigin-RevId: 306300032
2020-04-13Merge release-20200323.0-136-g5d885d7 (automated)gVisor bot
2020-04-13Port socket-related syscalls to VFS2.Dean Deng
Note that most kinds of sockets are not yet supported in VFS2 (only Unix sockets are partially supported at the moment), so these syscalls will still generally fail. Enabling them allows us to begin running socket tests for VFS2 as more features are ported over. Updates #1476, #1478, #1484, #1485. PiperOrigin-RevId: 306292294
2020-04-13Merge release-20200323.0-134-g6a4d17a (automated)gVisor bot
2020-04-13Remove obsolete TODOs for b/38173783Jon Budd
The comments in the ticket indicate that this behavior is fine and that the ticket should be closed, so we shouldn't need pointers to the ticket. PiperOrigin-RevId: 306266071
2020-04-13Merge release-20200323.0-133-g445c366 (automated)gVisor bot
2020-04-13Fix VFS2 getdents()/getdents64() alignment.Jamie Liu
PiperOrigin-RevId: 306263615
2020-04-11Merge release-20200323.0-130-gdaf3322 (automated)gVisor bot
2020-04-10Add logging message for noNewPrivileges OCI option.Ian Lewis
noNewPrivileges is ignored if set to false since gVisor assumes that PR_SET_NO_NEW_PRIVS is always enabled. PiperOrigin-RevId: 305991947
2020-04-11Merge release-20200323.0-129-g09ddb5a (automated)gVisor bot
2020-04-10Port extended attributes to VFS2.Dean Deng
As in VFS1, we only support the user.* namespace. Plumbing is added to tmpfs and goferfs. Note that because of the slightly different order of checks between VFS2 and Linux, one of the xattr tests needs to be relaxed slightly. Fixes #2363. PiperOrigin-RevId: 305985121
2020-04-10Merge release-20200323.0-128-g96f9142 (automated)gVisor bot
2020-04-10Use O_CLOEXEC when dup'ing FDsFabricio Voznika
The sentry doesn't allow execve, but it's a good defense in-depth measure. PiperOrigin-RevId: 305958737
2020-04-10Merge release-20200323.0-122-g1798d6c (automated)gVisor bot
2020-04-10Remove TODO from kernel.StracerFabricio Voznika
The dependency strace=>kernel grew over time. strace also depends on task's FD table and FSContext. It could be fixed with some interfaces the other way, but then we're trading an interface for another, and kernel.Stracer is likely cleaner. Closes #155 PiperOrigin-RevId: 305909678
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-17 08:30:26 +0000