summaryrefslogtreecommitdiffhomepage
path: root/pkg/sentry
AgeCommit message (Collapse)Author
2020-09-16Merge release-20200907.0-65-g3749e70a6 (automated)gVisor bot
2020-09-16Implement PRead for verity fsChong Cai
PRead is implemented by read from the underlying file in blocks, and verify each block. The verified contents are saved into the output buffer. PiperOrigin-RevId: 332092267
2020-09-16Merge release-20200907.0-64-g666397c5c (automated)gVisor bot
2020-09-16Merge release-20200907.0-63-g0356c7ef3 (automated)gVisor bot
2020-09-16Merge release-20200907.0-62-g49857849f (automated)gVisor bot
2020-09-16Merge pull request #3893 from lubinszARM:pr_n1_03gVisor bot
PiperOrigin-RevId: 332069743
2020-09-16Merge release-20200907.0-60-g87c5c0ad2 (automated)gVisor bot
2020-09-16Merge release-20200907.0-59-g326a1dbb7 (automated)gVisor bot
2020-09-16Merge release-20200907.0-58-g9ef1c7992 (automated)gVisor bot
2020-09-16Rename marshal.Task to marshal.CopyContext.Rahat Mahmood
CopyContext is a better name for the interface because from go-marshal's perspective, the interface has nothing to do with a task. A kernel.Task happens to implement the interface, but so can other things like MemoryManager and IO sequences. PiperOrigin-RevId: 331959678
2020-09-16Merge release-20200907.0-57-gd201feb8c (automated)gVisor bot
2020-09-15Enable automated marshalling for the syscall package.Rahat Mahmood
PiperOrigin-RevId: 331940975
2020-09-16Merge release-20200907.0-56-gdcd532e2e (automated)gVisor bot
2020-09-15Add support for OCI seccomp filters in the sandbox.Ian Lewis
OCI configuration includes support for specifying seccomp filters. In runc, these filter configurations are converted into seccomp BPF programs and loaded into the kernel via libseccomp. runsc needs to be a static binary so, for runsc, we cannot rely on a C library and need to implement the functionality in Go. The generator added here implements basic support for taking OCI seccomp configuration and converting it into a seccomp BPF program with the same behavior as a program generated by libseccomp. - New conditional operations were added to pkg/seccomp to support operations available in OCI. - AllowAny and AllowValue were renamed to MatchAny and EqualTo to better reflect that syscalls matching the conditionals result in the provided action not simply SCMP_RET_ALLOW. - BuildProgram in pkg/seccomp no longer panics if provided an empty list of rules. It now builds a program with the architecture sanity check only. - ProgramBuilder now allows adding labels that are unused. However, backwards jumps are still not permitted. Fixes #510 PiperOrigin-RevId: 331938697
2020-09-16Merge release-20200907.0-55-gc053c4bb0 (automated)gVisor bot
2020-09-16Merge release-20200907.0-54-gcb2e3c946 (automated)gVisor bot
2020-09-15Implement gvisor verity fs ioctl with GETFLAGSChong Cai
PiperOrigin-RevId: 331905347
2020-09-15Merge release-20200907.0-53-g8b15effd9 (automated)gVisor bot
2020-09-15Merge release-20200907.0-52-g456c6c33e (automated)gVisor bot
2020-09-15Merge release-20200907.0-51-ga004f0d08 (automated)gVisor bot
2020-09-15Support setting STATX_SIZE for kernfs.InodeAttrs.Dean Deng
Make setting STATX_SIZE a no-op, if it is valid for the given permissions and file type. Also update proc tests, which were overfitted before. Fixes #3842. Updates #1193. PiperOrigin-RevId: 331861087
2020-09-15Merge release-20200907.0-50-g72a30b114 (automated)gVisor bot
2020-09-15Merge release-20200907.0-49-g7f89a26e1 (automated)gVisor bot
2020-09-15Merge release-20200907.0-48-g0d790cbae (automated)gVisor bot
2020-09-15Merge release-20200907.0-47-g86b31a807 (automated)gVisor bot
2020-09-15Release FDTable lock before dropping the fds.Nayana Bidari
This is needed for SO_LINGER, where close() is blocked for linger timeout and we are holding the FDTable lock for the entire timeout which will not allow us to create/delete other fds. We have to release the locks and then drop the fds. PiperOrigin-RevId: 331844185
2020-09-15Read vfs2 epoll events atomically.Jamie Liu
Discovered by ayushranjan@: VFS2 was employing the following algorithm for fetching ready events from an epoll instance: - Create a statically sized EpollEvent slice on the stack of size 16. - Pass that to EpollInstance.ReadEvents() to populate. - EpollInstance.ReadEvents() requeues level-triggered events that it returns back into the ready queue. - Write the results to usermem. - If the number of results were = 16 then recall EpollInstance.ReadEvents() in the hopes of getting more. But this will cause duplication of the "requeued" ready level-triggered events. So if the ready queue has >= 16 ready events, the EpollWait for loop will spin until it fills the usermem with `maxEvents` events. Fixes #3521 PiperOrigin-RevId: 331840527
2020-09-15Merge release-20200907.0-46-g84d48c0fd (automated)gVisor bot
2020-09-15Merge pull request #3895 from btw616:fix/issue-3894gVisor bot
PiperOrigin-RevId: 331824411
2020-09-15Merge release-20200907.0-44-gd3880b76c (automated)gVisor bot
2020-09-15Fix proc.(*fdDir).IterDirents for VFS2Tiwei Bie
Currently the returned offset is an index, and we can't use it to find the next fd to serialize, because getdents should iterate correctly despite mutation of fds. Instead, we can return the next fd to serialize plus 2 (which accounts for "." and "..") as the offset. Fixes: #3894 Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
2020-09-14Merge release-20200907.0-43-g52ffeb2d6 (automated)gVisor bot
2020-09-14Add note about gofer link(2) limitationFabricio Voznika
PiperOrigin-RevId: 331648296
2020-09-14Merge release-20200907.0-42-g2747030ec (automated)gVisor bot
2020-09-14Merge release-20200907.0-41-g05d2ebee5 (automated)gVisor bot
2020-09-14Merge release-20200907.0-40-g2969b1740 (automated)gVisor bot
2020-09-14Correct FDSize in /proc/[pid]/status.Jamie Liu
In Linux, FDSize is fs/proc/array.c:task_state() => struct fdtable::max_fds, which is set to the underlying array's length in fs/file.c:alloc_fdtable(). Follow-up changes: - Remove FDTable.GetRefs() and FDTable.GetRefsVFS2(), which are unused. - Reset FDTable.used to 0 during restore, since the subsequent calls to FDTable.setAll() increment it again, causing its value to be doubled. (After this CL, FDTable.used is only used to avoid reallocation in FDTable.GetFDs(), so this fix is not very visible.) PiperOrigin-RevId: 331588190
2020-09-14Merge release-20200907.0-39-g833ceb0f1 (automated)gVisor bot
2020-09-13Merge release-20200907.0-38-gb6ca96b9b (automated)gVisor bot
2020-09-12Merge release-20200907.0-37-g3ca73841d (automated)gVisor bot
2020-09-11Move the 'marshal' and 'primitive' packages to the 'pkg' directory.Rahat Mahmood
PiperOrigin-RevId: 331256608
2020-09-11Merge release-20200810.0-237-g8d0f76dda (automated)gVisor bot
2020-09-11Merge release-20200907.0-36-g1f4fb817c (automated)gVisor bot
2020-09-11Merge release-20200810.0-236-gb8bee78d0 (automated)gVisor bot
2020-09-11Unexport fusefs.inode.nodeIDCraig Chi
2020-09-11Implement FUSE_UNLINKboyuan-he
Fixes #3696
2020-09-11Fix comments of TODO issues.Craig Chi
2020-09-11Add FUSE umount supportjinmouil
This change implements Release for the FUSE filesystem and expected behaviors of the FUSE devices. It includes several checks for aborted connection in the path for making a request and a function to abort all the ongoing FUSE requests in order.
2020-09-11Fix FUSE_RELEASE protocol reply processingJinmou Li
This commit fixes the potential unexpected errors of original handling of FUSE_RELEASE responses while keep the same behavior (ignoring any reply).
2020-09-11Improve FUSE async/noreply call logicJinmou Li
This change adds bookkeeping variables for the FUSE request. With them, old insecure confusing code we used to process async requests is replaced by new clear compiling ones. Future code can take advantage of them to have better control of each requests.
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-08 12:36:07 +0000