summaryrefslogtreecommitdiffhomepage
path: root/pkg/sentry
AgeCommit message (Collapse)Author
2019-10-30Merge release-20190806.1-348-gca93332 (automated)gVisor bot
2019-10-30support using KVM_MEM_READONLY for arm64 regionslubinszARM
On Arm platform, "setMemoryRegion" has extra permission checks. In virt/kvm/arm/mmu.c: kvm_arch_prepare_memory_region() .... if (writable && !(vma->vm_flags & VM_WRITE)) { ret = -EPERM; break; } .... So, for Arm platform, the "flags" for kvm_memory_region is required. And on x86 platform, the "flags" can be always set as '0'. Signed-off-by: Bin Lu <bin.lu@arm.com> COPYBARA_INTEGRATE_REVIEW=https://github.com/google/gvisor/pull/810 from lubinszARM:pr_setregion 8c99b19cfb0c859c6630a1cfff951db65fcf87ac PiperOrigin-RevId: 277602603
2019-10-29Merge release-20190806.1-343-ga2c51ef (automated)gVisor bot
2019-10-29Add endpoint tracking to the stack.Ian Gudger
In the future this will replace DanglingEndpoints. DanglingEndpoints must be kept for now due to issues with save/restore. This is arguably a cleaner design and allows the stack to know which transport endpoints might still be using its link endpoints. Updates #837 PiperOrigin-RevId: 277386633
2019-10-29Merge release-20190806.1-342-gd7f5e82 (automated)gVisor bot
2019-10-29Fix grammar in comment.Dean Deng
Missing "for". PiperOrigin-RevId: 277358513
2019-10-29Merge release-20190806.1-341-g38330e9 (automated)gVisor bot
2019-10-29Update symlink traversal limit when resolving interpreter path.Dean Deng
When execveat is called on an interpreter script, the symlink count for resolving the script path should be separate from the count for resolving the the corresponding interpreter. An ELOOP error should not occur if we do not hit the symlink limit along any individual path, even if the total number of symlinks encountered exceeds the limit. Closes #574 PiperOrigin-RevId: 277358474
2019-10-29Merge release-20190806.1-340-gc0b8fd4 (automated)gVisor bot
2019-10-29Update build tags to allow Go 1.14Michael Pratt
Currently there are no ABI changes. We should check again closer to release. PiperOrigin-RevId: 277349744
2019-10-29Merge release-20190806.1-339-g2e00771 (automated)gVisor bot
2019-10-29Refactor logic for loadExecutable.Dean Deng
Separate the handling of filenames and *fs.File objects in a more explicit way for the sake of clarity. PiperOrigin-RevId: 277344203
2019-10-29Merge release-20190806.1-333-g29273b0 (automated)gVisor bot
2019-10-29Disallow execveat on interpreter scripts with fd opened with O_CLOEXEC.Dean Deng
When an interpreter script is opened with O_CLOEXEC and the resulting fd is passed into execveat, an ENOENT error should occur (the script would otherwise be inaccessible to the interpreter). This matches the actual behavior of Linux's execveat. PiperOrigin-RevId: 277306680
2019-10-28Merge release-20190806.1-330-g198f1cd (automated)gVisor bot
2019-10-28Update commentMichael Pratt
FDTable.GetFile doesn't exist. PiperOrigin-RevId: 277089842
2019-10-26Merge release-20190806.1-329-g1c480ab (automated)gVisor bot
2019-10-25Aggregate arguments for loading executables into a single struct.Dean Deng
This change simplifies the function signatures of functions related to loading executables, such as LoadTaskImage, Load, loadBinary. PiperOrigin-RevId: 276821187
2019-10-25Merge release-20190806.1-327-g8f029b3 (automated)gVisor bot
2019-10-25Convert DelayOption to the newer/faster SockOpt int type.Ian Gudger
DelayOption is set on all new endpoints in gVisor. PiperOrigin-RevId: 276746791
2019-10-25Merge release-20190806.1-325-gfd59891 (automated)gVisor bot
2019-10-25platform/ptrace: use tgkill instead of killAndrei Vagin
The syscall filters don't allow kill, just tgkill. PiperOrigin-RevId: 276718421
2019-10-24Merge release-20190806.1-318-gd9fd536 (automated)gVisor bot
2019-10-24Handle AT_SYMLINK_NOFOLLOW flag for execveat.Dean Deng
PiperOrigin-RevId: 276441249
2019-10-23Handle AT_EMPTY_PATH flag in execveat.Dean Deng
PiperOrigin-RevId: 276419967
2019-10-23Merge release-20190806.1-315-g6d4d956 (automated)gVisor bot
2019-10-23Merge pull request #641 from tanjianfeng:mastergVisor bot
PiperOrigin-RevId: 276380008
2019-10-23Merge release-20190806.1-309-gfbe6b50 (automated)gVisor bot
2019-10-23Keep minimal available fd to accelerate fd allocationDarcySail
Use fd.next to store the iteration start position, which can be used to accelerate allocating new FDs. And adding the corresponding gtest benchmark to measure performance. @tanjianfeng COPYBARA_INTEGRATE_REVIEW=https://github.com/google/gvisor/pull/758 from DarcySail:master 96685ec7886dfe1a64988406831d3bc002b438cc PiperOrigin-RevId: 276351250
2019-10-22Merge release-20190806.1-304-gebe8001 (automated)gVisor bot
2019-10-22Update const names to be Go style.Ian Lewis
PiperOrigin-RevId: 276165962
2019-10-22Merge release-20190806.1-303-ge63ff6d (automated)gVisor bot
2019-10-22platform/ptrace: exit without panic if a stub process has been killed by SIGKILLAndrei Vagin
SIGKILL can be sent only by an user or OOM-killer. In both cases, we don't need to panic. PiperOrigin-RevId: 276150120
2019-10-22Merge release-20190806.1-298-g070a8c2 (automated)gVisor bot
2019-10-21Remove old TODO.Nicolas Lacasse
PiperOrigin-RevId: 275956240
2019-10-21Merge release-20190806.1-297-g0b569b7 (automated)gVisor bot
2019-10-21Add basic implementation of execveat syscall and associated tests.Dean Deng
Allow file descriptors of directories as well as AT_FDCWD. PiperOrigin-RevId: 275929668
2019-10-21Merge release-20190806.1-296-ga9358ce (automated)gVisor bot
2019-10-21Merge release-20190806.1-295-g12235d5 (automated)gVisor bot
2019-10-21AF_PACKET support for netstack (aka epsocket).Kevin Krakauer
Like (AF_INET, SOCK_RAW) sockets, AF_PACKET sockets require CAP_NET_RAW. With runsc, you'll need to pass `--net-raw=true` to enable them. Binding isn't supported yet. PiperOrigin-RevId: 275909366
2019-10-19Merge release-20190806.1-294-g652f7b1 (automated)gVisor bot
2019-10-19Add support for pipes in VFS2.Kevin Krakauer
PiperOrigin-RevId: 275650307
2019-10-17Merge release-20190806.1-286-gdfdbdf1 (automated)gVisor bot
2019-10-17Refactor pipe to support VFS2.Kevin Krakauer
* Pulls common functionality (IO and locking on open) into pipe_util.go. * Adds pipe/vfs.go, which implements a subset of vfs.FileDescriptionImpl. A subsequent change will add support for pipes in memfs. PiperOrigin-RevId: 275322385
2019-10-16Reorder BUILD license and load functions in gvisor.Kevin Krakauer
PiperOrigin-RevId: 275139066
2019-10-16Merge release-20190806.1-282-g8fe48dc (automated)gVisor bot
2019-10-16Add sublevel to kernel versionMichael Pratt
Standard Linux kernel versions are VERSION.PATCHLEVEL.SUBLEVEL. e.g., 4.4.0, even when the sublevel is 0. Match this standard. PiperOrigin-RevId: 275125715
2019-10-16Merge release-20190806.1-281-g9fb5622 (automated)gVisor bot
2019-10-16Merge release-20190806.1-280-gfd4e436 (automated)gVisor bot
2019-10-16Fix problem with open FD when copy up is triggered in overlayfsFabricio Voznika
Linux kernel before 4.19 doesn't implement a feature that updates open FD after a file is open for write (and is copied to the upper layer). Already open FD will continue to read the old file content until they are reopened. This is especially problematic for gVisor because it caches open files. Flag was added to force readonly files to be reopenned when the same file is open for write. This is only needed if using kernels prior to 4.19. Closes #1006 It's difficult to really test this because we never run on tests on older kernels. I'm adding a test in GKE which uses kernels with the overlayfs problem for 1.14 and lower. PiperOrigin-RevId: 275115289
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-17 12:52:11 +0000