This is useful to be able to refer to them from external packages, such as
to represent the `ioctl(2)` syscall profile that the Sentry has with the
KVM platform.
PiperOrigin-RevId: 566705114
The pytorch image is huge, about 7-8 GB. This doesn't
need to be downloaded with the other benchmark images. Move
it to a GPU directory to speed up benchmark runs.
PiperOrigin-RevId: 566449296
The peer credential check worked by querying the peer's UID using SO_PEERCRED.
However, when sandbox is configured with custom UID/GID mappings, which it is
in the following situations:
1. When not using directfs, sandbox has a mapping of only `65534:65534:1`. So
all other non-65534 UIDs are unmmaped.
2. When using directfs with userns-remap. The sandbox has the same UID/GID
mapping as the container.
In these cases, when the root user tries to connect, the host root user is not
mapped. Unmapped IDs are translated to overflowuid/gid, which happens to
default to 65534. This leads to unexpected results:
- Without directfs, this check allows any connection, because sandbox is also
running as nobody/65534.
- In the directfs+userns-remap case, all connections are denied.
This check doesn't really enforce anything. Hence remove it.
The real enforcement mechanism is the file mode of the unix domain socket over
which the connection happens. The socket file's mode depends on umask, which
defaults to 022. Hence only the user which creates the sandbox via
`runsc create` has write permission on this socket. So only the sandbox creator
or root can connect to the sandbox, as intended.
Fixes#9356
PiperOrigin-RevId: 565836818
Any user can connect to an abstract socket. See "Abstract sockets" section in
unix(7). Filesystem UDS requires write permission to connect to. Hence, file
mode is used to protect the server.
PiperOrigin-RevId: 565759783
Proposals usually have more longevity and contain interesting ideas.
Also clean up "new feature" and "enhancement" from the list. Those labels don't
exist in gVisor repo.
PiperOrigin-RevId: 565735357
UDS connect and bind fail when the socket path being used is more than 107 in
length. Shorten the path using procfs: "/proc/self/fd/{parentFD}/{sockName)"
This avoids falling back to using abstract sockets in some instances.
Suggested-by: Andrei Vagin <[email protected]>
PiperOrigin-RevId: 565557006
This saves on allocations.
This change is a subset of the changes in cl/563529897 and cl/563752003.
Committing this change in more discrete parts will help narrow down the
causes of b/299603749.
PiperOrigin-RevId: 565484026
This call is repeated on every container startup sequence, but it is expensive, consistently taking between 2-3 seconds to run each time. This adds a significant amount of startup latency to every container. From `strace` output, the main issue appears to be a call to `openat(AT_FDCWD, "/dev/nvidia0", O_RDWR|O_CLOEXEC)`. The first time this is called, it creates a new open device file descriptor and blocks for 2 seconds while doing so. This was measured on a `g4dn.2xlarge` instance on AWS, running a Tesla T4 GPU.
For comparison, the `nvidia-container-prestart-hook` for runc also runs `nvidia-container-cli` during container boot, but it only calls it once for the `configure` command. gVisor appears to call it twice, once for `info` and then for `configure`.
By removing the `info` call, or at least only running it when the GPU device files are not already present on the host, GPU container startups can be 2-3 seconds faster.
Does this sound reasonable? I'm not actually familiar with why the `/dev/nvidia0` file takes 2-3 seconds to open, or why GPU device files need to be explicitly loaded. But I tested the change, and gVisor nvproxy still works.
Syzkaller is reporting crashes relating to changes made by these commits.
Rolling back for now. Should be rolled forward with fix.
Reported-by: [email protected]
PiperOrigin-RevId: 564000728
Has the same effect as Linux commit 34dfde4ad87b ("tcp: Return user_mss for
TCP_MAXSEG in CLOSE/LISTEN state if user_mss set").
Updated test to accept both values (default and user set) so test works on
newer and older kernels.
PiperOrigin-RevId: 563844012
When copying a mount tree, new child mounts are added to a mount's
pending list. Each of these mounts has its pending mountpoint already set
with setKey. Eventually this method will be used to enable recursive binds.
PiperOrigin-RevId: 563236298
The ring data structure's requires it's own implementation of Entry. With
the new version you can more easily be part of multiple rings at once. Also,
a user who wants to use ilist probably doesn't need ring as well, so it makes
sense to separate the two.
PiperOrigin-RevId: 563151782
* disable broken socket_inet_loopback test // Lucas Manning
* disable lseek tests on anon inodes. They have been broken by
commit e7478158e1378325907edfdd960eca98a1be405b
Date: Wed Jun 29 15:06:57 2022 +0200
fs: clear or set FMODE_LSEEK based on llseek function
* don't check memory.kmem.limit_in_bytes, it has been deprecated and dropped:
commit 86327e8eb94c52eca4f93cfece2e29d1bf52acbf
Date: Tue Jul 4 13:52:40 2023 +0200
memcg: drop kmem.limit_in_bytes
commit 58056f77502f3567b760c9a8fc8d2e9081515b2d
Date: Fri Nov 5 13:37:44 2021 -0700
memcg, kmem: further deprecate kmem.limit_in_bytes
commit 0158115f702b0ba208ab0b5adf44cae99b3ebcc7
Date: Mon Sep 23 15:37:22 2019 -0700
memcg, kmem: deprecate kmem.limit_in_bytes
PiperOrigin-RevId: 562915457
While there is a difference between flavors of this ioctl (`TCSETS`,
`TCSETSF`, `TCSETSW`), in practice it seems not to matter. We should let
users call `TCSETSF` and can implement those differences if necessary.
This just swaps out the fdbased endpoint for an XDP one. Some related
changes in here:
- Moved the AF_XDP BPF program into its own Go package so it can be
shared.
- Added a flag to tcp_benchmark to disable user namespaces. This helps
when running as root, which is required to install BPF programs.
This change makes it simpler to write mount tests that examine the optional
field of mountinfo. It also cleans up the mounts in existing tests so they
don't pollute mountinfo after exit.
PiperOrigin-RevId: 561439839
