This is useful to be able to refer to them from external packages, such as
to represent the `ioctl(2)` syscall profile that the Sentry has with the
KVM platform.
PiperOrigin-RevId: 566705114
The peer credential check worked by querying the peer's UID using SO_PEERCRED.
However, when sandbox is configured with custom UID/GID mappings, which it is
in the following situations:
1. When not using directfs, sandbox has a mapping of only `65534:65534:1`. So
all other non-65534 UIDs are unmmaped.
2. When using directfs with userns-remap. The sandbox has the same UID/GID
mapping as the container.
In these cases, when the root user tries to connect, the host root user is not
mapped. Unmapped IDs are translated to overflowuid/gid, which happens to
default to 65534. This leads to unexpected results:
- Without directfs, this check allows any connection, because sandbox is also
running as nobody/65534.
- In the directfs+userns-remap case, all connections are denied.
This check doesn't really enforce anything. Hence remove it.
The real enforcement mechanism is the file mode of the unix domain socket over
which the connection happens. The socket file's mode depends on umask, which
defaults to 022. Hence only the user which creates the sandbox via
`runsc create` has write permission on this socket. So only the sandbox creator
or root can connect to the sandbox, as intended.
Fixes#9356
PiperOrigin-RevId: 565836818
UDS connect and bind fail when the socket path being used is more than 107 in
length. Shorten the path using procfs: "/proc/self/fd/{parentFD}/{sockName)"
This avoids falling back to using abstract sockets in some instances.
Suggested-by: Andrei Vagin <[email protected]>
PiperOrigin-RevId: 565557006
This saves on allocations.
This change is a subset of the changes in cl/563529897 and cl/563752003.
Committing this change in more discrete parts will help narrow down the
causes of b/299603749.
PiperOrigin-RevId: 565484026
Syzkaller is reporting crashes relating to changes made by these commits.
Rolling back for now. Should be rolled forward with fix.
Reported-by: [email protected]
PiperOrigin-RevId: 564000728
Has the same effect as Linux commit 34dfde4ad87b ("tcp: Return user_mss for
TCP_MAXSEG in CLOSE/LISTEN state if user_mss set").
Updated test to accept both values (default and user set) so test works on
newer and older kernels.
PiperOrigin-RevId: 563844012
When copying a mount tree, new child mounts are added to a mount's
pending list. Each of these mounts has its pending mountpoint already set
with setKey. Eventually this method will be used to enable recursive binds.
PiperOrigin-RevId: 563236298
The ring data structure's requires it's own implementation of Entry. With
the new version you can more easily be part of multiple rings at once. Also,
a user who wants to use ilist probably doesn't need ring as well, so it makes
sense to separate the two.
PiperOrigin-RevId: 563151782
While there is a difference between flavors of this ioctl (`TCSETS`,
`TCSETSF`, `TCSETSW`), in practice it seems not to matter. We should let
users call `TCSETSF` and can implement those differences if necessary.
This just swaps out the fdbased endpoint for an XDP one. Some related
changes in here:
- Moved the AF_XDP BPF program into its own Go package so it can be
shared.
- Added a flag to tcp_benchmark to disable user namespaces. This helps
when running as root, which is required to install BPF programs.
The idea behind conditionally compiled metrics originally was to use them in
hotpaths for profiling purposes. This CL makes that possible by outputting
declared metrics in TSV format, which can be used to track custom events at
runtime in relatively high resolution.
Usage:
1. Optionally enable compilation of runsc conditionally-compiled metrics
by passing in condmetric_profiling to the Go tags.
2. Add these flags to runsc:
- [Required] --profiling-metrics-log=/tmp/some.csv
- [Optional] --profiling-metrics=/task/syscalls,/task/faults
- If this flag is not specified it will monitor all
conditionally-compiled metrics by default.
- [Optional] --profiling-metrics-rate-us=10000
Some future improvements:
- Flag to output a metric-difference between timestamps instead of
constant accumulation.
- Output a gnuplot command along with the data.
- Current monitoring resolution is limited by what time.Sleep allows.
This can be overcome by spinning/yielding when lower monitoring
rates are requested.
PiperOrigin-RevId: 560849611
This issue was reported by Syzkaller. The stacktrace shows
forgetDeadMountpoint(..., skipDecRef=true) being called. But unlockMounts()
is still shown DecRef()-ing the objects. PopDelayedDecRefs() should be clearing
vfs.toDecRef.
Also make gofer.dentry.evictLocked() DecRef the returned objects. It was
ignoring the return value earlier.
Reported-by: [email protected]
PiperOrigin-RevId: 560164788
TestPreflightBindsEndpoint was using an IPv6 destination address with an IPv4
endpoint. This starts causing a panic once we properly check the length of
addresses (see child CL).
PiperOrigin-RevId: 558267882
Once a NIC is chosen for a route, we currently just grab the first IP on the
NIC as the source address. We should choose the address with the longest
matching prefix instead.
This is a simple linear search of the route table. That's slow for large
tables, but large tables are exceedingly rare for use with gVisor and we can
always reimplement this with a trie if it becomes necessary.
PiperOrigin-RevId: 557941259
For example, docker specifies a directory descriptor via /proc/self/fd:
mount(/sys/fs/cgroup/...", "/proc/self/fd/6", MS_BIND, 0x502f, <null>)
PiperOrigin-RevId: 557312955
This refactor changes the "shared list" from being a list pointer that's
shared among all the peers, to a circularly linked list that links all the
mounts together. This is generally safer (no shared pointer) and easier
to understand and work with. It's also closer to how linux implements this
feature.
The propagationType is also removed in favor of just using the propagation
flags from linux. This makes more sense as mounts can have two types at once
(shared+slave).
PiperOrigin-RevId: 556906544
