The wait command will always return 0 even if the underlying process
returns a different exit code. It prints out the exit code of the process
to its stdout as json.
PiperOrigin-RevId: 557877257
This is unnecessary because fileAccess=shared causes the rootfs mount to have
shared gofer mode. So we don't need a separate bind mount to force shared mode.
Fixes f12ca103ca ("test: Create a separate /tmp mount only for tests with the
shared tag")
PiperOrigin-RevId: 537213357
We plan on making --directfs=true the default for runsc. That will be a
risky change which might need rollbacks. This change is in preparation for
that so that the breaking change has a small delta.
PiperOrigin-RevId: 532670826
And enable all of the netlink tests that depend on this functionality.
Specifially, this CL implements hostinet.stack:
* .RemoveInterface()
* .AddInterfaceAddr()
* .RemoveInterfaceAddr()
Applications use netlink messages to call into these methods. For hostinet, we
use netlink messages to the host to implement these methods.
Note that the netlink messages are not simple passed from the application to
the host -- they are parsed first and only carefully crafted messages are sent
to the host.
This CL required a lot of refactoring to the existing netlink code in the
hostinet package, as well as a bunch of new functionality. All of that code has
been collected in hostinet/netlink.go
I also changed how we handle CAP_NET_ADMIN and CAP_NET_RAW in tests, since we
must drop those capabilities inside the sandbox if we don't have them on the
host. The new solution is cleaner and does not rely on google-specific env
variables.
PiperOrigin-RevId: 522685544
Also enables GRO in syscall tests. GRO should be totally transparent and should
not affect behavior. This ensures it's tested and fixes the bug it uncovered.
GRO would not immediately flush the final ACK in the SYN-SYN/ACK-ACK handshake.
This could lead to a situation where
- Client A calls connect(), which returns once the final ACK of the handshake
is sent and A reaches state ESTABLISHED
- The ACK gets GRO'd, delaying it from reaching the server
- Client B calls non-blocking connect()
- Client B's ACK gets GRO'd as well
- Client B is marked as ESTABLISHED
- The server, with accept queue size 1, is only going to accept one connection,
but two clients are ESTABLISHED.
It now immediately flushes packets with no payload, as they are important to
TCP connection state and management.
PiperOrigin-RevId: 516870932
We plan on making --overlay2=root:self the default for runsc. That will be a
risky change which might need rollbacks. This change is in preparation for
that. We manually set --overlay2=none in places where we don't want the
overlay configuration to impact. This change should be a noop. The intention
for this change is to make the risky change very small and limited to just
flipping a flag.
PiperOrigin-RevId: 513930702
This enabling this option prints out the sandbox PID and waits for the
specified duration. This makes it much easier to attach a debugger like
delve to the sandbox process.
PiperOrigin-RevId: 513564358
We must have CAP_NET_RAW to create raw sockets with hostinet. This change makes
the runsc Loader fail if hostinet+raw sockets are configured but we do not have
the necessary capability.
PiperOrigin-RevId: 513417124
This native test was flaking on Buildkite because it would timeout. The test
itself would pass but I think a cleanup stage would hang indefinitely. Such a
hang would only happen when one of the cleaners from uds.go:createPipeReader()
would fail with the following log:
`Failed to kick pipe reader: open /tmp/sockets930502909/pipe/out: no such
device or address`.
The connect_external_test does not even use pipes. It is unnecessary setup and
cleanup steps. Furthermore, test logs are very noisy from these such setup and
cleanup steps for tests that are not even run.
Although I am not sure why failing to kick the pipe reader would cause the test
to hang, I have split out the setup done in `CreateSocketTree()` into 3 parts:
1. Creating a UDS tree so that sandbox can connect to it.
2. Create connectors outside sandbox who connect to sockets created by sandbox.
3. Creating pipes outside the sandbox that sandbox can read/write to.
I also split the test targets into separate tests. These setup steps are only
done for their respective tests. Makes the logs more relevant, gets rid of
unnecessary steps and failures and deflakes the native connect test.
PiperOrigin-RevId: 511128400
Several syscall tests are working after refactoring inode operations.
This change also renames the use_fusefs test attribute to add_fusefs,
since that more accurately describes what the attribute does.
PiperOrigin-RevId: 506692314
This change replaces the FUSE inode implementations with a custom
inode type that implementsthe kernfs.Inode interface. It also cleans
up some of the attribute related functions and gets the open_test to
pass.
PiperOrigin-RevId: 506465698
This is to make it clear that the host file will be created inside this
directory. This also makes it look cleaner when other medium options are added
later.
PiperOrigin-RevId: 505033408
If you add "use_fusefs=True" to a syscall test, it generates a new test
target denoted with _fuse at the end. This target runs a shim binary
that mounts a FUSE fs at /tmp and runs a server that forwards all
filesystem ops to /fuse. Once the FUSE is mounted, the shim execs the normal
test binary.
This new dimension should help test the correctness of our FUSE implementation.
All relevant tests that already pass have the use_fusefs enabled. The rest
are still broken.
PiperOrigin-RevId: 501059036
The current io_uring support is very limited and experimental. Disable
it by default, and add a flag to enable it for testing.
PiperOrigin-RevId: 500760451
--overlay2 flag supersedes --overlay flag. It allows more granular
configuration for overlayfs in runsc. It does so in two ways:
1. Allows to apply overlay on all mounts or only the root mount.
--overlay applies overlay to all mounts.
2. Allows to specify if overlay's upper layer should be backed by
container memory or disk. --overlay always used container memory.
Allowing tmpfs to be backed by a file on disk prevents the container
memory from bloating up. Note that the tmpfs filesystem tree will
still be stored in sentry memory.
Using overlay on the root filesystem, helps avoid expensive
communication with the gofer process. The root filesystem of the
container is not preserved across container lifecycle. So we don't
need to keep updating the host filesystem, which will anyways be
destroyed once the container is destroyed. It is wasted effort.
Instead we keep all the changes to the root filesystem in tmpfs which
is directly accessible by the sentry.
The host file is created as an unnamed file using O_TMPFILE. Support
has been added for sub-containers too. Save/restore support is
still lacking.
Co-authored-by: Andrei Vagin <[email protected]>
PiperOrigin-RevId: 491988485
- Use the correct paths for sockets based on environment variables.
- Doing a double-bind(2) before listen(2) causes subsequent double-bind(2) after
listen(2) to fail with EADDRINUSE on Linux somehow. Avoid tripping that
behavior in the test.
- Do not run BindListenAccept test with TEST_UDS_ATTACH_TREE parameter.
PiperOrigin-RevId: 488430850
It requires setting the flag `--host-fifo=open`, otherwise the caller will not
be allowed to open host FIFOs (or named pipes) to protect the host by default.
Closes#8037
PiperOrigin-RevId: 483787839
The new `host-uds` flag has the following differences:
* More granular control: user can specify whether to ignore host UDS,
connect to an existing host UDS, create a host UDS, or both
* Will shortly be used to also control pipes from the host, hence the
removal of UDS from the name
* Can be used with other filesystems, not gofer-based, hence the
removal of fsgofer from the name
This change also removes support for bind() from 9P based gofer since it's
not supported and would make this change more complicated.
Updates #8037
PiperOrigin-RevId: 483538832
Also make `runsc debug` write to stdout and log file to make it
easier to see the output when running the command manually.
PiperOrigin-RevId: 470042053
lisafs is default. So we should not have all targets be generated
with _lisafs. Also if nothing is specified, then lisafs should run.
Which is not the case right now.
PiperOrigin-RevId: 469770835
Made some other changes:
- We no longer generate a separate runtime for p9 on `make
dev`.
- We no longer run p9 runtime tests. Instead run lisafs runtime
tests on presubmits.
- All tests are generated with lisafs. Only 1 p9 variant is
generated with default platform.
- Run integration tests only with lisafs.
P9 is now considered deprecated.
Use `--lisafs=false` if you need to disable it. Make sure to
report a bug if you have the need to disable LISAFS.
Fixes#6319
PiperOrigin-RevId: 469548694
Enable all trace points while running syscall tests to catch possible
crashes and bugs that may exist. These are not verifying that the data
in the points are correct though. Since all trace points are platform
agnostic for now, only enable them for ptrace.
Updates #4805
PiperOrigin-RevId: 455232093
This environment variable encodes what capabilities the platform
supports, and is consumed by `platform_util.cc` to determine
which syscall tests are appropriate to run.
PiperOrigin-RevId: 452870567
- Generates a lisafs variant of all syscall tests.
- Adds Makefile targets to run runtime tests with lisafs. We run runtime tests
continuously (on every commit to master) and on presubmits iff the commit
message contains "lisafs".
- Updates the docker tests target to run the integration tests with lisafs too.
Fixes#5466
PiperOrigin-RevId: 433782954
In some cases, it may be desirable to prebuild binaries and run all tests,
for example to run benchmarks with various experiments. Allow the top-level
Makefile to support this by checking for a STAGED_BINARIES variable.
PiperOrigin-RevId: 410673120
This change enables VFS2 by default. VFS2 is much faster than the previous
implementation and it's also more compatible. VFS1 is no longer supported and
will be deleted from the code.
Use `--vfs2=false` if you need to disable it. Make sure to report a bug if you
have the need to disable VFS2 or something is not working for you.
Closes#1035
PiperOrigin-RevId: 404898135
