Commit Graph
1356 Commits
Author SHA1 Message Date
Ayush RanjanandgVisor bot 8efec607d2 Additionally expect the custom tos/tclass in TOS_TCLASS_EXPECT_DEFAULT case.
PiperOrigin-RevId: 565458888
2023-09-14 13:25:12 -07:00
Ayush RanjanandgVisor bot 125b741d86 Return user_mss if user_mss is set and socket is unconnected.
Has the same effect as Linux commit 34dfde4ad87b ("tcp: Return user_mss for
TCP_MAXSEG in CLOSE/LISTEN state if user_mss set").

Updated test to accept both values (default and user set) so test works on
newer and older kernels.

PiperOrigin-RevId: 563844012
2023-09-08 13:57:42 -07:00
Jing ChenandgVisor bot 6cbd7dbd93 Let devices cgroup add/remove rules via devices.allow and devices.deny.
PiperOrigin-RevId: 563261158
2023-09-06 17:27:02 -07:00
Ghanan GowripalanandgVisor bot ce71f3cf3b Automated rollback of changelist 536743330
PiperOrigin-RevId: 563224104
2023-09-06 14:58:03 -07:00
gVisor bot a423565638 Merge pull request #9339 from kevinGC:tcsetsf2
PiperOrigin-RevId: 563207341
2023-09-06 13:58:08 -07:00
Jing ChenandgVisor bot 090d92a726 Have lgetxattr return ENODATA.
It is a workaround to lgetxattr/lsetxattr working with security.capacity when running docker in gvisor.

PiperOrigin-RevId: 563194162
2023-09-06 13:13:19 -07:00
Lucas ManningandgVisor bot 621c632afc A few fixes to run tests on 6.2+ kernels
* disable broken socket_inet_loopback test // Lucas Manning
* disable lseek tests on anon inodes. They have been broken by
commit e7478158e1378325907edfdd960eca98a1be405b
Date:   Wed Jun 29 15:06:57 2022 +0200
    fs: clear or set FMODE_LSEEK based on llseek function

* don't check memory.kmem.limit_in_bytes, it has been deprecated and dropped:
commit 86327e8eb94c52eca4f93cfece2e29d1bf52acbf
Date:   Tue Jul 4 13:52:40 2023 +0200
    memcg: drop kmem.limit_in_bytes
commit 58056f77502f3567b760c9a8fc8d2e9081515b2d
Date:   Fri Nov 5 13:37:44 2021 -0700
    memcg, kmem: further deprecate kmem.limit_in_bytes
commit 0158115f702b0ba208ab0b5adf44cae99b3ebcc7
Date:   Mon Sep 23 15:37:22 2019 -0700
    memcg, kmem: deprecate kmem.limit_in_bytes
PiperOrigin-RevId: 562915457
2023-09-05 15:51:21 -07:00
Kevin Krakauer dbbce69479 tty: enable TCSETSF
While there is a difference between flavors of this ioctl (`TCSETS`,
`TCSETSF`, `TCSETSW`), in practice it seems not to matter. We should let
users call `TCSETSF` and can implement those differences if necessary.
2023-09-05 09:53:50 -07:00
Lucas ManningandgVisor bot cec42923e3 Clean up mount tests.
This change makes it simpler to write mount tests that examine the optional
field of mountinfo. It also cleans up the mounts in existing tests so they
don't pollute mountinfo after exit.

PiperOrigin-RevId: 561439839
2023-08-30 13:56:03 -07:00
Jing ChenandgVisor bot e3f7443b9b Support MS_STRICTATIME flag for the syscall mount.
PiperOrigin-RevId: 560207305
2023-08-25 15:17:23 -07:00
Shambhavi SrivastavaandgVisor bot 884e65cf41 Automated rollback of changelist 557871250
PiperOrigin-RevId: 560158129
2023-08-25 11:58:29 -07:00
Andrei VaginandgVisor bot e2fc34862a proc: add /proc/sys/kernel/cap_last_cap
PiperOrigin-RevId: 559932636
2023-08-24 18:29:31 -07:00
Jing ChenandgVisor bot 606462c738 Add device cgroup's devices.list, which defaults to allow all.
PiperOrigin-RevId: 558534572
2023-08-20 02:20:04 -07:00
Andrei VaginandgVisor bot 5262e552f8 vfs: Introduce the rootfs mount
The namespace root mount can't be changed, so let's mount a dummy
read-only tmpfs here. It simplifies creation of containers without
leaking the root file system.

PiperOrigin-RevId: 558301458
2023-08-18 18:56:09 -07:00
Lucas ManningandgVisor bot 94441a6e26 Fix small mount propagation bug.
The MS_PRIVATE flag was not being cleared in addPeer.

Reported-by: [email protected]
PiperOrigin-RevId: 557949154
2023-08-17 15:14:15 -07:00
Jing ChenandgVisor bot 9a79dec6f1 Implement SO_SNDTIMEO and SO_RCVTIMEO for netlink's setsockopt and getsockopt.
PiperOrigin-RevId: 557933811
2023-08-17 14:18:15 -07:00
Shambhavi SrivastavaandgVisor bot 76b2713c08 Adding /proc/[pid]/task/[tid]/children
PiperOrigin-RevId: 557888186
2023-08-17 11:41:48 -07:00
Nicolas LacasseandgVisor bot 5dc1f9fa34 Automated rollback of changelist 554554034
PiperOrigin-RevId: 557871250
2023-08-17 10:50:10 -07:00
Jeff MartinandgVisor bot 54a6be0000 Internal change.
PiperOrigin-RevId: 556842126
2023-08-14 10:45:30 -07:00
Jing ChenandgVisor bot 6e7a49f314 Add missing device cgroups.
PiperOrigin-RevId: 556053561
2023-08-11 12:48:03 -07:00
Fangrui SongandgVisor bot 0fafb2be8a Align buffer for cmsg
`char control[CMSG_SPACE(sizeof(*out_cmsg_value)) + 1];` is not aligned as
cmsghdr. Accessing its member may lead to a -fsanitize=alignment failure.
Align `control` to struct cmsghdr to fix the issue.

PiperOrigin-RevId: 555951052
2023-08-11 07:54:10 -07:00
Nayana BidariandgVisor bot eba9311640 Make changes for CgroupsReadControlFile method to get memory usage per cgroup.
- Adds methods to Enter, Leave and Migrate the tasks for memory controller.
- Update the memory cgroup id when the task enters and leaves the cgroups.

PiperOrigin-RevId: 555568875
2023-08-10 11:09:28 -07:00
Jeff MartinandgVisor bot fc414d1147 Add test coverage for RTM_GETRULE, RTM_ADDRULE, and RTM_DELRULE
PiperOrigin-RevId: 554806910
2023-08-08 06:43:27 -07:00
Jeff MartinandgVisor bot 70b723d06c Add test coverage for RTM_NEWROUTE & RTM_DELROUTE
PiperOrigin-RevId: 554612706
2023-08-07 15:37:13 -07:00
Jeff MartinandgVisor bot ae03bdb1be Internal change.
PiperOrigin-RevId: 554591336
2023-08-07 14:22:55 -07:00
Shambhavi SrivastavaandgVisor bot f75fcdfa83 Implementing clone3
Updates #8585

PiperOrigin-RevId: 554554034
2023-08-07 12:19:32 -07:00
Jing ChenandgVisor bot 906efa4976 Implement setns CLONE_NEWUTS namespace type.
PiperOrigin-RevId: 554306089
2023-08-06 15:33:25 -07:00
Andrei VaginandgVisor bot 4af420d420 Implement setns for mount namespaces
PiperOrigin-RevId: 552859231
2023-08-01 11:12:29 -07:00
Jing ChenandgVisor bot 4e5d1c16a5 Add devices cgroups which is partially implemented. It could export the device cgroups to devices.deny and devices.allow, add/remove device cgroups rules will need to be implemented to fully support device cgroups.
PiperOrigin-RevId: 552673967
2023-07-31 21:22:07 -07:00
Andrei VaginandgVisor bot 4d39b66860 Implement mount namespaces
This change implements only the basic functions of mount namespaces.
All features that depends on user namespaces will be implemented separately.

PiperOrigin-RevId: 552673896
2023-07-31 21:12:21 -07:00
Jing ChenandgVisor bot a595c26bfe Implement setns CLONE_NEWIPC namespace type.
PiperOrigin-RevId: 552619565
2023-07-31 16:12:45 -07:00
Andrei VaginandgVisor bot c5493106c6 Implement the setns syscall
This change introduces the nsfs file system. Each new namespace allocates
a new nsfs inode.

Here are reasons why we need these inodes:
* each namespace has to have an unique id.
* proc/pid/ns/ contains one entry for each namespace. Bind mounting one of
  the files in this directory to somewhere else in the filesystem keeps the
  corresponding namespace alive even if all processes currently in
  the namespace terminate.
* setns() allows the calling process to join an existing namespace specified
  by a file descriptor.

PiperOrigin-RevId: 550694515
2023-07-24 15:45:08 -07:00
Nicolas LacasseandgVisor bot 6733665148 Implement PR_{S,G}ET_CHILD_SUBREAPER.
Closes #2323

PiperOrigin-RevId: 548205854
2023-07-14 13:19:25 -07:00
gVisor bot b4d5243dbc Merge pull request #7356 from turekt:pollrdhup-fix
PiperOrigin-RevId: 547867839
2023-07-13 11:39:30 -07:00
Jing ChenandgVisor bot e3e28b24d1 Allow fchown to change the ownership of a pipe file descriptor.
PiperOrigin-RevId: 547636998
2023-07-12 16:50:25 -07:00
Nayana BidariandgVisor bot 920bee37b7 Test to check setting IPV6_V6ONLY on datagram socket with IPV4 address fails.
PiperOrigin-RevId: 546955039
2023-07-10 12:58:50 -07:00
turekt 355bb3b1f2 POLLRDHUP delivery fix
Fixes https://github.com/google/gvisor/issues/6015 | Added EventRdHUp to waiter events | Added POLLRDHUP delivery on half-closed connection detection | Added POLLRDHUP delivery on local read end shutdown
2023-07-09 15:53:24 +02:00
Tony GongandgVisor bot 09aea91fc9 Use infinite poll timeout on Fuchsia
Use infinite timeout when polling on the connecting/connected socket
after the listening socket is closed/shutdown on Fuchsia, as this
particular poll has been observed to be very flaky in Fuchsia Infra.

PiperOrigin-RevId: 546006387
2023-07-06 09:14:24 -07:00
Andrei VaginandgVisor bot f5c8b355eb proc: allow to write null-terminated strings in /proc/pid/oom_score_adj
In Linux, oom_adj_write treats an input buffer as a string. It means that
it parses only the part before the first zero byte.

PiperOrigin-RevId: 544711418
2023-06-30 11:44:45 -07:00
Andrei VaginandgVisor bot 833fa1c28e cgroups: allow statfs on cgroup files
PiperOrigin-RevId: 544179511
2023-06-28 15:39:34 -07:00
Nayana BidariandgVisor bot 33bc37de55 Return error while calling shutdown on a bound unconnected UDP socket.
PiperOrigin-RevId: 542057418
2023-06-20 14:57:45 -07:00
gVisor bot d716a5246f Internal change.
PiperOrigin-RevId: 540338096
2023-06-14 11:56:16 -07:00
gVisor bot 014a6b223a Internal change.
PiperOrigin-RevId: 540319250
2023-06-14 10:56:23 -07:00
Etienne PerotandgVisor bot 14f360868f runsc: Make Systrap the default platform.
As per announced on gvisor-users:
https://groups.google.com/g/gvisor-users/c/OhGupJ5bTuo

PiperOrigin-RevId: 540085417
2023-06-13 15:09:54 -07:00
Ayush RanjanandgVisor bot f8e29b59d7 Mark newly created directories in merged parents in overlay as opaque.
This is an optimization that will prevent needless lookups on lower layers for
directories. This is analogous to the Linux commit 97c684cc9110 ("ovl: create
directories inside merged parent opaque").

If mkdir(2) does succeed, then none of the lower layers have a file at that
position, otherwise mkdir(2) would have failed with EEXIST.

Changes on the lower layer underneath a new upper layer directory are not
visible. See the following for example:
```
$ sudo mount -t overlay -o lowerdir=lower,upperdir=upper,workdir=workdir none overlay
$ mkdir -p overlay/dir/dir1
$ mkdir -p lower/dir/dir2
$ ls overlay/dir/
dir1
```

Benchmarking shows that this change cuts ABSL build time by 9.5%!
```
goos: linux
goarch: amd64
cpu: Intel(R) Xeon(R) CPU @ 2.20GHz
                                                  │ /tmp/benchout.runsc │     /tmp/benchout.runsc-opt      │
                                                  │       sec/op        │   sec/op    vs base              │
BuildABSL/page_cache.clean/filesystem.bindfs-8              71.16 ± 12%   64.40 ± 3%  -9.50% (p=0.003 n=8)
BuildGRPC/page_cache.clean/filesystem.bindfs-8              418.2 ±  1%   419.9 ± 1%       ~ (p=0.721 n=8)
RubySpecTest/page_cache.clean/filesystem.bindfs-8           76.67 ±  5%   75.17 ± 1%       ~ (p=0.382 n=8)
geomean                                                     131.6         126.7       -3.78%

                                                  │ /tmp/benchout.runsc │   /tmp/benchout.runsc-opt   │
                                                  │      load.sec       │  load.sec   vs base         │
RubySpecTest/page_cache.clean/filesystem.bindfs-8            12.95 ± 6%   12.80 ± 5%  ~ (p=0.625 n=8)
```

PiperOrigin-RevId: 538823897
2023-06-08 10:33:25 -07:00
Nayana BidariandgVisor bot c7e6c4879b Set send bufer size in the test BlockingPartialWriteClosed.
Fix the flaky test BlockingPartialWriteClosed by setting the send buffer size
to disable auto-tuning.

Before: http://sponge2/d5557791-88e3-491c-b3d8-733fcf4ca526
After: http://sponge2/4ee46189-c50a-4f49-a03c-7ed70d5dcf76
PiperOrigin-RevId: 538567854
2023-06-07 12:57:04 -07:00
Nayana BidariandgVisor bot 3cea46826c Automated rollback of changelist 538202277
PiperOrigin-RevId: 538315796
2023-06-06 16:03:47 -07:00
Nick BrownandgVisor bot 2f3b6c4408 Add a test for receiving UDP packet from INADDR_ANY
Add a test that validates that when a UDP packet is received with an
unspecified source address, it is delivered to a listening socket.

PiperOrigin-RevId: 538240044
2023-06-06 11:22:40 -07:00
Zeling FengandgVisor bot 8caec9445c Improve FillSocketBuffers test utility
The utility function used to interpret `EWOULDBLOCK` of a `write` call as
buffers being filled at both the receiver and the sender. This is not a valid
assumption even on Linux because it is possible that the test fills the sender
buffer faster than the socket is able to transfer the bytes, in that case,
EWOULDBLOCK will be observed even before the receiver side has a full buffer.
The fix to this is to inspect the buffer size at the receiver side, and discard
any error before the receiver buffer is full. Then we can use EWOULDBLOCK to
indicate the sender buffer is full.

PiperOrigin-RevId: 538202277
2023-06-06 09:14:26 -07:00
Konstantin BogomolovandgVisor bot 599facdeae Fix close_range syscall tests for Linux kernels <5.11
The CLOEXEC flag for close_range was added in 5.11; if CLOEXEC tests are run on
earlier versions they will return EINVAL.

PiperOrigin-RevId: 537160906
2023-06-01 16:37:00 -07:00