This native test was flaking on Buildkite because it would timeout. The test
itself would pass but I think a cleanup stage would hang indefinitely. Such a
hang would only happen when one of the cleaners from uds.go:createPipeReader()
would fail with the following log:
`Failed to kick pipe reader: open /tmp/sockets930502909/pipe/out: no such
device or address`.
The connect_external_test does not even use pipes. It is unnecessary setup and
cleanup steps. Furthermore, test logs are very noisy from these such setup and
cleanup steps for tests that are not even run.
Although I am not sure why failing to kick the pipe reader would cause the test
to hang, I have split out the setup done in `CreateSocketTree()` into 3 parts:
1. Creating a UDS tree so that sandbox can connect to it.
2. Create connectors outside sandbox who connect to sockets created by sandbox.
3. Creating pipes outside the sandbox that sandbox can read/write to.
I also split the test targets into separate tests. These setup steps are only
done for their respective tests. Makes the logs more relevant, gets rid of
unnecessary steps and failures and deflakes the native connect test.
PiperOrigin-RevId: 511128400
It requires setting the flag `--host-fifo=open`, otherwise the caller will not
be allowed to open host FIFOs (or named pipes) to protect the host by default.
Closes#8037
PiperOrigin-RevId: 483787839
When enabled with `AllowUDS`, unix domain sockets can be created in the sandbox
and bound on the host filesystem. The application can listen() and accept() on
these sockets as usual. Accept'ed sockets will be donated to the sandbox,
similar to how connect'ed sockets work.
In order to make notifications like poll work, the gofer donates the host-bound
socket FD to the sandbox, but the seccomp filters will (correctly) prevent the
sandbox from calling listen and accept directly on that FD. Instead, listen and
accept calls must go through the gofer. The donated host FD can should only be
used to poll for new incoming connectins.
Note that I changed the order of some of the Lisa RPCs in order to group Bind
with the existing similar Connect method. This changes the RPC numbers in a
backwards-incompatible way, but since nobody is using Lisa yet we are OK. It's
better to make these cleanup changes now before we have users and are locked
in.
PiperOrigin-RevId: 447236441
The syscall package has been deprecated in favor of golang.org/x/sys.
Note that syscall is still used in some places because the following don't seem
to have an equivalent in unix package:
- syscall.SysProcIDMap
- syscall.Credential
Updates #214
PiperOrigin-RevId: 361332034
This change fixes several issues with the fsgofer host UDS support. Notably, it
adds support for SOCK_SEQPACKET and SOCK_DGRAM sockets [1]. It also fixes
unsafe use of unet.Socket, which could cause a panic if Socket.FD is called
when err != nil, and calls to Socket.FD with nothing to prevent the garbage
collector from destroying and closing the socket.
A set of tests is added to exercise host UDS access. This required extracting
most of the syscall test runner into a library that can be used by custom
tests.
Updates #235
Updates #1003
[1] N.B. SOCK_DGRAM sockets are likely not particularly useful, as a server can
only reply to a client that binds first. We don't allow bind, so these are
unlikely to be used.
PiperOrigin-RevId: 275558502
