mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
zeekayandHanzo Dev
3da05638df
urpc encodes with encoding/json, which walks the payload on every call: a realistic control.ExecArgs costs 7084ns and 10 allocations to cross. ZAP reads a field at a constant offset out of the buffer that arrived, so the same payload is 740ns and one allocation -- but only if the offsets are stated, and a stated offset that is wrong is silent corruption rather than a compile error. So state them from the types themselves. //tools/zap reflects over the payloads at build time and writes the wire as Go source with the offsets as constants. It lives inside Bazel because pkg/sentry/control cannot be imported from outside it: the *_go_proto packages it depends on have no source in the tree. Six payloads had no layout to state. A map, an interface and a type from another module have no offsets, so each is answered in the type: SaveOpts.Metadata and StartContainerArgs.InitialCgroups/Limits cross as lists of pairs; boot.Route.Destination restates net.IPNet as Subnet; OpenMountArgs restates the OCI mount fields the call actually uses; StartArgs.Spec and SinkConfig.Config carry their documents as the bytes they arrived as; MetricsRegistrationResponse carries the protocol buffer the same way; and seccheck's session options become a type instead of a map of any. ExecArgs and MetricsExportData still have none: ExecArgs holds live kernel objects behind an interface, and MetricsExportData reaches a prometheus snapshot whose labels are a map. Co-authored-by: Hanzo Dev <[email protected]>
68 lines
1.6 KiB
Python
68 lines
1.6 KiB
Python
load("//tools:defs.bzl", "go_library", "go_test")
|
|
load("//tools/go_generics:defs.bzl", "go_template_instance")
|
|
|
|
package(default_applicable_licenses = ["//:license"])
|
|
|
|
licenses(["notice"])
|
|
|
|
go_template_instance(
|
|
name = "seqatomic_sinkslice",
|
|
out = "seqatomic_sinkslice_unsafe.go",
|
|
package = "seccheck",
|
|
suffix = "SinkSlice",
|
|
template = "//pkg/sync/seqatomic:generic_seqatomic",
|
|
types = {
|
|
"Value": "[]Sink",
|
|
},
|
|
)
|
|
|
|
go_library(
|
|
name = "seccheck",
|
|
srcs = [
|
|
"config.go",
|
|
"execve_hash_cache.go",
|
|
"metadata.go",
|
|
"metadata_amd64.go",
|
|
"metadata_arm64.go",
|
|
"seccheck.go",
|
|
"seqatomic_sinkslice_unsafe.go",
|
|
"syscall.go",
|
|
"zap.go",
|
|
],
|
|
visibility = ["//:sandbox"],
|
|
deps = [
|
|
"//pkg/abi",
|
|
"//pkg/abi/linux",
|
|
"//pkg/abi/sentry",
|
|
"//pkg/atomicbitops",
|
|
"//pkg/context",
|
|
"//pkg/fd",
|
|
"//pkg/gohacks",
|
|
"//pkg/log",
|
|
"//pkg/metric",
|
|
"//pkg/sentry/arch",
|
|
"//pkg/sentry/ktime",
|
|
"//pkg/sentry/seccheck/points:points_go_proto",
|
|
"//pkg/sync",
|
|
"@com_github_zap_proto_go//:go",
|
|
"@org_golang_google_protobuf//proto:go_default_library",
|
|
],
|
|
)
|
|
|
|
go_test(
|
|
name = "seccheck_test",
|
|
size = "small",
|
|
srcs = [
|
|
"config_test.go",
|
|
"execve_hash_cache_test.go",
|
|
"metadata_test.go",
|
|
"seccheck_test.go",
|
|
],
|
|
library = ":seccheck",
|
|
deps = [
|
|
"//pkg/context",
|
|
"//pkg/fd",
|
|
"//pkg/sentry/seccheck/points:points_go_proto",
|
|
],
|
|
)
|