Merge release-20191114.0-30-g0416c24 (automated)
This commit is contained in:
commit
d06b2545fa
|
@ -274,7 +274,7 @@ func (i *inodeFileState) recreateReadHandles(ctx context.Context, writer *handle
|
|||
// operations on the old will see the new data. Then, make the new handle take
|
||||
// ownereship of the old FD and mark the old readHandle to not close the FD
|
||||
// when done.
|
||||
if err := syscall.Dup2(h.Host.FD(), i.readHandles.Host.FD()); err != nil {
|
||||
if err := syscall.Dup3(h.Host.FD(), i.readHandles.Host.FD(), 0); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
|
|
|
@ -26,10 +26,6 @@ import (
|
|||
|
||||
// allowedSyscalls is the set of syscalls executed by the Sentry to the host OS.
|
||||
var allowedSyscalls = seccomp.SyscallRules{
|
||||
syscall.SYS_ARCH_PRCTL: []seccomp.Rule{
|
||||
{seccomp.AllowValue(linux.ARCH_GET_FS)},
|
||||
{seccomp.AllowValue(linux.ARCH_SET_FS)},
|
||||
},
|
||||
syscall.SYS_CLOCK_GETTIME: {},
|
||||
syscall.SYS_CLONE: []seccomp.Rule{
|
||||
{
|
||||
|
@ -42,9 +38,15 @@ var allowedSyscalls = seccomp.SyscallRules{
|
|||
syscall.CLONE_THREAD),
|
||||
},
|
||||
},
|
||||
syscall.SYS_CLOSE: {},
|
||||
syscall.SYS_DUP: {},
|
||||
syscall.SYS_DUP2: {},
|
||||
syscall.SYS_CLOSE: {},
|
||||
syscall.SYS_DUP: {},
|
||||
syscall.SYS_DUP3: []seccomp.Rule{
|
||||
{
|
||||
seccomp.AllowAny{},
|
||||
seccomp.AllowAny{},
|
||||
seccomp.AllowValue(0),
|
||||
},
|
||||
},
|
||||
syscall.SYS_EPOLL_CREATE1: {},
|
||||
syscall.SYS_EPOLL_CTL: {},
|
||||
syscall.SYS_EPOLL_PWAIT: []seccomp.Rule{
|
||||
|
|
|
@ -0,0 +1,31 @@
|
|||
// Copyright 2019 The gVisor Authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
// +build amd64
|
||||
|
||||
package filter
|
||||
|
||||
import (
|
||||
"syscall"
|
||||
|
||||
"gvisor.dev/gvisor/pkg/abi/linux"
|
||||
"gvisor.dev/gvisor/pkg/seccomp"
|
||||
)
|
||||
|
||||
func init() {
|
||||
allowedSyscalls[syscall.SYS_ARCH_PRCTL] = append(allowedSyscalls[syscall.SYS_ARCH_PRCTL],
|
||||
seccomp.Rule{seccomp.AllowValue(linux.ARCH_GET_FS)},
|
||||
seccomp.Rule{seccomp.AllowValue(linux.ARCH_SET_FS)},
|
||||
)
|
||||
}
|
|
@ -0,0 +1,21 @@
|
|||
// Copyright 2019 The gVisor Authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
// +build arm64
|
||||
|
||||
package filter
|
||||
|
||||
// Reserve for future customization.
|
||||
func init() {
|
||||
}
|
|
@ -43,7 +43,6 @@ import (
|
|||
"gvisor.dev/gvisor/pkg/sentry/pgalloc"
|
||||
"gvisor.dev/gvisor/pkg/sentry/platform"
|
||||
"gvisor.dev/gvisor/pkg/sentry/sighandling"
|
||||
slinux "gvisor.dev/gvisor/pkg/sentry/syscalls/linux"
|
||||
"gvisor.dev/gvisor/pkg/sentry/time"
|
||||
"gvisor.dev/gvisor/pkg/sentry/usage"
|
||||
"gvisor.dev/gvisor/pkg/sentry/watchdog"
|
||||
|
@ -147,9 +146,6 @@ type execProcess struct {
|
|||
func init() {
|
||||
// Initialize the random number generator.
|
||||
mrand.Seed(gtime.Now().UnixNano())
|
||||
|
||||
// Register the global syscall table.
|
||||
kernel.RegisterSyscallTable(slinux.AMD64)
|
||||
}
|
||||
|
||||
// Args are the arguments for New().
|
||||
|
|
|
@ -0,0 +1,27 @@
|
|||
// Copyright 2019 The gVisor Authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
// +build amd64
|
||||
|
||||
package boot
|
||||
|
||||
import (
|
||||
"gvisor.dev/gvisor/pkg/sentry/kernel"
|
||||
"gvisor.dev/gvisor/pkg/sentry/syscalls/linux"
|
||||
)
|
||||
|
||||
func init() {
|
||||
// Register the global syscall table.
|
||||
kernel.RegisterSyscallTable(linux.AMD64)
|
||||
}
|
|
@ -0,0 +1,27 @@
|
|||
// Copyright 2019 The gVisor Authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
// +build arm64
|
||||
|
||||
package boot
|
||||
|
||||
import (
|
||||
"gvisor.dev/gvisor/pkg/sentry/kernel"
|
||||
"gvisor.dev/gvisor/pkg/sentry/syscalls/linux"
|
||||
)
|
||||
|
||||
func init() {
|
||||
// Register the global syscall table.
|
||||
kernel.RegisterSyscallTable(linux.ARM64)
|
||||
}
|
Loading…
Reference in New Issue