Commit Graph

800 Commits

Author SHA1 Message Date
Jamie Liu a2c868a098 Add rvalue ref-qualified PosixErrorOr<T>::ValueOrDie() overloads.
This allows ValueOrDie() to be called on PosixErrorOr rvalues (e.g.
temporaries) holding move-only types without extraneous std::move()s.

PiperOrigin-RevId: 225098036
Change-Id: I662862e4f3562141f941845fc6e197edb27ce29b
2018-12-11 17:05:53 -08:00
Michael Pratt 24c1158b9c Add "trace signal" option
This option is effectively equivalent to -panic-signal, except that the
sandbox does not die after logging the traceback.

PiperOrigin-RevId: 225089593
Change-Id: Ifb1c411210110b6104613f404334bd02175e484e
2018-12-11 16:12:41 -08:00
Michael Pratt 2b6df6a204 Format unshare flags
unshare actually takes a subset of clone flags, but has no unique flags,
so formatting as clone flags is close enough.

PiperOrigin-RevId: 225082774
Change-Id: I5b580f18607c7785f323e37809094115520a17c0
2018-12-11 15:33:14 -08:00
Michael Pratt 437f567ff7 Fix README typos
PiperOrigin-RevId: 225054712
Change-Id: I26e8bc3ef04fe96a4640e50ba4b635d4aa72cc50
2018-12-11 12:57:09 -08:00
Christopher Koch cbe3c20e4e Fix typo.
PiperOrigin-RevId: 225046313
Change-Id: I95fe9c353a5bec13e6ad99094b7741a0e160e4d0
2018-12-11 12:06:14 -08:00
Christopher Koch 5934fad1d7 Remove unused envv variable from two funcs.
PiperOrigin-RevId: 225041520
Change-Id: Ib1afc693e592d308d60db82022c5b7743fd3c646
2018-12-11 11:40:16 -08:00
Michael Pratt 77a443269a Fix test tag argument typo
The argument is --test_tag_filters, not --test_tag_filter.

Also switch to ... instead of :*, as it doesn't require special shell
quoting to avoid * expansion.

PiperOrigin-RevId: 224949618
Change-Id: I45dd6acbaeae29f2cc0baa977b086b5c037c6a88
2018-12-10 23:59:18 -08:00
Ian Lewis 93ac04a6c3 Minor wording update to Kubernetes support section of the README
Updated the README to correct some wording and clarify a bit that containerd
CRI runtime is needed.

PiperOrigin-RevId: 224944753
Change-Id: I7b9c527500f99571aca7ef73058472ae9b3d5371
2018-12-10 22:57:14 -08:00
Haibo Xu 52fe3b87a4 Add safecopy support for arm64 platform.
Signed-off-by: Haibo Xu <haibo.xu@arm.com>
Change-Id: I565214581eeb44045169da7f44d45a489082ac3a
PiperOrigin-RevId: 224938170
2018-12-10 21:35:02 -08:00
Ian Gudger 5d87d8865f Implement MSG_WAITALL
MSG_WAITALL requests that recv family calls do not perform short reads. It only
has an effect for SOCK_STREAM sockets, other types ignore it.

PiperOrigin-RevId: 224918540
Change-Id: Id97fbf972f1f7cbd4e08eec0138f8cbdf1c94fe7
2018-12-10 17:56:34 -08:00
Brian Geffon d3bc79bc84 Open source system call tests.
PiperOrigin-RevId: 224886231
Change-Id: I0fccb4d994601739d8b16b1d4e6b31f40297fb22
2018-12-10 14:42:34 -08:00
Nicolas Lacasse 833edbd10b Internal change.
PiperOrigin-RevId: 224865061
Change-Id: I6aa31f880931980ad2fc4c4b3cc4c532aacb31f4
2018-12-10 12:51:54 -08:00
Rahat Mahmood fc29770251 Add type safety to shm ids and keys.
PiperOrigin-RevId: 224864380
Change-Id: I49542279ad56bf15ba462d3de1ef2b157b31830a
2018-12-10 12:48:02 -08:00
Michael Pratt 99d5958693 Validate FS_BASE in Task.Clone
arch_prctl already verified that the new FS_BASE was canonical, but
Task.Clone did not. Centralize these checks in the arch packages.

Failure to validate could cause an error in PTRACE_SET_REGS when we try
to switch to the app.

PiperOrigin-RevId: 224862398
Change-Id: Iefe63b3f9aa6c4810326b8936e501be3ec407f14
2018-12-10 12:37:16 -08:00
Ian Gudger 25b8424d75 Stub out TCP_QUICKACK
PiperOrigin-RevId: 224696233
Change-Id: I45c425d9e32adee5dcce29ca7439a06567b26014
2018-12-09 00:50:33 -08:00
Fabricio Voznika b89f9909d7 Update K8s support
Add pointers to Minikube and gvisor-containerd-shim.

PiperOrigin-RevId: 224654334
Change-Id: Icefefbe531e901fe4807ba81904de8b01baf8a15
2018-12-08 09:21:48 -08:00
Zhaozhong Ni 9984138abe sentry: turn "dynamically-created" procfs files into static creation.
PiperOrigin-RevId: 224600982
Change-Id: I547253528e24fb0bb318fc9d2632cb80504acb34
2018-12-07 17:03:54 -08:00
Michael Pratt 42e2e5cae9 Format sigaction in strace
Sample:

I1206 14:24:56.768520    3700 x:0] [   1] ioctl_test E rt_sigaction(SIGSEGV, 0x7ee6edb0c590 {Handler: 0x559c6d915cf0, Flags: SA_SIGINFO|SA_RESTORER|SA_ONSTACK|SA_NODEFER, Restorer: 0x2a9901a259a0, Mask: []}, 0x7ee6edb0c630)
I1206 14:24:56.768530    3700 x:0] [   1] ioctl_test X rt_sigaction(SIGSEGV, 0x7ee6edb0c590 {Handler: 0x559c6d915cf0, Flags: SA_SIGINFO|SA_RESTORER|SA_ONSTACK|SA_NODEFER, Restorer: 0x2a9901a259a0, Mask: []}, 0x7ee6edb0c630 {Handler: SIG_DFL, Flags: 0x0, Restorer: 0x0, Mask: []}) = 0x0 (2.701?s)

PiperOrigin-RevId: 224596606
Change-Id: I3512493aed99d3d75600249263da46686b1dc0e7
2018-12-07 16:28:54 -08:00
Michael Pratt 673949048e Add period to comment
PiperOrigin-RevId: 224553291
Change-Id: I35d0772c215b71f4319c23f22df5c61c908f8590
2018-12-07 11:53:19 -08:00
Nicolas Lacasse 7fa5179cbc Bump glog version.
PiperOrigin-RevId: 224551278
Change-Id: I76c537075ae291647d9e3e597ca1bd2477c9ce8d
2018-12-07 11:42:24 -08:00
Michael Pratt 51900fe3a4 Format signals, signal masks in strace
Sample:

I1205 16:51:49.869701    2492 x:0] [   1] ioctl_test E rt_sigaction(SIGIO, 0x7e0e5b5e8500, 0x7e0e5b5e85a0)
I1205 16:51:49.869766    2492 x:0] [   1] ioctl_test X rt_sigaction(SIGIO, 0x7e0e5b5e8500, 0x7e0e5b5e85a0) = 0x0 (44.336?s)
I1205 16:51:49.869831    2492 x:0] [   1] ioctl_test E rt_sigprocmask(SIG_UNBLOCK, 0x7e0e5b5e8878 [SIGIO], 0x7e0e5b5e87c0, 0x8)
I1205 16:51:49.869866    2492 x:0] [   1] ioctl_test X rt_sigprocmask(SIG_UNBLOCK, 0x7e0e5b5e8878 [SIGIO], 0x7e0e5b5e87c0 [SIGIO 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64], 0x8) = 0x0 (2.575?s)

PiperOrigin-RevId: 224422404
Change-Id: I3ed3f2ec6b1a639baa9cacd37ce7ee325c3703e4
2018-12-06 15:47:06 -08:00
Andrei Vagin 1b1a42ba6d A sandbox process should wait until it has not been moved into cgroups
PiperOrigin-RevId: 224418900
Change-Id: I53cf4d7c1c70117875b6920f8fd3d58a3b1497e9
2018-12-06 15:28:29 -08:00
Chris Kuiper 1b3442cae0 Allow sending of broadcast packets w/o route.
Currently sending a broadcast packet (for DHCP, e.g.) requires a "default
route" of the format "0.0.0.0/0 via 0.0.0.0 <intf>". There is no good reason
for this and on devices with several ports this creates a rather akward route
table with lots of such default routes (which defeats the purpose of a default
route).

PiperOrigin-RevId: 224378769
Change-Id: Icd7ec8a206eb08083cff9a837f6f9ab231c73a19
2018-12-06 11:48:12 -08:00
Michael Pratt 666db00c26 Convert ValueSet to a map
Unlike FlagSet, order doesn't matter here, so it can simply be a map.

PiperOrigin-RevId: 224377910
Change-Id: I15810c698a7f02d8614bf09b59583ab73cba0514
2018-12-06 11:43:11 -08:00
Ian Gudger 000fa84a3b Fix tcpip.Endpoint.Write contract regarding short writes
* Clarify tcpip.Endpoint.Write contract regarding short writes.
* Enforce tcpip.Endpoint.Write contract regarding short writes.
* Update relevant users of tcpip.Endpoint.Write.

PiperOrigin-RevId: 224377586
Change-Id: I24299ecce902eb11317ee13dae3b8d8a7c5b097d
2018-12-06 11:41:33 -08:00
Rahat Mahmood 685eaf119f Add counters for memory events.
Also ensure an event is emitted at startup.

PiperOrigin-RevId: 224372065
Change-Id: I5f642b6d6b13c6468ee8f794effe285fcbbf29cf
2018-12-06 11:15:47 -08:00
Zach Koopmans 4d8c7ae869 Fixing O_TRUNC behavior to match Linux.
PiperOrigin-RevId: 224351139
Change-Id: I9453bd75e5a8d38db406bb47fdc01038ac60922e
2018-12-06 09:26:49 -08:00
Zhaozhong Ni 7f35daddd2 sentry: support save / restore of TCP bind socket after shutdown.
PiperOrigin-RevId: 224227677
Change-Id: I08b0e0c0574170556269900653e5bcf9e9e5c9c9
2018-12-05 15:02:40 -08:00
Michael Pratt 9f64e64a6e Enforce directory accessibility before delete Walk
By Walking before checking that the directory is writable and
executable, MayDelete may return the Walk error (e.g., ENOENT) which
would normally be masked by a permission error (EACCES).

PiperOrigin-RevId: 224222453
Change-Id: I108a7f730e6bdaa7f277eaddb776267c00805475
2018-12-05 14:31:58 -08:00
Jamie Liu 23438b3632 Update MM.usageAS when mremap copies or moves a mapping.
PiperOrigin-RevId: 224221509
Change-Id: I7aaea74629227d682786d3e435737364921249bf
2018-12-05 14:27:23 -08:00
Zhaozhong Ni fda4557e3d sentry: skip waiting for undrain for netstack TCP endpoints in error state.
PiperOrigin-RevId: 224214981
Change-Id: I4c1dd5b1c856f7a4f9866a5dda44a5297e92486a
2018-12-05 13:51:16 -08:00
Michael Pratt 592f5bdc67 Add context to mount errors
This makes it more obvious why a mount failed.

PiperOrigin-RevId: 224203880
Change-Id: I7961774a7b6fdbb5493a791f8b3815c49b8f7631
2018-12-05 12:46:30 -08:00
Zach Koopmans 06131fe749 Check for CAP_SYS_RESOURCE in prctl(PR_SET_MM, ...)
If sys_prctl is called with PR_SET_MM without CAP_SYS_RESOURCE,
the syscall should return failure with errno set to EPERM.
See: http://man7.org/linux/man-pages/man2/prctl.2.html
PiperOrigin-RevId: 224182874
Change-Id: I630d1dd44af8b444dd16e8e58a0764a0cf1ad9a3
2018-12-05 10:53:51 -08:00
Chris Kuiper fab029c50b Remove incorrect code and improve testing of Stack.GetMainNICAddress
This removes code that should have never made it in in the first place, but did so due to incomplete testing. With the new tests the original code fails, the new code passes.

PiperOrigin-RevId: 224086966
Change-Id: I646fef76977f4528f3705f497b95fad6b3ec32bc
2018-12-04 19:09:11 -08:00
Michael Pratt 076f107643 Remove initRegs arg from clone
It is always the same as t.initRegs.

PiperOrigin-RevId: 224085550
Change-Id: I5cc4ddc3b481d4748c3c43f6f4bb50da1dbac694
2018-12-04 18:53:43 -08:00
Brian Geffon ffcbda0c8b Partial writes should loop in rpcinet.
FileOperations.Write should return ErrWouldBlock to allow the upper
layer to loop and sendmsg should continue writing where it left off
on a partial write.

PiperOrigin-RevId: 224081631
Change-Id: Ic61f6943ea6b7abbd82e4279decea215347eac48
2018-12-04 18:15:10 -08:00
Ian Gudger d209f71b9f Whitelist Go 1.12 for tcpip/time_unsafe.go
The signature of time.now has remained unchanged:
c2412a7681/src/time/time.go (L1072)

PiperOrigin-RevId: 224061160
Change-Id: Ic84bd6ee8fb9952cd9ab580bcb0892444ce7c2da
2018-12-04 15:52:14 -08:00
Brian Geffon 2cab0e82ad Linkat(2) should sanity check flags.
PiperOrigin-RevId: 224047765
Change-Id: I6f3c75b33c32bf8f8910ea3fab35406d7d672d87
2018-12-04 14:34:19 -08:00
Brian Geffon 82719be42e Max link traversals should be for an entire path.
The number of symbolic links that are allowed to be followed
are for a full path and not just a chain of symbolic links.

PiperOrigin-RevId: 224047321
Change-Id: I5e3c4caf66a93c17eeddcc7f046d1e8bb9434a40
2018-12-04 14:32:03 -08:00
Zhaozhong Ni adafc08d7c sentry: save / restore netstack procfs configuration.
PiperOrigin-RevId: 224047120
Change-Id: Ia6cb17fa978595cd73857b6178c4bdba401e185e
2018-12-04 14:30:42 -08:00
Brian Geffon 5a6a1eb420 Enforce name length restriction on paths.
NAME_LENGTH must be enforced per component.

PiperOrigin-RevId: 224046749
Change-Id: Iba8105b00d951f2509dc768af58e4110dafbe1c9
2018-12-04 14:28:33 -08:00
Rahat Mahmood 806e346491 Fix mempolicy_test on bazel.
Bazel runs multiple test cases on the same thread. Some of the test
cases rely on the test thread starting with the default memory policy,
while other tests modify the test thread's memory policy. This
obviously breaks when the test framework doesn't run each test case on
a new thread.

Also fixing an incompatibility where set_mempolicy(2) was prevented
from specifying an empty nodemask, which is allowed for some modes.

PiperOrigin-RevId: 224038957
Change-Id: Ibf780766f2706ebc9b129dbc8cf1b85c2a275074
2018-12-04 13:45:58 -08:00
Ian Gudger 8cbd6153a6 Fix available calculation when merging TCP segments
PiperOrigin-RevId: 224033418
Change-Id: I780be973e8be68ac93e8c9e7a100002e912f40d2
2018-12-04 13:15:25 -08:00
Zhaozhong Ni ad8f293e1a sentry: save copy of tcp segment's delivered views to avoid in-struct pointers.
PiperOrigin-RevId: 224033238
Change-Id: Ie5b1854b29340843b02c123766d290a8738d7631
2018-12-04 13:14:24 -08:00
Nicolas Lacasse 54dd0d0dc5 Fix data race caused by unlocked call of Dirent.descendantOf.
PiperOrigin-RevId: 224025363
Change-Id: I98864403c779832e9e1436f7d3c3f6fb2fba9904
2018-12-04 12:24:55 -08:00
Bin Lu c3dd68cea7 Add ARM64 support to pkg/abi/linux
Signed-off-by: Bin Lu <bin.lu@arm.com>
Change-Id: I73cc4c406fadccb054e8e83c9464f6bef6280b0f
PiperOrigin-RevId: 224025309
2018-12-04 12:24:07 -08:00
Googler 613899f852 Internal change.
PiperOrigin-RevId: 223893409
Change-Id: I58869c7fb0012f6c3f7612a96cb649348b56335f
2018-12-03 17:27:35 -08:00
Ian Gudger 5560615c53 Return an int32 for netlink SO_RCVBUF
Untyped integer constants default to type int and the binary package will panic
if one tries to encode an int.

PiperOrigin-RevId: 223890001
Change-Id: Iccc3afd6d74bad24c35d764508e450fd317b76ec
2018-12-03 17:03:15 -08:00
Nicolas Lacasse edbd8a86d2 Explicitly load "http_archive" in WORKSPACE.
Fixes this error in bazel:

	The native http_archive rule is deprecated.
	load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") for a
	drop-in replacement.

PiperOrigin-RevId: 223595891
Change-Id: I4706dc5b92970e00b673d22edea82fa45d854f07
2018-11-30 16:41:08 -08:00
Ian Gudger 99fb113869 Test that full segments will be sent when delay/cork is enabled
PiperOrigin-RevId: 223425575
Change-Id: Idd777e04c69e6ffcbfb0bdbea828a8b8b42d7672
2018-11-29 15:46:38 -08:00