Delete verityfs.

PiperOrigin-RevId: 454300799

pkg/abi/linux/ioctl.go

@@ -113,38 +113,6 @@ const (
 	_IOC_DIRSHIFT  = _IOC_SIZESHIFT + _IOC_SIZEBITS
 )
 
-// Constants from uapi/linux/fs.h.
-const (
-	FS_IOC_GETFLAGS = 2148034049
-	FS_VERITY_FL    = 1048576
-)
-
-// Constants from uapi/linux/fsverity.h.
-const (
-	FS_VERITY_HASH_ALG_SHA256 = 1
-	FS_VERITY_HASH_ALG_SHA512 = 2
-
-	FS_IOC_ENABLE_VERITY  = 1082156677
-	FS_IOC_MEASURE_VERITY = 3221513862
-)
-
-// DigestMetadata is a helper struct for VerityDigest.
-//
-// +marshal
-type DigestMetadata struct {
-	DigestAlgorithm uint16
-	DigestSize      uint16
-}
-
-// SizeOfDigestMetadata is the size of struct DigestMetadata.
-const SizeOfDigestMetadata = 4
-
-// VerityDigest is struct from uapi/linux/fsverity.h.
-type VerityDigest struct {
-	Metadata DigestMetadata
-	Digest   []byte
-}
-
 // IOC outputs the result of _IOC macro in asm-generic/ioctl.h.
 func IOC(dir, typ, nr, size uint32) uint32 {
 	return uint32(dir)<<_IOC_DIRSHIFT | typ<<_IOC_TYPESHIFT | nr<<_IOC_NRSHIFT | size<<_IOC_SIZESHIFT

pkg/merkletree/BUILD

@@ -1,23 +0,0 @@
-load("//tools:defs.bzl", "go_library", "go_test")
-
-package(licenses = ["notice"])
-
-go_library(
-    name = "merkletree",
-    srcs = ["merkletree.go"],
-    visibility = ["//pkg/sentry:internal"],
-    deps = [
-        "//pkg/abi/linux",
-        "//pkg/hostarch",
-    ],
-)
-
-go_test(
-    name = "merkletree_test",
-    srcs = ["merkletree_test.go"],
-    library = ":merkletree",
-    deps = [
-        "//pkg/abi/linux",
-        "//pkg/hostarch",
-    ],
-)

pkg/sentry/fsimpl/verity/BUILD

@@ -1,69 +0,0 @@
-load("//tools:defs.bzl", "go_library", "go_test")
-load("//tools/go_generics:defs.bzl", "go_template_instance")
-
-licenses(["notice"])
-
-go_template_instance(
-    name = "dentry_list",
-    out = "dentry_list.go",
-    package = "verity",
-    prefix = "dentry",
-    template = "//pkg/ilist:generic_list",
-    types = {
-        "Element": "*dentry",
-        "Linker": "*dentry",
-    },
-)
-
-go_library(
-    name = "verity",
-    srcs = [
-        "dentry_list.go",
-        "filesystem.go",
-        "save_restore.go",
-        "verity.go",
-    ],
-    visibility = ["//pkg/sentry:internal"],
-    deps = [
-        "//pkg/abi/linux",
-        "//pkg/atomicbitops",
-        "//pkg/context",
-        "//pkg/errors/linuxerr",
-        "//pkg/fspath",
-        "//pkg/hostarch",
-        "//pkg/marshal/primitive",
-        "//pkg/merkletree",
-        "//pkg/refsvfs2",
-        "//pkg/safemem",
-        "//pkg/sentry/arch",
-        "//pkg/sentry/fs/lock",
-        "//pkg/sentry/kernel",
-        "//pkg/sentry/kernel/auth",
-        "//pkg/sentry/memmap",
-        "//pkg/sentry/socket/unix/transport",
-        "//pkg/sentry/vfs",
-        "//pkg/sync",
-        "//pkg/usermem",
-    ],
-)
-
-go_test(
-    name = "verity_test",
-    srcs = [
-        "verity_test.go",
-    ],
-    library = ":verity",
-    deps = [
-        "//pkg/abi/linux",
-        "//pkg/context",
-        "//pkg/errors/linuxerr",
-        "//pkg/fspath",
-        "//pkg/sentry/arch",
-        "//pkg/sentry/fsimpl/testutil",
-        "//pkg/sentry/fsimpl/tmpfs",
-        "//pkg/sentry/kernel",
-        "//pkg/sentry/kernel/auth",
-        "//pkg/sentry/vfs",
-        "//pkg/usermem",
-    ],
-)

pkg/sentry/fsimpl/verity/save_restore.go

@@ -1,25 +0,0 @@
-// Copyright 2020 The gVisor Authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package verity
-
-import (
-	"gvisor.dev/gvisor/pkg/refsvfs2"
-)
-
-func (d *dentry) afterLoad() {
-	if d.refs.Load() != -1 {
-		refsvfs2.Register(d)
-	}
-}

runsc/boot/BUILD

@@ -64,7 +64,6 @@ go_library(
         "//pkg/sentry/fsimpl/proc",
         "//pkg/sentry/fsimpl/sys",
         "//pkg/sentry/fsimpl/tmpfs",
-        "//pkg/sentry/fsimpl/verity",
         "//pkg/sentry/inet",
         "//pkg/sentry/kernel",
         "//pkg/sentry/kernel:uncaught_signal_go_proto",

runsc/boot/vfs.go

@@ -16,7 +16,6 @@ package boot
 
 import (
 	"fmt"
-	"path"
 	"path/filepath"
 	"sort"
 	"strconv"
@@ -44,7 +43,6 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/fsimpl/proc"
 	"gvisor.dev/gvisor/pkg/sentry/fsimpl/sys"
 	"gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs"
-	"gvisor.dev/gvisor/pkg/sentry/fsimpl/verity"
 	"gvisor.dev/gvisor/pkg/sentry/inet"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
 	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
@@ -104,10 +102,6 @@ func registerFilesystems(k *kernel.Kernel) error {
 		AllowUserMount: true,
 		AllowUserList:  true,
 	})
-	vfsObj.MustRegisterFilesystemType(verity.Name, &verity.FilesystemType{}, &vfs.RegisterFilesystemTypeOptions{
-		AllowUserList:  true,
-		AllowUserMount: true,
-	})
 	vfsObj.MustRegisterFilesystemType(mqfs.Name, &mqfs.FilesystemType{}, &vfs.RegisterFilesystemTypeOptions{
 		AllowUserMount: true,
 		AllowUserList:  true,
@@ -687,12 +681,6 @@ func (c *containerMounter) getMountNameAndOptions(conf *config.Config, m *mountA
 		internalData interface{}
 	)
 
-	verityData, verityOpts, verityRequested, remainingMOpts, err := parseVerityMountOptions(m.mount.Options)
-	if err != nil {
-		return "", nil, false, err
-	}
-	m.mount.Options = remainingMOpts
-
 	// Find filesystem name and FS specific data field.
 	switch m.mount.Type {
 	case devpts.Name, devtmpfs.Name, proc.Name:
@@ -746,20 +734,6 @@ func (c *containerMounter) getMountNameAndOptions(conf *config.Config, m *mountA
 		InternalData: internalData,
 	}
 
-	if verityRequested {
-		verityData = verityData + "root_name=" + path.Base(m.mount.Destination)
-		verityOpts.LowerName = fsName
-		verityOpts.LowerGetFSOptions = opts.GetFilesystemOptions
-		fsName = verity.Name
-		opts = &vfs.MountOptions{
-			GetFilesystemOptions: vfs.GetFilesystemOptions{
-				Data:         verityData,
-				InternalData: verityOpts,
-			},
-			InternalMount: true,
-		}
-	}
-
 	return fsName, opts, useOverlay, nil
 }
 
@@ -795,50 +769,6 @@ func parseKeyValue(s string) (string, string, bool) {
 	return strings.TrimSpace(tokens[0]), strings.TrimSpace(tokens[1]), true
 }
 
-// parseAndFilterOptions scans the provided mount options for verity-related
-// mount options. It returns the parsed set of verity mount options, as well as
-// the filtered set of mount options unrelated to verity.
-func parseVerityMountOptions(mopts []string) (string, verity.InternalFilesystemOptions, bool, []string, error) {
-	nonVerity := []string{}
-	found := false
-	var rootHash string
-	verityOpts := verity.InternalFilesystemOptions{
-		Action: verity.PanicOnViolation,
-	}
-	for _, o := range mopts {
-		if !strings.HasPrefix(o, "verity.") {
-			nonVerity = append(nonVerity, o)
-			continue
-		}
-
-		k, v, ok := parseKeyValue(o)
-		if !ok {
-			return "", verityOpts, found, nonVerity, fmt.Errorf("invalid verity mount option with no value: %q", o)
-		}
-
-		found = true
-		switch k {
-		case "verity.roothash":
-			rootHash = v
-		case "verity.action":
-			switch v {
-			case "error":
-				verityOpts.Action = verity.ErrorOnViolation
-			case "panic":
-				verityOpts.Action = verity.PanicOnViolation
-			default:
-				log.Warningf("Invalid verity action %q", v)
-				verityOpts.Action = verity.PanicOnViolation
-			}
-		default:
-			return "", verityOpts, found, nonVerity, fmt.Errorf("unknown verity mount option: %q", k)
-		}
-	}
-	verityOpts.AllowRuntimeEnable = len(rootHash) == 0
-	verityData := "root_hash=" + rootHash + ","
-	return verityData, verityOpts, found, nonVerity, nil
-}
-
 // mountTmp mounts an internal tmpfs at '/tmp' if it's safe to do so.
 // Technically we don't have to mount tmpfs at /tmp, as we could just rely on
 // the host /tmp, but this is a nice optimization, and fixes some apps that call

runsc/cli/main.go

@@ -81,7 +81,6 @@ func Main(version string) {
 	subcommands.Register(new(cmd.Spec), "")
 	subcommands.Register(new(cmd.Start), "")
 	subcommands.Register(new(cmd.State), "")
-	subcommands.Register(new(cmd.VerityPrepare), "")
 	subcommands.Register(new(cmd.Wait), "")
 
 	// Helpers.

runsc/cmd/BUILD

@@ -37,7 +37,6 @@ go_library(
         "symbolize.go",
         "syscalls.go",
         "usage.go",
-        "verity_prepare.go",
         "wait.go",
     ],
     visibility = [

runsc/cmd/gofer.go

@@ -172,10 +172,6 @@ func (g *Gofer) Execute(_ context.Context, f *flag.FlagSet, args ...interface{})
 		filter.InstallUDSFilters()
 	}
 
-	if conf.Verity {
-		filter.InstallXattrFilters()
-	}
-
 	if err := filter.Install(); err != nil {
 		util.Fatalf("installing seccomp filters: %v", err)
 	}
@@ -204,8 +200,7 @@ func (g *Gofer) serveLisafs(spec *specs.Spec, conf *config.Config, root string)
 	server := fsgofer.NewLisafsServer(fsgofer.Config{
 		// These are global options. Ignore readonly configuration, that is set on
 		// a per connection basis.
-		HostUDS:           conf.FSGoferHostUDS,
-		EnableVerityXattr: conf.Verity,
+		HostUDS: conf.FSGoferHostUDS,
 	})
 
 	// Start with root mount, then add any other additional mount as needed.
@@ -261,9 +256,8 @@ func (g *Gofer) serve9P(spec *specs.Spec, conf *config.Config, root string) subc
 	// Start with root mount, then add any other additional mount as needed.
 	ats := make([]p9.Attacher, 0, len(spec.Mounts)+1)
 	ap, err := fsgofer.NewAttachPoint("/", fsgofer.Config{
-		ROMount:           spec.Root.Readonly || conf.Overlay,
-		HostUDS:           conf.FSGoferHostUDS,
-		EnableVerityXattr: conf.Verity,
+		ROMount: spec.Root.Readonly || conf.Overlay,
+		HostUDS: conf.FSGoferHostUDS,
 	})
 	if err != nil {
 		util.Fatalf("creating attach point: %v", err)
@@ -275,9 +269,8 @@ func (g *Gofer) serve9P(spec *specs.Spec, conf *config.Config, root string) subc
 	for _, m := range spec.Mounts {
 		if specutils.IsGoferMount(m) {
 			cfg := fsgofer.Config{
-				ROMount:           isReadonlyMount(m.Options) || conf.Overlay,
-				HostUDS:           conf.FSGoferHostUDS,
-				EnableVerityXattr: conf.Verity,
+				ROMount: isReadonlyMount(m.Options) || conf.Overlay,
+				HostUDS: conf.FSGoferHostUDS,
 			}
 			ap, err := fsgofer.NewAttachPoint(m.Destination, cfg)
 			if err != nil {

runsc/cmd/verity_prepare.go

@@ -1,114 +0,0 @@
-// Copyright 2021 The gVisor Authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"math/rand"
-	"os"
-
-	"github.com/google/subcommands"
-	specs "github.com/opencontainers/runtime-spec/specs-go"
-	"golang.org/x/sys/unix"
-	"gvisor.dev/gvisor/runsc/cmd/util"
-	"gvisor.dev/gvisor/runsc/config"
-	"gvisor.dev/gvisor/runsc/flag"
-	"gvisor.dev/gvisor/runsc/specutils"
-)
-
-// VerityPrepare implements subcommands.Commands for the "verity-prepare"
-// command. It sets up a sandbox with a writable verity mount mapped to "--dir",
-// and executes the verity measure tool specified by "--tool" in the sandbox. It
-// is intended to prepare --dir to be mounted as a verity filesystem.
-type VerityPrepare struct {
-	root string
-	tool string
-	dir  string
-}
-
-// Name implements subcommands.Command.Name.
-func (*VerityPrepare) Name() string {
-	return "verity-prepare"
-}
-
-// Synopsis implements subcommands.Command.Synopsis.
-func (*VerityPrepare) Synopsis() string {
-	return "Generates the data structures necessary to enable verityfs on a filesystem."
-}
-
-// Usage implements subcommands.Command.Usage.
-func (*VerityPrepare) Usage() string {
-	return "verity-prepare --tool=<measure_tool> --dir=<path>"
-}
-
-// SetFlags implements subcommands.Command.SetFlags.
-func (c *VerityPrepare) SetFlags(f *flag.FlagSet) {
-	f.StringVar(&c.root, "root", "/", `path to the root directory, defaults to "/"`)
-	f.StringVar(&c.tool, "tool", "", "path to the verity measure_tool")
-	f.StringVar(&c.dir, "dir", "", "path to the directory to be hashed")
-}
-
-// Execute implements subcommands.Command.Execute.
-func (c *VerityPrepare) Execute(_ context.Context, f *flag.FlagSet, args ...interface{}) subcommands.ExitStatus {
-	conf := args[0].(*config.Config)
-	waitStatus := args[1].(*unix.WaitStatus)
-
-	hostname, err := os.Hostname()
-	if err != nil {
-		return util.Errorf("Error to retrieve hostname: %v", err)
-	}
-
-	// Map the entire host file system.
-	absRoot, err := resolvePath(c.root)
-	if err != nil {
-		return util.Errorf("Error resolving root: %v", err)
-	}
-
-	spec := &specs.Spec{
-		Root: &specs.Root{
-			Path: absRoot,
-		},
-		Process: &specs.Process{
-			Cwd:          absRoot,
-			Args:         []string{c.tool, "--path", "/verityroot", "--rawpath", "/rawroot"},
-			Env:          os.Environ(),
-			Capabilities: specutils.AllCapabilities(),
-		},
-		Hostname: hostname,
-		Mounts: []specs.Mount{
-			{
-				Source:      c.dir,
-				Destination: "/verityroot",
-				Type:        "bind",
-				Options:     []string{"verity.roothash="},
-			},
-			{
-				Source:      c.dir,
-				Destination: "/rawroot",
-				Type:        "bind",
-			},
-		},
-	}
-
-	cid := fmt.Sprintf("runsc-%06d", rand.Int31n(1000000))
-
-	// Force no networking, it is not necessary to run the verity measure tool.
-	conf.Network = config.NetworkNone
-
-	conf.Verity = true
-
-	return startContainerAndWait(spec, conf, cid, waitStatus)
-}

runsc/config/config.go

@@ -73,9 +73,6 @@ type Config struct {
 	// Overlay is whether to wrap the root filesystem in an overlay.
 	Overlay bool `flag:"overlay"`
 
-	// Verity is whether there's one or more verity file system to mount.
-	Verity bool `flag:"verity"`
-
 	// FSGoferHostUDS enables the gofer to create and connect to host unix
 	// domain sockets.
 	FSGoferHostUDS bool `flag:"fsgofer-host-uds"`

runsc/config/flags.go

@@ -78,7 +78,6 @@ func RegisterFlags(flagSet *flag.FlagSet) {
 	flagSet.Var(fileAccessTypePtr(FileAccessExclusive), "file-access", "specifies which filesystem validation to use for the root mount: exclusive (default), shared.")
 	flagSet.Var(fileAccessTypePtr(FileAccessShared), "file-access-mounts", "specifies which filesystem validation to use for volumes other than the root mount: shared (default), exclusive.")
 	flagSet.Bool("overlay", false, "wrap filesystem mounts with writable overlay. All modifications are stored in memory inside the sandbox.")
-	flagSet.Bool("verity", false, "specifies whether a verity file system will be mounted.")
 	flagSet.Bool("fsgofer-host-uds", false, "allow the gofer to mount Unix Domain Sockets.")
 	flagSet.Bool("vfs2", true, "DEPRECATED: this flag has no effect.")
 	flagSet.Bool("fuse", false, "TEST ONLY; use while FUSE in VFSv2 is landing. This allows the use of the new experimental FUSE filesystem.")

runsc/fsgofer/filter/filter.go

@@ -36,9 +36,3 @@ func InstallUDSFilters() {
 	// Add additional filters required for connecting to the host's sockets.
 	allowedSyscalls.Merge(udsSyscalls)
 }
-
-// InstallXattrFilters extends the allowed syscalls to include xattr calls that
-// are necessary for Verity enabled file systems.
-func InstallXattrFilters() {
-	allowedSyscalls.Merge(xattrSyscalls)
-}

runsc/fsgofer/fsgofer.go

@@ -52,14 +52,6 @@ const (
 	unixPathMax = 108
 )
 
-// verityXattrs are the extended attributes used by verity file system.
-var verityXattrs = map[string]struct{}{
-	"user.merkle.offset":         {},
-	"user.merkle.size":           {},
-	"user.merkle.childrenOffset": {},
-	"user.merkle.childrenSize":   {},
-}
-
 // join is equivalent to path.Join() but skips path.Clean() which is expensive.
 func join(parent, child string) string {
 	return parent + "/" + child
@@ -76,10 +68,6 @@ type Config struct {
 	// HostUDS signals whether the gofer can create and connect to host
 	// unix domain sockets.
 	HostUDS bool
-
-	// EnableVerityXattr allows access to extended attributes used by the
-	// verity file system.
-	EnableVerityXattr bool
 }
 
 type attachPoint struct {
@@ -822,27 +810,11 @@ func (l *localFile) SetAttr(valid p9.SetAttrMask, attr p9.SetAttr) error {
 }
 
 func (l *localFile) GetXattr(name string, size uint64) (string, error) {
-	if !l.attachPoint.conf.EnableVerityXattr {
-		return "", unix.EOPNOTSUPP
-	}
-	if _, ok := verityXattrs[name]; !ok {
-		return "", unix.EOPNOTSUPP
-	}
-	buffer := make([]byte, size)
-	if _, err := unix.Fgetxattr(l.file.FD(), name, buffer); err != nil {
-		return "", err
-	}
-	return string(buffer), nil
+	return "", unix.EOPNOTSUPP
 }
 
 func (l *localFile) SetXattr(name string, value string, flags uint32) error {
-	if !l.attachPoint.conf.EnableVerityXattr {
-		return unix.EOPNOTSUPP
-	}
-	if _, ok := verityXattrs[name]; !ok {
-		return unix.EOPNOTSUPP
-	}
-	return unix.Fsetxattr(l.file.FD(), name, []byte(value), int(flags))
+	return unix.EOPNOTSUPP
 }
 
 func (*localFile) ListXattr(uint64) (map[string]struct{}, error) {

runsc/fsgofer/fsgofer_test.go

@@ -581,17 +581,6 @@ func TestSetGetDisabledXattr(t *testing.T) {
 	})
 }
 
-func TestSetGetXattr(t *testing.T) {
-	runCustom(t, []uint32{unix.S_IFREG}, []Config{{ROMount: false, EnableVerityXattr: true}}, func(t *testing.T, s fileState) {
-		name := "user.merkle.offset"
-		value := "tmp"
-		err := SetGetXattr(s.file, name, value)
-		if err != nil {
-			t.Fatalf("%v: SetGetXattr failed, err: %v", s, err)
-		}
-	})
-}
-
 func TestLink(t *testing.T) {
 	if !specutils.HasCapabilities(capability.CAP_DAC_READ_SEARCH) {
 		t.Skipf("Link test requires CAP_DAC_READ_SEARCH, running as %d", os.Getuid())