Fix build configurations.

This standardizes some build configurations and simplifies the structure
of packages intended to avoid fighting with automated formatting tools.

Updates #6938

PiperOrigin-RevId: 426495825

runsc/boot/platforms/BUILD

@@ -1,15 +1,11 @@
-load("//tools:defs.bzl", "go_library", "select_system")
+# The go_library rule is imported as a different name in this case,
+# in order to avoid automated tooling doing the wrong thing with the
+# operating-specific dependencies listed below.
+load("//tools:defs.bzl", "platforms", "select_system", exempt_go_library = "go_library")
 
 package(licenses = ["notice"])
 
-# Don't rewrite the deps attribute of :platforms.
-# @unused
-glaze_ignore = [
-    "platforms.go",
-    "platforms_darwin.go",
-]
-
-go_library(
+exempt_go_library(
     name = "platforms",
     srcs = [
         "platforms.go",
@@ -24,9 +20,8 @@ go_library(
     deps = select_system(
         darwin = [],
         linux = [
-            "//pkg/sentry/platform/kvm",
-            "//pkg/sentry/platform/ptrace",
-            "//runsc/boot/platforms/nonstandard",
+            "//pkg/sentry/platform/%s" % platform
+            for platform in platforms
         ],
     ),
 )

runsc/boot/platforms/nonstandard/BUILD

@@ -1,11 +0,0 @@
-load("//tools:defs.bzl", "go_library")
-
-package(licenses = ["notice"])
-
-go_library(
-    name = "nonstandard",
-    srcs = ["nonstandard.go"],
-    visibility = [
-        "//runsc:__subpackages__",
-    ],
-)

runsc/boot/platforms/nonstandard/nonstandard.go

@@ -1,16 +0,0 @@
-// Copyright 2021 The gVisor Authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Package nonstandard provides a place for nonstandard platforms.
-package nonstandard

runsc/boot/platforms/platforms.go

@@ -22,13 +22,4 @@ import (
 	// Import platforms that runsc might use.
 	_ "gvisor.dev/gvisor/pkg/sentry/platform/kvm"
 	_ "gvisor.dev/gvisor/pkg/sentry/platform/ptrace"
-	_ "gvisor.dev/gvisor/runsc/boot/platforms/nonstandard"
-)
-
-const (
-	// Ptrace runs the sandbox with the ptrace platform.
-	Ptrace = "ptrace"
-
-	// KVM runs the sandbox with the KVM platform.
-	KVM = "kvm"
 )

runsc/container/BUILD

@@ -1,4 +1,4 @@
-load("//tools:defs.bzl", "go_library", "go_test", "more_shards")
+load("//tools:defs.bzl", "default_platform", "go_library", "go_test", "more_shards", "platforms")
 
 package(licenses = ["notice"])
 
@@ -39,12 +39,18 @@ go_test(
     size = "large",
     srcs = [
         "console_test.go",
-        "container_norace_test.go",
-        "container_race_test.go",
         "container_test.go",
         "multi_container_test.go",
         "shared_volume_test.go",
     ],
+    # Only run the default platform for the tsan test, which should
+    # be compatible. For non-tsan builds, run all platforms.
+    args = select({
+        "//conditions:default": ["-test_platforms=%s" % ",".join(
+            [p for (p, tags) in platforms.items() if "manual" not in tags],
+        )],
+        "//tools:gotsan": ["-test_platforms=%s" % default_platform],
+    }),
     data = [
         "//runsc",
         "//test/cmd/test_app",
@@ -60,13 +66,14 @@ go_test(
         "//pkg/sentry/control",
         "//pkg/sentry/kernel",
         "//pkg/sentry/kernel/auth",
+        "//pkg/sentry/platform",
         "//pkg/sync",
         "//pkg/test/testutil",
         "//pkg/unet",
         "//pkg/urpc",
         "//runsc/boot",
-        "//runsc/boot/platforms",
         "//runsc/config",
+        "//runsc/flag",
         "//runsc/specutils",
         "@com_github_cenkalti_backoff//:go_default_library",
         "@com_github_kr_pty//:go_default_library",

runsc/container/console_test.go

@@ -121,7 +121,7 @@ func receiveConsolePTY(srv *unet.ServerSocket) (*os.File, error) {
 
 // Test that an pty FD is sent over the console socket if one is provided.
 func TestConsoleSocket(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			spec := testutil.NewSpecWithArgs("true")
 			spec.Process.Terminal = true
@@ -163,7 +163,7 @@ func TestConsoleSocket(t *testing.T) {
 
 // Test that an pty FD is sent over the console socket if one is provided.
 func TestMultiContainerConsoleSocket(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			rootDir, cleanup, err := testutil.SetupRootDir()
 			if err != nil {
@@ -500,7 +500,7 @@ func TestJobControlSignalRootContainer(t *testing.T) {
 
 // Test that terminal works with root and sub-containers.
 func TestMultiContainerTerminal(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			rootDir, cleanup, err := testutil.SetupRootDir()
 			if err != nil {

runsc/container/container_norace_test.go

@@ -1,21 +0,0 @@
-// Copyright 2018 The gVisor Authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//go:build !race
-// +build !race
-
-package container
-
-// Allow both kvm and ptrace for non-race builds.
-var platformOptions = []configOption{ptrace, kvm}

runsc/container/container_race_test.go

@@ -1,21 +0,0 @@
-// Copyright 2018 The gVisor Authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//go:build race
-// +build race
-
-package container
-
-// Only enabled ptrace with race builds.
-var platformOptions = []configOption{ptrace}

runsc/container/container_test.go

@@ -16,7 +16,6 @@ package container
 
 import (
 	"bytes"
-	"flag"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -39,17 +38,17 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/control"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
 	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
+	"gvisor.dev/gvisor/pkg/sentry/platform"
 	"gvisor.dev/gvisor/pkg/sync"
 	"gvisor.dev/gvisor/pkg/test/testutil"
 	"gvisor.dev/gvisor/pkg/urpc"
-	"gvisor.dev/gvisor/runsc/boot/platforms"
 	"gvisor.dev/gvisor/runsc/config"
+	"gvisor.dev/gvisor/runsc/flag"
 	"gvisor.dev/gvisor/runsc/specutils"
 )
 
 func TestMain(m *testing.M) {
 	log.SetLevel(log.Debug)
-	flag.Parse()
 	if err := testutil.ConfigureExePath(); err != nil {
 		panic(err.Error())
 	}
@@ -390,56 +389,44 @@ func run(spec *specs.Spec, conf *config.Config) error {
 	return nil
 }
 
-type configOption int
-
-const (
-	overlay configOption = iota
-	ptrace
-	kvm
-	nonExclusiveFS
-)
-
-var (
-	noOverlay = append(platformOptions, nonExclusiveFS)
-	all       = append(noOverlay, overlay)
-)
-
-func configsHelper(t *testing.T, opts ...configOption) map[string]*config.Config {
-	// Always load the default config.
-	cs := make(map[string]*config.Config)
-	for _, o := range opts {
-		c := testutil.TestConfig(t)
-		c.VFS2 = false
-		switch o {
-		case overlay:
-			c.Overlay = true
-			cs["overlay"] = c
-		case ptrace:
-			c.Platform = platforms.Ptrace
-			cs["ptrace"] = c
-		case kvm:
-			c.Platform = platforms.KVM
-			cs["kvm"] = c
-		case nonExclusiveFS:
-			c.FileAccess = config.FileAccessShared
-			cs["non-exclusive"] = c
-		default:
-			panic(fmt.Sprintf("unknown config option %v", o))
-		}
-	}
-	return cs
-}
+// platforms must be provided by the BUILD rule, or all platforms are included.
+var platforms = flag.String("test_platforms", strings.Join(platform.List(), ","), "Platforms to test with.")
 
 // configs generates different configurations to run tests.
 //
 // TODO(gvisor.dev/issue/1624): Remove VFS1 dimension.
-func configs(t *testing.T, opts ...configOption) map[string]*config.Config {
-	all := configsHelper(t, opts...)
-	for key, value := range configsHelper(t, opts...) {
-		value.VFS2 = true
-		all[key+"VFS2"] = value
+func configs(t *testing.T, noOverlay bool) map[string]*config.Config {
+	cs := make(map[string]*config.Config)
+	ps := strings.Split(*platforms, ",")
+
+	// Non-overlay versions.
+	for _, p := range ps {
+		c := testutil.TestConfig(t)
+		c.Platform = p
+		c.VFS2 = true
+		cs[p] = c
 	}
-	return all
+
+	// Overlay versions.
+	if !noOverlay {
+		for _, p := range ps {
+			c := testutil.TestConfig(t)
+			c.Platform = p
+			c.Overlay = true
+			c.VFS2 = true
+			cs[p+"-overlay"] = c
+		}
+	}
+
+	// FIXME(b/148134013): Delete with VFS1.
+	for _, p := range ps {
+		c := testutil.TestConfig(t)
+		c.Platform = p
+		c.VFS2 = false
+		cs[p+"-vfs1"] = c
+	}
+
+	return cs
 }
 
 // sleepSpec generates a spec with sleep 1000 and a conf.
@@ -456,7 +443,7 @@ func TestLifecycle(t *testing.T) {
 	childReaper.Start()
 	defer childReaper.Stop()
 
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			// The container will just sleep for a long time.  We will kill it before
 			// it finishes sleeping.
@@ -629,7 +616,7 @@ func TestExePath(t *testing.T) {
 		t.Fatalf("error making directory: %v", err)
 	}
 
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			for _, test := range []struct {
 				path    string
@@ -754,7 +741,7 @@ func doAppExitStatus(t *testing.T, vfs2 bool) {
 
 // TestExec verifies that a container can exec a new program.
 func TestExec(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			dir, err := ioutil.TempDir(testutil.TmpDir(), "exec-test")
 			if err != nil {
@@ -905,7 +892,7 @@ func TestExec(t *testing.T) {
 // TestExecProcList verifies that a container can exec a new program and it
 // shows correcly in the process list.
 func TestExecProcList(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			const uid = 343
 			spec, _ := sleepSpecConf(t)
@@ -976,7 +963,7 @@ func TestExecProcList(t *testing.T) {
 
 // TestKillPid verifies that we can signal individual exec'd processes.
 func TestKillPid(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			app, err := testutil.FindFile("test/cmd/test_app/test_app")
 			if err != nil {
@@ -1054,7 +1041,7 @@ func TestKillPid(t *testing.T) {
 // number after the last number from the checkpointed container.
 func TestCheckpointRestore(t *testing.T) {
 	// Skip overlay because test requires writing to host file.
-	for name, conf := range configs(t, noOverlay...) {
+	for name, conf := range configs(t, true /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			dir, err := ioutil.TempDir(testutil.TmpDir(), "checkpoint-test")
 			if err != nil {
@@ -1215,7 +1202,7 @@ func TestCheckpointRestore(t *testing.T) {
 // with filesystem Unix Domain Socket use.
 func TestUnixDomainSockets(t *testing.T) {
 	// Skip overlay because test requires writing to host file.
-	for name, conf := range configs(t, noOverlay...) {
+	for name, conf := range configs(t, true /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			// UDS path is limited to 108 chars for compatibility with older systems.
 			// Use '/tmp' (instead of testutil.TmpDir) to ensure the size limit is
@@ -1352,7 +1339,7 @@ func TestUnixDomainSockets(t *testing.T) {
 // recreated. Then it resumes the container, verify that the file gets created
 // again.
 func TestPauseResume(t *testing.T) {
-	for name, conf := range configs(t, noOverlay...) {
+	for name, conf := range configs(t, true /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			tmpDir, err := ioutil.TempDir(testutil.TmpDir(), "lock")
 			if err != nil {
@@ -1494,7 +1481,7 @@ func TestCapabilities(t *testing.T) {
 	uid := auth.KUID(os.Getuid() + 1)
 	gid := auth.KGID(os.Getgid() + 1)
 
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			spec, _ := sleepSpecConf(t)
 			rootDir, bundleDir, cleanup, err := testutil.SetupContainer(spec, conf)
@@ -1569,7 +1556,7 @@ func TestCapabilities(t *testing.T) {
 // TestRunNonRoot checks that sandbox can be configured when running as
 // non-privileged user.
 func TestRunNonRoot(t *testing.T) {
-	for name, conf := range configs(t, noOverlay...) {
+	for name, conf := range configs(t, true /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			spec := testutil.NewSpecWithArgs("/bin/true")
 
@@ -1613,7 +1600,7 @@ func TestRunNonRoot(t *testing.T) {
 // TestMountNewDir checks that runsc will create destination directory if it
 // doesn't exit.
 func TestMountNewDir(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			root, err := ioutil.TempDir(testutil.TmpDir(), "root")
 			if err != nil {
@@ -1644,7 +1631,7 @@ func TestMountNewDir(t *testing.T) {
 }
 
 func TestReadonlyRoot(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			spec, _ := sleepSpecConf(t)
 			spec.Root.Readonly = true
@@ -1692,7 +1679,7 @@ func TestReadonlyRoot(t *testing.T) {
 }
 
 func TestReadonlyMount(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			dir, err := ioutil.TempDir(testutil.TmpDir(), "ro-mount")
 			if err != nil {
@@ -1751,7 +1738,7 @@ func TestReadonlyMount(t *testing.T) {
 }
 
 func TestUIDMap(t *testing.T) {
-	for name, conf := range configs(t, noOverlay...) {
+	for name, conf := range configs(t, true /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			testDir, err := ioutil.TempDir(testutil.TmpDir(), "test-mount")
 			if err != nil {
@@ -2039,7 +2026,7 @@ func TestUserLog(t *testing.T) {
 }
 
 func TestWaitOnExitedSandbox(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			// Run a shell that sleeps for 1 second and then exits with a
 			// non-zero code.
@@ -2181,7 +2168,7 @@ func doDestroyStartingTest(t *testing.T, vfs2 bool) {
 }
 
 func TestCreateWorkingDir(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			tmpDir, err := ioutil.TempDir(testutil.TmpDir(), "cwd-create")
 			if err != nil {
@@ -2295,7 +2282,7 @@ func TestMountPropagation(t *testing.T) {
 }
 
 func TestMountSymlink(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			dir, err := ioutil.TempDir(testutil.TmpDir(), "mount-symlink")
 			if err != nil {
@@ -2518,7 +2505,7 @@ func TestCreateWithCorruptedStateFile(t *testing.T) {
 }
 
 func TestBindMountByOption(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			dir, err := ioutil.TempDir(testutil.TmpDir(), "bind-mount")
 			spec := testutil.NewSpecWithArgs("/bin/touch", path.Join(dir, "file"))

runsc/container/multi_container_test.go

@@ -137,7 +137,7 @@ func createSharedMount(mount specs.Mount, name string, pod ...*specs.Spec) {
 // TestMultiContainerSanity checks that it is possible to run 2 dead-simple
 // containers in the same sandbox.
 func TestMultiContainerSanity(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			rootDir, cleanup, err := testutil.SetupRootDir()
 			if err != nil {
@@ -175,7 +175,7 @@ func TestMultiContainerSanity(t *testing.T) {
 // TestMultiPIDNS checks that it is possible to run 2 dead-simple containers in
 // the same sandbox with different pidns.
 func TestMultiPIDNS(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			rootDir, cleanup, err := testutil.SetupRootDir()
 			if err != nil {
@@ -247,7 +247,7 @@ func TestMultiPIDNS(t *testing.T) {
 
 // TestMultiPIDNSPath checks the pidns path.
 func TestMultiPIDNSPath(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			rootDir, cleanup, err := testutil.SetupRootDir()
 			if err != nil {
@@ -365,7 +365,7 @@ func TestMultiPIDNSKill(t *testing.T) {
 		t.Fatal("error finding test_app:", err)
 	}
 
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			rootDir, cleanup, err := testutil.SetupRootDir()
 			if err != nil {
@@ -619,7 +619,7 @@ func TestMultiContainerMount(t *testing.T) {
 // TestMultiContainerSignal checks that it is possible to signal individual
 // containers without killing the entire sandbox.
 func TestMultiContainerSignal(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			rootDir, cleanup, err := testutil.SetupRootDir()
 			if err != nil {
@@ -719,7 +719,7 @@ func TestMultiContainerDestroy(t *testing.T) {
 		t.Fatal("error finding test_app:", err)
 	}
 
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			rootDir, cleanup, err := testutil.SetupRootDir()
 			if err != nil {
@@ -1216,7 +1216,7 @@ func TestMultiContainerContainerDestroyStress(t *testing.T) {
 // Test that pod shared mounts are properly mounted in 2 containers and that
 // changes from one container is reflected in the other.
 func TestMultiContainerSharedMount(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			rootDir, cleanup, err := testutil.SetupRootDir()
 			if err != nil {
@@ -1329,7 +1329,7 @@ func TestMultiContainerSharedMount(t *testing.T) {
 
 // Test that pod mounts are mounted as readonly when requested.
 func TestMultiContainerSharedMountReadonly(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			rootDir, cleanup, err := testutil.SetupRootDir()
 			if err != nil {
@@ -1463,7 +1463,7 @@ func TestMultiContainerSharedMountCompatible(t *testing.T) {
 
 // Test that shared pod mounts continue to work after container is restarted.
 func TestMultiContainerSharedMountRestart(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			rootDir, cleanup, err := testutil.SetupRootDir()
 			if err != nil {
@@ -1572,7 +1572,7 @@ func TestMultiContainerSharedMountRestart(t *testing.T) {
 // Test that unsupported pod mounts options are ignored when matching master and
 // replica mounts.
 func TestMultiContainerSharedMountUnsupportedOptions(t *testing.T) {
-	for name, conf := range configs(t, all...) {
+	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
 			rootDir, cleanup, err := testutil.SetupRootDir()
 			if err != nil {
@@ -1907,7 +1907,7 @@ func TestMultiContainerRunNonRoot(t *testing.T) {
 func TestMultiContainerHomeEnvDir(t *testing.T) {
 	// NOTE: Don't use overlay since we need changes to persist to the temp dir
 	// outside the sandbox.
-	for testName, conf := range configs(t, noOverlay...) {
+	for testName, conf := range configs(t, true /* noOverlay */) {
 		t.Run(testName, func(t *testing.T) {
 
 			rootDir, cleanup, err := testutil.SetupRootDir()

runsc/sandbox/BUILD

@@ -28,7 +28,6 @@ go_library(
         "//pkg/unet",
         "//pkg/urpc",
         "//runsc/boot",
-        "//runsc/boot/platforms",
         "//runsc/cgroup",
         "//runsc/config",
         "//runsc/console",

runsc/sandbox/sandbox.go

@@ -45,7 +45,6 @@ import (
 	"gvisor.dev/gvisor/pkg/unet"
 	"gvisor.dev/gvisor/pkg/urpc"
 	"gvisor.dev/gvisor/runsc/boot"
-	"gvisor.dev/gvisor/runsc/boot/platforms"
 	"gvisor.dev/gvisor/runsc/cgroup"
 	"gvisor.dev/gvisor/runsc/config"
 	"gvisor.dev/gvisor/runsc/console"
@@ -1426,7 +1425,7 @@ func deviceFileForPlatform(name string) (*os.File, error) {
 func checkBinaryPermissions(conf *config.Config) error {
 	// All platforms need the other exe bit
 	neededBits := os.FileMode(0001)
-	if conf.Platform == platforms.Ptrace {
+	if conf.Platform == "ptrace" {
 		// Ptrace needs the other read bit
 		neededBits |= os.FileMode(0004)
 	}

tools/BUILD

@@ -1,7 +1,24 @@
-load("//tools:defs.bzl", "bzl_library")
+load("//tools:defs.bzl", "bzl_library", "gotsan_flag_values", "gotsan_values")
 
 package(licenses = ["notice"])
 
+config_setting(
+    name = "debug",
+    values = {"compilation_mode": "dbg"},
+    visibility = [
+        "//:sandbox",
+    ],
+)
+
+config_setting(
+    name = "gotsan",
+    flag_values = gotsan_flag_values,
+    values = gotsan_values,
+    visibility = [
+        "//:sandbox",
+    ],
+)
+
 bzl_library(
     name = "defs_bzl",
     srcs = ["defs.bzl"],

tools/bazeldefs/go.bzl

@@ -57,9 +57,14 @@ def go_binary(name, static = False, pure = False, x_defs = None, system_malloc =
         kwargs["static"] = "on"
     if pure:
         kwargs["pure"] = "on"
+    gc_goopts = select({
+        "//conditions:default": kwargs.pop("gc_goopts", []),
+        "//tools:debug": kwargs.pop("gc_goopts", []) + ["-all=-N -l"],
+    })
     _go_binary(
         name = name,
         x_defs = x_defs,
+        gc_goopts = gc_goopts,
         **kwargs
     )
 
@@ -154,3 +159,7 @@ def select_goos():
         linux = "linux",
         darwin = "darwin",
     )
+
+# Defined by rules_go.
+gotsan_values = None
+gotsan_flag_values = {"@io_bazel_rules_go//go/config:race": "true"}

tools/defs.bzl

@@ -10,7 +10,7 @@ load("//tools/go_marshal:defs.bzl", "go_marshal", "marshal_deps", "marshal_test_
 load("//tools/nogo:defs.bzl", "nogo_test")
 load("//tools/bazeldefs:defs.bzl", _amd64_config = "amd64_config", _arch_config = "arch_config", _arm64_config = "arm64_config", _build_test = "build_test", _bzl_library = "bzl_library", _coreutil = "coreutil", _default_net_util = "default_net_util", _more_shards = "more_shards", _most_shards = "most_shards", _proto_library = "proto_library", _select_arch = "select_arch", _select_system = "select_system", _short_path = "short_path", _transition_allowlist = "transition_allowlist", _version = "version")
 load("//tools/bazeldefs:cc.bzl", _cc_binary = "cc_binary", _cc_flags_supplier = "cc_flags_supplier", _cc_grpc_library = "cc_grpc_library", _cc_library = "cc_library", _cc_proto_library = "cc_proto_library", _cc_test = "cc_test", _cc_toolchain = "cc_toolchain", _gbenchmark = "gbenchmark", _gbenchmark_internal = "gbenchmark_internal", _grpcpp = "grpcpp", _gtest = "gtest", _vdso_linker_option = "vdso_linker_option")
-load("//tools/bazeldefs:go.bzl", _gazelle = "gazelle", _go_binary = "go_binary", _go_embed_data = "go_embed_data", _go_grpc_and_proto_libraries = "go_grpc_and_proto_libraries", _go_library = "go_library", _go_path = "go_path", _go_proto_library = "go_proto_library", _go_rule = "go_rule", _go_test = "go_test", _select_goarch = "select_goarch", _select_goos = "select_goos")
+load("//tools/bazeldefs:go.bzl", _gazelle = "gazelle", _go_binary = "go_binary", _go_embed_data = "go_embed_data", _go_grpc_and_proto_libraries = "go_grpc_and_proto_libraries", _go_library = "go_library", _go_path = "go_path", _go_proto_library = "go_proto_library", _go_rule = "go_rule", _go_test = "go_test", _gotsan_flag_values = "gotsan_flag_values", _gotsan_values = "gotsan_values", _select_goarch = "select_goarch", _select_goos = "select_goos")
 load("//tools/bazeldefs:pkg.bzl", _pkg_deb = "pkg_deb", _pkg_tar = "pkg_tar")
 load("//tools/bazeldefs:platforms.bzl", _default_platform = "default_platform", _platforms = "platforms")
 load("//tools/bazeldefs:tags.bzl", "go_suffixes")
@@ -47,6 +47,8 @@ select_goos = _select_goos
 select_goarch = _select_goarch
 go_embed_data = _go_embed_data
 go_proto_library = _go_proto_library
+gotsan_values = _gotsan_values
+gotsan_flag_values = _gotsan_flag_values
 
 # Packaging rules.
 pkg_deb = _pkg_deb