netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Remove unused syscalls from filters

Browse Source 
mlock gone in Go 1.16 in https://golang.org/cl/246200.
The Go runtime (on amd64) switches from using arch_prctl(ARCH_SET_FS)
to CLONE_SETTLS to set the TLS.

PiperOrigin-RevId: 429648960
This commit is contained in:
Andrei Vagin
2022-02-18 14:31:58 -08:00
committed by gVisor bot
parent 155ac7c193
commit 1f03087a84
2 changed files with 0 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/boot/filter/config_amd64.go
-14
View File
@@ -40,19 +40,5 @@ func init() {
seccomp.EqualTo(0), // child_tidptr
seccomp.MatchAny{}, // tls
},
{
// TODO(b/168828518): No longer used in Go 1.16+ (on amd64).
seccomp.EqualTo(
unix.CLONE_VM |
unix.CLONE_FS |
unix.CLONE_FILES |
unix.CLONE_SIGHAND |
unix.CLONE_SYSVSEM |
unix.CLONE_THREAD),
seccomp.MatchAny{}, // newsp
seccomp.EqualTo(0), // parent_tidptr
seccomp.EqualTo(0), // child_tidptr
seccomp.MatchAny{}, // tls
},
}
}
runsc/fsgofer/filter/config_amd64.go
-20
View File
@@ -19,16 +19,10 @@ package filter
import (
"golang.org/x/sys/unix"
"gvisor.dev/gvisor/pkg/abi/linux"
"gvisor.dev/gvisor/pkg/seccomp"
)
func init() {
allowedSyscalls[unix.SYS_ARCH_PRCTL] = []seccomp.Rule{
// TODO(b/168828518): No longer used in Go 1.16+.
{seccomp.EqualTo(linux.ARCH_SET_FS)},
}
allowedSyscalls[unix.SYS_CLONE] = []seccomp.Rule{
// parent_tidptr and child_tidptr are always 0 because neither
// CLONE_PARENT_SETTID nor CLONE_CHILD_SETTID are used.
@@ -46,20 +40,6 @@ func init() {
seccomp.EqualTo(0), // child_tidptr
seccomp.MatchAny{}, // tls
},
{
// TODO(b/168828518): No longer used in Go 1.16+ (on amd64).
seccomp.EqualTo(
unix.CLONE_VM |
unix.CLONE_FS |
unix.CLONE_FILES |
unix.CLONE_SIGHAND |
unix.CLONE_SYSVSEM |
unix.CLONE_THREAD),
seccomp.MatchAny{}, // newsp
seccomp.EqualTo(0), // parent_tidptr
seccomp.EqualTo(0), // child_tidptr
seccomp.MatchAny{}, // tls
},
}
allowedSyscalls[unix.SYS_NEWFSTATAT] = []seccomp.Rule{}