netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Refactor code to use seccheck.SendToCheckers

Browse Source 
Updates #4805

PiperOrigin-RevId: 445017536
This commit is contained in:
Fabricio Voznika
2022-04-27 18:04:14 -07:00
committed by gVisor bot
parent 21e95c8a1c
commit 548d127739
9 changed files with 27 additions and 110 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/sentry/kernel/task_clone.go
+3 -1
View File
@@ -248,7 +248,9 @@ func (t *Task) Clone(args *linux.CloneArgs) (ThreadID, *SyscallControl, error) {
if seccheck.Global.Enabled(seccheck.PointClone) {
mask, info := getCloneSeccheckInfo(t, nt)
if err := seccheck.Global.Clone(t, mask, info); err != nil {
if err := seccheck.Global.SendToCheckers(func(c seccheck.Checker) error {
return c.Clone(t, mask, info)
}); err != nil {
// nt has been visible to the rest of the system since NewTask, so
// it may be blocking execve or a group stop, have been notified
// for group signal delivery, had children reparented to it, etc.
pkg/sentry/kernel/task_exec.go
+3 -1
View File
@@ -97,7 +97,9 @@ func (t *Task) Execve(newImage *TaskImage, argv, env []string, executable fsbrid
// We can't clearly hold kernel package locks while stat'ing executable.
if seccheck.Global.Enabled(seccheck.PointExecve) {
mask, info := getExecveSeccheckInfo(t, argv, env, executable, pathname)
if err := seccheck.Global.Execve(t, mask, info); err != nil {
if err := seccheck.Global.SendToCheckers(func(c seccheck.Checker) error {
return c.Execve(t, mask, info)
}); err != nil {
newImage.release()
return nil, err
}
pkg/sentry/kernel/task_exit.go
+6 -1
View File
@@ -31,6 +31,7 @@ import (
"gvisor.dev/gvisor/pkg/abi/linux"
"gvisor.dev/gvisor/pkg/errors/linuxerr"
"gvisor.dev/gvisor/pkg/log"
"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
"gvisor.dev/gvisor/pkg/sentry/seccheck"
pb "gvisor.dev/gvisor/pkg/sentry/seccheck/points/points_go_proto"
@@ -647,7 +648,11 @@ func (t *Task) exitNotifyLocked(fromPtraceDetach bool) {
}
if seccheck.Global.Enabled(seccheck.PointExitNotifyParent) {
mask, info := getExitNotifyParentSeccheckInfo(t)
seccheck.Global.ExitNotifyParent(t, mask, info)
if err := seccheck.Global.SendToCheckers(func(c seccheck.Checker) error {
return c.ExitNotifyParent(t, mask, info)
}); err != nil {
log.Infof("Ignoring error from ExitNotifyParent point: %v", err)
}
}
}
}
pkg/sentry/seccheck/BUILD
-3
View File
@@ -17,10 +17,7 @@ go_template_instance(
go_library(
name = "seccheck",
srcs = [
"clone.go",
"config.go",
"execve.go",
"exit.go",
"metadata.go",
"seccheck.go",
"seqatomic_checkerslice_unsafe.go",
pkg/sentry/seccheck/clone.go
-30
View File
@@ -1,30 +0,0 @@
// Copyright 2021 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package seccheck
import (
"gvisor.dev/gvisor/pkg/context"
pb "gvisor.dev/gvisor/pkg/sentry/seccheck/points/points_go_proto"
)
// Clone is called at the Clone checkpoint.
func (s *State) Clone(ctx context.Context, fields FieldSet, info *pb.CloneInfo) error {
for _, c := range s.getCheckers() {
if err := c.Clone(ctx, fields, info); err != nil {
return err
}
}
return nil
}
pkg/sentry/seccheck/execve.go
-36
View File
@@ -1,36 +0,0 @@
// Copyright 2021 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package seccheck
import (
"gvisor.dev/gvisor/pkg/context"
pb "gvisor.dev/gvisor/pkg/sentry/seccheck/points/points_go_proto"
)
const (
// ExecveFieldBinaryInfo is an optional field to collect information about the
// binary being executed.
ExecveFieldBinaryInfo Field = iota
)
// Execve is called at the Execve checkpoint.
func (s *State) Execve(ctx context.Context, mask FieldSet, info *pb.ExecveInfo) error {
for _, c := range s.getCheckers() {
if err := c.Execve(ctx, mask, info); err != nil {
return err
}
}
return nil
}
pkg/sentry/seccheck/exit.go
-35
View File
@@ -1,35 +0,0 @@
// Copyright 2021 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package seccheck
import (
"gvisor.dev/gvisor/pkg/context"
pb "gvisor.dev/gvisor/pkg/sentry/seccheck/points/points_go_proto"
)
// ExitNotifyParent is called at the ExitNotifyParent checkpoint.
//
// The ExitNotifyParent checkpoint occurs when a zombied thread group leader,
// not waiting for exit acknowledgement from a non-parent ptracer, becomes the
// last non-dead thread in its thread group and notifies its parent of its
// exiting.
func (s *State) ExitNotifyParent(ctx context.Context, fields FieldSet, info *pb.ExitNotifyParentInfo) error {
for _, c := range s.getCheckers() {
if err := c.ExitNotifyParent(ctx, fields, info); err != nil {
return err
}
}
return nil
}
pkg/sentry/seccheck/metadata.go
+6
View File
@@ -27,6 +27,12 @@ const (
ContainerStartFieldEnv Field = iota
)
const (
// ExecveFieldBinaryInfo is an optional field to collect information about the
// binary being executed.
ExecveFieldBinaryInfo Field = iota
)
var points = map[string]PointDesc{}
var sinks = map[string]SinkDesc{}
pkg/sentry/seccheck/seccheck_test.go
+9 -3
View File
@@ -75,7 +75,9 @@ func TestCheckerRegistered(t *testing.T) {
if !fields.Context.Contains(FieldCtxtCredentials) {
t.Errorf("fields.Context.Contains(PointContextCredentials): got false, wanted true")
}
if err := s.Clone(context.Background(), fields, &pb.CloneInfo{}); err != nil {
if err := s.SendToCheckers(func(c Checker) error {
return c.Clone(context.Background(), fields, &pb.CloneInfo{})
}); err != nil {
t.Errorf("Clone(): got %v, wanted nil", err)
}
if !checkerCalled {
@@ -112,7 +114,9 @@ func TestMultipleCheckersRegistered(t *testing.T) {
// CloneReq() should return the union of requested fields from all calls to
// AppendChecker.
fields := s.GetFieldSet(PointClone)
if err := s.Clone(context.Background(), fields, &pb.CloneInfo{}); err != nil {
if err := s.SendToCheckers(func(c Checker) error {
return c.Clone(context.Background(), fields, &pb.CloneInfo{})
}); err != nil {
t.Errorf("Clone(): got %v, wanted nil", err)
}
for i := range checkersCalled {
@@ -151,7 +155,9 @@ func TestCheckpointReturnsFirstCheckerError(t *testing.T) {
if !s.Enabled(PointClone) {
t.Errorf("Enabled(PointClone): got false, wanted true")
}
if err := s.Clone(context.Background(), FieldSet{}, &pb.CloneInfo{}); err != errFirstChecker {
if err := s.SendToCheckers(func(c Checker) error {
return c.Clone(context.Background(), FieldSet{}, &pb.CloneInfo{})
}); err != errFirstChecker {
t.Errorf("Clone(): got %v, wanted %v", err, errFirstChecker)
}
if !checkersCalled[0] {