Avoid importing platforms from many source files

PiperOrigin-RevId: 256494243

pkg/sentry/platform/BUILD

@@ -28,6 +28,7 @@ go_library(
         "//pkg/abi/linux",
         "//pkg/atomicbitops",
         "//pkg/log",
+        "//pkg/seccomp",
         "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/platform/safecopy",

pkg/sentry/platform/kvm/BUILD

@@ -14,6 +14,7 @@ go_library(
         "bluepill_fault.go",
         "bluepill_unsafe.go",
         "context.go",
+        "filters.go",
         "kvm.go",
         "kvm_amd64.go",
         "kvm_amd64_unsafe.go",
@@ -33,6 +34,7 @@ go_library(
         "//pkg/cpuid",
         "//pkg/log",
         "//pkg/procid",
+        "//pkg/seccomp",
         "//pkg/sentry/arch",
         "//pkg/sentry/platform",
         "//pkg/sentry/platform/interrupt",

pkg/sentry/platform/kvm/filters.go

@@ -0,0 +1,33 @@
+// Copyright 2019 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package kvm
+
+import (
+	"syscall"
+
+	"gvisor.dev/gvisor/pkg/seccomp"
+)
+
+// SyscallFilters returns syscalls made exclusively by the KVM platform.
+func (*KVM) SyscallFilters() seccomp.SyscallRules {
+	return seccomp.SyscallRules{
+		syscall.SYS_ARCH_PRCTL:      {},
+		syscall.SYS_IOCTL:           {},
+		syscall.SYS_MMAP:            {},
+		syscall.SYS_RT_SIGSUSPEND:   {},
+		syscall.SYS_RT_SIGTIMEDWAIT: {},
+		0xffffffffffffffff:          {}, // KVM uses syscall -1 to transition to host.
+	}
+}

pkg/sentry/platform/kvm/kvm.go

@@ -141,3 +141,17 @@ func (k *KVM) NewContext() platform.Context {
 		machine: k.machine,
 	}
 }
+
+type constructor struct{}
+
+func (*constructor) New(f *os.File) (platform.Platform, error) {
+	return New(f)
+}
+
+func (*constructor) OpenDevice() (*os.File, error) {
+	return OpenDevice()
+}
+
+func init() {
+	platform.Register("kvm", &constructor{})
+}

pkg/sentry/platform/platform.go

@@ -19,8 +19,10 @@ package platform
 
 import (
 	"fmt"
+	"os"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/seccomp"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/safemem"
 	"gvisor.dev/gvisor/pkg/sentry/usermem"
@@ -93,6 +95,9 @@ type Platform interface {
 	// Platforms for which this does not hold may panic if PreemptAllCPUs is
 	// called.
 	PreemptAllCPUs() error
+
+	// SyscallFilters returns syscalls made exclusively by this platform.
+	SyscallFilters() seccomp.SyscallRules
 }
 
 // NoCPUPreemptionDetection implements Platform.DetectsCPUPreemption and
@@ -347,3 +352,26 @@ type File interface {
 func (fr FileRange) String() string {
 	return fmt.Sprintf("[%#x, %#x)", fr.Start, fr.End)
 }
+
+// Constructor represents a platform type.
+type Constructor interface {
+	New(deviceFile *os.File) (Platform, error)
+	OpenDevice() (*os.File, error)
+}
+
+// platforms contains all available platform types.
+var platforms = map[string]Constructor{}
+
+// Register registers a new platform type.
+func Register(name string, platform Constructor) {
+	platforms[name] = platform
+}
+
+// Lookup looks up the platform constructor by name.
+func Lookup(name string) (Constructor, error) {
+	p, ok := platforms[name]
+	if !ok {
+		return nil, fmt.Errorf("unknown platform: %v", name)
+	}
+	return p, nil
+}

pkg/sentry/platform/ptrace/BUILD

@@ -5,6 +5,7 @@ package(licenses = ["notice"])
 go_library(
     name = "ptrace",
     srcs = [
+        "filters.go",
         "ptrace.go",
         "ptrace_unsafe.go",
         "stub_amd64.s",

pkg/sentry/platform/ptrace/filters.go

@@ -0,0 +1,33 @@
+// Copyright 2019 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ptrace
+
+import (
+	"syscall"
+
+	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/seccomp"
+)
+
+// SyscallFilters returns syscalls made exclusively by the ptrace platform.
+func (*PTrace) SyscallFilters() seccomp.SyscallRules {
+	return seccomp.SyscallRules{
+		unix.SYS_GETCPU:            {},
+		unix.SYS_SCHED_SETAFFINITY: {},
+		syscall.SYS_PTRACE:         {},
+		syscall.SYS_TGKILL:         {},
+		syscall.SYS_WAIT4:          {},
+	}
+}

pkg/sentry/platform/ptrace/ptrace.go

@@ -45,6 +45,7 @@
 package ptrace
 
 import (
+	"os"
 	"sync"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
@@ -236,3 +237,17 @@ func (p *PTrace) NewAddressSpace(_ interface{}) (platform.AddressSpace, <-chan s
 func (*PTrace) NewContext() platform.Context {
 	return &context{}
 }
+
+type constructor struct{}
+
+func (*constructor) New(*os.File) (platform.Platform, error) {
+	return New()
+}
+
+func (*constructor) OpenDevice() (*os.File, error) {
+	return nil, nil
+}
+
+func init() {
+	platform.Register("ptrace", &constructor{})
+}

runsc/BUILD

@@ -16,6 +16,7 @@ go_binary(
     x_defs = {"main.version": "{VERSION}"},
     deps = [
         "//pkg/log",
+        "//pkg/sentry/platform",
         "//runsc/boot",
         "//runsc/cmd",
         "//runsc/specutils",
@@ -47,6 +48,7 @@ go_binary(
     x_defs = {"main.version": "{VERSION}"},
     deps = [
         "//pkg/log",
+        "//pkg/sentry/platform",
         "//runsc/boot",
         "//runsc/cmd",
         "//runsc/specutils",

runsc/boot/BUILD

@@ -56,8 +56,6 @@ go_library(
         "//pkg/sentry/loader",
         "//pkg/sentry/pgalloc",
         "//pkg/sentry/platform",
-        "//pkg/sentry/platform/kvm",
-        "//pkg/sentry/platform/ptrace",
         "//pkg/sentry/sighandling",
         "//pkg/sentry/socket/epsocket",
         "//pkg/sentry/socket/hostinet",
@@ -86,6 +84,7 @@ go_library(
         "//pkg/tcpip/transport/udp",
         "//pkg/urpc",
         "//runsc/boot/filter",
+        "//runsc/boot/platforms",
         "//runsc/specutils",
         "@com_github_golang_protobuf//proto:go_default_library",
         "@com_github_opencontainers_runtime-spec//specs-go:go_default_library",

runsc/boot/config.go

@@ -22,40 +22,6 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/watchdog"
 )
 
-// PlatformType tells which platform to use.
-type PlatformType int
-
-const (
-	// PlatformPtrace runs the sandbox with the ptrace platform.
-	PlatformPtrace PlatformType = iota
-
-	// PlatformKVM runs the sandbox with the KVM platform.
-	PlatformKVM
-)
-
-// MakePlatformType converts type from string.
-func MakePlatformType(s string) (PlatformType, error) {
-	switch s {
-	case "ptrace":
-		return PlatformPtrace, nil
-	case "kvm":
-		return PlatformKVM, nil
-	default:
-		return 0, fmt.Errorf("invalid platform type %q", s)
-	}
-}
-
-func (p PlatformType) String() string {
-	switch p {
-	case PlatformPtrace:
-		return "ptrace"
-	case PlatformKVM:
-		return "kvm"
-	default:
-		return fmt.Sprintf("unknown(%d)", p)
-	}
-}
-
 // FileAccessType tells how the filesystem is accessed.
 type FileAccessType int
 
@@ -187,7 +153,7 @@ type Config struct {
 	LogPackets bool
 
 	// Platform is the platform to run on.
-	Platform PlatformType
+	Platform string
 
 	// Strace indicates that strace should be enabled.
 	Strace bool
@@ -247,7 +213,7 @@ func (c *Config) ToFlags() []string {
 		"--overlay=" + strconv.FormatBool(c.Overlay),
 		"--network=" + c.Network.String(),
 		"--log-packets=" + strconv.FormatBool(c.LogPackets),
-		"--platform=" + c.Platform.String(),
+		"--platform=" + c.Platform,
 		"--strace=" + strconv.FormatBool(c.Strace),
 		"--strace-syscalls=" + strings.Join(c.StraceSyscalls, ","),
 		"--strace-log-size=" + strconv.Itoa(int(c.StraceLogSize)),

runsc/boot/filter/BUILD

@@ -20,8 +20,6 @@ go_library(
         "//pkg/log",
         "//pkg/seccomp",
         "//pkg/sentry/platform",
-        "//pkg/sentry/platform/kvm",
-        "//pkg/sentry/platform/ptrace",
         "//pkg/tcpip/link/fdbased",
         "@org_golang_x_sys//unix:go_default_library",
     ],

runsc/boot/filter/config.go

@@ -437,29 +437,6 @@ func hostInetFilters() seccomp.SyscallRules {
 	}
 }
 
-// ptraceFilters returns syscalls made exclusively by the ptrace platform.
-func ptraceFilters() seccomp.SyscallRules {
-	return seccomp.SyscallRules{
-		unix.SYS_GETCPU:            {},
-		unix.SYS_SCHED_SETAFFINITY: {},
-		syscall.SYS_PTRACE:         {},
-		syscall.SYS_TGKILL:         {},
-		syscall.SYS_WAIT4:          {},
-	}
-}
-
-// kvmFilters returns syscalls made exclusively by the KVM platform.
-func kvmFilters() seccomp.SyscallRules {
-	return seccomp.SyscallRules{
-		syscall.SYS_ARCH_PRCTL:      {},
-		syscall.SYS_IOCTL:           {},
-		syscall.SYS_MMAP:            {},
-		syscall.SYS_RT_SIGSUSPEND:   {},
-		syscall.SYS_RT_SIGTIMEDWAIT: {},
-		0xffffffffffffffff:          {}, // KVM uses syscall -1 to transition to host.
-	}
-}
-
 func controlServerFilters(fd int) seccomp.SyscallRules {
 	return seccomp.SyscallRules{
 		syscall.SYS_ACCEPT: []seccomp.Rule{

runsc/boot/filter/filter.go

@@ -18,13 +18,9 @@
 package filter
 
 import (
-	"fmt"
-
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/seccomp"
 	"gvisor.dev/gvisor/pkg/sentry/platform"
-	"gvisor.dev/gvisor/pkg/sentry/platform/kvm"
-	"gvisor.dev/gvisor/pkg/sentry/platform/ptrace"
 )
 
 // Options are seccomp filter related options.
@@ -53,14 +49,7 @@ func Install(opt Options) error {
 		s.Merge(profileFilters())
 	}
 
-	switch p := opt.Platform.(type) {
-	case *ptrace.PTrace:
-		s.Merge(ptraceFilters())
-	case *kvm.KVM:
-		s.Merge(kvmFilters())
-	default:
-		return fmt.Errorf("unknown platform type %T", p)
-	}
+	s.Merge(opt.Platform.SyscallFilters())
 
 	return seccomp.Install(s)
 }

runsc/boot/loader.go

@@ -42,8 +42,6 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/loader"
 	"gvisor.dev/gvisor/pkg/sentry/pgalloc"
 	"gvisor.dev/gvisor/pkg/sentry/platform"
-	"gvisor.dev/gvisor/pkg/sentry/platform/kvm"
-	"gvisor.dev/gvisor/pkg/sentry/platform/ptrace"
 	"gvisor.dev/gvisor/pkg/sentry/sighandling"
 	slinux "gvisor.dev/gvisor/pkg/sentry/syscalls/linux"
 	"gvisor.dev/gvisor/pkg/sentry/time"
@@ -59,6 +57,7 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
 	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
 	"gvisor.dev/gvisor/runsc/boot/filter"
+	_ "gvisor.dev/gvisor/runsc/boot/platforms" // register all platforms.
 	"gvisor.dev/gvisor/runsc/specutils"
 
 	// Include supported socket providers.
@@ -416,19 +415,12 @@ func (l *Loader) Destroy() {
 }
 
 func createPlatform(conf *Config, deviceFile *os.File) (platform.Platform, error) {
-	switch conf.Platform {
-	case PlatformPtrace:
-		log.Infof("Platform: ptrace")
-		return ptrace.New()
-	case PlatformKVM:
-		log.Infof("Platform: kvm")
-		if deviceFile == nil {
-			return nil, fmt.Errorf("kvm device file must be provided")
-		}
-		return kvm.New(deviceFile)
-	default:
-		return nil, fmt.Errorf("invalid platform %v", conf.Platform)
+	p, err := platform.Lookup(conf.Platform)
+	if err != nil {
+		panic(fmt.Sprintf("invalid platform %v: %v", conf.Platform, err))
 	}
+	log.Infof("Platform: %s", conf.Platform)
+	return p.New(deviceFile)
 }
 
 func createMemoryFile() (*pgalloc.MemoryFile, error) {

runsc/boot/loader_test.go

@@ -47,6 +47,7 @@ func testConfig() *Config {
 		RootDir:        "unused_root_dir",
 		Network:        NetworkNone,
 		DisableSeccomp: true,
+		Platform:       "ptrace",
 	}
 }
 

runsc/boot/platforms/BUILD

@@ -0,0 +1,16 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+package(licenses = ["notice"])
+
+go_library(
+    name = "platforms",
+    srcs = ["platforms.go"],
+    importpath = "gvisor.dev/gvisor/runsc/boot/platforms",
+    visibility = [
+        "//runsc:__subpackages__",
+    ],
+    deps = [
+        "//pkg/sentry/platform/kvm",
+        "//pkg/sentry/platform/ptrace",
+    ],
+)

runsc/boot/platforms/platforms.go

@@ -0,0 +1,30 @@
+// Copyright 2019 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package platforms imports all available platform packages.
+package platforms
+
+import (
+	// Import platforms that runsc might use.
+	_ "gvisor.dev/gvisor/pkg/sentry/platform/kvm"
+	_ "gvisor.dev/gvisor/pkg/sentry/platform/ptrace"
+)
+
+const (
+	// Ptrace runs the sandbox with the ptrace platform.
+	Ptrace = "ptrace"
+
+	// KVM runs the sandbox with the KVM platform.
+	KVM = "kvm"
+)

runsc/cmd/BUILD

@@ -46,6 +46,7 @@ go_library(
         "//pkg/unet",
         "//pkg/urpc",
         "//runsc/boot",
+        "//runsc/boot/platforms",
         "//runsc/console",
         "//runsc/container",
         "//runsc/fsgofer",

runsc/cmd/boot.go

@@ -26,6 +26,7 @@ import (
 	specs "github.com/opencontainers/runtime-spec/specs-go"
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/runsc/boot"
+	"gvisor.dev/gvisor/runsc/boot/platforms"
 	"gvisor.dev/gvisor/runsc/specutils"
 )
 
@@ -172,7 +173,7 @@ func (b *Boot) Execute(_ context.Context, f *flag.FlagSet, args ...interface{})
 		if caps == nil {
 			caps = &specs.LinuxCapabilities{}
 		}
-		if conf.Platform == boot.PlatformPtrace {
+		if conf.Platform == platforms.Ptrace {
 			// Ptrace platform requires extra capabilities.
 			const c = "CAP_SYS_PTRACE"
 			caps.Bounding = append(caps.Bounding, c)