netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1109 from xiaobo55x:fsgofer

Browse Source 
PiperOrigin-RevId: 278032567
This commit is contained in:
gVisor bot
2019-11-01 17:37:07 -07:00
parent 515fee5b6d 80d0db274e
commit 802a3b3bd0
8 changed files with 163 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/fsgofer/BUILD
+2
View File
@@ -6,6 +6,8 @@ go_library(
name = "fsgofer",
srcs = [
"fsgofer.go",
"fsgofer_amd64_unsafe.go",
"fsgofer_arm64_unsafe.go",
"fsgofer_unsafe.go",
],
importpath = "gvisor.dev/gvisor/runsc/fsgofer",
runsc/fsgofer/filter/BUILD
+2
View File
@@ -6,6 +6,8 @@ go_library(
name = "filter",
srcs = [
"config.go",
"config_amd64.go",
"config_arm64.go",
"extra_filters.go",
"extra_filters_msan.go",
"extra_filters_race.go",
runsc/fsgofer/filter/config.go
+1 -6
View File
@@ -25,11 +25,7 @@ import (
// allowedSyscalls is the set of syscalls executed by the gofer.
var allowedSyscalls = seccomp.SyscallRules{
syscall.SYS_ACCEPT: {},
syscall.SYS_ARCH_PRCTL: []seccomp.Rule{
{seccomp.AllowValue(linux.ARCH_GET_FS)},
{seccomp.AllowValue(linux.ARCH_SET_FS)},
},
syscall.SYS_ACCEPT: {},
syscall.SYS_CLOCK_GETTIME: {},
syscall.SYS_CLONE: []seccomp.Rule{
{
@@ -155,7 +151,6 @@ var allowedSyscalls = seccomp.SyscallRules{
syscall.SYS_MPROTECT: {},
syscall.SYS_MUNMAP: {},
syscall.SYS_NANOSLEEP: {},
syscall.SYS_NEWFSTATAT: {},
syscall.SYS_OPENAT: {},
syscall.SYS_PPOLL: {},
syscall.SYS_PREAD64: {},
runsc/fsgofer/filter/config_amd64.go
+33
View File
@@ -0,0 +1,33 @@
// Copyright 2019 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// +build amd64
package filter
import (
"syscall"
"gvisor.dev/gvisor/pkg/abi/linux"
"gvisor.dev/gvisor/pkg/seccomp"
)
func init() {
allowedSyscalls[syscall.SYS_ARCH_PRCTL] = []seccomp.Rule{
{seccomp.AllowValue(linux.ARCH_GET_FS)},
{seccomp.AllowValue(linux.ARCH_SET_FS)},
}
allowedSyscalls[syscall.SYS_NEWFSTATAT] = []seccomp.Rule{}
}
runsc/fsgofer/filter/config_arm64.go
+27
View File
@@ -0,0 +1,27 @@
// Copyright 2019 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// +build arm64
package filter
import (
"syscall"
"gvisor.dev/gvisor/pkg/seccomp"
)
func init() {
allowedSyscalls[syscall.SYS_FSTATAT] = []seccomp.Rule{}
}
runsc/fsgofer/fsgofer_amd64_unsafe.go
+49
View File
@@ -0,0 +1,49 @@
// Copyright 2019 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// +build amd64
package fsgofer
import (
"syscall"
"unsafe"
"gvisor.dev/gvisor/pkg/abi/linux"
"gvisor.dev/gvisor/pkg/syserr"
)
func statAt(dirFd int, name string) (syscall.Stat_t, error) {
nameBytes, err := syscall.BytePtrFromString(name)
if err != nil {
return syscall.Stat_t{}, err
}
namePtr := unsafe.Pointer(nameBytes)
var stat syscall.Stat_t
statPtr := unsafe.Pointer(&stat)
if _, _, errno := syscall.Syscall6(
syscall.SYS_NEWFSTATAT,
uintptr(dirFd),
uintptr(namePtr),
uintptr(statPtr),
linux.AT_SYMLINK_NOFOLLOW,
0,
0); errno != 0 {
return syscall.Stat_t{}, syserr.FromHost(errno).ToError()
}
return stat, nil
}
runsc/fsgofer/fsgofer_arm64_unsafe.go
+49
View File
@@ -0,0 +1,49 @@
// Copyright 2019 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// +build arm64
package fsgofer
import (
"syscall"
"unsafe"
"gvisor.dev/gvisor/pkg/abi/linux"
"gvisor.dev/gvisor/pkg/syserr"
)
func statAt(dirFd int, name string) (syscall.Stat_t, error) {
nameBytes, err := syscall.BytePtrFromString(name)
if err != nil {
return syscall.Stat_t{}, err
}
namePtr := unsafe.Pointer(nameBytes)
var stat syscall.Stat_t
statPtr := unsafe.Pointer(&stat)
if _, _, errno := syscall.Syscall6(
syscall.SYS_FSTATAT,
uintptr(dirFd),
uintptr(namePtr),
uintptr(statPtr),
linux.AT_SYMLINK_NOFOLLOW,
0,
0); errno != 0 {
return syscall.Stat_t{}, syserr.FromHost(errno).ToError()
}
return stat, nil
}
runsc/fsgofer/fsgofer_unsafe.go
-25
View File
@@ -18,34 +18,9 @@ import (
"syscall"
"unsafe"
"gvisor.dev/gvisor/pkg/abi/linux"
"gvisor.dev/gvisor/pkg/syserr"
)
func statAt(dirFd int, name string) (syscall.Stat_t, error) {
nameBytes, err := syscall.BytePtrFromString(name)
if err != nil {
return syscall.Stat_t{}, err
}
namePtr := unsafe.Pointer(nameBytes)
var stat syscall.Stat_t
statPtr := unsafe.Pointer(&stat)
if _, _, errno := syscall.Syscall6(
syscall.SYS_NEWFSTATAT,
uintptr(dirFd),
uintptr(namePtr),
uintptr(statPtr),
linux.AT_SYMLINK_NOFOLLOW,
0,
0); errno != 0 {
return syscall.Stat_t{}, syserr.FromHost(errno).ToError()
}
return stat, nil
}
func utimensat(dirFd int, name string, times [2]syscall.Timespec, flags int) error {
// utimensat(2) doesn't accept empty name, instead name must be nil to make it
// operate directly on 'dirFd' unlike other *at syscalls.