diff --git a/runsc/boot/filter/BUILD b/runsc/boot/filter/BUILD index 2a68edb02..0f9aedc3f 100644 --- a/runsc/boot/filter/BUILD +++ b/runsc/boot/filter/BUILD @@ -13,6 +13,7 @@ go_library( "config_arm64.go", "config_profile.go", "extra_filters.go", + "extra_filters_asan.go", "extra_filters_hostinet.go", "extra_filters_msan.go", "extra_filters_race.go", diff --git a/runsc/boot/filter/extra_filters.go b/runsc/boot/filter/extra_filters.go index 5442add95..1d06f9669 100644 --- a/runsc/boot/filter/extra_filters.go +++ b/runsc/boot/filter/extra_filters.go @@ -12,8 +12,7 @@ // See the License for the specific language governing permissions and // limitations under the License. -//go:build !msan && !race -// +build !msan,!race +//go:build !asan && !msan && !race package filter diff --git a/runsc/boot/filter/extra_filters_asan.go b/runsc/boot/filter/extra_filters_asan.go new file mode 100644 index 000000000..416b39a0f --- /dev/null +++ b/runsc/boot/filter/extra_filters_asan.go @@ -0,0 +1,34 @@ +// Copyright 2023 The gVisor Authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +//go:build asan +// +build asan + +package filter + +import ( + "golang.org/x/sys/unix" + "gvisor.dev/gvisor/pkg/seccomp" +) + +// instrumentationFilters returns additional filters for syscalls used by ASAN. +func instrumentationFilters() seccomp.SyscallRules { + Report("ASAN is enabled: syscall filters less restrictive!") + return seccomp.SyscallRules{ + unix.SYS_CLONE: {}, + unix.SYS_MMAP: {}, + unix.SYS_SCHED_GETAFFINITY: {}, + unix.SYS_SET_ROBUST_LIST: {}, + } +}