diff --git a/runsc/boot/filter/BUILD b/runsc/boot/filter/BUILD index ed18f0047..d26a4de6d 100644 --- a/runsc/boot/filter/BUILD +++ b/runsc/boot/filter/BUILD @@ -12,6 +12,8 @@ go_library( "extra_filters.go", "extra_filters_msan.go", "extra_filters_race.go", + "extra_filters_race_amd64.go", + "extra_filters_race_arm64.go", "filter.go", ], visibility = [ diff --git a/runsc/boot/filter/extra_filters_race.go b/runsc/boot/filter/extra_filters_race.go index 046b39014..c8334a6c3 100644 --- a/runsc/boot/filter/extra_filters_race.go +++ b/runsc/boot/filter/extra_filters_race.go @@ -25,7 +25,7 @@ import ( // instrumentationFilters returns additional filters for syscalls used by TSAN. func instrumentationFilters() seccomp.SyscallRules { Report("TSAN is enabled: syscall filters less restrictive!") - return seccomp.SyscallRules{ + return archInstrumentationFilters(seccomp.SyscallRules{ unix.SYS_BRK: {}, unix.SYS_CLOCK_NANOSLEEP: {}, unix.SYS_CLONE: {}, @@ -33,10 +33,7 @@ func instrumentationFilters() seccomp.SyscallRules { unix.SYS_MMAP: {}, unix.SYS_MUNLOCK: {}, unix.SYS_NANOSLEEP: {}, - unix.SYS_OPEN: {}, unix.SYS_OPENAT: {}, unix.SYS_SET_ROBUST_LIST: {}, - // Used within glibc's malloc. - unix.SYS_TIME: {}, - } + }) } diff --git a/runsc/boot/filter/extra_filters_race_amd64.go b/runsc/boot/filter/extra_filters_race_amd64.go new file mode 100644 index 000000000..e7e8eb602 --- /dev/null +++ b/runsc/boot/filter/extra_filters_race_amd64.go @@ -0,0 +1,30 @@ +// Copyright 2022 The gVisor Authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +//go:build race +// +build race + +package filter + +import ( + "golang.org/x/sys/unix" + "gvisor.dev/gvisor/pkg/seccomp" +) + +func archInstrumentationFilters(f seccomp.SyscallRules) seccomp.SyscallRules { + f[unix.SYS_OPEN] = []seccomp.Rule{} + // Used within glibc's malloc. + f[unix.SYS_TIME] = []seccomp.Rule{} + return f +} diff --git a/runsc/boot/filter/extra_filters_race_arm64.go b/runsc/boot/filter/extra_filters_race_arm64.go new file mode 100644 index 000000000..47c5b398d --- /dev/null +++ b/runsc/boot/filter/extra_filters_race_arm64.go @@ -0,0 +1,26 @@ +// Copyright 2022 The gVisor Authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +//go:build race +// +build race + +package filter + +import ( + "gvisor.dev/gvisor/pkg/seccomp" +) + +func archInstrumentationFilters(f seccomp.SyscallRules) seccomp.SyscallRules { + return f +} diff --git a/runsc/fsgofer/filter/BUILD b/runsc/fsgofer/filter/BUILD index 82b48ef32..9707edd68 100644 --- a/runsc/fsgofer/filter/BUILD +++ b/runsc/fsgofer/filter/BUILD @@ -11,6 +11,8 @@ go_library( "extra_filters.go", "extra_filters_msan.go", "extra_filters_race.go", + "extra_filters_race_amd64.go", + "extra_filters_race_arm64.go", "filter.go", ], visibility = [ diff --git a/runsc/fsgofer/filter/extra_filters_race.go b/runsc/fsgofer/filter/extra_filters_race.go index 1a4862e1b..8304186ea 100644 --- a/runsc/fsgofer/filter/extra_filters_race.go +++ b/runsc/fsgofer/filter/extra_filters_race.go @@ -26,7 +26,7 @@ import ( // instrumentationFilters returns additional filters for syscalls used by TSAN. func instrumentationFilters() seccomp.SyscallRules { log.Warningf("*** SECCOMP WARNING: TSAN is enabled: syscall filters less restrictive!") - return seccomp.SyscallRules{ + return archInstrumentationFilters(seccomp.SyscallRules{ unix.SYS_BRK: {}, unix.SYS_CLOCK_NANOSLEEP: {}, unix.SYS_CLONE: {}, @@ -35,10 +35,7 @@ func instrumentationFilters() seccomp.SyscallRules { unix.SYS_MMAP: {}, unix.SYS_MUNLOCK: {}, unix.SYS_NANOSLEEP: {}, - unix.SYS_OPEN: {}, unix.SYS_OPENAT: {}, unix.SYS_SET_ROBUST_LIST: {}, - // Used within glibc's malloc. - unix.SYS_TIME: {}, - } + }) } diff --git a/runsc/fsgofer/filter/extra_filters_race_amd64.go b/runsc/fsgofer/filter/extra_filters_race_amd64.go new file mode 100644 index 000000000..e7e8eb602 --- /dev/null +++ b/runsc/fsgofer/filter/extra_filters_race_amd64.go @@ -0,0 +1,30 @@ +// Copyright 2022 The gVisor Authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +//go:build race +// +build race + +package filter + +import ( + "golang.org/x/sys/unix" + "gvisor.dev/gvisor/pkg/seccomp" +) + +func archInstrumentationFilters(f seccomp.SyscallRules) seccomp.SyscallRules { + f[unix.SYS_OPEN] = []seccomp.Rule{} + // Used within glibc's malloc. + f[unix.SYS_TIME] = []seccomp.Rule{} + return f +} diff --git a/runsc/fsgofer/filter/extra_filters_race_arm64.go b/runsc/fsgofer/filter/extra_filters_race_arm64.go new file mode 100644 index 000000000..47c5b398d --- /dev/null +++ b/runsc/fsgofer/filter/extra_filters_race_arm64.go @@ -0,0 +1,26 @@ +// Copyright 2022 The gVisor Authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +//go:build race +// +build race + +package filter + +import ( + "gvisor.dev/gvisor/pkg/seccomp" +) + +func archInstrumentationFilters(f seccomp.SyscallRules) seccomp.SyscallRules { + return f +}