netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity
9,879 Commits 1 Branch 0 Tags
master
Commit Graph
13 Commits
Author SHA1 Message Date
Andrei VaginandgVisor bot 32bbb18823 systrap: use seccomp notifications to communicate with syscall threads 
The new synchronous mode of seccomp-unotify (v6.6-rc1~205^2~6) reduces overhead
of context switches.

PiperOrigin-RevId: 622924980
 2024-04-08 12:47:44 -07:00
Etienne PerotandgVisor bot 326e1681e7 Improve seccomp ruleset debug logging readability. 
Before (sample ruleset):

```
Hot non-trivial syscalls:
  - sysno=1: {(arg0 == 0x4) => trace (0)}
  - sysno=39[vsyscall]: {(arg0 == 0x14) => errno (0)}
  - sysno=73: {(arg0 == 0x83) => trace (0)}
  - sysno=257: {(arg0 == 0x1cf) => kill thread, (arg0 == 0x71267) => kill process}
Cold non-trivial syscalls:
  - sysno=27[vsyscall]: {(arg0 == 0x4e) => errno (0)}
  - sysno=96[vsyscall]: {(true) => errno (0)}
  - sysno=202[vsyscall]: {(true) => errno (0)}
  - sysno=263: {((arg0 high=halfEq(0x0) && (arg0 low=halfEq(0x1d8) || arg0 low=halfEq(0x73598)))) => kill process, (arg0 == 0x1c295b98) => trap (0)}
  - sysno=265: {(arg0 == 0x1d7) => kill thread, (arg0 == 0x731af) => kill process}
Trivial syscalls:
  - sysno=0: {(true) => trace (0)}
  - sysno=3: {(true) => kill thread}
  - sysno=80: {(true) => kill thread}
  - sysno=81: {(true) => kill process}
```

After (same ruleset):

```
Hot non-trivial syscalls:
  - Syscall    1: (arg[0] == 0x4) => trace
  - Vsyscall  39: (arg[0] == 0x14) => return errno=0x0
  - Syscall   73: (arg[0] == 0x83) => trace
  - Syscall  257: {(arg[0] == 0x1cf) => kill thread; (arg[0] == 0x71267) => kill process}
Cold non-trivial syscalls:
  - Vsyscall  27: (arg[0] == 0x4e) => return errno=0x0
  - Vsyscall  96: return errno=0x0
  - Vsyscall 202: return errno=0x0
  - Syscall  263: {((arg[0].high == 0 && (arg[0].low == 0x1d8 || arg[0].low == 0x73598))) => kill process; (arg[0] == 0x1c295b98) => trap}
  - Syscall  265: {(arg[0] == 0x1d7) => kill thread; (arg[0] == 0x731af) => kill process}
Trivial syscalls:
  - Syscall    0: trace
  - Syscall    3: kill thread
  - Syscall   80: kill thread
  - Syscall   81: kill process
```

PiperOrigin-RevId: 587130340
 2023-12-01 15:02:32 -08:00
Etienne PerotandgVisor bot a81b188fdd seccomp: Add secfuzz library to fuzz seccomp-bpf programs. 
This contains a large auto-generated Go file.
Its goal is to convert BPF instruction coverage to Go line-based
coverage, so that coverage-based guidance works for the Go-based fuzzer.

This isn't used yet, but will be in a different change.

PiperOrigin-RevId: 576715826
 2023-10-25 19:38:53 -07:00
Adin ScannellandgVisor bot 4e03e87547 Fix simple mistakes identified by goreportcard. 
These are primarily simplification and lint mistakes. However, minor
fixes are also included and tests added where appropriate.

PiperOrigin-RevId: 351425971
 2021-01-12 12:38:22 -08:00
Rahat MahmoodandgVisor bot 4f462b0ed9 Convert uses of the binary package in kernel to go-marshal. 
PiperOrigin-RevId: 335077195
 2020-10-02 12:24:24 -07:00
Ian LewisandgVisor bot dcd532e2e4 Add support for OCI seccomp filters in the sandbox. 
OCI configuration includes support for specifying seccomp filters. In runc,
these filter configurations are converted into seccomp BPF programs and loaded
into the kernel via libseccomp. runsc needs to be a static binary so, for
runsc, we cannot rely on a C library and need to implement the functionality
in Go.

The generator added here implements basic support for taking OCI seccomp
configuration and converting it into a seccomp BPF program with the same
behavior as a program generated by libseccomp.

- New conditional operations were added to pkg/seccomp to support operations
  available in OCI.
- AllowAny and AllowValue were renamed to MatchAny and EqualTo to better reflect
  that syscalls matching the conditionals result in the provided action not
  simply SCMP_RET_ALLOW.
- BuildProgram in pkg/seccomp no longer panics if provided an empty list of
  rules. It now builds a program with the architecture sanity check only.
- ProgramBuilder now allows adding labels that are unused. However, backwards
  jumps are still not permitted.

Fixes #510

PiperOrigin-RevId: 331938697
 2020-09-15 23:19:17 -07:00
Andrei VaginandgVisor bot 0c586946ea Specify a memory file in platform.New(). 
PiperOrigin-RevId: 307941984
 2020-04-22 17:50:10 -07:00
Michael PrattandShentubot 4d52a55201 Change copyright notice to "The gVisor Authors" 
Based on the guidelines at
https://opensource.google.com/docs/releasing/authors/.

1. $ rg -l "Google LLC" | xargs sed -i 's/Google LLC.*/The gVisor Authors./'
2. Manual fixup of "Google Inc" references.
3. Add AUTHORS file. Authors may request to be added to this file.
4. Point netstack AUTHORS to gVisor AUTHORS. Drop CONTRIBUTORS.

Fixes #209

PiperOrigin-RevId: 245823212
Change-Id: I64530b24ad021a7d683137459cafc510f5ee1de9
 2019-04-29 14:26:23 -07:00
Fabricio VoznikaandShentubot 03226cd950 Add BPFAction type with Stringer 
PiperOrigin-RevId: 226018694
Change-Id: I98965e26fe565f37e98e5df5f997363ab273c91b
 2018-12-18 10:28:28 -08:00
Bin LuandShentubot c3dd68cea7 Add ARM64 support to pkg/abi/linux 
Signed-off-by: Bin Lu <bin.lu@arm.com>
Change-Id: I73cc4c406fadccb054e8e83c9464f6bef6280b0f
PiperOrigin-RevId: 224025309
 2018-12-04 12:24:07 -08:00
Fabricio VoznikaandShentubot eaac94d91c Use RET_KILL_PROCESS if available in kernel 
RET_KILL_THREAD doesn't work well for Go because it will
kill only the offending thread and leave the process hanging.
RET_TRAP can be masked out and it's not guaranteed to kill
the process. RET_KILL_PROCESS is available since 4.14.

For older kernel, continue to use RET_TRAP as this is the
best option (likely to kill process, easy to debug).

PiperOrigin-RevId: 222357867
Change-Id: Icc1d7d731274b16c2125b7a1ba4f7883fbdb2cbd
 2018-11-20 22:56:51 -08:00
Ian GudgerandShentubot 8fce67af24 Use correct company name in copyright header 
PiperOrigin-RevId: 217951017
Change-Id: Ie08bf6987f98467d07457bcf35b5f1ff6e43c035
 2018-10-19 16:35:11 -07:00
GooglerandAdin Scannell d02b74a5dc Check in gVisor. 
PiperOrigin-RevId: 194583126
Change-Id: Ica1d8821a90f74e7e745962d71801c598c652463
 2018-04-28 01:44:26 -04:00