60 Commits
Author SHA1 Message Date
Andrei VaginandgVisor bot 9fcf0b5b53 proc: invalidate task inodes when tasks are destroyed
PiperOrigin-RevId: 705785809
2024-12-13 00:58:08 -08:00
Jing ChenandgVisor bot cf5c4c9cbf Replace reflect.DeepEqual with [slices/maps].Equal.
They are faster on slice/map comparisons.

PiperOrigin-RevId: 633080355
2024-05-12 21:20:18 -07:00
Jing ChenandgVisor bot be48200c0e Re-order loads in BUILD files to make transformations reversible in Copybara.
PiperOrigin-RevId: 598898756
2024-01-16 11:21:40 -08:00
Etienne PerotandgVisor bot 69e0c7643d Use clear on map types wherever possible.
This is similar as pull request #9749 but for maps rather than slices.

PiperOrigin-RevId: 586504320
2023-11-29 18:00:07 -08:00
Andrei Vagin 5f4abad306 Fix a few typos
It is an idea of running codespell as part of our presubmit checks.
Before enabling it for new changes, let's fix what it has found.

Signed-off-by: Andrei Vagin <avagin@gmail.com>
2023-10-25 12:13:42 -07:00
Nayana BidariandgVisor bot 0fd906d7e0 Fix the sandbox memory usage via GetContainerMemoryUsage API.
The total(sandbox) memory usage using the GetContainerMemoryUsage API will
return incorrect usage when called before calling the API for each individual
containers in the sandbox. This is because the memory usage for the containers
cgroup is not updated while calculating the total usage. This CL fixes it by
updating the usage for every child cgroup, which will return the correct memory
usage for the parent cgroup.

PiperOrigin-RevId: 574300913
2023-10-17 16:44:07 -07:00
Jamie LiuandgVisor bot 1910a4577f cgroupfs: do not return errors from strconv.ParseInt() to write()
Arbitrary errors are not convertible to errnos for syscall return and cause the
sentry to panic.

PiperOrigin-RevId: 564782206
2023-09-12 11:29:05 -07:00
Jing ChenandgVisor bot c215e67a50 Let devices cgroup add/remove rules via devices.allow and devices.deny.
PiperOrigin-RevId: 563261158
2023-09-06 17:27:02 -07:00
Jing ChenandgVisor bot 51f60d6d14 Add device cgroup's devices.list, which defaults to allow all.
PiperOrigin-RevId: 558534572
2023-08-20 02:20:04 -07:00
Nayana BidariandgVisor bot b056ed871f Add GetMemoryUsage() API to the gVisor sandbox.
Adds GetMemoryUsage() API to get the memory usage of the containers.

PiperOrigin-RevId: 557923509
2023-08-17 13:43:56 -07:00
Jing ChenandgVisor bot 2ce5c336d3 Add missing device cgroups.
PiperOrigin-RevId: 556053561
2023-08-11 12:48:03 -07:00
Nayana BidariandgVisor bot a6c3a61c29 Make changes for CgroupsReadControlFile method to get memory usage per cgroup.
- Adds methods to Enter, Leave and Migrate the tasks for memory controller.
- Update the memory cgroup id when the task enters and leaves the cgroups.

PiperOrigin-RevId: 555568875
2023-08-10 11:09:28 -07:00
Jing ChenandgVisor bot ab7259268b Add devices cgroups which is partially implemented. It could export the device cgroups to devices.deny and devices.allow, add/remove device cgroups rules will need to be implemented to fully support device cgroups.
PiperOrigin-RevId: 552673967
2023-07-31 21:22:07 -07:00
Andrei VaginandgVisor bot 9f3b219e70 cgroups: allow statfs on cgroup files
PiperOrigin-RevId: 544179511
2023-06-28 15:39:34 -07:00
Shambhavi SrivastavaandgVisor bot 3591d91386 Fixing locking in ReadControl and WriteControl methods
PiperOrigin-RevId: 542928364
2023-06-23 12:30:18 -07:00
Nayana BidariandgVisor bot a589eb8a7c Add a unique id per cgroup.
PiperOrigin-RevId: 540031470
2023-06-13 12:02:27 -07:00
Nicolas LacasseandgVisor bot 8c975e6e6e Mark some kernfs inode as Anonymous.
These inodes can never be part of a filesystem tree. They are nameless and
never have a parent.

This allows us to avoid taking a lock in kernfs.InotifyWithParent for such
anonymous inodes.

PiperOrigin-RevId: 538823227
2023-06-08 10:25:04 -07:00
Adin ScannellandgVisor bot 1ceb814544 Add default_applicable_licenses rules to packages.
PiperOrigin-RevId: 513581243
2023-03-02 10:50:04 -08:00
Lucas ManningandgVisor bot 3c93bb1040 Defer kernfs openflag handling to inode implementations.
Some implementations handle more flags than others, so it doesn't
make sense to have one set of rules for all.

This change should functionally be a no-op.

PiperOrigin-RevId: 502712415
2023-01-17 16:01:40 -08:00
Ayush RanjanandgVisor bot 175db901ca Replace pkg/refs with pkg/refsvfs2.
All VFS1 only bits have been deleted.

Updates #1624

PiperOrigin-RevId: 492273183
2022-12-01 12:46:11 -08:00
Rahat MahmoodandgVisor bot 62ddad6119 cgroupfs: Fix several races with task migration.
Reported-by: syzbot+0be09ce607731f085f73@syzkaller.appspotmail.com
PiperOrigin-RevId: 491920581
2022-11-30 08:14:01 -08:00
Rahat MahmoodandgVisor bot fc0e4d0a03 Implement sentry control commands for cgroupfs.
Add sentry control commands to read and write cgroup control
values.

PiperOrigin-RevId: 474663678
2022-09-15 14:55:45 -07:00
Rahat MahmoodandgVisor bot 46e08207b5 cgroupfs: Handle hierachy changes across charge/uncharge.
When charging a pids cgroup during thread creation, it is possible for
the hierachy containing the pids controller to be destroyed and
recreated. If thread creation fails and the charge has to be rolled
back, an intervening hierachy change previously caused a charge
underflow during the rollback.

If the hierachy changes between the charge and uncharge, the uncharge
is uncessary.

Reported-by: syzbot+b72cc8d190b428e43a03@syzkaller.appspotmail.com
PiperOrigin-RevId: 471112484
2022-08-30 16:02:58 -07:00
Ayush RanjanandgVisor bot bf4d27a6ca Add inotify support to kernfs and anonfs.
This is consistent with Linux. Some applications recursively add
files to inotify FD. They fail if they run into kernfs files
because inotify_add_watch(2) returns EPERM in that case.

PiperOrigin-RevId: 462642204
2022-07-22 09:45:24 -07:00
Rahat MahmoodandgVisor bot d5a04e338e cgroupfs: Don't copy in with cgroups locks held.
CopyIn acquires mm.mappingMu, which is ordered before cgroups locks.

Reported-by: syzbot+97a5960840a8aeb25e6a@syzkaller.appspotmail.com
PiperOrigin-RevId: 455460140
2022-06-16 13:56:35 -07:00