141 Commits
Author SHA1 Message Date
Lucas ManningandgVisor bot 5817f4cc64 Fix FUSE how handles malformed INIT requests.
INIT requests need to be a minimum size, or else they are invalid
and will crash the sandbox.

Reported-by: syzbot+f5d95cf61917a9b13369@syzkaller.appspotmail.com
PiperOrigin-RevId: 511864246
2023-02-23 13:06:55 -08:00
Lucas ManningandgVisor bot 0650bd1a5c Enable access, chroot, chown, and sync tests for FUSE.
PiperOrigin-RevId: 510699649
2023-02-18 13:19:42 -08:00
Lucas ManningandgVisor bot a66612ffc3 Enable write and fallocate tests for FUSE.
This change also stubs out some methods that will be needed to
implement mmap.

PiperOrigin-RevId: 509298123
2023-02-13 12:17:57 -08:00
Lucas ManningandgVisor bot d4843e167a Enable the stat_times and truncate test for FUSE.
PiperOrigin-RevId: 507534117
2023-02-06 11:24:44 -08:00
Lucas ManningandgVisor bot e9471a18ff Enable FUSE rename test.
This adds some permissions checks to kernfs RenameAt that were
missing.

PiperOrigin-RevId: 507013151
2023-02-03 15:50:50 -08:00
Lucas ManningandgVisor bot fc52a6d9cc Give FUSE hard link capabilities and enable the link syscall test.
PiperOrigin-RevId: 507001947
2023-02-03 15:00:04 -08:00
Lucas ManningandgVisor bot 298b5f3612 Refactor FUSE inode implementation.
This change replaces the FUSE inode implementations with a custom
inode type that implementsthe kernfs.Inode interface. It also cleans
up some of the attribute related functions and gets the open_test to
pass.

PiperOrigin-RevId: 506465698
2023-02-01 17:20:22 -08:00
Lucas ManningandgVisor bot f0d5892907 Fix flaky creat_test.
PiperOrigin-RevId: 504927279
2023-01-26 13:37:50 -08:00
Lucas ManningandgVisor bot 492f4c95c9 Clean up FUSE device methods.
Most of this is just style cleanup. There some comments that are not
really necessary (describing what, not why), control flow that
is more complex than is necessary, and redefinitions of common constant
values.

In the case of writeLocked, using DropFirst() is actually broken when reading
from a pipe, so that change is functional.

PiperOrigin-RevId: 504608319
2023-01-25 11:04:00 -08:00
Lucas ManningandgVisor bot 3c93bb1040 Defer kernfs openflag handling to inode implementations.
Some implementations handle more flags than others, so it doesn't
make sense to have one set of rules for all.

This change should functionally be a no-op.

PiperOrigin-RevId: 502712415
2023-01-17 16:01:40 -08:00
Lucas ManningandgVisor bot 320004cbe6 Send SETATTR request after open when atomic_o_trunc is not set.
In Linux, the VFS is responsible for implementing O_TRUNC. It does
this by calling setattr with a zero size on the underlying inode.
The sentry VFS does not have the same inode abstraction, so we need
to implement the SETATTR behavior inside the fusefs implementation.

PiperOrigin-RevId: 501385452
2023-01-11 14:51:36 -08:00
Lucas ManningandgVisor bot 6fb2a265a1 Remove FUSE feature flag and enable by default.
PiperOrigin-RevId: 493410677
2022-12-06 14:22:34 -08:00
Ayush RanjanandgVisor bot 175db901ca Replace pkg/refs with pkg/refsvfs2.
All VFS1 only bits have been deleted.

Updates #1624

PiperOrigin-RevId: 492273183
2022-12-01 12:46:11 -08:00
Ayush RanjanandgVisor bot 1fa3c06f1e Delete VFS1 completely.
- Delete pkg/sentry/fs/*.
- Move pkg/sentry/fs/fsutil out of VFS1 directory and remove VFS1 components.
- Remove remaining unused references to VFS1 from remaining codebase.
- Rename/refactor code to avoid even referencing VFS2, unless necessary.
- Rewrite VFS1-only tests to VFS2.

Updates #1624

PiperOrigin-RevId: 490064269
2022-11-21 13:57:52 -08:00
Ayush RanjanandgVisor bot bf4d27a6ca Add inotify support to kernfs and anonfs.
This is consistent with Linux. Some applications recursively add
files to inotify FD. They fail if they run into kernfs files
because inotify_add_watch(2) returns EPERM in that case.

PiperOrigin-RevId: 462642204
2022-07-22 09:45:24 -07:00
Ayush RanjanandgVisor bot f6ed4523dc Reformat codebase.
PiperOrigin-RevId: 449358041
2022-05-17 17:48:35 -07:00
Lucas ManningandgVisor bot 32c474d82f Allow multiple FUSE filesystems to share a connection.
Before this change FUSE connections were shared 1:1 with FUSE filesystems, which
is incorrect behavior. A FUSE FD should have a 1:1 relationship with a FUSE
connection, and any number of FUSE filesystems can use the same connection.

PiperOrigin-RevId: 445988328
2022-05-02 11:41:42 -07:00
Kevin KrakauerandgVisor bot 9050184c20 switch fsimpl/ from sync/atomic to atomicbitops for 32 bit values
PiperOrigin-RevId: 443535714
2022-04-21 18:32:04 -07:00
Kevin KrakauerandgVisor bot 370672e989 prohibit direct use of sync/atomic (u)int64 functions
All atomic 64 bit ints are changed to atomicbitops.(Ui|I)nt64. A nogo checker
enforces that sync/atomic 64 bit functions are not called.

For reviewers: the interesting changes are in the atomicbitops and checkaligned
packages.

Why do this?
- It is very easy to accidentally use atomic values without sync/atomic funcs.
- We have checkatomics, but this is optional and is forgotten in several places.
  - Using a type+checker to enforce this seems less error prone and simpler.
- We get NoCopy protection.
- Use of 64 bit atomics can break 32 bit builds. We have types to handle this
  without any runtime cost, so we might as well use them.

PiperOrigin-RevId: 440473398
2022-04-08 16:06:26 -07:00
Kevin KrakauerandgVisor bot 019e0c9301 use atomicbitops, not sync/atomic, in refsvfs2
Since refsvfs2 are used in netstack, we should use atomicbitops to avoid
breaking 32-bit builds.

On 64-bit builds there is no performance difference.

PiperOrigin-RevId: 439687980
2022-04-05 15:16:01 -07:00
Fabricio VoznikaandgVisor bot dfcf798425 Fix epoll_ctl(2) regular files and dirs
Linux behaves differently for regular files and dirs for poll(2)/select(2)
compared to epoll_ctl(2). The latter returns EPERM for file and dirs.
I've also changed host FDs to behave like the underlying FD in regards
to epoll to keep it compatible with docker.

Fixes #7134

PiperOrigin-RevId: 429412692
2022-02-17 15:12:36 -08:00
Etienne PerotandgVisor bot e219f75d8b Fuse: Cache maxActiveRequests in connection to avoid reading it from fs.
Reported-by: syzbot+6a1f1b6e126622f61c0e@syzkaller.appspotmail.com
PiperOrigin-RevId: 426488251
2022-02-04 14:11:34 -08:00
Adin ScannellandgVisor bot a87bb4aae2 Ensure that nogo is enabled.
A recent change stopped using the correct file (the export data, not the
archive) and checklocks started failing. Unfortunately, this was suppressed,
since the filter command was not failing with findings.

This change fixes that problem and adds a test to ensure that this cannot
happen again. If nogo starts failing to identify problems, the sanity_test in
nogo/sanity will also start to fail.

This change also requires updating the WORKSPACE to the latest rules_go and
Go version, in order to pick up the fixed go_tools. The latest rules_go in
turn required an updated bazel, which in turn required a minor change in the
coverdata implementation.

Fixing the fact propagation brought forward a number of problems with caching
for bazel workers. Its unclear whether this was a core worker issue or whether
some caching was broken, but the situation was basically undebugable. Instead,
the way facts are stored and loaded is optimized to be able to remove the use
of workers altogether and ideally make nogo debuggable.

PiperOrigin-RevId: 426327186
2022-02-03 23:45:40 -08:00
Etienne PerotandgVisor bot 10d1a49c5b Fuse: DeviceFD.Read: Lock DeviceFD ahead of other locks.
Syzkaller reports a "unlocking an unlocked mutex" here:
https://github.com/google/gvisor/blob/a5ce865145c718f26c7a8f305f6c8262e992051c/pkg/sentry/fsimpl/fuse/dev.go#L154
... which can only happen if `fd.fs` changes in the middle. By locking
`DeviceFD` earlier, we follow the lock ordering specified in
https://github.com/google/gvisor/blob/a5ce865145c718f26c7a8f305f6c8262e992051c/pkg/sentry/fsimpl/fuse/connection.go#L42
hopefully fixing the issue.

Reported-by: syzbot+f211c42d52f93416457d@syzkaller.appspotmail.com
PiperOrigin-RevId: 426288804
2022-02-03 18:51:20 -08:00
Rahat MahmoodandgVisor bot 55ef371668 Return well-defined error on short payload in FUSE.
Errors from syscalls without a well-defined translation to errnos
result in sentry panics.

Reported-by: syzbot+907201b840bb25d94e00@syzkaller.appspotmail.com
PiperOrigin-RevId: 426248731
2022-02-03 15:14:36 -08:00