The attributes are expected by Dockerd to start. In gVisor, skipping
the attributes is good enough to run the Docker workloads.
PiperOrigin-RevId: 650362257
The NEWLINK commands contains many properties and here is no reason to have
another abstract interface between the Sentry and network stacks.
PiperOrigin-RevId: 627916629
It is an idea of running codespell as part of our presubmit checks.
Before enabling it for new changes, let's fix what it has found.
Signed-off-by: Andrei Vagin <avagin@gmail.com>
And enable all of the netlink tests that depend on this functionality.
Specifially, this CL implements hostinet.stack:
* .RemoveInterface()
* .AddInterfaceAddr()
* .RemoveInterfaceAddr()
Applications use netlink messages to call into these methods. For hostinet, we
use netlink messages to the host to implement these methods.
Note that the netlink messages are not simple passed from the application to
the host -- they are parsed first and only carefully crafted messages are sent
to the host.
This CL required a lot of refactoring to the existing netlink code in the
hostinet package, as well as a bunch of new functionality. All of that code has
been collected in hostinet/netlink.go
I also changed how we handle CAP_NET_ADMIN and CAP_NET_RAW in tests, since we
must drop those capabilities inside the sandbox if we don't have them on the
host. The new solution is cleaner and does not rely on google-specific env
variables.
PiperOrigin-RevId: 522685544
This catches up the interface to the `EmitUnimplementedEvent` method signature
on `kernel.Kernel`.
Also add build-time test to verify that `kernel.Kernel` implements this
interface, in order to catch such breakages at build time in the future.
PiperOrigin-RevId: 519000411
ErrNoRoute gets translated to EHOSTUNREACH which causes some code paths to
produce different errors unexpectedly. Rename the error so we can clean up some
sites to return ENETUNREACH more clearly where needed.
Updates #8105
PiperOrigin-RevId: 482355099
We were calling Send/RecvNotify inside of endpoint.Send/RecvMsg, which is
called as part of CopyIn/Out with mm.activeMu held. This leads to lock order
violation because those Send/RecvNotify needs TaskSet.mu to send a signal to a
task.
This CL changes endpoint.Send/RecvMsg to return a notification callback which
can be plumbed to the caller of CopyIn/Out and called without mm.activeMu held.
Updated the lock documentation in mm.go to order TaskSet.mu > mm.activeMu.
PiperOrigin-RevId: 452319981
This is consistent with Linux, which calls mknod(), then takes
unix_sock::bindlock and then marks the socket as bound. On error, the mknod is
reverted. See net/unix/af_unix.c:unix_bind_bsd().
This helps break the following lock chain: kernfs.filesystemRWMutex ->
kernel.taskSetRWMutex -> mm.activeRWMutex -> transport.endpointMutex.
PiperOrigin-RevId: 442104624
Andrei Vagin
Jamie LiuandgVisor bot
cweld510
Jing ChenandgVisor bot
Andrei Vagin
Mustafa Uzun
Kevin KrakauerandgVisor bot
Nicolas LacasseandgVisor bot
Etienne PerotandgVisor bot
Adin ScannellandgVisor bot
Ayush RanjanandgVisor bot
Bruno Dal BoandgVisor bot