As of https://go.dev/cl/646095, the Go runtime calls
prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME) when mapping memory to annotate
mappings in /proc/self/maps. Since this is a system call made throughout the
application lifetime, it needs to be allowed through the system call filters.
PiperOrigin-RevId: 734182524
Exec'd processes cannot be stitched back to the original caller
and are killed after restore. So ignore failures
to restore host FDs (generally stdio) that belong
to them.
Fixes#11439
PiperOrigin-RevId: 732972054
Replaces the flag "unsafe-skip-restore-spec-validation" with
"restore-spec-validation" which allows the user to set the level of restore
spec validation such as ignore, warning or enforce. This allows user to skip
validation if required. By default, the flag will be set to "enforce" which
will perform spec validation.
This is a breaking change for users who have enabled
--unsafe-skip-restore-spec-validation flag. We advise these users to use the
new flag introduced in this change: --restore-spec-validation and set it to
"warning" or "ignore". This setting (--restore-spec-validation=warning) gives
the same behavior as when the old flag was enabled.
PiperOrigin-RevId: 719045616
This test case creates one connection, then it closes one end of it. After that
it waits for a linger timeout and tries to create the second connection with
the same client source port. The test is flaky if the second half of the fist
connection isn't closed before creating the second connection.
PiperOrigin-RevId: 715924851
reflect.Equal() considers nil and empty maps/slices different. But from spec
validation perspective, they should be considered the same. So added
validateMap() generic utility to do the comparison correctly.
Also fixed the validation of spec.Process.Rlimits, which was an array of
structs. Apart from suffering from the said reflect.Equal() issue, it also
suffered from ordering comparison. A list of shuffled-but-same rlimits should
be restorable. Fixed it to use validateArray().
There were only 2 users of `validateStructMap` remaining. So removed it
switched its users to call validateStruct() directly.
Fixes#11248
PiperOrigin-RevId: 703302621
This wraps `nvproxy`'s `ioctl` handlers with wrappers that are
driver-capability-aware, and initially populates the ABI tree
with all functions marked as being available for capabilities
`compute` and `utility`.
It is not yet possible for the user to specify which capability
they want to enable. This should not cause a regression for users
because the hardcoded effective capability set is the one that is
currently specified for all current handlers.
Updates #9452.
Updates #10856.
PiperOrigin-RevId: 697824737
Ayush RanjanandgVisor bot
Nayana BidariandgVisor bot
Jamie LiuandgVisor bot
Michael PrattandgVisor bot
Fabricio VoznikaandgVisor bot
Etienne PerotandgVisor bot
Andrei Vagin
cweld510
Kevin KrakauerandgVisor bot