mirror of
https://github.com/netbirdio/gvisor.git
synced 2026-05-22 17:12:49 -07:00
Ayush RanjanandgVisor bot
9e66f710de
Our devtmpfs implementation uses the same tmpfs filesystem instance for all devtmpfs mounts in the sandbox. This would mean that devices mounted in a container are visible and accessible to all other containers in the sandbox. With GPU/TPU, the contents of devtmpfs can be different for different containers within the same sandbox. So it is important to not share the same devtmpfs contents. It is better to drop support for devtmpfs, than to implement it incorrectly. Instead, this change introduces a new dummy filesystem type named `dev`. This filesystem can not be mounted or listed by the application. This filesystem creates a new tmpfs instance on GetFilesystem() and populates it with all the device files. PiperOrigin-RevId: 578969556
32 lines
685 B
Python
32 lines
685 B
Python
load("//tools:defs.bzl", "go_library")
|
|
|
|
package(default_applicable_licenses = ["//:license"])
|
|
|
|
licenses(["notice"])
|
|
|
|
go_library(
|
|
name = "memdev",
|
|
srcs = [
|
|
"full.go",
|
|
"memdev.go",
|
|
"null.go",
|
|
"random.go",
|
|
"zero.go",
|
|
],
|
|
visibility = ["//pkg/sentry:internal"],
|
|
deps = [
|
|
"//pkg/abi/linux",
|
|
"//pkg/atomicbitops",
|
|
"//pkg/context",
|
|
"//pkg/errors/linuxerr",
|
|
"//pkg/rand",
|
|
"//pkg/safemem",
|
|
"//pkg/sentry/fsimpl/tmpfs",
|
|
"//pkg/sentry/kernel",
|
|
"//pkg/sentry/kernel/auth",
|
|
"//pkg/sentry/memmap",
|
|
"//pkg/sentry/vfs",
|
|
"//pkg/usermem",
|
|
],
|
|
)
|