If the path of allowed directory in a manifest file ended with a '/'
e.g. "sgx.allowed_files.tmp_dir = file:tmp/" anything inside it was
disallowed due to a buggy subdirectory check
Previously, a checkpoint on child's do_migration() was allocated at a
random address and could overlap with parent's VMAs, leading to
intermittent bugs on some apps (including Apache under SGX PAL). This
commit turns on CPSTORE_DERANDOMIZATION so that the child always maps
the checkpoint at the same address as the parent. Note that this is
a temporary solution because of memory fragmentation and security
issues. It also disallows the parent process to have less memory than
the child (relevant in SGX environment, e.g., to GCC regression test).
- Deduplicate much of setup code.
- Allow running non-sandbox and sandbox code in single run.
- Use pytest.
- Generate JUnit-XML file for Jenkins.
- Document running a subset of regression tests.
Previous implementation of vfork() was both buggy (worked only in simple
cases) and not compatible with the new IPC implementation. We take a
shortcut for now and emulate vfork() via fork(); this is allowed by
POSIX. This commit also adds LibOS regression test for vfork().
Previously, Graphene incorrectly treated execve() under SGX PAL:
Graphene would emulate execve() as fork + execve, and the new forked
process didn't try to "assume" the identity of its parent (which
violated execve specification "all process attributes are preserved").
This commit reworks the implementations of clone/fork and execve. In
particular, the IPC subsystem clearly distinguishes between the two
cases: clone/fork works as before whereas execve forks new "real"
process (which starts executing the requested program) and silently
exits the now-useless "temporary" process. New "real" process assumes
the identity of "temporary" process by inheriting its VMID (ID of
process for IPC purposes) and IPC-info objects with their PAL handles.
This commit also cleans up initialization of four IPC-info objects: self
(creates process-unique server pipe for IPC), parent (holds pipe for IPC
with parent process), and two namespace leaders (hold pipes for IPC with
leader processes). To correctly identify new-process server pipe, the
implementation of create_pipe() now allows to create VMID-based pipe URI.
This commit adds default signal dispositions (as per Linux) to all 32
standard signals. It also adds WCOREDUMP bit to correctly inform wait4()
status word.
This commit updates graphene-tests submodules to enable new killXX LTP
regression tests, as well as fix the waitpid05 LTP test. It is important
to update this submodule reference in this commit because otherwise
waitpid05 tests will fail Graphene's CI.
- Add error case: fail with EISDIR if directory is open()'ed with
writable access.
- Add additional checks: O_TRUNC must work only on regular writable
files (otherwise do not truncate).
The commit also improves LibOS regression test on FS corner cases and
fixes a tiny bug in DkStreamSetLength() with assert hanging Graphene.
Previously, Graphene had a bug when dentry's rel_path was not initialized
to actual relative path if parent + filename length was longer than
256B. The problem was that rel_path was a shim_qstr which could contain
maximum 256 chars. This commit increases the limit to 4096B and adds
checks to fail explicitly if rel_path is still too large. Also, it adds
LibOS regression test.
Note that relative paths greater than 256 chars in length are not
uncommon. Most OSes impose the limit of 4096 chars or no limit at all.
Previously, OpenMP apps failed to run under Graphene-SGX because it did
not support raw system calls (used inside of OpenMP lib, in particular
the futex() syscall). Since recently, Graphene-SGX has support for raw
syscall execution. This commit adds a test showing that OpenMP works.
Add LibOS regression test which contains a raw syscall instruction to test
SIGILL handler hook logic (if SIGILL'ed instruction is a syscall, it is
redirected inside LibOS as if syscalldb() was called).
Previously the check on correct memory region under Linux-SGX
(called is_in_one_vma()) only checked that the whole memory region fits
into one VMA. In some cases (e.g. DATA and BSS sections), memory regions
can span several adjacent VMAs. This commit refines the check and
renames it to is_in_adjacent_vmas(). It also adds a LibOS test.
This commit also adds LibOS regression test for sigaltstack(). This
test is currently disabled (signal delivery on sigaltstack is not yet
implemented).
Previously, execve(NULL, ...) failed with segfault. This commit adds
memory checks that all arguments of execve() are valid memory regions.
Also adds LibOS regression test on execve(bad-file, bad-args, bad-env).
Previously, test_user_{memory/string} failed on Linux-SGX PAL.
These functions check if user-supplied buffer/string is accessible
inside LibOS. There was only one option: setup a segfault handler
to catch memory errors and access one byte of each page in user-supplied
buffer/string. If some byte is inaccessible, then exception is raised
and caught by segfault handler. The handler checks the faulting
address and redirects back to function and it returns with failure.
This option doesn't work under SGX because there is no trusted field
that contains the faulting address. SGX v1 doesn't have such field at
all, SGX v2 introduces a field in SSA.MISC region but only at the
4K-page granularity.
This commit adds a second option used for SGX PAL: functions consult
LibOS's internal VMA bookkeeping. If buffer/string is not in any VMA,
then these functions fail. This option is slightly slower than first one
since it requires locking and traversing a list of VMAs.
Some Linux applications get the number of CPU cores by querying
/proc/cpuinfo. Before, such apps would be confused by a wrong
format of /proc/cpuinfo in Graphene. This commit updates format
to exactly the same as in Linux kernel.
This commit also adds a LibOS regression test for /proc/cpuinfo.
Li Lei