-
Notifications
You must be signed in to change notification settings - Fork 1.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(seccomp): moved call to seccomp
Previously seccomp was called in `build.rs` in root directory. This setup was confusing and required some workarounds to work. (`build.rs` was called recursively) Also it was causing problems for cross compilation. This commit moves call for seccomp from `build.rs` in root into `build.rs` in `firecracker`. It also does calls to the seccompiler directly, rather than calling seccomp binary. Signed-off-by: Egor Lazarchuk <[email protected]>
- Loading branch information
1 parent
c9f62fb
commit db4095d
Showing
4 changed files
with
111 additions
and
133 deletions.
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,7 +3,7 @@ name = "firecracker" | |
| version = "1.5.0-dev" | ||
| authors = ["Amazon Firecracker team <[email protected]>"] | ||
| edition = "2021" | ||
| build = "../../build.rs" | ||
| build = "build.rs" | ||
| description = "Firecracker enables you to deploy workloads in lightweight virtual machines, called microVMs, which provide enhanced security and workload isolation over traditional VMs, while enabling the speed and resource efficiency of containers." | ||
| homepage = "https://firecracker-microvm.github.io/" | ||
| license = "Apache-2.0" | ||
|
|
@@ -36,6 +36,13 @@ regex = { version = "1.9.5", default-features = false, features = ["std", "unico | |
| serde = { version = "1.0.188", features = ["derive"] } | ||
| userfaultfd = "0.6.1" | ||
|
|
||
| [build-dependencies] | ||
| # Dev-Dependencies for build.rs | ||
| seccompiler = { path = "../seccompiler" } | ||
| serde = { version = "1.0.188", features = ["derive"] } | ||
| serde_json = "1.0.107" | ||
| bincode = "1.2.1" | ||
|
|
||
| [[example]] | ||
| name = "uffd_malicious_handler" | ||
| path = "examples/uffd/malicious_handler.rs" | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,102 @@ | ||
| // Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| use std::collections::BTreeMap; | ||
| use std::fs::File; | ||
| use std::path::Path; | ||
|
|
||
| use seccompiler::{ | ||
| common::BpfProgram, | ||
| compiler::{Compiler, JsonFile}, | ||
| }; | ||
| const ADVANCED_BINARY_FILTER_FILE_NAME: &str = "seccomp_filter.bpf"; | ||
|
|
||
| const JSON_DIR: &str = "../../resources/seccomp"; | ||
| const SECCOMPILER_SRC_DIR: &str = "../seccompiler/src"; | ||
|
|
||
| // This script is run on every modification in the target-specific JSON file in `resources/seccomp`. | ||
| // It compiles the JSON seccomp policies into a serializable BPF format, using seccompiler-bin. | ||
| // The generated binary code will get included in Firecracker's code, at compile-time. | ||
| fn main() { | ||
| let firecracker_version = env!("CARGO_PKG_VERSION").to_string(); | ||
| println!( | ||
| "cargo:rustc-env=FIRECRACKER_VERSION={}", | ||
| firecracker_version | ||
| ); | ||
|
|
||
| // Target triple | ||
| let target = std::env::var("TARGET").expect("Missing target."); | ||
| let out_dir = std::env::var("OUT_DIR").expect("Missing build-level OUT_DIR."); | ||
| // Target arch (x86_64 / aarch64) | ||
| let target_arch = std::env::var("CARGO_CFG_TARGET_ARCH").expect("Missing target arch."); | ||
|
|
||
| // println!( | ||
| // "cargo:warning=target: {}, out_dir: {}, target_arch: {}", | ||
| // target, out_dir, target_arch | ||
| // ); | ||
|
|
||
| let seccomp_json_path = format!("{}/{}.json", JSON_DIR, target); | ||
| // If the current target doesn't have a default filter, use a default, empty filter. | ||
| // This is to make sure that Firecracker builds even with libc toolchains for which we don't | ||
| // provide a default filter. For example, GNU libc. | ||
| let seccomp_json_path = if Path::new(&seccomp_json_path).exists() { | ||
| seccomp_json_path | ||
| } else { | ||
| println!( | ||
| "cargo:warning=No default seccomp policy for target: {}. Defaulting to \ | ||
| `resources/seccomp/unimplemented.json`.", | ||
| target | ||
| ); | ||
| format!("{}/unimplemented.json", JSON_DIR) | ||
| }; | ||
|
|
||
| // Retrigger the build script if the JSON file has changed. | ||
| // let json_path = json_path.to_str().expect("Invalid bytes"); | ||
| println!("cargo:rerun-if-changed={}", &seccomp_json_path); | ||
| // Also retrigger the build script on any seccompiler source code change. | ||
| register_seccompiler_src_watchlist(SECCOMPILER_SRC_DIR); | ||
|
|
||
| let out_path = format!("{}/{}", out_dir, ADVANCED_BINARY_FILTER_FILE_NAME); | ||
|
|
||
| // Run seccompiler-bin, getting the default, advanced filter. | ||
| run_seccompiler_bin(&target_arch, &seccomp_json_path, &out_path); | ||
| } | ||
|
|
||
| // Run seccompiler with the given arguments. | ||
| fn run_seccompiler_bin(arch: &str, input_path: &str, out_path: &str) { | ||
| let input = std::fs::read_to_string(input_path).expect("Correct input file"); | ||
| let filters: JsonFile = serde_json::from_str(&input).expect("Input read"); | ||
|
|
||
| let arch = arch.try_into().expect("Target"); | ||
| let compiler = Compiler::new(arch); | ||
|
|
||
| // transform the IR into a Map of BPFPrograms | ||
| let bpf_data: BTreeMap<String, BpfProgram> = compiler | ||
| .compile_blob(filters.0, false) | ||
| .expect("Successfull compilation"); | ||
|
|
||
| // serialize the BPF programs & output them to a file | ||
| let output_file = File::create(out_path).expect("Create seccompiler output path"); | ||
| bincode::serialize_into(output_file, &bpf_data).expect("Seccompiler serialization"); | ||
| } | ||
|
|
||
| // Recursively traverse the entire seccompiler source folder and trigger a re-run of this build | ||
| // script on any modification of these files. | ||
| fn register_seccompiler_src_watchlist<P: AsRef<Path>>(src_dir: P) { | ||
| let contents = std::fs::read_dir(src_dir).expect("Unable to read folder contents."); | ||
| for entry in contents { | ||
| let path = entry.unwrap().path(); | ||
| let metadata = std::fs::metadata(&path).expect("Unable to read file/folder metadata."); | ||
|
|
||
| if metadata.is_file() { | ||
| // Watch all source files. | ||
| println!( | ||
| "cargo:rerun-if-changed={}", | ||
| path.to_str().expect("Invalid unicode bytes.") | ||
| ); | ||
| } else if metadata.is_dir() { | ||
| // If is a folder, recurse. | ||
| register_seccompiler_src_watchlist(&path); | ||
| } | ||
| } | ||
| } |