They were necessary when they were the source of constant values
extracted from kernel code (hard to do). Now constants are checked-in
separately, and these large files can be easily regenerated with 'make generate'.
Now they are only a source of large uninteresting diffs in commits.
Remove them.
This splits generation process into two phases:
1. Extract values of constants from linux kernel sources.
2. Generate Go code.
Constant values are checked in.
The advantage is that the second phase is now completely independent
from linux source files, kernel version, presence of headers for
particular drivers, etc. This allows to change what Go code we generate
any time without access to all kernel headers (which in future won't be
limited to only upstream headers).
Constant extraction process does require proper kernel sources,
but this can be done only once by the person who added the driver
and has access to the required sources. Then the constant values
are checked in for others to use.
Consant extraction process is per-file/per-arch. That is,
if I am adding a driver that is not present upstream and that
works only on a single arch, I will check in constants only for
that driver and for that arch.
Ignore SIGSEGV/SIGBUS during copyin/copyout of arguments.
The memory may not be addressable. The ignoring allows to
pass partially-addressable input data to kernel.
It's unclear if it's a good idea or not yet.
The new namespace-based sanboxing is good,
but it's not always what one wants
(and also requires special kernel configs).
Change dropprivs config value to sandbox,
which can have different values (currently: none, setuid, namespace).
Setuid mode uses setuid(nobody) before fuzzing as before.
In future we can add more sandboxing modes or, say,
extend -sandbox=setuid to -sandbox=setuid:johndoe
to impersonolate into given user.
This solves several problems:
- host usually have outdates headers, so previously we need to define missing consts
- host may not have some headers at all
- generation depends on linux distribution and version
- some of the consts cannot be defined at all (e.g. ioctls that use struct arguments)
WUNTRACED wait returns when child has stopped.
That's not what we want to wait for.
If it's stopped we need to timeout wait and kill
the stopped child.
Syscall numbers for different architectures are now pulled in
from kernel headers. This solves 2 problems:
- we don't need to hardcode numbers for new syscalls (that don't present in typical distro headers)
- we have correct number for different archs (previously hardcoded numbers were for x86_64)
This also makes syscall numbers available for Go code, which can be useful.
