Skip to content
Merged
Show file tree
Hide file tree
Changes from 5 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .cargo/config.toml
Original file line number Diff line number Diff line change
Expand Up @@ -37,3 +37,8 @@ rustflags = [
"-Aclippy::extra-unused-type-parameters", # stylistic
"-Aclippy::default_constructed_unit_structs", # stylistic
]

[env]
# Needed for musl builds so user doesn't have to install musl-tools.
CC_x86_64_unknown_linux_musl = { value = ".cargo/musl-gcc", force = true, relative = true }
CXX_x86_64_unknown_linux_musl = { value = ".cargo/musl-g++", force = true, relative = true }
7 changes: 7 additions & 0 deletions .cargo/musl-g++
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
#!/bin/sh

# Wrapper for building with musl.
#
# See comments for musl-gcc in this repo.

g++ "$@"
13 changes: 13 additions & 0 deletions .cargo/musl-gcc
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
#!/bin/sh

# Wrapper for building with musl.
#
# musl unfortunately requires a musl-enabled C compiler (musl-gcc) to be
# installed, which can be kind of a pain to get installed depending on the
# distro. That's not a very good user experience.
#
# The real musl-gcc wrapper sets the correct system include paths for linking
# with musl libc library. Since this is not actually used to link any binaries
# it should most likely work just fine.

gcc "$@"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we need those extra wrappers, do we? We're only calling gcc/g++ with no extra flags

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We do, compiling with the x86_64-unknown-linux-musl target will fail otherwise.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

isn't it enough to set CC_x86_64_unknown_linux_musl = { value = "gcc", force = true, relative = true } ?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Indeed, looks like that works (without relative = true), though we lose the explanatory comments in the files. For that reason I'd rather keep the musl-gcc files.

15 changes: 15 additions & 0 deletions .gitlab/pipeline/test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -504,3 +504,18 @@ cargo-hfuzz:
- cargo hfuzz build
- for target in $(cargo read-manifest | jq -r '.targets | .[] | .name'); do
cargo hfuzz run "$target" || { printf "fuzzing failure for %s\n" "$target"; exit 1; }; done

# cf https://github.com/paritytech/polkadot-sdk/issues/1652
test-syscalls:
stage: test
extends:
- .docker-env
- .common-refs
- .run-immediately
variables:
SKIP_WASM_BUILD: 1
script:
- cargo build --locked --profile production --target x86_64-unknown-linux-musl --bin polkadot-execute-worker --bin polkadot-prepare-worker
- cd polkadot/scripts/list-syscalls
- ./list-syscalls.rb ../../../target/x86_64-unknown-linux-musl/production/polkadot-execute-worker --only-used-syscalls | diff -u execute-worker-syscalls -
- ./list-syscalls.rb ../../../target/x86_64-unknown-linux-musl/production/polkadot-prepare-worker --only-used-syscalls | diff -u prepare-worker-syscalls -
Comment on lines +520 to +521
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot @altaua, it works! I'm just curious why there is a - at the end?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We got some confirmation that it works. 😂

https://gitlab.parity.io/parity/mirrors/polkadot-sdk/-/jobs/3941675

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm just curious why there is a - at the end?

It's diff between a file and stdin

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@altaua It would be ideal if we had an informative message on failure, something like

The list of syscalls in the worker binary has changed. Please review whether this is expected and update execute-worker-syscalls if so

71 changes: 71 additions & 0 deletions polkadot/scripts/list-syscalls/execute-worker-syscalls
Original file line number Diff line number Diff line change
@@ -0,0 +1,71 @@
0 (read)
1 (write)
2 (open)
3 (close)
4 (stat)
5 (fstat)
7 (poll)
8 (lseek)
9 (mmap)
10 (mprotect)
11 (munmap)
12 (brk)
13 (rt_sigaction)
14 (rt_sigprocmask)
15 (rt_sigreturn)
16 (ioctl)
19 (readv)
20 (writev)
24 (sched_yield)
25 (mremap)
28 (madvise)
39 (getpid)
41 (socket)
42 (connect)
45 (recvfrom)
46 (sendmsg)
53 (socketpair)
55 (getsockopt)
56 (clone)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see particularly dangerous syscalls here, like clone

Is there a possibility of further tailoring this list to the ones required strictly during PVF execution, after all the wasmtime setup is done? We only really need to install the filter right before executing the PVF, not during the prerequisite setup, which should enable us to tighten this list

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had an idea of having a "blacklist for the whitelist", that is, pick out all the I/O syscalls from this list and additionally block those. Makes sense to implement that at the same time as logging, and we'll see if any I/O calls get through the filter. For now, as we discussed, I just want some reasonable assurance that io_uring is never called, so we can properly block networking in the interim. :)

60 (exit)
61 (wait4)
62 (kill)
72 (fcntl)
79 (getcwd)
82 (rename)
83 (mkdir)
87 (unlink)
89 (readlink)
96 (gettimeofday)
97 (getrlimit)
99 (sysinfo)
102 (getuid)
110 (getppid)
131 (sigaltstack)
140 (getpriority)
141 (setpriority)
144 (sched_setscheduler)
157 (prctl)
158 (arch_prctl)
200 (tkill)
202 (futex)
204 (sched_getaffinity)
213 (epoll_create)
217 (getdents64)
218 (set_tid_address)
228 (clock_gettime)
230 (clock_nanosleep)
231 (exit_group)
232 (epoll_wait)
233 (epoll_ctl)
257 (openat)
262 (newfstatat)
263 (unlinkat)
273 (set_robust_list)
281 (epoll_pwait)
284 (eventfd)
290 (eventfd2)
291 (epoll_create1)
302 (prlimit64)
318 (getrandom)
319 (memfd_create)
Loading