Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Kernel filesystem change #663

Open
wants to merge 36 commits into
base: main
Choose a base branch
from

Conversation

ShaleXIONG
Copy link
Member

@ShaleXIONG ShaleXIONG commented Oct 6, 2023

Rework entirely on the execution engines and modify the policy accordingly.

  • Remove the support of WASMI since it only has an experimental support to WASI.
  • Remove the in-memory file system (FS) internally in Veracruz. For the remaining WASM engine, Wasmtime, we revert to the default implementation of WASI directly provided by the engine; such implementation links WASI calls to the kernel filesystem.
  • Rework on the Sandbox, to execute native binary. Remove all steps of copying between (no long exist) in-memory FS.
  • Rework on native module. It is renamed to "service". Now individual service which is excused in a separate thread, monitors a named pipe file, input, under the mounted directory, specified in the policy file. Any caller of this service should read output under the mounted directory.
  • WASM engine, Sandbox and services are now unified to the same trait, Execution, which requires two methods, name returning the name of this execution, and execute executing a path to a file, or a directory. The later case is useful for service, which is mounted in a directory.
  • Rework on the policy. Remove the old native module field, but treat native binary as a program too. For the service, we introduce a new service field, to specify the name of this service, and the mounted directory. Execution engine will mounted the service based on the name (matching). Also rework the permission specification, it uses rwx. Remove the old capability parameter, but combine the permission with entity by => symbol, for example "<CLIENT_CERT> => output:r, input:w".

Minor:

  • Rework policy generator and freestanding execution engine. Simplify the use of clap by using the derive features.

@ShaleXIONG ShaleXIONG force-pushed the kernel-filesystem branch 2 times, most recently from 82c0019 to 52284d4 Compare December 4, 2023 16:03
@ShaleXIONG ShaleXIONG force-pushed the kernel-filesystem branch 2 times, most recently from b6ee90c to b48ac99 Compare December 8, 2023 16:00
@ShaleXIONG ShaleXIONG changed the title WIP: Kernel filesystem change Kernel filesystem change Jan 29, 2024
@ShaleXIONG ShaleXIONG force-pushed the kernel-filesystem branch 4 times, most recently from cb7ba2b to c02e6e0 Compare April 3, 2024 09:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant