gfwleak/tango-verify-policy
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

VerifyPolicy adapted to aarch64 architecture

Browse Source
This commit is contained in:
fengweihao
2024-11-20 17:27:09 +08:00
parent 4ee9dd101c
commit d8ea2a7463
10 changed files with 138 additions and 282 deletions
Download Patch File Download Diff File Expand all files Collapse all files

148
.gitlab-ci.yml
View File

@@ -3,14 +3,15 @@ variables:
BUILD_PADDING_PREFIX: /tmp/padding_for_CPACK_RPM_BUILD_SOURCE_DIRS_PREFIX_PREFIX_PREFIX_PREFIX_PREFIX_PREFIX/
INSTALL_PREFIX: "/opt/tsg/verify-policy"
TESTING_VERSION_BUILD: 0
BUILD_IMAGE_CENTOS8: "git.mesalab.cn:7443/mesa_platform/build-env:rockylinux"
BUILD_IMAGE_X86_64_EL8: "git.mesalab.cn:7443/mesa_platform/build-env:rockylinux"
BUILD_IMAGE_AARCH64_EL9: "git.mesalab.cn:7443/mesa_platform/build-env:rocky9-aarch64"
stages:
- build
- test
###############################################################################
# The script is set to el7 or el8
# The script is set to el9 or el8
###############################################################################
.build_before_script:
before_script:
@@ -20,21 +21,39 @@ stages:
- chmod +x ./ci/travis.sh
- yum makecache
.build_by_travis_for_centos8:
.build_by_travis_for_x86_64_el8:
stage: build
image: $BUILD_IMAGE_CENTOS8
image: $BUILD_IMAGE_X86_64_EL8
extends: .build_before_script
script:
- ./ci/travis.sh
tags:
- share
.build_by_travis_for_aarch64_el9:
stage: build
image: $BUILD_IMAGE_AARCH64_EL9
extends: .build_before_script
script:
- ./ci/travis.sh
tags:
- tsg-os-builder-aarch64
###############################################################################
# make test: centos8
# make test: el8 or el9
###############################################################################
run_test_for_centos8:
run_test_for_x86_64_el8:
stage: test
extends: .build_by_travis_for_centos8
extends: .build_by_travis_for_x86_64_el8
script:
- yum makecache
- ./ci/travis.sh
- cd build
- make test
run_test_for_aarch64_el9:
stage: test
extends: .build_by_travis_for_aarch64_el9
script:
- yum makecache
- ./ci/travis.sh
@@ -42,10 +61,10 @@ run_test_for_centos8:
- make test
###############################################################################
# compile use image: centos8
# compile use image: el8
###############################################################################
branch_build_debug_for_centos8:
extends: .build_by_travis_for_centos8
branch_build_debug_for_x86_64_el8:
extends: .build_by_travis_for_x86_64_el8
variables:
BUILD_TYPE: Debug
except:
@@ -53,17 +72,17 @@ branch_build_debug_for_centos8:
- /^master.*$/i
- tags
branch_build_release_for_centos8:
branch_build_release_for_x86_64_el8:
variables:
BUILD_TYPE: RelWithDebInfo
extends: .build_by_travis_for_centos8
extends: .build_by_travis_for_x86_64_el8
except:
- /^develop-.*$/i
- /^master.*$/i
- tags
develop_build_debug_for_centos8:
extends: .build_by_travis_for_centos8
develop_build_debug_for_x86_64_el8:
extends: .build_by_travis_for_x86_64_el8
variables:
TESTING_VERSION_BUILD: 1
UPLOAD: 1
@@ -80,8 +99,8 @@ develop_build_debug_for_centos8:
- /^develop-.*$/i
- /^master.*$/i
develop_build_release_for_centos8:
extends: .build_by_travis_for_centos8
develop_build_release_for_x86_64_el8:
extends: .build_by_travis_for_x86_64_el8
variables:
TESTING_VERSION_BUILD: 1
UPLOAD: 1
@@ -98,7 +117,7 @@ develop_build_release_for_centos8:
- /^develop-.*$/i
- /^master.*$/i
release_build_debug_for_centos8:
release_build_debug_for_x86_64_el8:
variables:
UPLOAD: 1
BUILD_TYPE: Debug
@@ -106,7 +125,7 @@ release_build_debug_for_centos8:
SYMBOL_TARGET: verify-policy
PULP3_REPO_NAME: tsg-stable-x86_64.el8
PULP3_DIST_NAME: tsg-stable-x86_64.el8
extends: .build_by_travis_for_centos8
extends: .build_by_travis_for_x86_64_el8
artifacts:
name: "verify-policy-$CI_COMMIT_REF_NAME-debug"
paths:
@@ -114,7 +133,7 @@ release_build_debug_for_centos8:
only:
- tags
release_build_release_for_centos8:
release_build_release_for_x86_64_el8:
variables:
BUILD_TYPE: RelWithDebInfo
UPLOAD: 1
@@ -122,10 +141,99 @@ release_build_release_for_centos8:
SYMBOL_TARGET: verify-policy
PULP3_REPO_NAME: tsg-stable-x86_64.el8
PULP3_DIST_NAME: tsg-stable-x86_64.el8
extends: .build_by_travis_for_centos8
extends: .build_by_travis_for_x86_64_el8
artifacts:
name: "verify-policy-$CI_COMMIT_REF_NAME-release"
paths:
- build/*.rpm
only:
- tags
###############################################################################
# compile use image: el9
###############################################################################
branch_build_debug_for_aarch64_el9:
extends: .build_by_travis_for_aarch64_el9
variables:
BUILD_TYPE: Debug
except:
- /^develop-.*$/i
- /^master.*$/i
- tags
branch_build_release_for_aarch64_el9:
variables:
BUILD_TYPE: RelWithDebInfo
extends: .build_by_travis_for_aarch64_el9
except:
- /^develop-.*$/i
- /^master.*$/i
- tags
develop_build_debug_for_aarch64_el9:
extends: .build_by_travis_for_aarch64_el9
variables:
TESTING_VERSION_BUILD: 1
UPLOAD: 1
BUILD_TYPE: Debug
PACKAGE: 1
SYMBOL_TARGET: verify-policy
PULP3_REPO_NAME: tsg-testing-aarch64.el9
PULP3_DIST_NAME: tsg-testing-aarch64.el9
artifacts:
name: "verify-policy-develop-$CI_COMMIT_REF_NAME-debug"
paths:
- build/*.rpm
only:
- /^develop-.*$/i
- /^master.*$/i
develop_build_release_for_aarch64_el9:
extends: .build_by_travis_for_aarch64_el9
variables:
TESTING_VERSION_BUILD: 1
UPLOAD: 1
BUILD_TYPE: RelWithDebInfo
PACKAGE: 1
SYMBOL_TARGET: verify-policy
PULP3_REPO_NAME: tsg-testing-aarch64.el9
PULP3_DIST_NAME: tsg-testing-aarch64.el9
artifacts:
name: "verify-policy-develop-$CI_COMMIT_REF_NAME-release"
paths:
- build/*.rpm
only:
- /^develop-.*$/i
- /^master.*$/i
release_build_debug_for_aarch64_el9:
variables:
UPLOAD: 1
BUILD_TYPE: Debug
PACKAGE: 1
SYMBOL_TARGET: verify-policy
PULP3_REPO_NAME: tsg-stable-aarch64.el9
PULP3_DIST_NAME: tsg-stable-aarch64.el9
extends: .build_by_travis_for_aarch64_el9
artifacts:
name: "verify-policy-$CI_COMMIT_REF_NAME-debug"
paths:
- build/*.rpm
only:
- tags
release_build_release_for_aarch64_el9:
variables:
BUILD_TYPE: RelWithDebInfo
UPLOAD: 1
PACKAGE: 1
SYMBOL_TARGET: verify-policy
PULP3_REPO_NAME: tsg-stable-aarch64.el9
PULP3_DIST_NAME: tsg-stable-aarch64.el9
extends: .build_by_travis_for_aarch64_el9
artifacts:
name: "verify-policy-$CI_COMMIT_REF_NAME-release"
paths:
- build/*.rpm
only:
- tags

2
ci/travis.sh
View File

@@ -33,7 +33,7 @@ env | sort
: "${COMPILER_IS_GNUCXX:=OFF}"
# Install dependency from YUM
yum install -y libcjson-devel libmaatframe-devel libfieldstat4-devel libMESA_prof_load-devel sapp-devel libuuid-devel
yum install -y libcjson-devel libmaatframe-devel libfieldstat4-devel libMESA_prof_load-devel sapp-devel libuuid-devel libbreakpad_mini-devel
mkdir build || true
cd build

3
cmake/Package.cmake
View File

@@ -19,9 +19,6 @@ set(CPACK_RPM_FILE_NAME "RPM-DEFAULT")
set(CPACK_RPM_PACKAGE_AUTOREQPROV "no")
set(CPACK_RPM_PACKAGE_RELEASE_DIST on)
set(CPACK_RPM_DEBUGINFO_PACKAGE on)
set(CPACK_RPM_POST_INSTALL_SCRIPT_FILE ${CMAKE_SOURCE_DIR}/cmake/PostInstall.in)
set(CPACK_RPM_POST_UNINSTALL_SCRIPT_FILE ${CMAKE_SOURCE_DIR}/cmake/PostUninstall.in)
set(CPACK_RPM_PRE_UNINSTALL_SCRIPT_FILE ${CMAKE_SOURCE_DIR}/cmake/PreUninstall.in)
set(CPACK_RPM_BUILD_SOURCE_DIRS_PREFIX /opt/tsg)

3
cmake/PostInstall.in
View File

@@ -1,3 +0,0 @@
%sysctl_apply
%tmpfiles_create
/sbin/ldconfig

3
cmake/PostUninstall.in
View File

@@ -1,3 +0,0 @@
%sysctl_apply
%tmpfiles_create
/sbin/ldconfig

2
cmake/PreUninstall.in
View File

@@ -1,2 +0,0 @@
%sysctl_apply
%tmpfiles_create

2
platform/CMakeLists.txt
View File

@@ -7,5 +7,5 @@ add_executable(verify-policy src/verify_policy.cpp src/verify_matcher.cpp)
#target_include_directories(verify-policy PUBLIC ${CMAKE_CURRENT_LIST_DIR}/include)
target_link_libraries(verify-policy common cjson maatframe uuid)
target_link_libraries(verify-policy pthread dl libevent-static MESA_prof_load breakpad-client-static cjson ${SYSTEMD_LIBRARIES})
target_link_libraries(verify-policy pthread dl libevent-static MESA_prof_load breakpad_mini cjson ${SYSTEMD_LIBRARIES})

229
platform/src/verify_policy.cpp
View File

@@ -4,11 +4,6 @@
> Mail:
> Created Time: 2019年08月23日 星期五 14时41分17秒
************************************************************************/
/* Breakpad */
#include <client/linux/handler/exception_handler.h>
#include <common/linux/http_upload.h>
#include<iostream>
#include <stdio.h>
#include <stdlib.h>
@@ -30,6 +25,9 @@
#include <sys/stat.h>
#include <libgen.h>
/* Breakpad */
#include <MESA/breakpad_mini.h>
#include <MESA/MESA_prof_load.h>
#include "verify_policy.h"
@@ -272,225 +270,6 @@ finish:
return xret;
}
struct breakpad_instance
{
unsigned int en_breakpad;
char minidump_dir_prefix[VERIFY_STRING_MAX];
google_breakpad::ExceptionHandler * exceptionHandler;
/* Upload to crash server */
unsigned int en_breakpad_upload;
char minidump_sentry_upload_url[VERIFY_STRING_MAX];
/* Upload tools name */
char upload_tools_filename[VERIFY_STRING_MAX];
/* Upload tools exec command */
char * upload_tools_exec_argv[64];
char * minidump_filename;
};
static void _mkdir(const char *dir)
{
char tmp[PATH_MAX];
char * p = NULL;
size_t len;
snprintf(tmp, sizeof(tmp), "%s", dir);
len = strlen(tmp);
if (tmp[len - 1] == '/')
tmp[len - 1] = 0;
for (p = tmp + 1; *p; p++)
{
if (*p == '/')
{
*p = 0;
mkdir(tmp, S_IRWXU);
*p = '/';
}
}
mkdir(tmp, S_IRWXU);
}
int breakpad_init_minidump_upload(struct breakpad_instance * instance, const char * profile)
{
int ret = 0;
char execpath[PATH_MAX] = {};
char * execdirname = NULL;
ret = MESA_load_profile_string_nodef(profile, "system", "breakpad_upload_url",
instance->minidump_sentry_upload_url, sizeof(instance->minidump_sentry_upload_url));
if (unlikely(ret < 0))
{
log_fatal(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "breakpad_upload_url is necessary, failed. ");
goto errout;
}
ret = readlink("/proc/self/exe", execpath, sizeof(execpath));
if(unlikely(ret < 0))
{
log_fatal(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "Failed at readlink /proc/self/exec: %s", strerror(errno));
/* after log, reset errno */
errno = 0;
goto errout;
}
execdirname = dirname(execpath);
snprintf(instance->upload_tools_filename, sizeof(instance->upload_tools_filename) - 1,
"%s/%s", execdirname, "minidump_upload");
/* Execfile */
instance->upload_tools_exec_argv[0] = strdup(instance->upload_tools_filename);
/* Firstly, Product Name and Product Version */
instance->upload_tools_exec_argv[1] = strdup("-p");
instance->upload_tools_exec_argv[2] = strdup("tfe");
instance->upload_tools_exec_argv[3] = strdup("-v");
instance->upload_tools_exec_argv[4] = strdup(version());
/* Minidump file location, now we don't know it */
instance->minidump_filename = (char *)ALLOC(char, PATH_MAX);
instance->upload_tools_exec_argv[5] = instance->minidump_filename;
/* Minidup upload url */
instance->upload_tools_exec_argv[6] = strdup(instance->minidump_sentry_upload_url);
instance->upload_tools_exec_argv[7] = NULL;
return 0;
errout:
return -1;
}
static bool tfe_breakpad_dump_to_file(const google_breakpad::MinidumpDescriptor& descriptor,
void* context, bool succeeded)
{
fprintf(stderr, "Crash happened, minidump path: %s\n", descriptor.path());
return succeeded;
}
static bool tfe_breakpad_dump_and_report(const google_breakpad::MinidumpDescriptor& descriptor,
void* context, bool succeeded)
{
struct breakpad_instance * instance = g_verify_proxy->breakpad;
int ret = 0;
strncpy(instance->minidump_filename, descriptor.path(), PATH_MAX - 1);
fprintf(stderr, "Crash happened, prepare upload the minidump file: %s\n", descriptor.path());
ret = access(instance->minidump_filename, F_OK | R_OK);
if (ret < 0)
{
fprintf(stderr, "minidump file is not existed, cannot upload minidump file");
return succeeded;
}
/* Firstly, fork an child process */
pid_t exec_child_pid = fork();
if (exec_child_pid == 0)
{
/* As a child, exec minidump upload tools */
ret = execv(instance->upload_tools_filename, instance->upload_tools_exec_argv);
if (ret < 0)
{
fprintf(stderr, "Failed at exec the upload program %s: %s\n",
instance->upload_tools_filename, strerror(errno));
/* after log, reset errno */
errno = 0;
}
exit(EXIT_FAILURE);
}
else if (exec_child_pid > 0)
{
fprintf(stderr, "Starting upload minidump, PID = %d. \n", exec_child_pid);
return succeeded;
}
else
{
/* failed at fork, cannot upload the minidump */
fprintf(stderr, "Failed at fork(), cannot upload minidump file. : %s\n", strerror(errno));
/* after log, reset errno */
errno = 0;
return succeeded;
}
}
struct breakpad_instance * breakpad_init(const char * profile)
{
struct breakpad_instance * instance = ALLOC(struct breakpad_instance, 1);
assert(instance != nullptr);
int ret = 0;
unsigned int disable_coredump;
MESA_load_profile_uint_def(profile, "system", "disable_coredump", &disable_coredump, 0);
if (disable_coredump > 0)
{
const struct rlimit __rlimit_vars = {.rlim_cur = 0, .rlim_max = 0};
ret = setrlimit(RLIMIT_CORE, &__rlimit_vars);
if (ret < 0)
{
log_fatal(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "setrlimit(RLIMIT_CORE, 0) failed: %s", strerror(errno));
/* after log, reset errno */
errno = 0;
}
}
MESA_load_profile_uint_def(profile, "system", "enable_breakpad", &instance->en_breakpad, 1);
if (instance->en_breakpad <= 0)
{
log_fatal(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "Breakpad Crash Reporting System is disabled. ");
return instance;
}
MESA_load_profile_string_def(profile, "system", "breakpad_minidump_dir",
instance->minidump_dir_prefix, sizeof(instance->minidump_dir_prefix), "/tmp/crashreport");
MESA_load_profile_uint_def(profile, "system", "enable_breakpad_upload",
&instance->en_breakpad_upload, 0);
/* Create the minidump dir if it is not existed */
_mkdir(instance->minidump_dir_prefix);
if (instance->en_breakpad_upload)
{
/* Try to init the breakpad upload */
ret = breakpad_init_minidump_upload(instance, profile);
if (ret < 0)
{
log_fatal(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "Breakpad upload init failed, using local breakpad dumpfile");
instance->en_breakpad_upload = 0;
}
/* When we use breakpad, do not generate any coredump file */
const struct rlimit __rlimit_vars = {.rlim_cur = 0, .rlim_max = 0};
ret = setrlimit(RLIMIT_CORE, &__rlimit_vars);
if (ret < 0)
{
log_fatal(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "setrlimit(RLIMIT_CORE, 0) failed: %s", strerror(errno));
/* after log, reset errno */
errno = 0;
}
}
if (instance->en_breakpad_upload)
{
instance->exceptionHandler = new google_breakpad::ExceptionHandler(
google_breakpad::MinidumpDescriptor(instance->minidump_dir_prefix), NULL,
tfe_breakpad_dump_and_report, NULL, true, -1);
}
else
{
instance->exceptionHandler = new google_breakpad::ExceptionHandler(
google_breakpad::MinidumpDescriptor(instance->minidump_dir_prefix), NULL,
tfe_breakpad_dump_to_file, NULL, true, -1);
}
log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "Breakpad Crash Report is enable. ");
log_info(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "Minidump Dir: %s", instance->minidump_dir_prefix);
return instance;
}
void __signal_handler_cb(int sig)
{
switch (sig)
@@ -552,7 +331,7 @@ int main(int argc, char * argv[])
log_fatal(g_verify_proxy->logger, MODULE_VERIFY_POLICY, "Read table_info.conf, take time %lu(s)", end_time.tv_sec - start_time.tv_sec);
printf("Read table_info.conf, take time %lu(s)\n", end_time.tv_sec - start_time.tv_sec);
g_verify_proxy->breakpad = breakpad_init(main_profile);
g_verify_proxy->breakpad = breakpad_init(main_profile, "system", g_verify_proxy->logger, version());
CHECK_OR_EXIT(g_verify_proxy->breakpad, "Failed at starting breakpad. Exit.");
for (size_t i = 0; i < (sizeof(signals) / sizeof(int)); i++)

28
vendor/CMakeLists.txt vendored
View File

@@ -55,30 +55,6 @@ add_dependencies(gmock googletest)
set_property(TARGET gmock PROPERTY IMPORTED_LOCATION ${INSTALL_DIR}/lib/libgmock.a)
set_property(TARGET gmock PROPERTY INTERFACE_INCLUDE_DIRECTORIES ${INSTALL_DIR}/include)
### Google Breakpad Binary
### Caution: This package is a pre-compiled binary package, only used in x86_64 servers.
ExternalProject_Add(breakpad
PREFIX breakpad
URL ${CMAKE_CURRENT_SOURCE_DIR}/breakpad-master-abfe08e.tar.gz
URL_MD5 96fb25a9d96cc55db71a7f374ad363b4
CONFIGURE_COMMAND ./configure --prefix=<INSTALL_DIR>
BUILD_IN_SOURCE 1)
ExternalProject_Get_Property(breakpad INSTALL_DIR)
file(MAKE_DIRECTORY ${INSTALL_DIR}/include/breakpad)
add_library(breakpad-client-static STATIC IMPORTED GLOBAL)
add_dependencies(breakpad-client-static breakpad)
set_property(TARGET breakpad-client-static PROPERTY IMPORTED_LOCATION ${INSTALL_DIR}/lib/libbreakpad_client.a)
set_property(TARGET breakpad-client-static PROPERTY INTERFACE_INCLUDE_DIRECTORIES ${INSTALL_DIR}/include/breakpad)
target_link_libraries(breakpad-client-static INTERFACE pthread)
# install the minidump tools to target binary dir
install(PROGRAMS ${INSTALL_DIR}/bin/minidump-2-core DESTINATION bin COMPONENT)
install(PROGRAMS ${INSTALL_DIR}/bin/minidump_dump DESTINATION bin COMPONENT )
install(PROGRAMS ${INSTALL_DIR}/bin/minidump_stackwalk DESTINATION bin COMPONENT)
install(PROGRAMS ${INSTALL_DIR}/bin/minidump_upload DESTINATION bin COMPONENT)
### gperftools
ExternalProject_Add(gperftools
PREFIX gperftools
@@ -111,6 +87,10 @@ add_library(maatframe SHARED IMPORTED GLOBAL)
set_property(TARGET maatframe PROPERTY IMPORTED_LOCATION ${MESA_FRAMEWORK_LIB_DIR}/libmaatframe.so)
set_property(TARGET maatframe PROPERTY INTERFACE_INCLUDE_DIRECTORIES ${MESA_FRAMEWORK_INCLUDE_DIR})
add_library(breakpad_mini SHARED IMPORTED GLOBAL)
set_property(TARGET breakpad_mini PROPERTY IMPORTED_LOCATION ${MESA_FRAMEWORK_LIB_DIR}/libbreakpad_mini.so)
set_property(TARGET breakpad_mini PROPERTY INTERFACE_INCLUDE_DIRECTORIES ${MESA_FRAMEWORK_INCLUDE_DIR})
### pcre2
ExternalProject_Add(pcre2 PREFIX pcre2
URL ${CMAKE_CURRENT_SOURCE_DIR}/pcre2-10.32.tar.gz

BIN
vendor/breakpad-master-abfe08e.tar.gz vendored
View File

Binary file not shown.