On behalf of @Kr1sso
Initial draft for EndpointSecurity based sandbox support on macOS Catalina and higher. This is here to test and prototype a new sandbox for the upcoming OS release as kernel extensions are deprecated and will soon be forbidden.
Important
This currently only runs on systems with SIP disabled, using super user privileges and signing the bxl binary with a valid developer certificate before executing!
```
codesign --entitlements Private/macOS/sandbox.entitlements Out/Bin/Debug/osx-x64/bxl -s XYZ
```
A valid signing key (replace XYZ) can be obtained by using a registered MS developer account connected with an AppleID.
Running
```
security find-identity -v -p codesigning
```
will list those if any are available on the system.
* Full support for macOS Catalina (e.g. data partition path filtering, test adjustments) and sandbox update to support CI and build scenarios on beta 4 and upwards.
- don't define FEATURE_MICROSOFT_DIAGNOSTICS_TRACING constant for any builds
- remove all importFrom("Microsoft.Diagnostics.Tracing.EventSource.Redist").pkg
- remove all importFrom("Microsoft.Diagnostics.Tracing.TraceEvent").pkg
- remove all importFrom("Microsoft.Applications.Telemetry.Desktop").pkg
- add #if NET_FRAMEWORK_451 hacks to work around missing tracing features in .NET Framework 4.5.1
* Allow users to specify the source from which a qtest target is built. This is essential for the correct operation of qtest's flaky test detection and reporting.
* Minor
* Address reviewer comment
* Add a way to pass environment variables into the qtest pip
* Account for the possibility that qTestEnvironmentVariables may be undefined
* Address reviewer comment
This is one of three changes required for running journal tests in VM. In this change, we translate host UNC drive path that is often access by tools like dotnet.exe.
This change also include introduction of some special environment variables that the unit tests will use to work properly when run in VMs.
* Move coverage file upload to a pip dependent on the qtest pip, so that even if the test is a cache hit, coverage files will be uploaded
* Minor
* Fix argument
* Address reviewer comments
* Minor
* Address reviewer comments
* Minor
* Fix path separator
* Update qtest version
* Address reviewer comments
This change allows us to launch pips in the VM. This change also includes more logging when VmCommandProxy is invoked.
Some changes need to be added to CloudBuild's side:
Subst B: in VM for D:\dbs\el\bxlint
Net share D: in all involved host machines.
In this change we hook up the mechanism for running pip in VM.
Interaction with VM is via so-called VmCommandProxy, which is provided by CB team. Instead of calling the methods of VmCommandProxy, we launch VmCommandProxy executable with specific commands. In this way, we don't need to be bound by the .NET framework used by VmCommandProxy.
Currently, VM initialization requires username/password because it has to create a drive map from the VM back to the host. This will change soon. The changes in this PR will enable us to test running pip in VM in the CI/CBTest environment.
Before this PR, on every trie operation a leaf node corresponding to a given key is retrieved, creating any intermediate nodes along the way.
This is unnecessary for lookup operations. When the key does not exist in the trie, instead of traversing the trie until a leaf node is found and creating all intermediate nodes along the way, the lookup should fail as soon as an intermediate node is not found.
As a consequence of the previous implementation, if a process connects to the kext and then immediately disconnects, that alone causes the size of the `connectedClients_` dictionary to monotonically grow. This can become a problem because those nodes are released only when the kext is unloaded.
This will be useful because being able to control bundle identifier and buildxl class prefix from a single place will allow us to easily build and simultaneously load multiple versions of our kext (e.g., one for LKG and one for tests)
All OSObject classes are added to a global (system-wide) registry. To avoid name collisions with classes from other kernel extensions, class names should be fully qualified. Currently, we have a bunch of OSObject classes whose names are very generic, like Thread, or ConcurrentDictionary, or Node, etc.
This PR renames all our OSObject classes by prepending com_microsoft_buildxl_ to their existing names.
Iman Narasamdya
Aleksandar Milicevic
Kristijan Šimić
Anirudh Santhiar
Pratik Lade
Iman Narasamdya
Kevin Bazan Williams
Huihui Nora Huang
Microsoft Open Source