scope: shell-cov via busybox env-gate; netbinds always reports#873
Merged
Conversation
Refines the analysis-scoping feature in response to two problems found after merge: - netbinds was scoped to the firmware subtree, which silently dropped infra binds (e.g. gdbserver) and broke the indiv_debug+gdbserver test. Netbinds now always reports (igloo_driver: drop the sock_hc scope gate). - shell coverage was scoped on the host via an exec-seeded pid set, which missed fork-without-exec subshells, grew unbounded, and drifted on PID reuse. It now self-gates in busybox on the IGLOO_NO_SHELL_COV env marker, which gen_image injects into preinit only when scoping is enabled and init.sh clears at the firmware handoff. No host-side pid tracking. Syscall/exec scoping (namespace + driver scope_filter) is unchanged. core.analysis_scope remains the single switch: 'firmware' enables the driver syscall gate AND the preinit marker; 'none' disables both so everything reports. Test fixtures run the default 'firmware' path again so it stays covered. Requires busybox >= 0.0.17 (env-gated coverage) and igloo_driver >= 0.0.86 (netbinds ungated); pins bumped accordingly.
penguin-tools 0.0.18 bundles busybox a435ba5e with the shell-coverage env gate (IGLOO_NO_SHELL_COV), which is how the busybox change actually reaches the image (busybox is shipped via penguin-tools.tar.gz, not a release asset). BUSYBOX_VERSION is provenance-only, bumped to match. igloo_driver already at 0.0.86 (netbinds ungated).
The committed schema_doc.md was generated with the image's older pydantic, which renders multi-line Field descriptions unindented; current pydantic (what the test_schema CI job pip-installs) indents them. Regenerate so the snapshot section matches and the up-to-date check passes. Pre-existing drift surfaced by this PR; analysis_scope wording is unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Refines the analysis-scoping feature (#870) after two post-merge problems:
indiv_debug+gdbservertest. Now netbinds always reports (igloo_driver drops the sock gate).IGLOO_NO_SHELL_COVenv marker.Syscall/exec scoping is unchanged — that's the noise we actually want gone, and it stays.
How the marker works
gen_image.pyinjectsexport IGLOO_NO_SHELL_COV=1intopreinitonly whenanalysis_scopeis enabled (config-driven, not hardcoded — and avoids the MIPS 256-byte cmdline limit).init.shclears it at the firmware handoff → firmware reports.portal_hc()early-returns when it's set (busybox PR).core.analysis_scopestays the single switch:firmwareenables both the driver syscall gate and the preinit marker;nonedisables both. Removed the host-sidein_scope_pidsmachinery entirely (scope.py now only enables the driver gate).Coverage
Test fixtures go back to the default
analysis_scope: firmwareso the default path is exercised in CI again (wasnoneas a workaround for the netbinds/gdbserver break, which this fixes properly).CI builds against pinned deps, so this is red until:
BUSYBOX_VERSIONbumped hereIGLOO_DRIVER_VERSIONbumped herePins are already set to 0.0.17 / 0.0.86 in this PR; just need the matching releases cut.
Known edge case
guest_cmd/call_usermodehelperspawns don't inherit the env marker, so their shell coverage still reports (while their syscalls are scoped out as infra). Main infra path is fully covered. Can follow up by injecting the marker inportal_exec.c's envp if desired.