New mount API: implement fsopen(2), fsconfig(2), fsmount(2), move_mount(2).

The first step in implementing the new file-descriptor based mount API in
gVisor. A "filesystem creation context" is created using fsopen(). The context
is then configured using fsconfig(), and the FSCONFIG_CMD_CREATE command is
used to create a filesystem. A "mount object" can be obtained using fsmount(),
which can be operated on directly using the *at() functions or mounted onto the
real directory tree using move_mount().

For compatibility reasons, the new mount API is gated behind the runtime flag
`--new-mount-api`, which is disabled by default.

The current implementation has the following limitations:
- Linux passes configuration options to filesystems on-the-fly as fsopen() and
  fsconfig() are called, allowing per-parameter error handling. gVisor
  currently queues up all options and passes them to the filesystem all-at-once
  when FSCONFIG_CMD_CREATE occurs. Lifting this will require refactoring the
  option parsing for all existing filesystems.
- Only flag and string arguments to fsconfig() are supported.
- Reconfiguration of the filesystem through fsconfig() is not supported.
- move_mount(): flags MOVE_MOUNT_SET_GROUP and MOVE_MOUNT_BENEATH are not
  supported.
- The filesystem context message retrieval interface is not supported.

In the interest of review size, there is no implementation yet for
open_tree(2) or fspick(2).

PiperOrigin-RevId: 923640824

Author: relkochta

pkg/abi/linux/file.go

@@ -100,6 +100,56 @@ const (
 	UMOUNT_NOFOLLOW = 0x8
 )
 
+// Constants for fsopen(2).
+const (
+	FSOPEN_CLOEXEC = 0x1
+)
+
+// Constants for fsconfig(2).
+const (
+	FSCONFIG_SET_FLAG        = 0x0
+	FSCONFIG_SET_STRING      = 0x1
+	FSCONFIG_SET_BINARY      = 0x2
+	FSCONFIG_SET_PATH        = 0x3
+	FSCONFIG_SET_PATH_EMPTY  = 0x4
+	FSCONFIG_SET_FD          = 0x5
+	FSCONFIG_CMD_CREATE      = 0x6
+	FSCONFIG_CMD_RECONFIGURE = 0x7
+	FSCONFIG_CMD_CREATE_EXCL = 0x8
+)
+
+// Constants for fsmount(2).
+const (
+	FSMOUNT_CLOEXEC = 0x1
+)
+
+// Constants for move_mount(2).
+const (
+	MOVE_MOUNT_F_SYMLINKS   = 0x00000001
+	MOVE_MOUNT_F_AUTOMOUNTS = 0x00000002
+	MOVE_MOUNT_F_EMPTY_PATH = 0x00000004
+	MOVE_MOUNT_T_SYMLINKS   = 0x00000010
+	MOVE_MOUNT_T_AUTOMOUNTS = 0x00000020
+	MOVE_MOUNT_T_EMPTY_PATH = 0x00000040
+	MOVE_MOUNT_SET_GROUP    = 0x00000100
+	MOVE_MOUNT_BENEATH      = 0x00000200
+)
+
+// Constants for mount_setattr(2).
+const (
+	MOUNT_ATTR_RDONLY      = 0x00000001
+	MOUNT_ATTR_NOSUID      = 0x00000002
+	MOUNT_ATTR_NODEV       = 0x00000004
+	MOUNT_ATTR_NOEXEC      = 0x00000008
+	MOUNT_ATTR__ATIME      = 0x00000070
+	MOUNT_ATTR_RELATIME    = 0x00000000
+	MOUNT_ATTR_NOATIME     = 0x00000010
+	MOUNT_ATTR_STRICTATIME = 0x00000020
+	MOUNT_ATTR_NODIRATIME  = 0x00000080
+	MOUNT_ATTR_IDMAP       = 0x00100000
+	MOUNT_ATTR_NOSYMFOLLOW = 0x00200000
+)
+
 // Constants for unlinkat(2).
 const (
 	AT_REMOVEDIR = 0x200

pkg/sentry/fsimpl/fsconfigfd/BUILD

@@ -0,0 +1,19 @@
+load("//tools:defs.bzl", "go_library")
+
+package(default_applicable_licenses = ["//:license"])
+
+licenses(["notice"])
+
+go_library(
+    name = "fsconfigfd",
+    srcs = ["fsconfigfd.go"],
+    visibility = ["//pkg/sentry:internal"],
+    deps = [
+        "//pkg/abi/linux",
+        "//pkg/context",
+        "//pkg/errors/linuxerr",
+        "//pkg/sentry/kernel/auth",
+        "//pkg/sentry/vfs",
+        "//pkg/sync",
+    ],
+)