Skip to content

Commit d60758e

Browse files
schandr78schandr78
committed
Revert "Merged PR 692519: Apply an allowed-list logic to filter out shared opaque outputs and undeclared source reads"
This reverts commit bf0e495.
1 parent 1bac9b1 commit d60758e

File tree

7 files changed

+131
-427
lines changed

7 files changed

+131
-427
lines changed

‎Public/Src/Engine/Processes/FileAccessReportingContext.cs‎

Lines changed: 58 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -80,32 +80,6 @@ public void ReportFileAccessDeniedByManifest(ReportedFileAccess unexpectedFileAc
8080
MatchAndReportUnexpectedFileAccess(unexpectedFileAccess);
8181
}
8282

83-
/// <summary>
84-
/// Matches an instance of <see cref="ReportedFileAccess"/> with allow list entries.
85-
/// </summary>
86-
public FileAccessAllowlist.MatchType MatchReportedFileAccess(ReportedFileAccess fileAccess) =>
87-
m_fileAccessAllowlist?.HasEntries == true
88-
? m_fileAccessAllowlist.Matches(m_loggingContext, fileAccess, m_pip)
89-
: FileAccessAllowlist.MatchType.NoMatch;
90-
91-
/// <summary>
92-
/// Matches an instance of <see cref="ObservedFileAccess"/> with allow list entries.
93-
/// </summary>
94-
public (FileAccessAllowlist.MatchType aggregateMatchType, (ReportedFileAccess, FileAccessAllowlist.MatchType)[] reportedMatchTypes) MatchObservedFileAccess(ObservedFileAccess observedFileAccess)
95-
{
96-
var aggregateMatch = FileAccessAllowlist.MatchType.MatchesAndCacheable;
97-
var rfas = new (ReportedFileAccess, FileAccessAllowlist.MatchType)[observedFileAccess.Accesses.Count];
98-
int index = 0;
99-
foreach (ReportedFileAccess reportedAccess in observedFileAccess.Accesses)
100-
{
101-
FileAccessAllowlist.MatchType thisMatch = MatchReportedFileAccess(reportedAccess);
102-
rfas[index++] = (reportedAccess, thisMatch);
103-
aggregateMatch = AggregateMatchType(aggregateMatch, thisMatch);
104-
}
105-
106-
return (aggregateMatch, rfas);
107-
}
108-
10983
/// <summary>
11084
/// For an unexpected <see cref="ObservedFileAccess"/> (which is actually an aggregation of <see cref="ReportedFileAccess"/>es to
11185
/// a single path), reports each constituent access and computes an aggregate allowlist match type (the least permissive of any
@@ -117,83 +91,76 @@ public FileAccessAllowlist.MatchType MatchAndReportUnexpectedObservedFileAccess(
11791
foreach (ReportedFileAccess reportedAccess in unexpectedObservedFileAccess.Accesses)
11892
{
11993
FileAccessAllowlist.MatchType thisMatch = MatchAndReportUnexpectedFileAccess(reportedAccess);
120-
aggregateMatch = AggregateMatchType(aggregateMatch, thisMatch);
121-
}
12294

123-
return aggregateMatch;
124-
}
125-
126-
private static FileAccessAllowlist.MatchType AggregateMatchType(FileAccessAllowlist.MatchType aggregateType, FileAccessAllowlist.MatchType currentType)
127-
{
128-
switch (currentType)
129-
{
130-
case FileAccessAllowlist.MatchType.NoMatch:
131-
aggregateType = FileAccessAllowlist.MatchType.NoMatch;
132-
break;
133-
case FileAccessAllowlist.MatchType.MatchesButNotCacheable:
134-
if (aggregateType == FileAccessAllowlist.MatchType.MatchesAndCacheable)
135-
{
136-
aggregateType = FileAccessAllowlist.MatchType.MatchesButNotCacheable;
137-
}
138-
139-
break;
140-
default:
141-
Contract.Assert(currentType == FileAccessAllowlist.MatchType.MatchesAndCacheable);
142-
break;
95+
switch (thisMatch)
96+
{
97+
case FileAccessAllowlist.MatchType.NoMatch:
98+
aggregateMatch = FileAccessAllowlist.MatchType.NoMatch;
99+
break;
100+
case FileAccessAllowlist.MatchType.MatchesButNotCacheable:
101+
if (aggregateMatch == FileAccessAllowlist.MatchType.MatchesAndCacheable)
102+
{
103+
aggregateMatch = FileAccessAllowlist.MatchType.MatchesButNotCacheable;
104+
}
105+
106+
break;
107+
default:
108+
Contract.Assert(thisMatch == FileAccessAllowlist.MatchType.MatchesAndCacheable);
109+
break;
110+
}
143111
}
144112

145-
return aggregateType;
113+
return aggregateMatch;
146114
}
147115

148116
/// <summary>
149117
/// Reports an access that - ignoring allowlisting - was unexpected. This can be due to a manifest-side or BuildXL-side denial decision.
150118
/// </summary>
151119
private FileAccessAllowlist.MatchType MatchAndReportUnexpectedFileAccess(ReportedFileAccess unexpectedFileAccess)
152120
{
153-
FileAccessAllowlist.MatchType matchType = FileAccessAllowlist.MatchType.NoMatch;
154-
155121
if (m_fileAccessAllowlist != null && m_fileAccessAllowlist.HasEntries)
156122
{
157123
Contract.Assert(
158124
m_config.FailUnexpectedFileAccesses == false,
159125
"Having a file-access allowlist requires that Detours failure injection is off.");
160126

161-
matchType = m_fileAccessAllowlist.Matches(m_loggingContext, unexpectedFileAccess, m_pip);
162-
}
163-
164-
ReportFileAccess(unexpectedFileAccess, matchType);
165-
return matchType;
166-
}
127+
FileAccessAllowlist.MatchType matchType = m_fileAccessAllowlist.Matches(m_loggingContext, unexpectedFileAccess, m_pip);
128+
switch (matchType)
129+
{
130+
case FileAccessAllowlist.MatchType.NoMatch:
131+
AddUnexpectedFileAccessNotAllowlisted(unexpectedFileAccess);
132+
ReportUnexpectedFileAccessNotAllowlisted(unexpectedFileAccess);
133+
break;
134+
case FileAccessAllowlist.MatchType.MatchesButNotCacheable:
135+
AddUnexpectedFileAccessAllowlisted(unexpectedFileAccess);
136+
m_numAllowlistedButNotCacheableFileAccessViolations++;
137+
ReportAllowlistedFileAccessNonCacheable(unexpectedFileAccess);
138+
break;
139+
case FileAccessAllowlist.MatchType.MatchesAndCacheable:
140+
AddUnexpectedFileAccessAllowlisted(unexpectedFileAccess);
141+
m_numAllowlistedAndCacheableFileAccessViolations++;
142+
ReportAllowlistedFileAccessCacheable(unexpectedFileAccess);
143+
break;
144+
default:
145+
throw Contract.AssertFailure("Unknown allowlist-match type.");
146+
}
167147

168-
/// <summary>
169-
/// Reports file access to this reporting context.
170-
/// </summary>
171-
public void ReportFileAccess(ReportedFileAccess fileAccess, FileAccessAllowlist.MatchType matchType)
172-
{
173-
switch (matchType)
148+
return matchType;
149+
}
150+
else
174151
{
175-
case FileAccessAllowlist.MatchType.NoMatch:
176-
AddUnexpectedFileAccessNotAllowlisted(fileAccess);
177-
ReportUnexpectedFileAccessNotAllowlisted(fileAccess);
178-
break;
179-
case FileAccessAllowlist.MatchType.MatchesButNotCacheable:
180-
AddUnexpectedFileAccessAllowlisted(fileAccess);
181-
m_numAllowlistedButNotCacheableFileAccessViolations++;
182-
ReportAllowlistedFileAccessNonCacheable(fileAccess);
183-
break;
184-
case FileAccessAllowlist.MatchType.MatchesAndCacheable:
185-
AddUnexpectedFileAccessAllowlisted(fileAccess);
186-
m_numAllowlistedAndCacheableFileAccessViolations++;
187-
ReportAllowlistedFileAccessCacheable(fileAccess);
188-
break;
189-
default:
190-
throw Contract.AssertFailure("Unknown allowlist-match type.");
152+
AddUnexpectedFileAccessNotAllowlisted(unexpectedFileAccess);
153+
ReportUnexpectedFileAccessNotAllowlisted(unexpectedFileAccess);
154+
return FileAccessAllowlist.MatchType.NoMatch;
191155
}
192156
}
193157

194158
private void AddUnexpectedFileAccessNotAllowlisted(ReportedFileAccess reportedFileAccess)
195159
{
196-
m_violations ??= new List<ReportedFileAccess>();
160+
if (m_violations == null)
161+
{
162+
m_violations = new List<ReportedFileAccess>();
163+
}
197164

198165
if (reportedFileAccess.Operation != ReportedFileOperation.NtCreateFile || m_config.UnsafeSandboxConfiguration.MonitorNtCreateFile)
199166
{
@@ -208,7 +175,10 @@ private void AddUnexpectedFileAccessNotAllowlisted(ReportedFileAccess reportedFi
208175

209176
private void AddUnexpectedFileAccessAllowlisted(ReportedFileAccess reportedFileAccess)
210177
{
211-
m_allowlistedAccesses ??= new List<ReportedFileAccess>();
178+
if (m_allowlistedAccesses == null)
179+
{
180+
m_allowlistedAccesses = new List<ReportedFileAccess>();
181+
}
212182

213183
if (reportedFileAccess.Operation != ReportedFileOperation.NtCreateFile || m_config.UnsafeSandboxConfiguration.MonitorNtCreateFile)
214184
{
@@ -223,7 +193,7 @@ private void ReportUnexpectedFileAccessNotAllowlisted(ReportedFileAccess reporte
223193

224194
if (path.StartsWith(PipEnvironment.RestrictedTemp, OperatingSystemHelper.PathComparison))
225195
{
226-
Tracing.Logger.Log.PipProcessDisallowedTempFileAccess(
196+
BuildXL.Processes.Tracing.Logger.Log.PipProcessDisallowedTempFileAccess(
227197
m_loggingContext,
228198
m_pip.SemiStableHash,
229199
m_pip.GetDescription(m_context),
@@ -232,7 +202,7 @@ private void ReportUnexpectedFileAccessNotAllowlisted(ReportedFileAccess reporte
232202
}
233203
else
234204
{
235-
Tracing.Logger.Log.PipProcessDisallowedFileAccess(
205+
BuildXL.Processes.Tracing.Logger.Log.PipProcessDisallowedFileAccess(
236206
m_loggingContext,
237207
m_pip.SemiStableHash,
238208
m_pip.GetDescription(m_context),
@@ -242,13 +212,13 @@ private void ReportUnexpectedFileAccessNotAllowlisted(ReportedFileAccess reporte
242212
path);
243213

244214
if (reportedFileAccess.Operation == ReportedFileOperation.NtCreateFile &&
245-
!m_config.UnsafeSandboxConfiguration.MonitorNtCreateFile)
215+
!m_config.UnsafeSandboxConfiguration.MonitorNtCreateFile)
246216
{
247217
// If the unsafe_IgnoreNtCreate is set, disallowed ntCreateFile accesses are not marked as violations.
248218
// Since there will be no error or warning for the ignored NtCreateFile violations in the FileMonitoringViolationAnalyzer,
249219
// this is the only place for us to log a warning for those.
250220
// We also need to emit a dx09 verbose above for those violations due to WrapItUp.
251-
Tracing.Logger.Log.PipProcessDisallowedNtCreateFileAccessWarning(
221+
BuildXL.Processes.Tracing.Logger.Log.PipProcessDisallowedNtCreateFileAccessWarning(
252222
m_loggingContext,
253223
m_pip.SemiStableHash,
254224
m_pip.GetDescription(m_context),
@@ -267,7 +237,7 @@ private void ReportAllowlistedFileAccessNonCacheable(ReportedFileAccess reported
267237

268238
if (m_reportAllowlistedAccesses)
269239
{
270-
Tracing.Logger.Log.PipProcessUncacheableAllowlistNotAllowedInDistributedBuilds(
240+
BuildXL.Processes.Tracing.Logger.Log.PipProcessUncacheableAllowlistNotAllowedInDistributedBuilds(
271241
m_loggingContext,
272242
m_pip.SemiStableHash,
273243
m_pip.GetDescription(m_context),
@@ -278,7 +248,7 @@ private void ReportAllowlistedFileAccessNonCacheable(ReportedFileAccess reported
278248
}
279249
else
280250
{
281-
Tracing.Logger.Log.PipProcessDisallowedFileAccessAllowlistedNonCacheable(
251+
BuildXL.Processes.Tracing.Logger.Log.PipProcessDisallowedFileAccessAllowlistedNonCacheable(
282252
m_loggingContext,
283253
m_pip.SemiStableHash,
284254
m_pip.GetDescription(m_context),
@@ -292,7 +262,7 @@ private void ReportAllowlistedFileAccessCacheable(ReportedFileAccess reportedFil
292262
string path = reportedFileAccess.GetPath(m_context.PathTable);
293263
string description = reportedFileAccess.Describe();
294264

295-
Tracing.Logger.Log.PipProcessDisallowedFileAccessAllowlistedCacheable(
265+
BuildXL.Processes.Tracing.Logger.Log.PipProcessDisallowedFileAccessAllowlistedCacheable(
296266
m_loggingContext,
297267
m_pip.SemiStableHash,
298268
m_pip.GetDescription(m_context),

0 commit comments

Comments
 (0)