unblocked_terms.txt: clean up trivial cases

Avoid some easily-replaced non-inclusive words and remove them from the
unblocked_terms.txt list.

Remove a clippy lint with a name matching the list since all affected
warnings have already been removed.

Remove all terms that are already not present in the crosvm
repository from unblocked_terms.txt (including the commented lines).

BUG=b:178821708
TEST=../dev/contrib/search_blocked_words.sh unblocked_terms.txt
TEST=cargo test -p devices
TEST=cargo test -p disk
TEST=bin/clippy

Change-Id: I8261921380decc839f01adb9ad1d4d14d5a85114
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2847462
Reviewed-by: Dennis Kempin <denniskempin@google.com>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
This commit is contained in:
Daniel Verkamp 2021-04-22 13:42:16 -07:00 committed by Commit Bot
parent 6869e53101
commit 6ded64f192
6 changed files with 8 additions and 34 deletions

View file

@ -59,7 +59,6 @@ SUPPRESS=(
field_reassign_with_default
# We don't care about these lints. Okay to remain suppressed globally.
blacklisted_name
cast_lossless
cognitive_complexity
enum_variant_names

View file

@ -2267,15 +2267,15 @@ mod tests {
strip_xattr_prefix(&mut actual);
assert_eq!(&actual[..], &no_strippable_names[..]);
let only_strippable_names = b"user.virtiofs.security.sehash\0user.virtiofs.security.wtf\0";
let only_strippable_names = b"user.virtiofs.security.sehash\0user.virtiofs.security.wat\0";
let mut actual = only_strippable_names.to_vec();
strip_xattr_prefix(&mut actual);
assert_eq!(&actual[..], b"security.sehash\0security.wtf\0");
assert_eq!(&actual[..], b"security.sehash\0security.wat\0");
let mixed_names = b"user.virtiofs.security.sehash\0security.selinux\0user.virtiofs.security.wtf\0user.foobar\0";
let mixed_names = b"user.virtiofs.security.sehash\0security.selinux\0user.virtiofs.security.wat\0user.foobar\0";
let mut actual = mixed_names.to_vec();
strip_xattr_prefix(&mut actual);
let expected = b"security.sehash\0security.selinux\0security.wtf\0user.foobar\0";
let expected = b"security.sehash\0security.selinux\0security.wat\0user.foobar\0";
assert_eq!(&actual[..], &expected[..]);
let no_nul_with_prefix = b"user.virtiofs.security.sehash";

View file

@ -1916,7 +1916,7 @@ mod tests {
}
#[test]
fn test_header_crazy_file_size_rejected() {
fn test_header_excessive_file_size_rejected() {
let mut header = valid_header();
&mut header[24..32].copy_from_slice(&[0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x1e]);
with_basic_file(&header, |disk_file: File| {
@ -1969,7 +1969,7 @@ mod tests {
let mut header = valid_header();
&mut header[56..60].copy_from_slice(&[0x02, 0x00, 0xe8, 0xff]);
with_basic_file(&header, |disk_file: File| {
QcowFile::from(disk_file).expect_err("Created disk with crazy refcount clusters");
QcowFile::from(disk_file).expect_err("Created disk with excessive refcount clusters");
});
}
@ -1978,7 +1978,7 @@ mod tests {
let mut header = valid_header();
&mut header[48..56].copy_from_slice(&[0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x02, 0x00]);
with_basic_file(&header, |disk_file: File| {
QcowFile::from(disk_file).expect_err("Created disk with crazy refcount offset");
QcowFile::from(disk_file).expect_err("Created disk with excessive refcount offset");
});
}

View file

@ -19,7 +19,7 @@ A typical session of crosvm starts in `main.rs` where command line parsing is do
## Forking
During the device creation routine, each device will be created and then wrapped in a `ProxyDevice` which will internally `fork` (but not `exec`) and [minijail] the device, while dropping it for the main process. The only interaction that the device is capable of having with the main process is via the proxied trait methods of `BusDevice`, shared memory mappings such as the guest memory, and file descriptors that were specifically whitelisted by that device's security policy. This can lead to some surprising behavior to be aware of such as why some file descriptors which were once valid are now invalid.
During the device creation routine, each device will be created and then wrapped in a `ProxyDevice` which will internally `fork` (but not `exec`) and [minijail] the device, while dropping it for the main process. The only interaction that the device is capable of having with the main process is via the proxied trait methods of `BusDevice`, shared memory mappings such as the guest memory, and file descriptors that were specifically allowed by that device's security policy. This can lead to some surprising behavior to be aware of such as why some file descriptors which were once valid are now invalid.
## Sandboxing Policy

View file

@ -3,33 +3,8 @@
#
# See repohooks/README.md for more details.
# black.?hat
black.?list
# build.?cop
crazy
# cripple
dummy
# first.?class.?citizen
# grandfathered
# gr[ae]y.?hat
# gr[ae]y.?list
# \bhe\b
# \bshe\b
# \bhim\b
# \bher\b
# \bhis\b
# \bhers\b
# man.?in.?the.?middle
master
# \bmitm(\b|\d)
\bnative
# \bred.?line
# rtfm
# \b(in)?sane(\b|\d)
sanity
slave
# white.?glove
# white.?hat
# white.?label
white.?list
\bwtf