Remove the syscall sandbox

After initially being merged in #20487, it's no-longer clear that an
internal syscall sandboxing mechanism is something that Bitcoin Core
should have/maintain, especially when compared to better
maintained/supported alterantives, i.e firejail.

Note that given where it's used, the sandbox also gets dragged into the
kernel.

There is some related discussion in #24771.

This should not require any sort of deprecation, as this was only ever
an opt-in, experimental feature.

Closes #24771.
This commit is contained in:
fanquake
2023-05-04 12:07:26 +01:00
parent b3db18a012
commit 32e2ffc393
28 changed files with 5 additions and 1175 deletions

View File

@@ -21,7 +21,6 @@
#include <univalue.h>
#include <util/any.h>
#include <util/check.h>
#include <util/syscall_sandbox.h>
#include <stdint.h>
#ifdef HAVE_MALLOC_INFO
@@ -70,27 +69,6 @@ static RPCHelpMan setmocktime()
};
}
#if defined(USE_SYSCALL_SANDBOX)
static RPCHelpMan invokedisallowedsyscall()
{
return RPCHelpMan{
"invokedisallowedsyscall",
"\nInvoke a disallowed syscall to trigger a syscall sandbox violation. Used for testing purposes.\n",
{},
RPCResult{RPCResult::Type::NONE, "", ""},
RPCExamples{
HelpExampleCli("invokedisallowedsyscall", "") + HelpExampleRpc("invokedisallowedsyscall", "")},
[&](const RPCHelpMan& self, const JSONRPCRequest& request) -> UniValue {
if (!Params().IsTestChain()) {
throw std::runtime_error("invokedisallowedsyscall is used for testing only.");
}
TestDisallowedSandboxCall();
return UniValue::VNULL;
},
};
}
#endif // USE_SYSCALL_SANDBOX
static RPCHelpMan mockscheduler()
{
return RPCHelpMan{"mockscheduler",
@@ -428,9 +406,6 @@ void RegisterNodeRPCCommands(CRPCTable& t)
{"hidden", &echo},
{"hidden", &echojson},
{"hidden", &echoipc},
#if defined(USE_SYSCALL_SANDBOX)
{"hidden", &invokedisallowedsyscall},
#endif // USE_SYSCALL_SANDBOX
};
for (const auto& c : commands) {
t.appendCommand(c.name, &c);