6 Commits (d6ff2ec60b12e1030e21389fcd4a8a2d6e11426e)

Author	SHA1	Message	Date
Alex Hall	5dfa9a542c	(core) Upgrade to Python 3.11 ... Summary: Replaced mentions of Python 3.9 with 3.11 Test Plan: this Reviewers: paulfitz, georgegevoian Reviewed By: paulfitz, georgegevoian Subscribers: dsagal, georgegevoian, paulfitz Differential Revision: https://phab.getgrist.com/D3980	1 year ago
Paul Fitzpatrick	472a9a186e	(core) control the distribution of attachment metadata ... Summary: for users who don't automatically have deep rights to the document, provide them with attachment metadata only for rows they have access to. This is a little tricky to do efficiently. We provide attachment metadata when an individual table is fetched, rather than on initial document load, so we don't block that load on a full document scan. We provide attachment metadata to a client when we see that we are shipping rows mentioning particular attachments, without making any effort to keep track of the metadata they already have. Test Plan: updated tests Reviewers: dsagal, jarek Reviewed By: dsagal, jarek Differential Revision: https://phab.getgrist.com/D3722	2 years ago
Paul Fitzpatrick	6dce083484	(core) add a GVISOR_USE_DEFAULT_USER flag to support different gvisor versions ... Summary: This is just a convenience for myself. I happen to have a version of gvisor on my Linux dev machine that differs from what we use in our containers. There's a small difference in user setup that only manifests itself when importing files. Grist uses a directory readable only by the creating user, created outside the container, and then accessed within the container. For that to work, the user identities have to line up exactly. This adds a flag I can set in my environment to make things work. An alternative solution that doesn't require a flag would be to make the temporary directories readable by other users, but that seemed a bigger change than justified. Ideally we'd make a very robust and easy to run sandbox for Linux users, and I have ideas there for the future. Test Plan: manual Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D3742	2 years ago
Paul Fitzpatrick	312d2331a8	(core) lock down modification of the _grist_Attachments table ... Summary: Rows in the _grist_Attachments table have a special lifecycle, being created by a special method, and deleted via a special process. All other modifications are now rejected, for simplicity. Test Plan: added test Reviewers: dsagal, jarek Reviewed By: dsagal, jarek Differential Revision: https://phab.getgrist.com/D3712	2 years ago
Paul Fitzpatrick	cf23a2d1ee	(core) add GVISOR_LIMIT_MEMORY to cap memory available in sandbox ... Summary: This allows limiting the memory available to documents in the sandbox when gvisor is used. If memory limit is exceeded, we offer to open doc in recovery mode. Recovery mode is tweaked to open docs with tables in "ondemand" mode, which will generally take less memory and allow for deleting rows. The limit is on the size of the virtual address space available to the sandbox (`RLIMIT_AS`), which in practice appears to function as one would want, and is the only practical option. There is a documented `RLIMIT_RSS` limit to `specifies the limit (in bytes) of the process's resident set (the number of virtual pages resident in RAM)` but this is no longer enforced by the kernel (neither the host nor gvisor). When the sandbox runs out of memory, there are many ways it can fail. This diff catches all the ones I saw, but there could be more. Test Plan: added tests Reviewers: alexmojaki Reviewed By: alexmojaki Subscribers: alexmojaki Differential Revision: https://phab.getgrist.com/D3398	2 years ago
Paul Fitzpatrick	134ae99e9a	(core) add gvisor-based sandboxing to core ... Summary: This adds support for gvisor sandboxing in core. When Grist is run outside of a container, regular gvisor can be used (if on linux), and will run in rootless mode. When Grist is run inside a container, docker's default policy is insufficient for running gvisor, so a fork of gvisor is used that has less defence-in-depth but can run without privileges. Sandboxing is automatically turned on in the Grist core container. It is not turned on automatically when built from source, since it is operating-system dependent. This diff may break a complex method of testing Grist with gvisor on macs that I may have been the only person using. If anyone complains I'll find time on a mac to fix it :) This diff includes a small "easter egg" to force document loads, primarily intended for developer use. Test Plan: existing tests pass; checked that core and saas docker builds function Reviewers: alexmojaki Reviewed By: alexmojaki Subscribers: alexmojaki Differential Revision: https://phab.getgrist.com/D3333	3 years ago