Merge branch 'main' into auto-generate-syscall-mapping

Author: celinehoang177

.github/workflows/dev.yml

@@ -11,7 +11,7 @@ jobs:
     environment: dockerhub
     steps:
       - name: Login to Docker Hub
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           username: securesystemslab
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/release.yml

@@ -13,7 +13,7 @@ jobs:
     environment: dockerhub
     steps:
       - name: Login to Docker Hub
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           username: securesystemslab
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.gitignore

@@ -5,6 +5,7 @@ clang+llvm-*
 #Ignore WebAssembly artifacts
 *.wasm
 *.cwasm
+*.wat
 
 #Ignore Build artifacts
 src/glibc/build/
@@ -15,6 +16,7 @@ scripts/object_lists_final/
 #Ignore testing results
 e2e_status
 reports/
+report.html
 
 #Ignore python cache
 __pycache__/

Docker/Dockerfile.dev

@@ -86,6 +86,7 @@ WORKDIR /home/${USERNAME}
 # --profile minimal tells rustup to install only the essentials for the toolchain
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
     sh -s -- -y --profile minimal
+RUN /home/${USERNAME}/.cargo/bin/rustup component add rust-src --toolchain nightly-2026-02-11-x86_64-unknown-linux-gnu
 
 # --- Clone the repo as user ---
 RUN git clone --branch "${BRANCH_NAME}" --single-branch "${REPO_URL}" /home/${USERNAME}/lind-wasm
@@ -123,8 +124,14 @@ ENV LIND_WASM_ROOT=/home/${USERNAME}/lind-wasm
 USER root
 RUN install -D -m 0755 /home/${USERNAME}/lind-wasm/scripts/lind_compile /usr/local/bin/lind_compile \
  && install -D -m 0755 /home/${USERNAME}/lind-wasm/scripts/lind_run     /usr/local/bin/lind_run     \
+ && install -D -m 0755 /home/${USERNAME}/lind-wasm/scripts/cargo-lind_compile /usr/local/bin/cargo-lind_compile \
  && ln -sf /usr/local/bin/lind_compile /usr/local/bin/lind-clang \
- && ln -sf /usr/local/bin/lind_run     /usr/local/bin/lind-wasm
+ && ln -sf /usr/local/bin/lind_run     /usr/local/bin/lind-wasm \
+ && ln -sf /usr/local/bin/cargo-lind_compile /usr/local/bin/lind-cargo-build
+# Replace copied helper scripts with symlinks so local edits are reflected.
+RUN rm -f /usr/local/bin/lind_compile /usr/local/bin/lind_run \
+ && ln -sf /home/${USERNAME}/lind-wasm/scripts/lind_compile /usr/local/bin/lind_compile \
+ && ln -sf /home/${USERNAME}/lind-wasm/scripts/lind_run     /usr/local/bin/lind_run
 USER ${USERNAME}
 
 CMD ["/bin/bash"]

Docker/Dockerfile.e2e

@@ -99,6 +99,7 @@ RUN wget http://security.ubuntu.com/ubuntu/pool/universe/n/ncurses/libtinfo5_6.3
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
     sh -s -- -y --profile minimal
 ENV PATH="/root/.cargo/bin:${PATH}"
+RUN rustup component add rust-src --toolchain nightly-2026-02-11-x86_64-unknown-linux-gnu
 
 
 # Build lind-boot
@@ -124,12 +125,14 @@ RUN make lind-boot
 FROM base AS build-glibc
 # NOTE: Using 'make' risks cache invalidation on unrelated Makefile changes
 COPY scripts ./scripts
+COPY tools ./tools
 COPY --parents src/glibc Makefile .
-RUN make sysroot
+COPY --from=build-lind-boot --parents build/lind-boot .
+RUN make sysroot \
+ && test -f lindfs/lib/libc.cwasm \
+ && test -f lindfs/lib/libm.cwasm
 
 
-# Build Docker image that includes the full lind-wasm toolchain
-# NOTE: Lind-wasm source code is not included
 # Build Docker image that includes the full lind-wasm toolchain
 # NOTE: Lind-wasm source code is not included
 FROM base AS release
@@ -139,33 +142,45 @@ COPY --from=build-lind-boot --parents build/lind-boot .
 RUN chmod 0755 /build/lind-boot
 COPY --from=build-glibc --parents src/glibc/sysroot .
 COPY --from=build-glibc --parents build/sysroot .
+COPY --from=build-glibc --parents lindfs .
 COPY --parents scripts tests tools skip_test_cases.txt .
 
 ENV LIND_WASM_ROOT=/
 
-RUN install -D -m 0755 /scripts/lind_compile /usr/local/bin/lind_compile \
- && install -D -m 0755 /scripts/lind_run     /usr/local/bin/lind_run     \
+RUN chmod 0755 /scripts/lind_compile /scripts/lind_run /scripts/cargo-lind_compile \
+ && ln -sf /scripts/lind_compile /usr/local/bin/lind_compile \
+ && ln -sf /scripts/lind_run     /usr/local/bin/lind_run \
+ && install -D -m 0755 /scripts/cargo-lind_compile /usr/local/bin/cargo-lind_compile \
  && ln -sf /usr/local/bin/lind_compile /usr/local/bin/lind-clang \
- && ln -sf /usr/local/bin/lind_run     /usr/local/bin/lind-wasm
+ && ln -sf /usr/local/bin/lind_run     /usr/local/bin/lind-wasm \
+ && ln -sf /usr/local/bin/cargo-lind_compile /usr/local/bin/lind-cargo-build
 
 
 # Run all tests, print results, and exit with 1, if any test fails; 0 otherwise
 FROM base AS test
 ENV LIND_WASM_ROOT=/
 COPY --parents scripts tests tools skip_test_cases.txt Makefile .
 RUN chmod 0755 /scripts/test_runner.py /scripts/lind_compile /scripts/lind_run \
- && install -D -m 0755 /scripts/lind_compile /usr/local/bin/lind_compile \
- && install -D -m 0755 /scripts/lind_run     /usr/local/bin/lind_run \
+ && chmod 0755 /scripts/cargo-lind_compile \
+ && ln -sf /scripts/lind_compile /usr/local/bin/lind_compile \
+ && ln -sf /scripts/lind_run     /usr/local/bin/lind_run \
+ && install -D -m 0755 /scripts/cargo-lind_compile /usr/local/bin/cargo-lind_compile \
  && ln -sf /usr/local/bin/lind_compile /usr/local/bin/lind-clang \
- && ln -sf /usr/local/bin/lind_run     /usr/local/bin/lind-wasm
+ && ln -sf /usr/local/bin/lind_run     /usr/local/bin/lind-wasm \
+ && ln -sf /usr/local/bin/cargo-lind_compile /usr/local/bin/lind-cargo-build
+# NOTE: Precompiled lindfs runtime libraries are mounted and copied into the
+# writable test lindfs so runtime preloads like /lib/libc.cwasm are available.
 # Create symlink so hardcoded paths in wasmtime match Docker environment
 RUN mkdir -p /home/lind && ln -sf / /home/lind/lind-wasm
 # NOTE: Build artifacts from prior stages are only mounted, to save COPY time
 # and cache layers. This means they are not preserved in the resulting image.
 RUN --mount=from=build-lind-boot,source=src/lind-boot/target,destination=src/lind-boot/target \
     --mount=from=build-lind-boot,source=build/lind-boot,destination=/build/lind-boot \
+    --mount=from=build-glibc,source=lindfs,destination=/prebuilt-lindfs,readonly \
     --mount=from=build-glibc,source=src/glibc/sysroot,destination=src/glibc/sysroot \
-    make test && \
+    make PREBUILT_LINDFS_ROOT=/prebuilt-lindfs \
+         LIND_RUNTIME_LINDFS_ALIAS=/home/lind/lind-wasm/lindfs \
+         test && \
     make md_generation OUT=/ REPORT=/report.html
 
 

Makefile

@@ -7,6 +7,7 @@ LINDFS_DIRS := \
 	       bin \
 	       dev \
 	       etc \
+	       lib \
 	       sbin \
 	       tmp \
 	       usr/bin \
@@ -18,6 +19,8 @@ LINDFS_DIRS := \
 	       var/log \
 	       var/run
 
+WITH_FPCAST ?=
+
 .PHONY: build 
 build: generate-syscall-mappings lindfs lind-boot sysroot
 	@echo "Build complete"
@@ -27,7 +30,7 @@ all: build
 
 .PHONY: sysroot
 sysroot: build-dir
-	./scripts/make_glibc_and_sysroot.sh
+	./scripts/make_glibc_and_sysroot.sh $(if $(WITH_FPCAST),--with-fpcast)
 	$(MAKE) sync-sysroot
 
 .PHONY: lind-boot
@@ -47,13 +50,13 @@ lindfs:
 	cp -rT scripts/lindfs-conf/usr/share/zoneinfo $(LINDFS_ROOT)/usr/share/zoneinfo
 
 .PHONY: lind-debug
-lind-debug: build-dir
-	# Build glibc with LIND_DEBUG enabled (by setting the LIND_DEBUG variable)
-	$(MAKE) build_glibc LIND_DEBUG=1
-	
+lind-debug: lindfs build-dir
 	# Build lind-boot with the lind_debug feature enabled
 	cargo build --manifest-path src/lind-boot/Cargo.toml --features lind_debug
 	cp src/lind-boot/target/debug/lind-boot $(LINDBOOT_BIN)
+
+	# Build glibc with LIND_DEBUG enabled (by setting the LIND_DEBUG variable)
+	$(MAKE) build_glibc LIND_DEBUG=1
 build_glibc:
 	# build sysroot passing -DLIND_DEBUG if LIND_DEBUG is set
 	if [ "$(LIND_DEBUG)" = "1" ]; then \
@@ -77,7 +80,32 @@ sync-sysroot:
 
 .PHONY: test
 test: lindfs
-	@if LIND_WASM_BASE=. LINDFS_ROOT=$(LINDFS_ROOT) \
+	# Unified harness entry point (run all discovered harnesses for e2e signal)
+	alias_path='$(LIND_RUNTIME_LINDFS_ALIAS)'; \
+	prebuilt_lindfs_root='$(PREBUILT_LINDFS_ROOT)'; \
+	cleanup() { \
+	  if [ -n "$$alias_path" ]; then \
+	    alias_parent="$$(dirname "$$alias_path")"; \
+	    rm -f "$$alias_path"; \
+	    rmdir "$$alias_parent" 2>/dev/null || true; \
+	    rmdir "$$(dirname "$$alias_parent")" 2>/dev/null || true; \
+	  fi; \
+	}; \
+	if [ -n "$$alias_path" ]; then \
+	  mkdir -p "$$(dirname "$$alias_path")"; \
+	  rm -f "$$alias_path"; \
+	  case '$(LINDFS_ROOT)' in \
+	    /*) lindfs_root='$(LINDFS_ROOT)' ;; \
+	    *) lindfs_root="$$PWD/$(LINDFS_ROOT)" ;; \
+	  esac; \
+	  ln -s "$$lindfs_root" "$$alias_path"; \
+	  trap cleanup EXIT; \
+	fi; \
+	if [ -n "$$prebuilt_lindfs_root" ] && [ -d "$$prebuilt_lindfs_root/lib" ]; then \
+	  mkdir -p "$(LINDFS_ROOT)/lib"; \
+	  cp -a "$$prebuilt_lindfs_root/lib/." "$(LINDFS_ROOT)/lib/"; \
+	fi; \
+	if LIND_WASM_BASE=. LINDFS_ROOT=$(LINDFS_ROOT) \
 	python3 ./scripts/test_runner.py --export-report report.html && \
 	find reports -maxdepth 1 -name '*.json' -print -exec cat {} \; && \
 	if [ "$(LIND_DEBUG)" = "1" ]; then \

scripts/cargo-lind_compile

@@ -37,12 +37,12 @@ WASM_OPT_BIN="${WASM_OPT_BIN:-wasm-opt}"
 WASMTIME_BIN="${WASMTIME_BIN:-wasmtime}"
 
 echo "Building with profile: $PROFILE"
-cargo +nightly build -Z build-std=std,panic_abort "${CARGO_ARGS[@]}"
+cargo +nightly-2026-02-11 build -Z build-std=std,panic_abort "${CARGO_ARGS[@]}"
 
 echo "-------------------------------"
 for f in $(find "$CARGO_TARGET_DIR/wasm32-wasip1/$PROFILE" -name "*.wasm" ! -path "*deps*" 2>/dev/null | sort -r); do
         # Find the wasm files in the appropriate profile directory
-        lind_compile --opt-only "$f" &> /dev/null || true
+        lind_compile -s --opt-only "$f" &> /dev/null || true
         # Precompile the optimized wasm file to cache it to LindFS
         lind_compile --precompile-only "$f" &> /dev/null || true
 done

scripts/extract_glibc_symbols.sh

@@ -0,0 +1,130 @@
+#!/usr/bin/env bash
+# extract_glibc_symbols.sh
+#
+# Finds (or reads) glibc "Versions" files, then runs the Python parser on each
+# file (one by one), printing:
+#   <path-to-Versions>:
+#     <symbol or flag>
+#     <symbol or flag>
+#
+# Usage:
+#   ./extract_glibc_symbols.sh <glibc-root> <parse_versions.py> \
+#       [--include-private] [--flags] [--out FILE] [--paths-file FILE]
+#
+# Options:
+#   --include-private   Include GLIBC_PRIVATE symbols
+#   --flags             Output wasm-ld flags: --export-if-defined=<sym>
+#   --out FILE          Write output to FILE (default: stdout)
+#   --paths-file FILE   Read Versions paths from FILE instead of running find.
+#                       One path per line. Relative paths are interpreted
+#                       relative to <glibc-root>. Blank lines and lines
+#                       starting with '#' are ignored.
+#
+# Notes:
+# - Output is grouped per Versions file and is NOT globally deduped.
+# - If you want a deduped global list, post-process separately.
+
+set -euo pipefail
+
+if [[ $# -lt 2 ]]; then
+  echo "usage: $0 <glibc-root> <parse_versions.py> [--include-private] [--flags] [--out FILE] [--paths-file FILE]" >&2
+  exit 2
+fi
+
+GLIBC_ROOT="$1"
+PY_SCRIPT="$2"
+shift 2
+
+INCLUDE_PRIVATE=0
+FLAGS=0
+OUTFILE=""
+PATHS_FILE=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --include-private) INCLUDE_PRIVATE=1; shift ;;
+    --flags) FLAGS=1; shift ;;
+    --out)
+      OUTFILE="${2:-}"
+      shift 2
+      ;;
+    --paths-file)
+      PATHS_FILE="${2:-}"
+      shift 2
+      ;;
+    -h|--help)
+      sed -n '1,90p' "$0"
+      exit 0
+      ;;
+    *)
+      echo "error: unknown arg: $1" >&2
+      exit 2
+      ;;
+  esac
+done
+
+if [[ ! -d "$GLIBC_ROOT" ]]; then
+  echo "error: glibc root not found: $GLIBC_ROOT" >&2
+  exit 2
+fi
+
+if [[ ! -f "$PY_SCRIPT" ]]; then
+  echo "error: python script not found: $PY_SCRIPT" >&2
+  exit 2
+fi
+
+if [[ -n "$PATHS_FILE" && ! -f "$PATHS_FILE" ]]; then
+  echo "error: paths file not found: $PATHS_FILE" >&2
+  exit 2
+fi
+
+if [[ -n "$OUTFILE" ]]; then
+  exec > "$OUTFILE"
+fi
+
+args=()
+if [[ "$INCLUDE_PRIVATE" -eq 1 ]]; then
+  args+=(--include-private)
+fi
+if [[ "$FLAGS" -eq 1 ]]; then
+  args+=(--flags)
+fi
+
+emit_one() {
+  local vf="$1"
+  #echo "${vf}:"
+  python3 "$PY_SCRIPT" "${args[@]}" "$vf" | sed 's/^/    /'
+  #echo
+}
+
+if [[ -n "$PATHS_FILE" ]]; then
+  # Read one path per line; ignore blank lines and comments.
+  # Relative paths are resolved against GLIBC_ROOT.
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    # trim leading/trailing whitespace
+    line="${line#"${line%%[![:space:]]*}"}"
+    line="${line%"${line##*[![:space:]]}"}"
+
+    [[ -z "$line" ]] && continue
+    [[ "${line:0:1}" == "#" ]] && continue
+
+    if [[ "$line" = /* ]]; then
+      vf="$line"
+    else
+      vf="$GLIBC_ROOT/$line"
+    fi
+
+    if [[ ! -f "$vf" ]]; then
+      echo "warning: not found: $vf" >&2
+      continue
+    fi
+
+    emit_one "$vf"
+  done < "$PATHS_FILE"
+else
+  # Find all Versions files under the specified glibc root, stable order.
+  find "$GLIBC_ROOT" -name "Versions" -type f -print0 | sort -z | \
+  while IFS= read -r -d '' vf; do
+    emit_one "$vf"
+  done
+fi