Add tempfs experiment and gate mounting behind it

[JoshuaKrstic]

--The binary still needs to be updated.-- Until then, this feature will always be off. Which is fine ofc.

The binary has been updated and the flag exists.

[alexmwu]

I'm not sure why the cloud build is not failing but you don't actually mount a tmpfs in the cloud build. Probably due to the experiment not being there?

go-tpm-tools/launcher/image/test/test_mounts.yaml

Line 51 in 03c656e

if echo $SERIAL_OUTPUT | grep -q "tmpfs.*${_TMPFS_SIZE_KB}.*/tmp/sized"

Additionally, you aren't gating the /dev/shm feature. You can see /dev/shm size changes to from 64KB to 128000KB

[jkl73]

It's probably the string in printed by the launcher "Mounts:[{Destination:/tmp/sized Size:222}]", together with the "tmpfs" print by the kernel, and some number in the timestamp causing the regex to pass the grep. Maybe adding "^" and "$" to the grep pattern in the test may do the trick.

[alexmwu]

It's probably the string in printed by the launcher "Mounts:[{Destination:/tmp/sized Size:222}]", together with the "tmpfs" print by the kernel, and some number in the timestamp causing the regex to pass the grep. Maybe adding "^" and "$" to the grep pattern in the test may do the trick.

I think we can also try replacing .* with [[:space:]]

[jkl73]

Also we may want to add the flag here instead:

go-tpm-tools/launcher/spec/launch_spec.go

Line 180 in 03c656e

if val, ok := unmarshaledMap[devShmSizeKey]; ok && val != "" {

and

go-tpm-tools/launcher/spec/launch_spec.go

Line 191 in 03c656e

if val, ok := unmarshaledMap[mountKey]; ok && val != "" {

[JoshuaKrstic]

/gcbrun

[JoshuaKrstic]

/gcbrun

function unexported, and Alex is OOO