Proto commits in google/gvisor

These commits are when the Protocol Buffers files have changed: (only the last 100 relevant commits are shown)

2026-07-24

seccheck: add binary_in_memfd to ExecveInfo PiperOrigin-RevId: 953601428

The documentation is generated from this commit.

seccheck: support ptrace request extraction via syscall points PiperOrigin-RevId: 953109282

seccheck: add overlayfs layer information to mmap seccheck points. PiperOrigin-RevId: 953060531

2026-07-23

seccheck: Add trace point for the listen(2) syscall. This change implements the PointListen trace point to capture details of the listen syscall, including the file descriptor, backlog, socket family, socket type, and bound address. It also updates the seccheck metadata for amd64 and arm64, adds the Listen protobuf message, and includes test coverage. PiperOrigin-RevId: 952916092

seccheck: add binary_in_memfd to ExecveInfo PiperOrigin-RevId: 952308439

2026-07-22

seccheck: support ptrace request extraction via syscall points PiperOrigin-RevId: 952361532

Add binary size and nlink to exec security check points. PiperOrigin-RevId: 952306838

seccheck: Add trace point for the listen(2) syscall. This change implements the PointListen trace point to capture details of the listen syscall, including the file descriptor, backlog, socket family, socket type, and bound address. It also updates the seccheck metadata for amd64 and arm64, adds the Listen protobuf message, and includes test coverage. PiperOrigin-RevId: 951708245

seccheck: Add an LRU cache for execve binary SHA-256 and SHA-1 hashes. This change introduces an LRU cache (ExecveHashCache) and multi-algorithm calculation engine (file_hash.go) to store and resolve SHA-256 and SHA-1 digests of executables during execve syscalls. PiperOrigin-RevId: 952257971

seccheck: Add execfn to ExecveInfo seccheck point This change adds the execfn field to the ExecveInfo seccheck point. This field preserves the original, unresolved pathname passed to execve(2) (used for AT_EXECFN), distinguishing it from BinaryPath, which contains the fully resolved filesystem path after symlink and interpreter resolution. Tests have been updated to verify the distinction between BinaryPath, Execfn, and Argv[0]. PiperOrigin-RevId: 952211288

seccheck: Add execfn to ExecveInfo seccheck point This change adds the execfn field to the ExecveInfo seccheck point. This field preserves the original, unresolved pathname passed to execve(2) (used for AT_EXECFN), distinguishing it from BinaryPath, which contains the fully resolved filesystem path after symlink and interpreter resolution. Tests have been updated to verify the distinction between BinaryPath, Execfn, and Argv[0]. PiperOrigin-RevId: 951652309

2026-07-21

seccheck: Add trace point for the listen(2) syscall. This change implements the PointListen trace point to capture details of the listen syscall, including the file descriptor, backlog, socket family, socket type, and bound address. It also updates the seccheck metadata for amd64 and arm64, adds the Listen protobuf message, and includes test coverage. PiperOrigin-RevId: 951708245

Implement custom TaskService (proto and ttrpc server) in task_server. PiperOrigin-RevId: 951698516

Implement custom TaskService (proto and ttrpc server) in task_server. PiperOrigin-RevId: 923049687

seccheck: Trace sibling processes connected via pipes during execve. This change extends the execve trace point to identify and include information about sibling processes connected to the current process's stdin or stdout via a pipe. It exposes the underlying Pipe object from VFSPipe and VFSPipeFD to match pipe endpoints. When a pipe is detected on stdin/stdout, the sentry searches sibling processes to find the other end and populates the new pipe_input_proc and pipe_output_proc fields with the sibling's binary path, argv, and context data. Tests have been updated to verify this behavior. PiperOrigin-RevId: 950963084

2026-07-17

Add seccheck field to indicate if a file is on an overlayfs lower layer. This change introduces a new field `binary_overlayfs_lower` in the `ExecveBinaryInfo` seccheck point. This field is set to true if the executed binary is found on one of the lower layers of an overlay filesystem. A helper function `overlay.IsOnLower` is added to determine this. The existing `binary_overlayfs_upper` field is also clarified to represent any file on the upper layer. PiperOrigin-RevId: 949711533

2026-07-15

Add seccheck field to indicate if a file is on an overlayfs lower layer. This change introduces a new field `binary_overlayfs_lower` in the `ExecveBinaryInfo` seccheck point. This field is set to true if the executed binary is found on one of the lower layers of an overlay filesystem. A helper function `overlay.IsOnLower` is added to determine this. The existing `binary_overlayfs_upper` field is also clarified to represent any file on the upper layer. PiperOrigin-RevId: 948608788

Add seccheck support for collecting stdin/stdout/stderr info on execve. This change introduces a new seccheck field, FieldSentryExecveFdInfo, for the Execve trace point. When enabled, this field collects information about file descriptors 0, 1, and 2 (stdin, stdout, stderr) and populates the new stdin, stdout, and stderr fields in the ExecveInfo proto. The collected FdInfo includes the file path, mode, inode, whether it's on an overlayfs upper layer, and socket details (local/remote addresses) if the FD is a socket. PiperOrigin-RevId: 948482163

Add executable ctime to ExecveInfo and MmapInfo. This change includes the creation time (ctime) of the executable binary in the seccheck ExecveInfo and MmapInfo. The Timespec proto message is moved to common.proto for reuse. PiperOrigin-RevId: 948385290

Add executable ctime to ExecveInfo and MmapInfo. This change includes the creation time (ctime) of the executable binary in the seccheck ExecveInfo and MmapInfo. The Timespec proto message is moved to common.proto for reuse. PiperOrigin-RevId: 947205599

seccheck: Add is_exec_session to context This change adds a new field `is_exec_session` to the seccheck Context. This field is set to true if the task originated from an exec session, such as those created by `runsc exec` or `kubectl exec`. PiperOrigin-RevId: 948071517

Add seccheck support for collecting stdin/stdout/stderr info on execve. This change introduces a new seccheck field, FieldSentryExecveFdInfo, for the Execve trace point. When enabled, this field collects information about file descriptors 0, 1, and 2 (stdin, stdout, stderr) and populates the new stdin, stdout, and stderr fields in the ExecveInfo proto. The collected FdInfo includes the file path, mode, inode, whether it's on an overlayfs upper layer, and socket details (local/remote addresses) if the FD is a socket. PiperOrigin-RevId: 947808754

2026-07-14

Add seccheck point for mmap(2). This change introduces a seccheck point for the mmap syscall on both amd64 and arm64. A new proto message `Mmap` is defined to capture the syscall arguments, including the file descriptor path when requested. The example seccheck server is updated to handle the new message type, and a basic test case is added to the trace tests. PiperOrigin-RevId: 947914706

Add seccheck point for mmap(2). This change introduces a seccheck point for the mmap syscall on both amd64 and arm64. A new proto message `Mmap` is defined to capture the syscall arguments, including the file descriptor path when requested. The example seccheck server is updated to handle the new message type, and a basic test case is added to the trace tests. PiperOrigin-RevId: 944817338

seccheck: Add is_exec_session to context This change adds a new field `is_exec_session` to the seccheck Context. This field is set to true if the task originated from an exec session, such as those created by `runsc exec` or `kubectl exec`. PiperOrigin-RevId: 947316637

2026-07-13

Add executable ctime to ExecveBinaryInfo. This change includes the creation time (ctime) of the executable binary in the seccheck ExecveBinaryInfo and MmapInfo. The Timespec proto message is moved to common.proto for reuse. PiperOrigin-RevId: 947205599

Internal change. PiperOrigin-RevId: 944137567

2026-07-10

Add executable inode number to seccheck ExecveBinaryInfo. PiperOrigin-RevId: 945774987

Add executable inode number to seccheck ExecveBinaryInfo. PiperOrigin-RevId: 944694866

2026-07-09

Add seccheck point for mmap(2). This change introduces a seccheck point for the mmap syscall on both amd64 and arm64. A new proto message `Mmap` is defined to capture the syscall arguments, including the file descriptor path when requested. The example seccheck server is updated to handle the new message type, and a basic test case is added to the trace tests. PiperOrigin-RevId: 944817338

Add seccheck point for mmap(2). This change introduces a seccheck point for the mmap syscall on both amd64 and arm64. A new proto message `Mmap` is defined to capture the syscall arguments, including the file descriptor path when requested. The example seccheck server is updated to handle the new message type, and a basic test case is added to the trace tests. PiperOrigin-RevId: 944817338

2026-07-08

Add executable inode number to seccheck ExecveBinaryInfo. PiperOrigin-RevId: 944694866

Add seccheck point for mmap. This change introduces a new seccheck point, "sentry/mmap", which is triggered when a memory mapping is created. The seccheck event includes information about the mapped file, such as its path, inode, mode, UID, and GID, as well as a timestamp. It also indicates if the mapping corresponds to the initial executable. This allows for monitoring of potential code injection or execution from unexpected sources. PiperOrigin-RevId: 944614086

Add seccheck field to indicate if executed binary is on overlayfs upper layer. This change introduces a new field `binary_overlayfs_upper` to the `ExecveBinaryInfo` seccheck point. This field is set to true if the executable being run is located on the upper layer of an overlay filesystem. A new helper function `overlay.IsCopiedUp` is added to check this condition. PiperOrigin-RevId: 944568906

2026-07-07

Add seccheck field to indicate if executed binary is on overlayfs upper layer. This change introduces a new field `binary_overlayfs_upper` to the `ExecveBinaryInfo` seccheck point. This field is set to true if the executable being run is located on the upper layer of an overlay filesystem. A new helper function `overlay.IsCopiedUp` is added to check this condition. PiperOrigin-RevId: 913758999

Add seccheck point for mmap. This change introduces a new seccheck point, "sentry/mmap", which is triggered when a memory mapping is created. The seccheck event includes information about the mapped file, such as its path, inode, mode, UID, and GID, as well as a timestamp. It also indicates if the mapping corresponds to the initial executable. This allows for monitoring of potential code injection or execution from unexpected sources. PiperOrigin-RevId: 915566174

2026-07-06

Add checkpoint/restore coordination with libtpu to runsc. PiperOrigin-RevId: 943469548

Add seccheck field to indicate if executed binary is on overlayfs upper layer. This change introduces a new field `binary_overlayfs_upper` to the `ExecveBinaryInfo` seccheck point. This field is set to true if the executable being run is located on the upper layer of an overlay filesystem. A new helper function `overlay.IsCopiedUp` is added to check this condition. PiperOrigin-RevId: 913758999

Add seccheck point for mmap. This change introduces a new seccheck point, "sentry/mmap", which is triggered when a memory mapping is created. The seccheck event includes information about the mapped file, such as its path, inode, mode, UID, and GID, as well as a timestamp. It also indicates if the mapping corresponds to the initial executable. This allows for monitoring of potential code injection or execution from unexpected sources. PiperOrigin-RevId: 915566174

Add seccheck field to indicate if executed binary is on overlayfs upper layer. This change introduces a new field `binary_overlayfs_upper` to the `ExecveBinaryInfo` seccheck point. This field is set to true if the executable being run is located on the upper layer of an overlay filesystem. A new helper function `overlay.IsCopiedUp` is added to check this condition. PiperOrigin-RevId: 913758999

2026-06-26

Implement save/restore for TPU/VFIO devices to enable cross device C/R. This change enables save and restore for TPU/VFIO such that they can be saved on one device and restored on another. The change tracks open VFIO/TPU FDs and, during save, captures the PCI Bus:Device:Function (BDF) and IOMMU group numbers so they can be properly remapped. During restore, it remaps these old IDs to new IDs based on the restored container's device configuration and reopens the necessary host file descriptors. The remapping information is passed via the context to the afterLoad methods of the VFIO/TPU FD implementations. PiperOrigin-RevId: 938132005

Add checkpoint/restore coordination with libtpu to runsc. PiperOrigin-RevId: 922310675

2026-06-05

Internal change. PiperOrigin-RevId: 927384056

Internal change. PiperOrigin-RevId: 927390410

Internal change. PiperOrigin-RevId: 927399029

Internal change. PiperOrigin-RevId: 927390251

Internal change. PiperOrigin-RevId: 927389828

Internal change. PiperOrigin-RevId: 927390359

2026-05-22

Add PPID to ContextData in gvisor seccheck PiperOrigin-RevId: 919895409

Internal change PiperOrigin-RevId: 919856743

2026-05-12

Add support for customizing the default nodepool in GKE tester. PiperOrigin-RevId: 914077000

Internal change PiperOrigin-RevId: 913914238

Internal change PiperOrigin-RevId: 913914237

Internal change PiperOrigin-RevId: 913914232

Internal change PiperOrigin-RevId: 913914231

2026-05-04

Internal change. PiperOrigin-RevId: 910311877

2026-04-29

Internal change. PiperOrigin-RevId: 907764703

2026-03-03

Fix new sandbox_options proto build. PiperOrigin-RevId: 878013302

Create initial sandbox configuration spec. This configuration will serve as the base for various language-specific sandbox APIs. PiperOrigin-RevId: 877625759

2026-02-27

Fix cos_gpu_compatibility_test Update the proto for the cos_gpu_compatibility_test so that it passes PiperOrigin-RevId: 876426910

2025-12-04

Remove pkg/shim/v1/runtimeoptions/v14 that supports containerd before v1.4. gVisor now supports containerd 1.6 and later. PiperOrigin-RevId: 840429781

2025-06-02

Kubernetes testcluster: Add "restore" nodepool. This is a nodepool configured identically to the test nodepool, and is meant to be a restore target for checkpoint/restore benchmarks. PiperOrigin-RevId: 766345186

2025-05-21

Internal change. PiperOrigin-RevId: 761600409

2025-02-25

Merge pull request #11473 from Champ-Goblem:shim-add-cgroup-v2-metrics-support PiperOrigin-RevId: 730560110

2025-02-24

netstack/packet: use lockdep mutexes FUTURE_COPYBARA_INTEGRATE_REVIEW=https://github.com/google/gvisor/pull/11473 from Champ-Goblem:shim-add-cgroup-v2-metrics-support b602afb7647546148cab820775aba3b57e767213 PiperOrigin-RevId: 730536578

2025-02-22

Relocate containerd-shim-runsc-v1 deps from shim/ to shim/v1. FUTURE_COPYBARA_INTEGRATE_REVIEW=https://github.com/google/gvisor/pull/11473 from Champ-Goblem:shim-add-cgroup-v2-metrics-support b602afb7647546148cab820775aba3b57e767213 PiperOrigin-RevId: 729612115

2025-01-30

Fix a few typos

2024-12-30

Kubernetes benchmarks: Refactor kubectl context to allow sets of clusters. Also add sanity check to make sure each cluster works as part of initialization, by running a sample pod within. PiperOrigin-RevId: 710786751

2024-12-23

Internal change (diffbased). PiperOrigin-RevId: 709157384

2024-11-06

Add test to check COS drivers as they are posted. Our current check of COS drivers often lags behind COS releases. This is due to needing to preload GPU docker images onto the images that run in our CI pipelines. In addition, COS can be a bit more complex than originally thought releasing driver versions both across GPU types and release branches. Thus, this test searches the latest COS images on each family for new drivers. It does this by looking at COS's published release notes which include a proto of LATEST/DEFAULT drivers selected for each device. This will flag new versions faster with more coverage than our CI pipeline currently. Due to this not actually needing a GPU to run, this can run on any VM. PiperOrigin-RevId: 693736100

2024-10-22

Unbreak build failures in Kubernetes benchmarks. This updates the Google Cloud APIs and their Go libraries to their latest versions, which adds some of the missing fields of the container cluster service v1 proto that didn't exist in the version defined in `WORKSPACE`. This also severs the proto import dependency of `test_range_config.proto` on the container cluster API proto, both because it shouldn't be GKE-specific but also because the Go genproto version of the container cluster API is different (from the Go linker's perspective) from the container cluster proto that is imported from `test_range_config.proto`. Instead, it is encoded as an "any" proto for both nodepools and clusters. Go repositories are re-arranged such that the genproto version imported is taken from the `WORKSPACE` file rather than the one embedded in other Go repositories earlier in the file. The version of this API in Go's genproto library is still missing some of the TPU node placement fields, so that part is filled in via reflection when available. That is hacky but that codepath only applies to TPU clusters so not applicable for most benchmarks. PiperOrigin-RevId: 688682505

2024-10-16

Add Kubernetes benchmarks suite. This is a large set of Kubernetes-based performance benchmarks that has been in use at Google for gVisor performance testing on GKE, and is now open-source. This set of benchmarks has been created and maintained by multiple contributors over the last 2 years: @zkoopmans, @EtiennePerot, @kevinGC, @ayushr2, @manninglucas, @konstantin-s-bogom. PiperOrigin-RevId: 686649688

2024-06-18

Add ioctl sniffing tool to run GPU workloads and report unsupported ioctl calls. PiperOrigin-RevId: 644197930

2023-10-25

Fix a few typos It is an idea of running codespell as part of our presubmit checks. Before enabling it for new changes, let's fix what it has found. Signed-off-by: Andrei Vagin <avagin@gmail.com>

Fix a few typos It is an idea of running codespell as part of our presubmit checks. Before enabling it for new changes, let's fix what it has found. Signed-off-by: Andrei Vagin <avagin@gmail.com>

2023-09-06

Emit SentryTcpListenEvent when the application listens on a tcp port. PiperOrigin-RevId: 562957239

Emit SentryTcpListenEvent when the application listens on a tcp port. PiperOrigin-RevId: 562957239

2023-04-10

Introduce SentryMountPromiseBlockEvent. PiperOrigin-RevId: 523233705

Introduce SentryMountPromiseBlockEvent. PiperOrigin-RevId: 523233705

2022-12-27

gVisor: Add library for exporting instrumentation data in Prometheus format. This adds a new library, `//pkg/prometheus`, which contains just enough data structures such that we can encode instrumentation information in Prometheus information. These data structures are JSON-encodable, such that they can be used over the `runsc` control channel for export (implemented in a future CL). The existing `metric.go` library gains new functionality to export its own data using this new export format. This change is part of a series of changes to support Prometheus-style metrics in `runsc`. Doing so requires making several seemingly-odd design decisions, due to the following architectural constraints: - Prometheus requires an HTTP server serving the `/metrics` endpoint. - For performance reasons, the `runsc boot` process cannot run the `netpoller` goroutine. - Since we don't want to write our own HTTP server implementation, this means the HTTP endpoint has to be served by a separate process that remains running during the lifetime of the container. - The `runsc boot` process is untrusted. - This means we cannot trust metrics data that comes out of the Sentry. Therefore, there needs to be an elaborate dance where we pre-register metric metadata before starting any untrusted workload. Then, the server relaying the metric data must verify the validity of metric values against this metric metadata. This avoids leaking metrics, cardinality blow-ups, and other such DoS vectors. - This feature needs to be easy-to-use in a typical Docker setting. - This means having the ability to just say `--metrics-server=localhost:1337` in the `runsc` runtime entry in `/etc/docker/daemon.json` and have that Just Work(TM), even when multiple containers are running. - Since only one process may listen on a port at a given time, this means the metric server needs to be able to multiplex requests out to multiple running sandboxes, and remain alive for the entire duration of either of these sandboxes. However, it should also die when there are no sandboxes, so that we don't end up with leftover metric servers lying around. - For this reason, the metrics server runs *outside* of the usual per-container cgroups. - This also saves system resources by not running one server per sandbox. - The metrics server must be exposed to the outside world, and cannot assume that its clients are trustworthy. - For this reason, a metrics server is bound to a runtime root directory, and double-checks all that the sandboxes it is asked to follow actually exist in this root directory. PiperOrigin-RevId: 498039624

gVisor: Add library for exporting instrumentation data in Prometheus format. This adds a new library, `//pkg/prometheus`, which contains just enough data structures such that we can encode instrumentation information in Prometheus information. These data structures are JSON-encodable, such that they can be used over the `runsc` control channel for export (implemented in a future CL). The existing `metric.go` library gains new functionality to export its own data using this new export format. This change is part of a series of changes to support Prometheus-style metrics in `runsc`. Doing so requires making several seemingly-odd design decisions, due to the following architectural constraints: - Prometheus requires an HTTP server serving the `/metrics` endpoint. - For performance reasons, the `runsc boot` process cannot run the `netpoller` goroutine. - Since we don't want to write our own HTTP server implementation, this means the HTTP endpoint has to be served by a separate process that remains running during the lifetime of the container. - The `runsc boot` process is untrusted. - This means we cannot trust metrics data that comes out of the Sentry. Therefore, there needs to be an elaborate dance where we pre-register metric metadata before starting any untrusted workload. Then, the server relaying the metric data must verify the validity of metric values against this metric metadata. This avoids leaking metrics, cardinality blow-ups, and other such DoS vectors. - This feature needs to be easy-to-use in a typical Docker setting. - This means having the ability to just say `--metrics-server=localhost:1337` in the `runsc` runtime entry in `/etc/docker/daemon.json` and have that Just Work(TM), even when multiple containers are running. - Since only one process may listen on a port at a given time, this means the metric server needs to be able to multiplex requests out to multiple running sandboxes, and remain alive for the entire duration of either of these sandboxes. However, it should also die when there are no sandboxes, so that we don't end up with leftover metric servers lying around. - For this reason, the metrics server runs *outside* of the usual per-container cgroups. - This also saves system resources by not running one server per sandbox. - The metrics server must be exposed to the outside world, and cannot assume that its clients are trustworthy. - For this reason, a metrics server is bound to a runtime root directory, and double-checks all that the sandboxes it is asked to follow actually exist in this root directory. PiperOrigin-RevId: 498039624

2022-12-14

Adding container_start_duration metric for container multi-container mode. Including the time when a container start request is received and the time it is completed in the ContainerStartedEvent proto message. PiperOrigin-RevId: 495390114

Adding container_start_duration metric for container multi-container mode. Including the time when a container start request is received and the time it is completed in the ContainerStartedEvent proto message. PiperOrigin-RevId: 495390114

2022-12-07

Adding metrics for start container in multi-container mode. PiperOrigin-RevId: 493655449

Adding metrics for start container in multi-container mode. PiperOrigin-RevId: 493655449

2022-11-17

Adding more trace point integration tests for the following syscalls: - Chdir - Fchdir - Setgid - Setuid - Setsid - Setresuid - Setresgid Updates #4805 PiperOrigin-RevId: 489076929

Adding more trace point integration tests for the following syscalls: - Chdir - Fchdir - Setgid - Setuid - Setsid - Setresuid - Setresgid Updates #4805 PiperOrigin-RevId: 489076929

2022-11-15

Add read/write syscalls to trace points Closes #8092 PiperOrigin-RevId: 488719448

Add read/write syscalls to trace points Closes #8092 PiperOrigin-RevId: 488719448

2022-10-07

Add container exit event. PiperOrigin-RevId: 479651998

Add container exit event. PiperOrigin-RevId: 479651998

2022-09-15

Implement sentry control commands for cgroupfs. Add sentry control commands to read and write cgroup control values. PiperOrigin-RevId: 474663678

Implement sentry control commands for cgroupfs. Add sentry control commands to read and write cgroup control values. PiperOrigin-RevId: 474663678

2022-07-07

Add Points to some syscalls Added a raw syscall points to all syscalls. Added schematized syscall points to the following syscalls: - timerfd_create - timerfd_settime - timerfd_gettime - fork, vfork - inotify_init, inotify_init1 - inotify_add_watch - inotify_rm_watch - socketpair Updates #4805 PiperOrigin-RevId: 459596784

Add Points to some syscalls Added a raw syscall points to all syscalls. Added schematized syscall points to the following syscalls: - timerfd_create - timerfd_settime - timerfd_gettime - fork, vfork - inotify_init, inotify_init1 - inotify_add_watch - inotify_rm_watch - socketpair Updates #4805 PiperOrigin-RevId: 459596784

2022-06-25

Add Points to some syscalls Added a raw syscall points to all syscalls. Added schematized syscall points to the following syscalls: - chroot - dup, dup2, dup3 - prlimit64 - eventfd, eventfd2 - signalfd, signalfd4 - bind - accept, accept4 - fcntl - pipe, pipe2 Updates #4805 PiperOrigin-RevId: 457139504

Add Points to some syscalls Added a raw syscall points to all syscalls. Added schematized syscall points to the following syscalls: - chroot - dup, dup2, dup3 - prlimit64 - eventfd, eventfd2 - signalfd, signalfd4 - bind - accept, accept4 - fcntl - pipe, pipe2 Updates #4805 PiperOrigin-RevId: 457139504

2022-05-25

Add Points to some syscalls Added a raw syscall points to all syscalls. Added schematized syscall points to the following syscalls: - Chdir - Fchdir - Setgid - Setuid - Setsid - Setresuid - Setresgid PiperOrigin-RevId: 451001973

Add Points to some syscalls Added a raw syscall points to all syscalls. Added schematized syscall points to the following syscalls: - Chdir - Fchdir - Setgid - Setuid - Setsid - Setresuid - Setresgid PiperOrigin-RevId: 451001973

Remove unused field from syscall.Read proto Updates #4805 PiperOrigin-RevId: 450802760