netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Move rlimit-setting code from runsc main to run only as part of runsc boot.

Browse Source 
This allows other `runsc` subcommands to run in restricted contexts without
printing a warning about not being able to set `RLIMIT_MEMLOCK` in contexts
where this doesn't matter.

In particular, this helps with `runsc metric-server`, which can be locked down
to run with very little capabilities.

PiperOrigin-RevId: 508491474
This commit is contained in:
Etienne Perot
2023-02-09 15:29:05 -08:00
committed by gVisor bot
parent c0a18ec43b
commit 5419f17710
2 changed files with 17 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/cli/main.go
-17
View File
@@ -242,23 +242,6 @@ func Main(version string) {
signal.Ignore(unix.SIGTERM)
}
// pgalloc.MemoryFile (which provides application memory) sometimes briefly
// mlock(2)s ranges of memory in order to fault in a large number of pages at
// a time. Try to make RLIMIT_MEMLOCK unlimited so that it can do so. runsc
// expects to run in a memory cgroup that limits its memory usage as
// required.
var rlim unix.Rlimit
if err := unix.Getrlimit(unix.RLIMIT_MEMLOCK, &rlim); err != nil {
log.Warningf("Failed to get RLIMIT_MEMLOCK: %v", err)
} else if rlim.Cur != unix.RLIM_INFINITY || rlim.Max != unix.RLIM_INFINITY {
rlim.Cur = unix.RLIM_INFINITY
rlim.Max = unix.RLIM_INFINITY
if err := unix.Setrlimit(unix.RLIMIT_MEMLOCK, &rlim); err != nil {
// We may not have CAP_SYS_RESOURCE, so this failure may be expected.
log.Infof("Failed to set RLIMIT_MEMLOCK: %v", err)
}
}
// Call the subcommand and pass in the configuration.
var ws unix.WaitStatus
subcmdCode := subcommands.Execute(context.Background(), conf, &ws)
runsc/cmd/boot.go
+17
View File
@@ -172,6 +172,23 @@ func (b *Boot) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcomma
// Set traceback level
debug.SetTraceback(conf.Traceback)
// pgalloc.MemoryFile (which provides application memory) sometimes briefly
// mlock(2)s ranges of memory in order to fault in a large number of pages at
// a time. Try to make RLIMIT_MEMLOCK unlimited so that it can do so. runsc
// expects to run in a memory cgroup that limits its memory usage as
// required.
var rlim unix.Rlimit
if err := unix.Getrlimit(unix.RLIMIT_MEMLOCK, &rlim); err != nil {
log.Warningf("Failed to get RLIMIT_MEMLOCK: %v", err)
} else if rlim.Cur != unix.RLIM_INFINITY || rlim.Max != unix.RLIM_INFINITY {
rlim.Cur = unix.RLIM_INFINITY
rlim.Max = unix.RLIM_INFINITY
if err := unix.Setrlimit(unix.RLIMIT_MEMLOCK, &rlim); err != nil {
// We may not have CAP_SYS_RESOURCE, so this failure may be expected.
log.Infof("Failed to set RLIMIT_MEMLOCK: %v", err)
}
}
if len(b.productName) == 0 {
// Do this before chroot takes effect, otherwise we can't read /sys.
if product, err := ioutil.ReadFile("/sys/devices/virtual/dmi/id/product_name"); err != nil {