From 5419f1771000615124ff30b15fa70852a4a682ec Mon Sep 17 00:00:00 2001
From: Etienne Perot <eperot@google.com>
Date: Thu, 9 Feb 2023 15:26:08 -0800
Subject: [PATCH] Move rlimit-setting code from `runsc` main to run only as
 part of `runsc boot`.

This allows other `runsc` subcommands to run in restricted contexts without
printing a warning about not being able to set `RLIMIT_MEMLOCK` in contexts
where this doesn't matter.

In particular, this helps with `runsc metric-server`, which can be locked down
to run with very little capabilities.

PiperOrigin-RevId: 508491474
---
 runsc/cli/main.go | 17 -----------------
 runsc/cmd/boot.go | 17 +++++++++++++++++
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/runsc/cli/main.go b/runsc/cli/main.go
index 3321e64b8..342433204 100644
--- a/runsc/cli/main.go
+++ b/runsc/cli/main.go
@@ -242,23 +242,6 @@ func Main(version string) {
 		signal.Ignore(unix.SIGTERM)
 	}
 
-	// pgalloc.MemoryFile (which provides application memory) sometimes briefly
-	// mlock(2)s ranges of memory in order to fault in a large number of pages at
-	// a time. Try to make RLIMIT_MEMLOCK unlimited so that it can do so. runsc
-	// expects to run in a memory cgroup that limits its memory usage as
-	// required.
-	var rlim unix.Rlimit
-	if err := unix.Getrlimit(unix.RLIMIT_MEMLOCK, &rlim); err != nil {
-		log.Warningf("Failed to get RLIMIT_MEMLOCK: %v", err)
-	} else if rlim.Cur != unix.RLIM_INFINITY || rlim.Max != unix.RLIM_INFINITY {
-		rlim.Cur = unix.RLIM_INFINITY
-		rlim.Max = unix.RLIM_INFINITY
-		if err := unix.Setrlimit(unix.RLIMIT_MEMLOCK, &rlim); err != nil {
-			// We may not have CAP_SYS_RESOURCE, so this failure may be expected.
-			log.Infof("Failed to set RLIMIT_MEMLOCK: %v", err)
-		}
-	}
-
 	// Call the subcommand and pass in the configuration.
 	var ws unix.WaitStatus
 	subcmdCode := subcommands.Execute(context.Background(), conf, &ws)
diff --git a/runsc/cmd/boot.go b/runsc/cmd/boot.go
index 54840295d..a41d25303 100644
--- a/runsc/cmd/boot.go
+++ b/runsc/cmd/boot.go
@@ -172,6 +172,23 @@ func (b *Boot) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcomma
 	// Set traceback level
 	debug.SetTraceback(conf.Traceback)
 
+	// pgalloc.MemoryFile (which provides application memory) sometimes briefly
+	// mlock(2)s ranges of memory in order to fault in a large number of pages at
+	// a time. Try to make RLIMIT_MEMLOCK unlimited so that it can do so. runsc
+	// expects to run in a memory cgroup that limits its memory usage as
+	// required.
+	var rlim unix.Rlimit
+	if err := unix.Getrlimit(unix.RLIMIT_MEMLOCK, &rlim); err != nil {
+		log.Warningf("Failed to get RLIMIT_MEMLOCK: %v", err)
+	} else if rlim.Cur != unix.RLIM_INFINITY || rlim.Max != unix.RLIM_INFINITY {
+		rlim.Cur = unix.RLIM_INFINITY
+		rlim.Max = unix.RLIM_INFINITY
+		if err := unix.Setrlimit(unix.RLIMIT_MEMLOCK, &rlim); err != nil {
+			// We may not have CAP_SYS_RESOURCE, so this failure may be expected.
+			log.Infof("Failed to set RLIMIT_MEMLOCK: %v", err)
+		}
+	}
+
 	if len(b.productName) == 0 {
 		// Do this before chroot takes effect, otherwise we can't read /sys.
 		if product, err := ioutil.ReadFile("/sys/devices/virtual/dmi/id/product_name"); err != nil {