Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
nsenter: cloned_binary: use the runc statedir for O_TMPFILE
Writing a file to tmpfs actually incurs a memcg penalty, and thus the
benefit of being able to disable memfd_create(2) with
_LIBCONTAINER_DISABLE_MEMFD_CLONE is fairly minimal -- though it should
be noted that quite a few distributions don't use tmpfs for /tmp (and
instead have it as a regular directory or subvolume of the host
filesystem).

Since runc must have write access to the state directory anyway (and the
state directory is usually not on a tmpfs) we can use that instead of
/tmp -- avoiding potential memcg costs with no real downside.

Signed-off-by: Aleksa Sarai <asarai@suse.de>
  • Loading branch information
cyphar committed Feb 19, 2019
1 parent 786c672 commit e344a46
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 3 deletions.
1 change: 1 addition & 0 deletions libcontainer/container_linux.go
Expand Up @@ -481,6 +481,7 @@ func (c *linuxContainer) commandTemplate(p *Process, childPipe *os.File) (*exec.
cmd.ExtraFiles = append(cmd.ExtraFiles, childPipe)
cmd.Env = append(cmd.Env,
fmt.Sprintf("_LIBCONTAINER_INITPIPE=%d", stdioFdCount+len(cmd.ExtraFiles)-1),
fmt.Sprintf("_LIBCONTAINER_STATEDIR=%s", c.root),
)
if disabledMemfdClone := os.Getenv("_LIBCONTAINER_DISABLE_MEMFD_CLONE"); disabledMemfdClone != "" {
cmd.Env = append(cmd.Env,
Expand Down
12 changes: 9 additions & 3 deletions libcontainer/nsenter/cloned_binary.c
Expand Up @@ -205,8 +205,14 @@ static int fetchve(char ***argv)

static int make_execfd(int *fdtype, int allowed)
{
int fd;
char template[] = "/tmp/runc-cloned-binary.XXXXXX";
int fd = -1;
char template[PATH_MAX] = {0};
char *prefix = secure_getenv("_LIBCONTAINER_STATEDIR");

if (!prefix || *prefix != '/')
prefix = "/tmp";
if (snprintf(template, sizeof(template), "%s/runc.XXXXXX", prefix) < 0)
return -1;

/*
* Try memfd first, it's much nicer since it's easily detected thanks to
Expand All @@ -228,7 +234,7 @@ static int make_execfd(int *fdtype, int allowed)
*/
*fdtype = EFD_TMPFILE;
if (*fdtype & allowed) {
fd = open("/tmp", O_TMPFILE | O_EXCL | O_RDWR | O_CLOEXEC, 0700);
fd = open(prefix, O_TMPFILE | O_EXCL | O_RDWR | O_CLOEXEC, 0700);
if (fd >= 0) {
struct stat statbuf = {};
bool working_otmpfile = false;
Expand Down

0 comments on commit e344a46

Please sign in to comment.