conmonrs/

init.rs

//! The setup of the server process before it serves: umask, OOM score, open
//! files limit, malloc and transparent huge pages, the standard streams and
//! the descriptors it inherited, its working directory and the subreaper
//! flag, and giving the runtime calls the OOM score, huge pages setting and
//! open files limits the server started with.

use crate::config::LogDriver;
use anyhow::{Context, Result};
use nix::{
    errno::Errno,
    fcntl::{OFlag, open},
    sys::{
        prctl,
        resource::{Resource, getrlimit, rlim_t, setrlimit},
        stat::{Mode, umask},
    },
    unistd::{chdir, dup2_stderr, dup2_stdin, dup2_stdout, write},
};
use std::{
    fs::OpenOptions,
    io::{ErrorKind, Write},
    os::fd::{AsRawFd, IntoRawFd, RawFd},
    path::Path,
    sync::{
        OnceLock,
        atomic::{AtomicBool, Ordering},
    },
};
use tokio::process::Command;

/// The OOM score adjustment of the server.
const OOM_SCORE_ADJ: &str = "/proc/self/oom_score_adj";

/// Set up the process before it forks: remember the OOM score and raise the
/// open files limit for the runtimes, configure malloc and protect the
/// server from the OOM killer. The server keeps the C locale, unlike conmon,
/// so that the errors it returns to CRI-O do not depend on the environment.
/// The umask is set before the configuration prepares the runtime
/// directories, see `crate::run`.
pub(crate) fn set_up_process() -> Result<()> {
    save_oom_score();
    raise_nofile_limit();
    configure_malloc();
    // While we could configure this, standard practice has it as -1000, so
    // it may be YAGNI to add configuration.
    set_oom_score("-1000")
}

/// Like a daemon, do not keep the standard streams of the caller, like the
/// file the Go client reads the launch errors from, see `startServer` in
/// `pkg/client`. The processes the server starts, like the runtimes, would
/// write into it otherwise. Only the stdout log driver writes to them.
pub(crate) fn redirect_stdio(log_driver: LogDriver) -> Result<()> {
    if log_driver == LogDriver::Stdout {
        return Ok(());
    }
    let null = open(c"/dev/null", OFlag::O_RDWR, Mode::empty()).context("open /dev/null")?;
    dup2_stdin(&null).context("redirect stdin")?;
    dup2_stdout(&null).context("redirect stdout")?;
    dup2_stderr(&null).context("redirect stderr")?;
    // A closed standard stream got it, which has to stay.
    if null.as_raw_fd() <= libc::STDERR_FILENO {
        let _: RawFd = null.into_raw_fd();
    }
    Ok(())
}

/// Close file descriptors inherited from whatever started us.
///
/// conmon-rs daemonizes and outlives the process that spawned it, so any
/// descriptor it inherits stays open for the lifetime of the server. If the
/// spawning process was itself started with extra descriptors open, holding
/// them can keep that process tree from ever finishing, for example a test
/// harness waiting for its own pipe to close.
///
/// conmon does the same thing, see `close_all_fds_ge_than(3)` there. Any
/// descriptor conmon-rs actually needs is created after this point, so
/// nothing above stderr is worth keeping.
#[expect(unsafe_code, reason = "closing descriptors which may be gone")]
pub(crate) fn close_inherited_fds() {
    for fd in inherited_fds() {
        // The descriptor used to enumerate them is already closed by now, so
        // check before closing to avoid closing an unrelated descriptor that
        // reused the number. This runs before tokio starts, so nothing else
        // can be opening descriptors concurrently.
        //
        // These are raw libc calls rather than the `nix` wrappers on purpose:
        // `BorrowedFd`/`OwnedFd` require the descriptor to be open for the
        // duration of the borrow, and whether it is still open is exactly
        // what is unknown here. `fcntl(2)` and `close(2)` take a plain
        // integer with no such precondition and report `EBADF`.
        //
        // SAFETY: both calls are defined for any integer; a stale or invalid
        // descriptor number fails with `EBADF` rather than affecting anything
        // else. Closing an open one takes it from nobody, as no live value
        // owns a descriptor above stderr at this point: nothing the setup
        // opened before is kept. Only the journal sockets in the statics of
        // `crate::journal` get created that early, by `Server::log_early`,
        // whose error ends the start before it gets here, and by the panic
        // hook, which only a panic runs and which gets installed right
        // before this call.
        if unsafe { libc::fcntl(fd, libc::F_GETFD) } != -1 {
            // SAFETY: as above.
            unsafe { libc::close(fd) };
        }
    }
}

/// Every open descriptor above stderr. Split out from `close_inherited_fds`
/// so it can be tested without closing the test runner's own descriptors.
///
/// This is Linux only: it enumerates `/proc/self/fd` and would report nothing
/// at all where that is unavailable, silently leaking the inherited
/// descriptors. conmon-rs already requires Linux elsewhere (`prctl`, epoll,
/// journald), so the assertion below just makes a port fail here loudly
/// rather than lose the behaviour quietly. A log line would not work,
/// `close_inherited_fds` runs well before the logging got set up.
fn inherited_fds() -> Vec<RawFd> {
    const {
        assert!(
            cfg!(target_os = "linux"),
            "inherited fds are enumerated through /proc/self/fd, which is Linux only"
        );
    };

    let mut fds = Vec::new();

    if let Ok(entries) = std::fs::read_dir("/proc/self/fd") {
        for entry in entries.flatten() {
            if let Some(fd) = entry
                .file_name()
                .to_str()
                .and_then(|name| name.parse::<RawFd>().ok())
                && fd > 2
            {
                fds.push(fd);
            }
        }
    }

    fds
}

/// Set up the process to serve, once the logging is: do not keep the working
/// directory of the caller busy, like a mount which then cannot be unmounted
/// (the paths of the configuration are absolute, see `Config::make_absolute`,
/// and so are the ones of the requests), and make the container processes
/// get reparented to the server once their runtime exits.
pub(crate) fn set_up_serving() -> Result<()> {
    chdir("/").context("change into the root directory")?;
    prctl::set_child_subreaper(true).context("set child subreaper")
}

/// Adjust the OOM score of the server, best effort without the privileges
/// to lower it.
fn set_oom_score(score: &str) -> Result<()> {
    set_oom_score_at(Path::new(OOM_SCORE_ADJ), score)
}

fn set_oom_score_at(path: &Path, score: &str) -> Result<()> {
    match OpenOptions::new()
        .write(true)
        .open(path)
        .and_then(|mut file| file.write_all(score.as_bytes()))
    {
        Ok(()) => Ok(()),
        Err(e) if e.kind() == ErrorKind::PermissionDenied => {
            eprintln!("Missing sufficient privileges to adjust OOM score");
            Ok(())
        }
        Err(e) => Err(e).context("adjust OOM score"),
    }
}

/// Set the default umask.
pub(crate) fn set_default_umask() {
    umask(Mode::from_bits_truncate(0o022));
}

/// The most malloc arenas of the server. glibc gives every thread an arena
/// of its own, up to eight per CPU, and on AArch64 it backs them with 2 MiB
/// transparent huge pages by default, so each costs up to 2 MiB resident. The
/// runtime, which also runs the RPC `LocalSet`, runs on one thread, the others
/// only serve short blocking work, so one arena is enough, the per thread
/// caches of the allocator absorb most of the contention.
#[cfg(target_env = "gnu")]
const MALLOC_ARENAS: libc::c_int = 1;

/// The size from which on glibc maps every allocation on its own, which goes
/// back to the kernel once freed, and the free memory at the top of the heap
/// from which on glibc returns it. Both are the defaults of glibc, which
/// raises them to the size of every mapped allocation that gets freed, up to
/// 32 and 64 MiB. After an exec_sync with a large output, up to 16 MiB per
/// pipe which get copied into the response, the allocations of that size
/// would stay in the heap then and keep it resident. Setting them turns that
/// off.
#[cfg(target_env = "gnu")]
const MALLOC_THRESHOLD: libc::c_int = 128 * 1024;

/// Limit the malloc arenas of the server, see [`MALLOC_ARENAS`], and fix the
/// thresholds of glibc, see [`MALLOC_THRESHOLD`]. Runs before the fork, while
/// the process has a single thread. The runtimes and containers keep the
/// defaults, an exec starts their allocator anew.
#[cfg_attr(target_env = "gnu", expect(unsafe_code, reason = "mallopt"))]
fn configure_malloc() {
    #[cfg(target_env = "gnu")]
    for (param, value, name) in [
        (libc::M_ARENA_MAX, MALLOC_ARENAS, "arenas"),
        (libc::M_MMAP_THRESHOLD, MALLOC_THRESHOLD, "mmap threshold"),
        (libc::M_TRIM_THRESHOLD, MALLOC_THRESHOLD, "trim threshold"),
    ] {
        // SAFETY: mallopt only changes a parameter of the allocator.
        if unsafe { libc::mallopt(param, value) } != 1 {
            // Before the logging gets set up.
            eprintln!("Unable to set the malloc {name}");
        }
    }
}

/// Whether the server turned transparent huge pages off for itself, which
/// the processes it runs must not inherit, see [`disable_thp`].
static THP_DISABLED: AtomicBool = AtomicBool::new(false);

/// Turn transparent huge pages off for the process, as early as possible.
/// On AArch64 glibc asks for them for its heap by default, so the first
/// growth of the heap beyond a 2 MiB boundary costs 2 MiB resident, which a
/// server per pod does not need. mallopt cannot turn that off, and the
/// tunable which can takes effect only from the start of the process. Huge
/// pages which were already allocated stay.
///
/// The setting gets inherited and kept across exec, so the runtimes get the
/// one the server started with, see
/// [`reset_inherited`]. A setting of whoever started the server stays.
pub(crate) fn disable_thp() {
    match prctl::get_thp_disable() {
        Ok(false) => {}
        // Already disabled, or not supported, like under qemu-user.
        Ok(true) | Err(Errno::EINVAL) => return,
        Err(e) => {
            // Before the logging gets set up.
            eprintln!("Unable to get the transparent huge pages setting: {e}");
            return;
        }
    }
    match prctl::set_thp_disable(true) {
        Ok(()) => THP_DISABLED.store(true, Ordering::Relaxed),
        Err(e) => eprintln!("Unable to disable transparent huge pages: {e}"),
    }
}

/// The OOM score adjustment the server started with, see [`reset_inherited`].
static INHERITED_OOM_SCORE: OnceLock<Box<[u8]>> = OnceLock::new();

/// The soft and hard limit of open files the server started with, if it
/// raised the soft one, see [`raise_nofile_limit`].
static INHERITED_NOFILE: OnceLock<(rlim_t, rlim_t)> = OnceLock::new();

/// Raise the soft limit of open files to the hard one. The server holds the
/// pipes, log files, pidfds and sockets of every container of a pod and the
/// sessions of the streaming server, while Go programs like CRI-O start it
/// with the soft limit they started with, often 1024. The runtimes get the
/// limits the server started with, see [`reset_inherited`].
fn raise_nofile_limit() {
    let (soft, hard) = match getrlimit(Resource::RLIMIT_NOFILE) {
        Ok(limits) => limits,
        Err(e) => {
            // Before the logging gets set up.
            eprintln!("Unable to get the open files limit: {e}");
            return;
        }
    };
    if soft >= hard {
        return;
    }
    match setrlimit(Resource::RLIMIT_NOFILE, hard, hard) {
        Ok(()) => {
            let _ = INHERITED_NOFILE.set((soft, hard));
        }
        Err(e) => eprintln!("Unable to raise the open files limit to {hard}: {e}"),
    }
}

/// Remember the OOM score adjustment the server started with, before it
/// protects itself with [`set_oom_score`].
fn save_oom_score() {
    match std::fs::read(OOM_SCORE_ADJ) {
        Ok(score) => {
            let _ = INHERITED_OOM_SCORE.set(score.trim_ascii().into());
        }
        Err(e) => eprintln!("Unable to read OOM score: {e}"),
    }
}

/// Give a child the OOM score adjustment, the transparent huge pages setting
/// and the open files limits the server started with instead of its own, see
/// [`save_oom_score`], [`disable_thp`] and [`raise_nofile_limit`]. The
/// runtimes pass them on to the container processes, an exec would be the
/// last process the kernel picks otherwise. conmon resets the OOM score of
/// its runtime the same way. Add it after the other pre_exec hooks, those run
/// in order and may need the raised limit.
#[expect(unsafe_code, reason = "a pre_exec hook")]
pub(crate) fn reset_inherited(cmd: &mut Command) {
    let score: Option<&'static [u8]> = INHERITED_OOM_SCORE.get().map(|score| &**score);
    let thp_disabled = THP_DISABLED.load(Ordering::Relaxed);
    let nofile = INHERITED_NOFILE.get().copied();
    if score.is_none() && !thp_disabled && nofile.is_none() {
        return;
    }
    // SAFETY: the hook allocates nothing and only calls open, write, close,
    // prctl and setrlimit, which are async signal safe. Raising the score,
    // enabling huge pages and lowering a limit need no privileges, a
    // failure keeps the setting of the server, as before.
    unsafe {
        cmd.pre_exec(move || {
            if let Some(score) = score
                && let Ok(fd) = open(
                    c"/proc/self/oom_score_adj",
                    OFlag::O_WRONLY | OFlag::O_CLOEXEC,
                    Mode::empty(),
                )
            {
                let _ = write(fd, score);
            }
            if thp_disabled {
                let _ = prctl::set_thp_disable(false);
            }
            restore_nofile(nofile);
            Ok(())
        });
    }
}

/// Set the open files limits of the process, if any, async signal safe for a
/// pre_exec hook. A failure keeps the ones of the server.
fn restore_nofile(limits: Option<(rlim_t, rlim_t)>) {
    if let Some((soft, hard)) = limits {
        let _ = setrlimit(Resource::RLIMIT_NOFILE, soft, hard);
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::{
        child_reaper::{ChildReaper, RuntimeCall},
        container_io::ContainerIO,
        container_log::ContainerLog,
        test_util::run_in_own_process,
    };
    use std::{fs, os::unix::fs::PermissionsExt};
    use tokio::time::{Duration, Instant};

    #[test]
    fn inherited_fds_reports_descriptors_above_stderr() -> Result<()> {
        let file = tempfile::tempfile()?;
        let fd = file.as_raw_fd();

        let fds = inherited_fds();

        assert!(
            fds.contains(&fd),
            "expected an open descriptor {fd} to be reported, got {fds:?}"
        );
        // stdin, stdout and stderr are never reported, they are not ours to close.
        assert!(!fds.contains(&0));
        assert!(!fds.contains(&1));
        assert!(!fds.contains(&2));

        Ok(())
    }

    #[test]
    fn oom_score_gets_written() -> Result<()> {
        let dir = tempfile::tempdir()?;
        let path = dir.path().join("oom_score_adj");
        fs::write(&path, "0")?;
        set_oom_score_at(&path, "-1000")?;
        assert_eq!(fs::read_to_string(&path)?, "-1000");

        // Without the privileges it stays as it is.
        fs::set_permissions(&path, fs::Permissions::from_mode(0o444))?;
        set_oom_score_at(&path, "-999")?;

        // Anything else fails.
        assert!(set_oom_score_at(&dir.path().join("missing").join("file"), "0").is_err());
        assert!(set_oom_score_at(dir.path(), "0").is_err());
        Ok(())
    }

    #[tokio::test]
    #[expect(unsafe_code, reason = "a pre_exec hook")]
    async fn restore_nofile_sets_the_child_limit() -> Result<()> {
        // Like a server which raised the soft limit it started with. Only the
        // child gets the lower one, the limits of the tests stay.
        let limits = getrlimit(Resource::RLIMIT_NOFILE)?;
        let inherited = limits.0.min(4096) / 2;
        let mut cmd = Command::new("sh");
        cmd.args(["-c", "ulimit -Sn"]);
        // SAFETY: the hook only calls setrlimit, see `reset_inherited`.
        unsafe {
            cmd.pre_exec(move || {
                restore_nofile(Some((inherited, limits.1)));
                Ok(())
            });
        }
        let output = cmd.output().await?;
        assert_eq!(
            String::from_utf8(output.stdout)?.trim(),
            inherited.to_string()
        );
        assert_eq!(getrlimit(Resource::RLIMIT_NOFILE)?, limits);
        Ok(())
    }

    /// Set for the test process which runs the test of the settings.
    const SETTINGS_TEST_ENV: &str = "CONMONRS_SETTINGS_TEST";

    /// The server remembers the settings it started with once, and the test
    /// changes the ones of its process, which the children of the other
    /// tests would inherit. It runs in a process of its own.
    #[test]
    fn runtimes_get_the_settings_the_server_started_with() -> Result<()> {
        let test = "init::tests::settings_in_own_process";
        run_in_own_process(test, SETTINGS_TEST_ENV, false)
    }

    #[tokio::test]
    #[ignore = "run by runtimes_get_the_settings_the_server_started_with in a process of its own"]
    async fn settings_in_own_process() -> Result<()> {
        if std::env::var_os(SETTINGS_TEST_ENV).is_none() {
            return Ok(());
        }
        // Like a server at its start, which then protects itself from the
        // OOM killer. The test raises its score instead, which needs no
        // privileges, unless it has the highest one already, like in a
        // pod of the best effort class.
        let read_score = || anyhow::Ok(fs::read_to_string(OOM_SCORE_ADJ)?.trim().to_owned());
        let score = read_score()?;
        save_oom_score();
        let raised = (score.parse::<i32>()? + 1).min(1000);
        set_oom_score(&raised.to_string())?;
        let own_score = read_score()?;
        if own_score == score {
            eprintln!("skipped: unable to change the OOM score, the reset does not show");
        }
        // With a soft limit of open files below the hard one, which the
        // server raises.
        let (soft, hard) = getrlimit(Resource::RLIMIT_NOFILE)?;
        let soft = soft.min(hard).min(4096) / 2;
        setrlimit(Resource::RLIMIT_NOFILE, soft, hard)?;
        raise_nofile_limit();
        assert_eq!(getrlimit(Resource::RLIMIT_NOFILE)?, (hard, hard));

        let settings = "cat /proc/self/oom_score_adj; ulimit -Sn";
        let child = async |reset: bool| -> Result<String> {
            let mut cmd = Command::new("sh");
            cmd.args(["-c", settings]);
            if reset {
                reset_inherited(&mut cmd);
            }
            Ok(String::from_utf8(cmd.output().await?.stdout)?)
        };
        // A child inherits the settings of the server otherwise.
        assert_eq!(child(false).await?, format!("{own_score}\n{hard}\n"));
        let inherited = format!("{score}\n{soft}\n");
        assert_eq!(child(true).await?, inherited);

        // The runtime of a call gets them reset.
        let dir = tempfile::tempdir()?;
        let (pidfile, path) = (dir.path().join("pid"), dir.path().join("settings"));
        let script = format!(
            "{{ {settings}; }} >{}; echo $$ >{}",
            path.display(),
            pidfile.display()
        );
        let args = ["-c".into(), script];
        let mut io = ContainerIO::new(false, ContainerLog::new())?;
        let deadline = Instant::now() + Duration::from_secs(600);
        let call = RuntimeCall::new(Path::new("sh"), &args, &pidfile, deadline);
        let started = ChildReaper::default().create_child(call, &mut io).await?;
        started.token.cancel();
        assert_eq!(fs::read_to_string(path)?, inherited);
        Ok(())
    }

    /// The transparent huge pages setting of a process, true if enabled.
    fn thp_enabled(status: &str) -> Option<bool> {
        let line = status.lines().find(|l| l.starts_with("THP_enabled:"))?;
        Some(line.split_whitespace().nth(1)? == "1")
    }

    async fn child_thp_enabled(reset: bool) -> Result<Option<bool>> {
        let mut cmd = Command::new("cat");
        cmd.arg("/proc/self/status");
        if reset {
            reset_inherited(&mut cmd);
        }
        let output = cmd.output().await?;
        Ok(thp_enabled(&String::from_utf8(output.stdout)?))
    }

    /// Changes the setting of the test process, which only its children
    /// inherit, and restores it afterwards. The runtimes which other tests
    /// spawn meanwhile get it reset, which does not matter to them.
    #[tokio::test]
    async fn runtimes_do_not_inherit_disabled_thp() -> Result<()> {
        if thp_enabled(&fs::read_to_string("/proc/self/status")?) != Some(true)
            || prctl::get_thp_disable() != Ok(false)
        {
            // Disabled by whoever started the tests, which stays, or not
            // supported by the kernel.
            eprintln!("skipped: transparent huge pages are disabled or not supported");
            return Ok(());
        }
        disable_thp();
        let disabled = thp_enabled(&fs::read_to_string("/proc/self/status")?);
        let inherited = child_thp_enabled(false).await;
        let reset = child_thp_enabled(true).await;
        prctl::set_thp_disable(false)?;
        THP_DISABLED.store(false, Ordering::Relaxed);

        assert_eq!(disabled, Some(false));
        assert_eq!(inherited?, Some(false));
        assert_eq!(reset?, Some(true));
        Ok(())
    }
}