[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v2 055/109] virtiofsd: set maximum RLIMIT_NOFILE limit
From: |
Dr. David Alan Gilbert (git) |
Subject: |
[PATCH v2 055/109] virtiofsd: set maximum RLIMIT_NOFILE limit |
Date: |
Tue, 21 Jan 2020 12:23:39 +0000 |
From: Stefan Hajnoczi <address@hidden>
virtiofsd can exceed the default open file descriptor limit easily on
most systems. Take advantage of the fact that it runs as root to raise
the limit.
Signed-off-by: Stefan Hajnoczi <address@hidden>
Reviewed-by: Daniel P. Berrangé <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
---
tools/virtiofsd/passthrough_ll.c | 32 ++++++++++++++++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
index 3f7ec85938..7257a4a512 100644
--- a/tools/virtiofsd/passthrough_ll.c
+++ b/tools/virtiofsd/passthrough_ll.c
@@ -52,6 +52,7 @@
#include <sys/file.h>
#include <sys/mount.h>
#include <sys/prctl.h>
+#include <sys/resource.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
@@ -2267,6 +2268,35 @@ static void setup_sandbox(struct lo_data *lo, struct
fuse_session *se)
setup_seccomp();
}
+/* Raise the maximum number of open file descriptors */
+static void setup_nofile_rlimit(void)
+{
+ const rlim_t max_fds = 1000000;
+ struct rlimit rlim;
+
+ if (getrlimit(RLIMIT_NOFILE, &rlim) < 0) {
+ fuse_log(FUSE_LOG_ERR, "getrlimit(RLIMIT_NOFILE): %m\n");
+ exit(1);
+ }
+
+ if (rlim.rlim_cur >= max_fds) {
+ return; /* nothing to do */
+ }
+
+ rlim.rlim_cur = max_fds;
+ rlim.rlim_max = max_fds;
+
+ if (setrlimit(RLIMIT_NOFILE, &rlim) < 0) {
+ /* Ignore SELinux denials */
+ if (errno == EPERM) {
+ return;
+ }
+
+ fuse_log(FUSE_LOG_ERR, "setrlimit(RLIMIT_NOFILE): %m\n");
+ exit(1);
+ }
+}
+
int main(int argc, char *argv[])
{
struct fuse_args args = FUSE_ARGS_INIT(argc, argv);
@@ -2388,6 +2418,8 @@ int main(int argc, char *argv[])
fuse_daemonize(opts.foreground);
+ setup_nofile_rlimit();
+
/* Must be before sandbox since it wants /proc */
setup_capng();
--
2.24.1
- [PATCH v2 048/109] virtiofsd: sandbox mount namespace, (continued)
- [PATCH v2 050/109] virtiofsd: move to a new pid namespace, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 052/109] virtiofsd: Parse flag FUSE_WRITE_KILL_PRIV, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 053/109] virtiofsd: cap-ng helpers, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 054/109] virtiofsd: Drop CAP_FSETID if client asked for it, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 055/109] virtiofsd: set maximum RLIMIT_NOFILE limit,
Dr. David Alan Gilbert (git) <=
- [PATCH v2 056/109] virtiofsd: fix libfuse information leaks, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 057/109] docs: Add docs/tools, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 058/109] virtiofsd: add security guide document, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 059/109] virtiofsd: add --syslog command-line option, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 060/109] virtiofsd: print log only when priority is high enough, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 062/109] virtiofsd: Add timestamp to the log with FUSE_LOG_DEBUG level, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 063/109] virtiofsd: Handle reinit, Dr. David Alan Gilbert (git), 2020/01/21