Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

skip read /proc/filesystems if process_label is null #4354

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

ningmingxiao
Copy link

@ningmingxiao ningmingxiao commented Jul 19, 2024

when compare to crun runc will open "/proc/filesystems" even process_label is null
when I try to make runc exec faster
#3181

@ningmingxiao ningmingxiao changed the title skip read /proc/filesystems if process_label is null DRAFT: skip read /proc/filesystems if process_label is null Jul 19, 2024
@lifubang
Copy link
Member

Good news, thanks. Did you have a benchmark to test how faster than before? For example, you can run 1000 times ’runc exec’.

@ningmingxiao
Copy link
Author

ningmingxiao commented Jul 20, 2024

Good news, thanks. Did you have a benchmark to test how faster than before? For example, you can run 1000 times ’runc exec’.
runc 1.1.12
old

[root@localhost runc]#  time for ((i=0; i<1000;i++)); do runc exec nmx002 true; done
real    0m46.434s
user    0m9.970s
sys     0m19.874s

after this pr

[root@localhost runc]#  time for ((i=0; i<1000;i++)); do runc exec nmx001 true; done

real    0m44.850s
user    0m9.953s
sys     0m19.343s

will improve little.

@ningmingxiao ningmingxiao changed the title DRAFT: skip read /proc/filesystems if process_label is null skip read /proc/filesystems if process_label is null Jul 29, 2024
Comment on lines +41 to -40
defer selinux.SetKeyLabel("") //nolint: errcheck
}
defer selinux.SetKeyLabel("") //nolint: errcheck
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we know what the intent was for these empty selinux.SetKeyLabel("") ? See my comment on opencontainers/selinux#214 (comment)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's used to clear the label for the next keyring created by the current process once we got an error when we start/exec the container. Because this label can't be inherited by sub-process, so the initial value should be "", so we can set it to an empty string directly to clear it.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we use unix.KeyctlString() set keylabel ? @lifubang

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we use unix.KeyctlString() set keylabel ?

I think no.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we know what the intent was for these empty selinux.SetKeyLabel("") ? See my comment on opencontainers/selinux#214 (comment)

Some are added by commit cd96170, and some are by aa3fee6, which provides an explanation:

should also call SetProcessLabel("") after the container starts
to go back to the default SELinux behaviour.

Given the fact that Init() never returns unless there's an error (because it ends with exec), those defers are only called in case of an error.

@kolyshkin
Copy link
Contributor

I think the performance overhead is negligible (as the /proc/filesystems is only read once per binary invocation).

As to whether we can skip SetKeyLabel and SetExecLabel calls (and defers) if config.ProcessLabel is empty, I assume this is a valid approach, but perhaps @rhatdan can shed some light.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants