From 2ba894ffd1753bc7bd52d9cef1148352c5a575d2 Mon Sep 17 00:00:00 2001 From: criyle Date: Sat, 22 Feb 2025 21:30:33 +0000 Subject: [PATCH] vfork: fix asm on other architectures doc: update #13 --- README.md | 11 +++++++++-- pkg/forkexec/vfork/asm_linux_386.s | 6 +++++- pkg/forkexec/vfork/asm_linux_amd64.s | 2 +- pkg/forkexec/vfork/asm_linux_arm.s | 2 +- 4 files changed, 16 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index a91a15f..ca09110 100644 --- a/README.md +++ b/README.md @@ -13,8 +13,9 @@ Notice: Only works on Linux since ptrace, unshare, cgroup are available only on ## Build & Install - install latest go compiler from [golang/download](https://golang.org/dl/) -- install libseccomp library: (for Ubuntu) `apt install libseccomp-dev` -- build & install: `go install github.com/criyle/go-sandbox/...` +- download repository: `git clone githuc.com/criyle/go-sandbox` +- build: `go build ./cmd/runprog` +- or install directly: `go install github.com/criyle/go-sandbox/cmd/runprog@latest` ## Technologies @@ -45,6 +46,12 @@ Default file access syscall check: 2. Use Linux Control Groups to limit & acct CPU & memory (eliminated wait4.rusage) 3. Container tech with execveat memfd, sethostname, setdomainname +### prefork containers + +Utilize the linux namespace + cgroup but create container in advance to reduce the duplicated effort of creating mount points. See Pre-forked container protocol and environment for design details. + +On kernel >= 5.7 with cgroup v2, the new `clone3(CLONE_INTO_CGROUP)` with `vfork` is available to reduce the resource consumption of create new address spaces as well. + ## Design ### Result Status diff --git a/pkg/forkexec/vfork/asm_linux_386.s b/pkg/forkexec/vfork/asm_linux_386.s index 925ee06..7d70c3a 100644 --- a/pkg/forkexec/vfork/asm_linux_386.s +++ b/pkg/forkexec/vfork/asm_linux_386.s @@ -4,6 +4,10 @@ #include "textflag.h" +// See ../runtime/sys_linux_386.s for the reason why we always use int 0x80 +// instead of the glibc-specific "CALL 0x10(GS)". +#define INVOKE_SYSCALL INT $0x80 + // func RawVforkSyscall(trap, a1, a2, a3 uintptr) (r1, err uintptr) TEXT ·RawVforkSyscall(SB),NOSPLIT|NOFRAME,$0-24 MOVL trap+0(FP), AX // syscall entry @@ -22,4 +26,4 @@ TEXT ·RawVforkSyscall(SB),NOSPLIT|NOFRAME,$0-24 ok: MOVL AX, r1+16(FP) MOVL $0, err+20(FP) - RET \ No newline at end of file + RET diff --git a/pkg/forkexec/vfork/asm_linux_amd64.s b/pkg/forkexec/vfork/asm_linux_amd64.s index b4832ef..8ec9f37 100644 --- a/pkg/forkexec/vfork/asm_linux_amd64.s +++ b/pkg/forkexec/vfork/asm_linux_amd64.s @@ -25,4 +25,4 @@ TEXT ·RawVforkSyscall(SB),NOSPLIT|NOFRAME,$0-48 ok2: MOVQ AX, r1+32(FP) MOVQ $0, err+40(FP) - RET \ No newline at end of file + RET diff --git a/pkg/forkexec/vfork/asm_linux_arm.s b/pkg/forkexec/vfork/asm_linux_arm.s index b1b7c65..88d66bc 100644 --- a/pkg/forkexec/vfork/asm_linux_arm.s +++ b/pkg/forkexec/vfork/asm_linux_arm.s @@ -23,4 +23,4 @@ ok: MOVW R0, r1+16(FP) MOVW $0, R0 MOVW R0, err+20(FP) - RET \ No newline at end of file + RET