The value has no effect, but it is stored and inherited across fork().
Unlike Linux, our default value is 0.
Elasticsearch >=v9.3.0 requires this.
PiperOrigin-RevId: 944228419
Adds the infrastructure for a DynamicBytesFile to become pollable
(perhaps with select, poll, or epoll). Simply arrange for a
DynamicBytesPoller to be notified whenever the relevant file is updated
and implement PollableDynamicBytesSource on the DynamicBytesSource.
EPOLLPRI and EPOLLERR are triggered for these files, which seems to
match Linux's implementation for /proc/sys files.
The first two files to support this are hostname and domainname in
/proc/sys/kernel. This is used by systemd-journald to monitor for
hostname changes.
This change fixes the issue by surfacing the CPU accounting gVisor already tracks, read as plain atomics, closish to how Linux serves `/proc/stat`:
- **`cpu` aggregate line:** served from kernel-wide cumulative user/system CPU accumulators advanced by the existing CPU-clock ticker (analogous to Linux's `kcpustat`), read as two atomics. Idle time is approximated from uptime, giving monitoring tools meaningful deltas between samples.
- **Per-CPU lines (`cpu0`..`cpuN`):** since gVisor has no per-core accounting, the aggregate is distributed evenly across application cores (remainder assigned to `cpu0`), so the per-CPU lines sum back to the aggregate.
- **`procs_running` / `procs_blocked`:** O(1) reads of kernel atomic counters maintained on task scheduling-state transitions, analogous to Linux's `nr_running`/`nr_iowait`, instead of being hardcoded to zero.
`intr`, `ctxt`, `processes`, and `softirq` remain stubbed -- a global fork counter would be needed for `processes`?
Verified end-to-end with a `runsc` build: `top` and `htop` now report live CPU usage under load.
Fixes#9967.
Co-authored-by: Hanzo Dev <[email protected]>
Expose randomize_va_space in procfs with a static value of 2
(full randomization), matching gVisor's actual ASLR behavior.
gVisor always applies full ASLR for user memory mappings, so we
report the value 2 to match the actual behavior.
This fixes programs(e.g. https://github.com/psf/pyperf) that
read this file to collect ASLR metadata and fail with ENOENT
when the file is missing.
Signed-off-by: Tan Yifeng <[email protected]>
- Add /proc/devices.
- Provide /proc/driver/nvidia/params when nvproxy is enabled. CUDA-using
applications already try to open this file, but silently tolerate its
non-existence. However, both the IMEX daemon and IMEX-using applications are
believed to require this file for ImexChannelCount. (libnvidia-container
additionally provides /proc/driver/nvidia/{registry,version}, but we have yet
to see any application use these.)
- Add new capability nvconf.CapFabricIMEXManagement. When enabled, provide
/proc/driver/nvidia/capabilities/fabric-imex-mgmt and the corresponding
/dev/nvidia-caps/nvidia-cap#.
- Add support for /dev/nvidia-caps-imex-channels/ (irrespective of the new
capability, since IMEX-using applications need this directory as well).
- Allow devutil.GoferClient.OpenAt() to take a relative path (i.e. containing
more than one path component) rather than only a basename, since this is
needed to open /dev/nvidia-caps/*.
- Add nvproxy support for all known-required controls, and all allocation
classes to which those controls correspond.
This CL is specifically for nvidia-imex, the "NVIDIA IMEX Service for NVLink
Networks" (or "IMEX daemon"); applications using IMEX haven't been tested yet,
and may require additional allocation classes / control commands, or some
existing ones marked as requiring CapFabricIMEXManagement as being enabled more
broadly.
PiperOrigin-RevId: 859286209
This change updates the security checks to align with Linux kernel behavior:
* Add ptrace_may_access-style checks (kernel.ContextCanTrace) when accessing
/proc/[pid]/maps and /proc/[pid]/smaps.
* Change the permissions of the /proc/[pid]/fd directory to 0500 (read/execute
for owner only).
* Add a similar kernel.ContextCanTrace check for /proc/[pid]/{environ,auxv}.
PiperOrigin-RevId: 842001353
Linux prints this field when cache information is available. This field
is conditional (see arch/x86/kernel/cpu/proc.c:x86_cache_size()). It a
different meaning and implementation on each vendor. For example, as of
Linux 6.1.0 it returns LLC size on Intel and L2 size on AMD CPUs.
Even though usefullness of this field in its current implementation
debatable, some relatively popular software such as PyPy (as of 7.3.11)
relies on it and prints a warning if it is not available.
Linux prints these fields when the kernel is built with support for multiple
processors/cores (CONFIG_SMP), in
arch/x86/kernel/cpu/proc.c:show_cpuinfo_core().
Fixes#10205
PiperOrigin-RevId: 632621375
Adapted from cl/630063475.
This causes FUSE tests involving submounts to fail, because fuse.inode.Valid()
just returns false (fails revalidation) after the entry time expires, causing
all submounts to be unmounted; change it to perform revalidation instead, a la
Linux's fs/fuse/dir.c:fuse_dentry_revalidate(). This in turn requires that we
plumb the dentry's parent and name through kernfs.Inode.Valid().
PiperOrigin-RevId: 630476483
The code in GVisor relied on the process name not containing whitespace when
parsing /proc/*/stat. This CL fixes that by moving parsing to its own function,
implemented properly.
PiperOrigin-RevId: 511616209
Added a mechanism to query runtime sentry heap usage using procfs from inside
the sandbox. This may help with providing insight regarding sandbox hitting the
memory limit on the host despite reporting a lower application memory usage.
And added a test to `proc.cc`.
PiperOrigin-RevId: 470061488
All anonfs dentries are non-directories. So all FilesystemImpl
methods that would require an anonDentry to be a directory should
return ENOTDIR.
PiperOrigin-RevId: 455271653
Some /proc files are static in gVisor, but can be updated in native
linux. To test the values of these files, move them to a separate test
and run it using "container" tag to avoid faulty comparisons in native.
Since a separate IPC namespace is used, update shm comparisons to check
the actual value, not an interval.
This change implements /proc/cmdline with a basic faux command line
"BOOT_IMAGE=/vmlinuz-[version]-gvisor quiet" so apps that may expect
it do not receive errors.
Also tests for the existence of /proc/cmdline as part of the system
call test suite
PiperOrigin-RevId: 372462070
In order to resolve path names, fsSymlink.Readlink() may need to reenter
kernfs. Change the code so that kernfs.Inode.Readlink() is called without
locks and document the new contract.
PiperOrigin-RevId: 371770222
