search

ioi / isolate

Sandbox for securely executing untrusted programs
Other
1.04k stars 154 forks source link

Fix cgroup memory limits not working #123

Closed Holmes98 closed 1 year ago

Holmes98 commented 1 year ago

The changes from #109 attempted to fix an issue where cgroup memory limits could not be increased across runs within the same sandbox, but if swap is enabled, this breaks memory limits on the initial run, as attempting to set memory.memsw.limit_in_bytes before memory.limit_in_bytes has been set results in an error (which isolate ignores due to the ? flag). For example, when running the following commands, memory limits are ignored on the first run, but work on the second run:

isolate -b0 --init --cg
isolate -b0 --cg --cg-mem 16384 --run -- /usr/bin/python3 -c '[0]*10000000'
isolate -b0 --cg --cg-mem 32768 --run -- /usr/bin/python3 -c '[0]*10000000'
isolate -b0 --cleanup --cg

This PR restores the original ordering and proposes an alternative fix: reset any existing limit on memory.memsw.limit_in_bytes before setting memory.limit_in_bytes to allow the limit to be increased.

gollux commented 1 year ago

Sorry about that, it fell through my testing, since I do not use swap at any of my machines. I will merge your fix.

However, please keep in mind that using swap with Isolate is not recommended (it makes run times too much variable).