ioi / isolate

Sandbox for securely executing untrusted programs
Other
1.04k stars 154 forks source link

isolate memory accouting issue #134

Closed HeRaNO closed 6 months ago

HeRaNO commented 8 months ago

I'm testing isolate with a null C code:

// nul.c, put in /work
int main(){}

running with:

gcc nul.c -o nul
isolate --cg --init
isolate --cg -v -p --dir=box=/work --meta=metafile --run -- ./nul

The metafile says:

time:0.002
time-wall:0.013
max-rss:1152
csw-voluntary:4
csw-forced:3
cg-mem:344
exitcode:0

Then I wrote a null Java code:

// Main.java, put in /work
public class Main {
    public static void main(String args[]) {
    }
}

running with:

javac Main.java
isolate --cg --cleanup
isolate --cg --init
isolate --cg -v -p --dir=box=/work --meta=metafile --run -- /usr/lib/jvm/java-11-openjdk-amd64/bin/java Main

The metafile says:

time:0.126
time-wall:0.147
max-rss:33904
csw-voluntary:417
csw-forced:57
cg-mem:38316
exitcode:0

The isolate version is 1.10.1, running with cgroups v1 mode (master branch).

My problem is:

  1. The C program will run in just one process. In my opinion, the Max RSS should be identical to the max memory usage accounted by cgroups. But why the value is different?
  2. The Java code may run in a multiprocess way. However, the memory overhead is really huge. How to reduce that. I know that it has nothing to do with isolate itself, but do you have any suggestions on it?
  3. How can I get a more precise memory accounting value? Considering the Turing Machine model, I think that the maximum memory usage of the two programs should be ~0KB.
HeRaNO commented 6 months ago

Such a messy problem that I guess something is wrong in the kernel when accounting max_usage_in_bytes. Please reopen it when it's needed to discuss.