ioi / isolate

Sandbox for securely executing untrusted programs
Other
1.04k stars 154 forks source link

Wrong memory usage when run program twice in one box #136

Closed HeRaNO closed 8 months ago

HeRaNO commented 8 months ago

Prepare the codes from #134 and run them continuously.

$ isolate --cg --cleanup
$ isolate --cg --init
/var/local/lib/isolate/0
$ isolate --cg -v -v -p --dir=box=/work --meta=metafile --run -- /usr/lib/jvm/java-11-openjdk-amd64/bin/java Main
Using control group box-0 under parent .
Started proxy_pid=... box_pid=... box_pid_inside_ns=...
Entering control group box-0
CG: Write tasks = 2
CG: Write tasks = 2
CG: Write tasks = 2
CG: Write cpuacct.usage = 0
Binding ...
...
OK (0.068 sec real, 0.072 sec wall)
$ cat metafile
...
max-rss:34144
...
cg-mem:10216
exitcode:0
$ isolate --cg -v -v -p --dir=box=/work --meta=metafile --run -- ./nul
Using control group box-0 under parent .
Started proxy_pid=... box_pid=... box_pid_inside_ns=...
Entering control group box-0
CG: Write tasks = 2
CG: Write tasks = 2
CG: Write tasks = 2
CG: Write cpuacct.usage = 0
Binding ...
OK (0.001 sec real, 0.025 sec wall)
$ cat metafile
...
max-rss:1152
...
cg-mem:10216
exitcode:0

It seems that the cg-mem has not been reset to 0. The isolate version is 1.10.1 with cgroups v1 enable.

UPD: Oops, we should set --cg-mem to make max_usage reset to 0. Perhaps we can reset it at the initializing?

gollux commented 8 months ago

This is expected behavior. If you run multiple commands in the same sandbox, the cgroup persists and it can retain cached data from the previous commands. I'm going to add a note to the man page, so that people are not surprised.

Generally, I recommend to use a fresh sandbox for each command.