From nobody Mon Feb 9 10:30:15 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1562138509; cv=none; d=zoho.com; s=zohoarc; b=VgxAYtZ4wk1RZJarNfSvqQg1EJ3rbSsQm3fN3QjEcbnMah/lhT5e8Mf1CcsQIkKJR7gztKY2gnTjI1CRxLKnn2AKvhXh0sKg/6il3p7zuSEkU7CfSbIxq//Zy7ZogK5QqwzbVwr1vsLi6epbEPUP2p0TpzW7Edb3gkCzJp21xHc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zoho.com; s=zohoarc; t=1562138509; h=Content-Type:Content-Transfer-Encoding:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To:ARC-Authentication-Results; bh=+A5kXkDIqwUB6xQqrjjcVcKFwSp/cBK4EK/nkcNultU=; b=RhAaBrt2I6WjXXV1rqP5o6A81jiC+Hvu9pLTRXcwH9YQak9QBtpknDYzuHYSTUrkzF06IY8PEejaHvaWQk1cfo+4qU9bl+h7yodvOZMJgkwOSiIKO/mNl3LBG4gLH11LA6SuWu5cYGbLzlR6KtmEIgNu8mIr6+agbHH8xq0E7bs= ARC-Authentication-Results: i=1; mx.zoho.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass header.from= (p=none dis=none) header.from= Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1562138509023706.3220893313489; Wed, 3 Jul 2019 00:21:49 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 18332307CDD5; Wed, 3 Jul 2019 07:21:47 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id DF53D8509; Wed, 3 Jul 2019 07:21:45 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 6A9D818184B7; Wed, 3 Jul 2019 07:21:45 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id x637Jd3W020060 for ; Wed, 3 Jul 2019 03:19:39 -0400 Received: by smtp.corp.redhat.com (Postfix) id 9247818EC7; Wed, 3 Jul 2019 07:19:39 +0000 (UTC) Received: from localhost.localdomain (ovpn-204-217.brq.redhat.com [10.40.204.217]) by smtp.corp.redhat.com (Postfix) with ESMTP id 24E1F78423 for ; Wed, 3 Jul 2019 07:19:36 +0000 (UTC) From: Michal Privoznik To: libvir-list@redhat.com Date: Wed, 3 Jul 2019 09:19:20 +0200 Message-Id: <8cf311e297b18b159d3bb6dc201df260585b904c.1562138162.git.mprivozn@redhat.com> In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH 3/3] virCommand: use procfs to learn opened FDs X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.49]); Wed, 03 Jul 2019 07:21:47 +0000 (UTC) Content-Type: text/plain; charset="utf-8" When spawning a child process, between fork() and exec() we close all file descriptors and keep only those the caller wants us to pass onto the child. The problem is how we do that. Currently, we get the limit of opened files and then iterate through each one of them and either close() it or make it survive exec(). This approach is suboptimal (although, not that much in default configurations where the limit is pretty low - 1024). We have /proc where we can learn what FDs we hold open and thus we can selectively close only those. Signed-off-by: Michal Privoznik --- src/util/vircommand.c | 78 ++++++++++++++++++++++++++++++++++++++----- 1 file changed, 70 insertions(+), 8 deletions(-) diff --git a/src/util/vircommand.c b/src/util/vircommand.c index faee36c449..d154bb81d4 100644 --- a/src/util/vircommand.c +++ b/src/util/vircommand.c @@ -491,27 +491,89 @@ virExecCommon(virCommandPtr cmd, gid_t *groups, int n= groups) return ret; } =20 +# ifdef __linux__ +/* On Linux, we can utilize procfs and read the table of opened + * FDs and selectively close only those FDs we don't want to pass + * onto child process (well, the one we will exec soon since this + * is called from the child). */ +static int +virCommandMassCloseGetFDsLinux(virCommandPtr cmd ATTRIBUTE_UNUSED, + virBitmapPtr fds) +{ + DIR *dp =3D NULL; + struct dirent *entry; + const char *dirName =3D "/proc/self/fd"; + int rc; + int ret =3D -1; + + if (virDirOpen(&dp, dirName) < 0) + return -1; + + while ((rc =3D virDirRead(dp, &entry, dirName)) > 0) { + int fd; + + if (virStrToLong_i(entry->d_name, NULL, 10, &fd) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("unable to parse FD: %s"), + entry->d_name); + goto cleanup; + } + + if (virBitmapSetBit(fds, fd) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("unable to set FD as open: %d"), + fd); + goto cleanup; + } + } + + if (rc < 0) + goto cleanup; + + ret =3D 0; + cleanup: + VIR_DIR_CLOSE(dp); + return ret; +} + +# else /* !__linux__ */ + +static int +virCommandMassCloseGetFDsGeneric(virCommandPtr cmd ATTRIBUTE_UNUSED, + virBitmapPtr fds) +{ + virBitmapSetAll(fds); + return 0; +} +# endif /* !__linux__ */ + static int virCommandMassClose(virCommandPtr cmd, int childin, int childout, int childerr) { + VIR_AUTOPTR(virBitmap) fds =3D NULL; int openmax =3D sysconf(_SC_OPEN_MAX); - int fd; - int tmpfd; + int fd =3D -1; =20 - if (openmax < 0) { - virReportSystemError(errno, "%s", - _("sysconf(_SC_OPEN_MAX) failed")); + if (!(fds =3D virBitmapNew(openmax))) return -1; - } =20 - for (fd =3D 3; fd < openmax; fd++) { +# ifdef __linux__ + if (virCommandMassCloseGetFDsLinux(cmd, fds) < 0) + return -1; +# else + if (virCommandMassCloseGetFDsGeneric(cmd, fds) < 0) + return -1; +# endif + + fd =3D virBitmapNextSetBit(fds, -1); + for (; fd >=3D 0; fd =3D virBitmapNextSetBit(fds, fd)) { if (fd =3D=3D childin || fd =3D=3D childout || fd =3D=3D childerr) continue; if (!virCommandFDIsSet(cmd, fd)) { - tmpfd =3D fd; + int tmpfd =3D fd; VIR_MASS_CLOSE(tmpfd); } else if (virSetInherit(fd, true) < 0) { virReportSystemError(errno, _("failed to preserve fd %d"), fd); --=20 2.21.0 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list