From: Dominik Csapak <d.csapak@proxmox.com>
To: "Fabian Grünbichler" <f.gruenbichler@proxmox.com>,
"Proxmox Backup Server development discussion"
<pbs-devel@lists.proxmox.com>
Subject: Re: [pbs-devel] [PATCH proxmox] sys: fs: set FD_CLOEXEC when creating temp files
Date: Fri, 29 Nov 2024 09:02:39 +0100 [thread overview]
Message-ID: <ae0dba6b-c079-41ed-8c17-313d7a05de06@proxmox.com> (raw)
In-Reply-To: <771443181.1837.1732867036375@webmail.proxmox.com>
On 11/29/24 08:57, Fabian Grünbichler wrote:
>> Dominik Csapak <d.csapak@proxmox.com> hat am 28.11.2024 15:54 CET geschrieben:
>> In general we want all open files to have set CLOEXEC since our
>> reloading mechanism can basically fork at any moment and we don't want
>> newer daemons to carry around old file descriptors, especially lock
>> files.
>>
>> Since `make_tmp_file` is called by many things (e.g. open_file_locked,
>> logrotate, rrd), set FD_CLOEXEC after getting the filehandle.
>>
>> This fixes an issue with e.g. tape backups not working because of such
>> lingering lock files after a reload.
>
> and also one that "leaked" an additional FD for every proxmox-backup-proxy reload via the RRD journal files - so this fixes a bug where PBS will eventually run into the open file limits if you keep reloading that service without ever stopping or restarting it.
nice! did not have too much time yesterday to look into other benefits ;)
>
> might be a good addition to the commit message :)
>
>> Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
>> ---
>> there are other code parts where we open file without CLOEXEC, but
>> wanted to send this for now.
>>
>> proxmox-sys/src/fs/file.rs | 7 +++++--
>> 1 file changed, 5 insertions(+), 2 deletions(-)
>>
>> diff --git a/proxmox-sys/src/fs/file.rs b/proxmox-sys/src/fs/file.rs
>> index fbfc0b58..05d0aff0 100644
>> --- a/proxmox-sys/src/fs/file.rs
>> +++ b/proxmox-sys/src/fs/file.rs
>> @@ -7,7 +7,7 @@ use std::time::Duration;
>>
>> use anyhow::{bail, format_err, Context as _, Error};
>> use nix::errno::Errno;
>> -use nix::fcntl::OFlag;
>> +use nix::fcntl::{FcntlArg, FdFlag, OFlag};
>> use nix::sys::stat;
>> use nix::unistd;
>> use nix::NixPath;
>> @@ -128,7 +128,10 @@ pub fn make_tmp_file<P: AsRef<Path>>(
>> let mut template = path.to_owned();
>> template.set_extension("tmp_XXXXXX");
>> let (mut file, tmp_path) = match unistd::mkstemp(&template) {
>> - Ok((fd, path)) => (unsafe { File::from_raw_fd(fd) }, path),
>> + Ok((fd, path)) => {
>> + nix::fcntl::fcntl(fd, FcntlArg::F_SETFD(FdFlag::FD_CLOEXEC))?;
>> + (unsafe { File::from_raw_fd(fd) }, path)
>> + }
>
> unfortunately, this is still racy since the FD is open with O_CLOEXEC between the unistd::mkstemp and the fcntl - see the man page of fcntl which explicitly calls this out:
>
> "In multithreaded programs, using fcntl() F_SETFD to set the close-on-exec flag at the same time as another thread performs a fork(2) plus execve(2) is vulnerable to a race condition that may unintentionally leak the file descriptor to the program executed in the child process."
>
> we could use libc::mkostemp (unsafe, path/template+flags -> raw fd or error as c_int) instead? and/or we could write a wrapper around it and propose it upstream for nix inclusion? ;) but since this seems to be the only place where we call mkstemp..
>
yeah had the same though, and have a version here where i basically copied nix's mkstemp but with
oflags + mkostemp call to libc, so i can send that if wanted
the question for me is if it's ok to use since mkostemp is only a glibc extension (since 2.7) and we
may use that in proxmox-backup-client which we want to statically build ?
(not sure how that static compilation works with such a thing though...)
>> Err(err) => bail!("mkstemp {:?} failed: {}", template, err),
>> };
>>
>> --
>> 2.39.5
>>
>>
>>
>> _______________________________________________
>> pbs-devel mailing list
>> pbs-devel@lists.proxmox.com
>> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
next prev parent reply other threads:[~2024-11-29 8:03 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-11-28 14:54 Dominik Csapak
2024-11-29 7:57 ` Fabian Grünbichler
2024-11-29 8:02 ` Dominik Csapak [this message]
2024-11-29 8:14 ` Fabian Grünbichler
2024-11-29 10:21 ` Thomas Lamprecht
2024-11-29 12:31 ` Thomas Lamprecht
2024-11-29 13:12 ` Dominik Csapak
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ae0dba6b-c079-41ed-8c17-313d7a05de06@proxmox.com \
--to=d.csapak@proxmox.com \
--cc=f.gruenbichler@proxmox.com \
--cc=pbs-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox