9792366952

Committed 04 Jul 2024 10:02AM UTC coverage: 16.044% (-0.4%) from 16.441%

Build # 9792366952

Build Type

push

github

Committed by

web-flow

Commit Message

Merge pull request #138 from bodgit/mlock

fix: Warn if `CAP_IPC_LOCK` capability is missing

Run Details

0 of 17 new or added lines in 1 file covered. (0.0%)

73 of 455 relevant lines covered (16.04%)

0.31 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/internal/cmd/utils_linux.go

package cmd

import (
        "fmt"

        "github.com/hashicorp/go-secure-stdlib/mlock"
        log "github.com/sirupsen/logrus"
        "github.com/syndtr/gocapability/capability"
        cli "github.com/urfave/cli/v2"
)

// ExecWrapper mlocks the process memory (if supported) before our `run` functions,
// and gracefully logs and exits afterwards.
func ExecWrapper(f func(ctx *cli.Context) (int, error)) cli.ActionFunc {
        return func(ctx *cli.Context) error {
                caps, err := capability.NewPid2(0)
                if err != nil {
                        return exit(1, fmt.Errorf("error getting capabilities: %w", err))
                }

                if err = caps.Load(); err != nil {
                        return exit(1, fmt.Errorf("error loading capabilities: %w", err))
                }

                if caps.Get(capability.EFFECTIVE, capability.CAP_IPC_LOCK) { // mlock.Supported() is assumed
                        if err = mlock.LockMemory(); err != nil {
                                return exit(1, fmt.Errorf("error locking vac memory: %w", err))
                        }
                } else {
                        log.Warn("unable to lock memory, missing CAP_IPC_LOCK capability")
                }

                return exit(f(ctx))
        }
}

1	package cmd
2
3	import (
4	"fmt"
5
6	"github.com/hashicorp/go-secure-stdlib/mlock"
7	log "github.com/sirupsen/logrus"
8	"github.com/syndtr/gocapability/capability"
9	cli "github.com/urfave/cli/v2"
10	)
11
12	// ExecWrapper mlocks the process memory (if supported) before our `run` functions,
13	// and gracefully logs and exits afterwards.
NEW 14	func ExecWrapper(f func(ctx *cli.Context) (int, error)) cli.ActionFunc {	×
NEW 15	return func(ctx *cli.Context) error {	×
NEW 16	caps, err := capability.NewPid2(0)	×
NEW 17	if err != nil {	×
NEW 18	return exit(1, fmt.Errorf("error getting capabilities: %w", err))	×
NEW 19	}	×
20
NEW 21	if err = caps.Load(); err != nil {	×
NEW 22	return exit(1, fmt.Errorf("error loading capabilities: %w", err))	×
NEW 23	}	×
24
NEW 25	if caps.Get(capability.EFFECTIVE, capability.CAP_IPC_LOCK) { // mlock.Supported() is assumed	×
NEW 26	if err = mlock.LockMemory(); err != nil {	×
NEW 27	return exit(1, fmt.Errorf("error locking vac memory: %w", err))	×
NEW 28	}	×
NEW 29	} else {	×
NEW 30	log.Warn("unable to lock memory, missing CAP_IPC_LOCK capability")	×
NEW 31	}	×
32
NEW 33	return exit(f(ctx))	×
34	}
35	}

mvisonneau / vac / 9792366952

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous