Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disable core dumps for workspaces #12814

Closed
wants to merge 2 commits into from
Closed

Disable core dumps for workspaces #12814

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
28ecfce
[workspacekit] Disable core dumps
Furisto Sep 7, 2022
1c653ff
Enable configuration of core dumps in .gitpod.yml files
aledbf Sep 20, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions components/gitpod-protocol/data/gitpod-schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -282,6 +282,25 @@
"type": "boolean",
"deprecationMessage": "The 'experimentalNetwork' property is deprecated.",
"description": "Experimental network configuration in workspaces (deprecated). Enabled by default"
},
"coreDump": {
"type": "object",
"description": "Configure the default action of certain signals is to cause a process to terminate and produce a core dump file, a file containing an image of the process's memory at the time of termination. Disabled by default.",
"deprecationMessage": "The 'coreDump' property is experimental.",
"additionalProperties": false,
"properties": {
"enabled": {
"type": "boolean"
},
"cur": {
"type": "number",
"description": "Cur specifies the soft limit"
},
"max": {
"type": "number",
"description": "Max specifies the hard limit"
}
}
}
},
"additionalProperties": false,
Expand Down
7 changes: 7 additions & 0 deletions components/gitpod-protocol/src/protocol.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -803,6 +803,12 @@ export interface RepositoryCloneInformation {
checkoutLocation?: string;
}

export interface CoreDumpConfig {
enabled?: boolean;
cur?: number;
max?: number;
}

export interface WorkspaceConfig {
mainConfiguration?: string;
additionalRepositories?: RepositoryCloneInformation[];
Expand All @@ -815,6 +821,7 @@ export interface WorkspaceConfig {
github?: GithubAppConfig;
vscode?: VSCodeConfig;
jetbrains?: JetBrainsConfig;
coreDump?: CoreDumpConfig;

/** deprecated. Enabled by default **/
experimentalNetwork?: boolean;
Expand Down
11 changes: 11 additions & 0 deletions components/server/src/workspace/workspace-starter.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1416,6 +1416,17 @@ export class WorkspaceStarter {
dotfileEnv.setValue(user.additionalData?.dotfileRepo || "");
envvars.push(dotfileEnv);

if (workspace.config.coreDump.enabled) {
const noLimits:number=18446744073709551615;

const rLimitCur = new EnvironmentVariable();
rLimitCur.setName("GITPOD_RLIMIT_CORE");
rLimitCur.setValue(JSON.stringify({
cur: workspace.config.coreDump.cur === 0 ? noLimits : workspace.config.coreDump.cur,
max: workspace.config.coreDump.max === 0 ? noLimits : workspace.config.coreDump.max,
}));
}

const createGitpodTokenPromise = (async () => {
const scopes = this.createDefaultGitpodAPITokenScopes(workspace, instance);
const token = crypto.randomBytes(30).toString("hex");
Expand Down
19 changes: 19 additions & 0 deletions components/workspacekit/cmd/rings.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -829,6 +829,25 @@ var ring2Cmd = &cobra.Command{
return
}

type fakeRlimit struct {
Cur uint64 `json:"cur"`
Max uint64 `json:"max"`
}

var rlimit fakeRlimit
err = json.Unmarshal([]byte(os.Getenv("GITPOD_RLIMIT_CORE")), &rlimit)
if err != nil {
log.WithError(err).WithField("data", os.Getenv("RLIMIT_CORE")).Error("cannot deserialize RLIMIT_CORE")
}

rlimitCore := &syscall.Rlimit{
Cur: rlimit.Cur,
Max: rlimit.Max,
}
if err := syscall.Setrlimit(syscall.RLIMIT_CORE, rlimitCore); err != nil {
log.WithError(err).Error("cannot disable core dumps")
}

// Now that we're in our new root filesystem, including proc and all, we can load
// our seccomp filter, and tell our parent about it.
scmpFd, err := seccomp.LoadFilter()
Expand Down