<commit_before>package main

import (
	"context"
	"fmt"
	"net"
	"os"
	"os/signal"
	"runtime"
	"syscall"
	"time"

	"github.com/inconshreveable/log15"
	"github.com/kardianos/osext"
	"github.com/stephane-martin/skewer/cmd"
	"github.com/stephane-martin/skewer/services"
	"github.com/stephane-martin/skewer/sys"
	"github.com/stephane-martin/skewer/sys/binder"
	"github.com/stephane-martin/skewer/sys/capabilities"
	"github.com/stephane-martin/skewer/sys/dumpable"
	"github.com/stephane-martin/skewer/sys/namespaces"
	"github.com/stephane-martin/skewer/sys/scomp"
	"github.com/stephane-martin/skewer/utils/logging"
)

func getLogger(ctx context.Context, name string, handle int) (log15.Logger, error) {
	loggerConn, err := net.FileConn(os.NewFile(uintptr(handle), "logger"))
	if err != nil {
		return nil, err
	}
	err = loggerConn.(*net.UnixConn).SetReadBuffer(65536)
	if err != nil {
		return nil, err
	}
	err = loggerConn.(*net.UnixConn).SetWriteBuffer(65536)
	if err != nil {
		return nil, err
	}
	return logging.NewRemoteLogger(ctx, loggerConn).New("proc", name), nil
}

func main() {
	numcpus := runtime.NumCPU()
	maxprocs := numcpus * 8
	if maxprocs < 16 {
		maxprocs = 16
	}
	runtime.GOMAXPROCS(maxprocs)


	name := os.Args[0]
	loggerCtx, cancelLogger := context.WithCancel(context.Background())
	var logger log15.Logger = nil

	if runtime.GOOS == "openbsd" {
		// so that we execute IP capabilities probes before the call to pledge
		net.Dial("udp4", "127.0.0.1:80")
	}

	cleanup := func(msg string, err error) {
		if err != nil {
			if len(msg) == 0 {
				msg = "Process fatal error"
			}
			if logger != nil {
				logger.Crit(msg, "error", err)
			}
			fmt.Fprintln(os.Stderr, name, ":", msg, ":", err.Error())
			time.Sleep(100 * time.Millisecond)
			cancelLogger()
			time.Sleep(100 * time.Millisecond)
			os.Exit(-1)
		} else {
			cancelLogger()
			time.Sleep(100 * time.Millisecond)
		}
	}

	switch name {
	case "skewer-conf":
		sys.MlockAll()
		dumpable.SetNonDumpable()
		capabilities.NoNewPriv()
		signal.Ignore(syscall.SIGHUP, syscall.SIGTERM, syscall.SIGINT)

		logger, err := getLogger(loggerCtx, name, 3)
		if err != nil {
			cleanup("Could not create a logger for the configuration service", err)
		}
		err = scomp.SetupSeccomp(name)
		if err != nil {
			cleanup("Seccomp setup error", err)
		}
		err = scomp.SetupPledge(name)
		if err != nil {
			cleanup("Pledge setup error", err)
		}
		err = services.LaunchConfProvider(logger)
		if err != nil {
			cleanup("ConfigurationProvider encountered a fatal error", err)
		}

	case "confined-skewer-journal":
		// journal is a special case, as /run/log/journal and /var/log/journal
		// can not be bind-mounted (probably because of setgid bits)
		dumpable.SetNonDumpable()
		path, err := osext.Executable()
		if err != nil {
			cleanup("Error getting executable path", err)
		}
		// mask most of directories, but no pivotroot
		err = namespaces.SetJournalFs(path)
		if err != nil {
			cleanup("mount error", err)
		}
		err = sys.SetHostname(name)
		if err != nil {
			cleanup("sethostname error", err)
		}
		// from here we don't need root capabilities in the container
		err = capabilities.DropAllCapabilities()
		if err != nil {
			cleanup("Error dropping caps", err)
		}
		err = syscall.Exec(path, []string{os.Args[0][9:]}, os.Environ())
		if err != nil {
			cleanup("execve error", err)
		}

	case "confined-skewer-accounting", "confined-skewer-tcp", "confined-skewer-udp", "confined-skewer-relp", "confined-skewer-store", "confined-skewer-conf":
		path, err := osext.Executable()
		if err != nil {
			cleanup("Error getting executable path", err)
		}
		if capabilities.CapabilitiesSupported {
			// we are root inside the user namespace that was created by plugin control
			dumpable.SetNonDumpable()

			root, err := namespaces.MakeChroot(path)
			if err != nil {
				cleanup("mount error", err)
			}
			err = namespaces.PivotRoot(root)
			if err != nil {
				cleanup("pivotroot error", err)
			}
			err = sys.SetHostname(name)
			if err != nil {
				cleanup("sethostname error", err)
			}
			// from here we don't need root capabilities in the container
			err = capabilities.DropAllCapabilities()
			if err != nil {
				cleanup("Error dropping caps", err)
			}
		}

		err = syscall.Exec(path, []string{os.Args[0][9:]}, os.Environ())
		if err != nil {
			cleanup("execve error", err)
		}

	case "skewer-tcp", "skewer-udp", "skewer-relp", "skewer-journal", "skewer-store", "skewer-accounting":
		if name != "skewer-store" {
			sys.MlockAll()
		}
		signal.Ignore(syscall.SIGHUP, syscall.SIGTERM, syscall.SIGINT)
		dumpable.SetNonDumpable()
		capabilities.NoNewPriv()

		var binderClient *binder.BinderClient
		var pipe *os.File
		var err error

		if os.Getenv("SKEWER_HAS_BINDER") == "TRUE" {
			if os.Getenv("SKEWER_HAS_LOGGER") == "TRUE" {
				logger, err = getLogger(loggerCtx, name, 4)
				if os.Getenv("SKEWER_HAS_PIPE") == "TRUE" {
					pipe = os.NewFile(5, "pipe")
				}
			} else if os.Getenv("SKEWER_HAS_PIPE") == "TRUE" {
				pipe = os.NewFile(4, "pipe")
			}
			binderClient, _ = binder.NewBinderClient(os.NewFile(3, "binder"), logger)<commit_msg>set gomaxprocs for badger<commit_after>package main

import (
	"context"
	"fmt"
	"net"
	"os"
	"os/signal"
	"runtime"
	"syscall"
	"time"

	"github.com/inconshreveable/log15"
	"github.com/kardianos/osext"
	"github.com/stephane-martin/skewer/cmd"
	"github.com/stephane-martin/skewer/services"
	"github.com/stephane-martin/skewer/sys"
	"github.com/stephane-martin/skewer/sys/binder"
	"github.com/stephane-martin/skewer/sys/capabilities"
	"github.com/stephane-martin/skewer/sys/dumpable"
	"github.com/stephane-martin/skewer/sys/namespaces"
	"github.com/stephane-martin/skewer/sys/scomp"
	"github.com/stephane-martin/skewer/utils/logging"
)

func getLogger(ctx context.Context, name string, handle int) (log15.Logger, error) {
	loggerConn, err := net.FileConn(os.NewFile(uintptr(handle), "logger"))
	if err != nil {
		return nil, err
	}
	err = loggerConn.(*net.UnixConn).SetReadBuffer(65536)
	if err != nil {
		return nil, err
	}
	err = loggerConn.(*net.UnixConn).SetWriteBuffer(65536)
	if err != nil {
		return nil, err
	}
	return logging.NewRemoteLogger(ctx, loggerConn).New("proc", name), nil
}

func main() {
	name := os.Args[0]
	loggerCtx, cancelLogger := context.WithCancel(context.Background())
	var logger log15.Logger = nil

	if runtime.GOOS == "openbsd" {
		// so that we execute IP capabilities probes before the call to pledge
		net.Dial("udp4", "127.0.0.1:80")
	}

	cleanup := func(msg string, err error) {
		if err != nil {
			if len(msg) == 0 {
				msg = "Process fatal error"
			}
			if logger != nil {
				logger.Crit(msg, "error", err)
			}
			fmt.Fprintln(os.Stderr, name, ":", msg, ":", err.Error())
			time.Sleep(100 * time.Millisecond)
			cancelLogger()
			time.Sleep(100 * time.Millisecond)
			os.Exit(-1)
		} else {
			cancelLogger()
			time.Sleep(100 * time.Millisecond)
		}
	}

	switch name {
	case "skewer-conf":
		sys.MlockAll()
		dumpable.SetNonDumpable()
		capabilities.NoNewPriv()
		signal.Ignore(syscall.SIGHUP, syscall.SIGTERM, syscall.SIGINT)

		logger, err := getLogger(loggerCtx, name, 3)
		if err != nil {
			cleanup("Could not create a logger for the configuration service", err)
		}
		err = scomp.SetupSeccomp(name)
		if err != nil {
			cleanup("Seccomp setup error", err)
		}
		err = scomp.SetupPledge(name)
		if err != nil {
			cleanup("Pledge setup error", err)
		}
		err = services.LaunchConfProvider(logger)
		if err != nil {
			cleanup("ConfigurationProvider encountered a fatal error", err)
		}

	case "confined-skewer-journal":
		// journal is a special case, as /run/log/journal and /var/log/journal
		// can not be bind-mounted (probably because of setgid bits)
		dumpable.SetNonDumpable()
		path, err := osext.Executable()
		if err != nil {
			cleanup("Error getting executable path", err)
		}
		// mask most of directories, but no pivotroot
		err = namespaces.SetJournalFs(path)
		if err != nil {
			cleanup("mount error", err)
		}
		err = sys.SetHostname(name)
		if err != nil {
			cleanup("sethostname error", err)
		}
		// from here we don't need root capabilities in the container
		err = capabilities.DropAllCapabilities()
		if err != nil {
			cleanup("Error dropping caps", err)
		}
		err = syscall.Exec(path, []string{os.Args[0][9:]}, os.Environ())
		if err != nil {
			cleanup("execve error", err)
		}

	case "confined-skewer-accounting", "confined-skewer-tcp", "confined-skewer-udp", "confined-skewer-relp", "confined-skewer-store", "confined-skewer-conf":
		path, err := osext.Executable()
		if err != nil {
			cleanup("Error getting executable path", err)
		}
		if capabilities.CapabilitiesSupported {
			// we are root inside the user namespace that was created by plugin control
			dumpable.SetNonDumpable()

			root, err := namespaces.MakeChroot(path)
			if err != nil {
				cleanup("mount error", err)
			}
			err = namespaces.PivotRoot(root)
			if err != nil {
				cleanup("pivotroot error", err)
			}
			err = sys.SetHostname(name)
			if err != nil {
				cleanup("sethostname error", err)
			}
			// from here we don't need root capabilities in the container
			err = capabilities.DropAllCapabilities()
			if err != nil {
				cleanup("Error dropping caps", err)
			}
		}

		err = syscall.Exec(path, []string{os.Args[0][9:]}, os.Environ())
		if err != nil {
			cleanup("execve error", err)
		}

	case "skewer-tcp", "skewer-udp", "skewer-relp", "skewer-journal", "skewer-store", "skewer-accounting":
		if name == "skewer-store" {
			runtime.GOMAXPROCS(128)
		} else {
			sys.MlockAll()
		}
		signal.Ignore(syscall.SIGHUP, syscall.SIGTERM, syscall.SIGINT)
		dumpable.SetNonDumpable()
		capabilities.NoNewPriv()

		var binderClient *binder.BinderClient
		var pipe *os.File
		var err error

		if os.Getenv("SKEWER_HAS_BINDER") == "TRUE" {
			if os.Getenv("SKEWER_HAS_LOGGER") == "TRUE" {
				logger, err = getLogger(loggerCtx, name, 4)
				if os.Getenv("SKEWER_HAS_PIPE") == "TRUE" {
					pipe = os.NewFile(5, "pipe")
				}
			} else if os.Getenv("SKEWER_HAS_PIPE") == "TRUE" {
				pipe = os.NewFile(4, "pipe")
			}
			binderClient, _ = binder.NewBinderClient(os.NewFile(3, "binder"), logger)
{'fraction_non_alphanumeric': 0.14666273468986532, 'fraction_numerical': 0.00982994200334218, 'mean_word_length': 3.677701149425287, 'pattern_counts': {'":': 12, '<': 4, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6279427', 'n_tokens_mistral': 4192, 'n_tokens_neox': 3699, 'n_words': 829}