Polkadot: Verify the workers at startup #10386
Conversation
|
User @naijauser, please sign the CLA here. |
|
/cmd label T8-polkadot |
|
Hi @bkchr, please take a look. |
|
Command "label T8-polkadot" has failed ❌! See logs here |
bkchr
left a comment
bkchr
left a comment
There was a problem hiding this comment.
Not really fixing the issue right now.
| /// Verify validator on start. Checks that env vars were cleared on node startup. | ||
| #[arg(long, requires = "validator")] | ||
| pub verify_on_start: bool, |
There was a problem hiding this comment.
This is not what the issue is about.
| if verify_on_start { | ||
| let worker_version = polkadot_node_core_pvf::get_worker_version(&prep_worker_path)?; | ||
| let mut worker_dir = prep_worker_path.clone(); | ||
| let _ = worker_dir.pop(); | ||
|
|
||
| let worker_info = WorkerInfo { | ||
| pid: std::process::id(), | ||
| kind: WorkerKind::Prepare, | ||
| version: Some(worker_version), | ||
| worker_dir_path: worker_dir, | ||
| }; | ||
|
|
||
| if !security::check_env_vars_were_cleared(&worker_info) { | ||
| let err = "Not all env vars were cleared when spawning the process."; | ||
| log::warn!("{}", err); | ||
|
|
||
| worker_shutdown(worker_info, err); | ||
| } | ||
| } |
There was a problem hiding this comment.
The issue is about calling into the worker and do all the extra checks there, ensuring that the worker will work when being executed later on.
There was a problem hiding this comment.
Hello @bkchr, thanks for checking this out. I don't quite understand what you mean by calling into the worker to do all the checks there.
Could you clarify that bit?
There was a problem hiding this comment.
I think I get it now. @bkchr
Do you mean something like...
let output = Command::new(path)
.arg("--check-can-enable-landlock")
.arg("--check-can-enable-seccomp")
.arg("--check-can-unshare-user-namespace-and-change-root")
.arg("--check-can-do-secure-clone")
.stderr(Stdio::piped())
.stdout(Stdio::piped())
.output()
.with_context(|| format!("Failed to spawn worker {:?}", path))?;
if !output.status.success() {
worker_shutdown(worker_info, err);
}We do this inside determine_workers_paths.
2 participants
Closes #8117
Description
Checks that env vars have been cleared on polkadot node startup.
Checklist
Trequired)