redmine

Disabled thread splitting by default

... ... @@ -99,7 +99,7 @@ enum flags_enum {
CUSTOMSIGNALS = 23|OPTION_LONGOPTONLY,
CHROOT = 24|OPTION_LONGOPTONLY,
MOUNTPOINTS = 25|OPTION_LONGOPTONLY,
NOTHREADSPLITTING = 26|OPTION_LONGOPTONLY,
THREADSPLITTING = 26|OPTION_LONGOPTONLY,
SYNCHANDLERUID = 27|OPTION_LONGOPTONLY,
SYNCHANDLERGID = 28|OPTION_LONGOPTONLY,
CAPS_INHERIT = 29|OPTION_LONGOPTONLY,
... ...
... ... @@ -72,7 +72,7 @@ static const struct option long_options[] =
{"sync-handler-uid", required_argument, NULL, SYNCHANDLERUID},
{"sync-handler-gid", required_argument, NULL, SYNCHANDLERGID},
{"chroot", required_argument, NULL, CHROOT},
{"no-thread-splitting", optional_argument, NULL, NOTHREADSPLITTING},
{"thread-splitting", optional_argument, NULL, THREADSPLITTING},
#ifdef GETMNTENT_SUPPORT
{"mountpoints", optional_argument, NULL, MOUNTPOINTS},
#endif
... ...
... ... @@ -337,12 +337,6 @@ An user ID to be used for
See
.BR \-\-preserve\-capabilities .
This option is ignored if the
.B clsync
instance have no CAP_SETUID capability (or analog) or if option
.B --no-thread-splitting
is enabled.
The default value is "$UID".
.PP
.RE
... ... @@ -356,12 +350,6 @@ A group ID to be used for
See
.BR \-\-preserve\-capabilities .
This option is ignored if the
.B clsync
instance have no CAP_SETGID capability (or analog) or if option
.B --no-thread-splitting
is enabled.
The default value is "$GID".
.PP
.RE
... ... @@ -466,14 +454,17 @@ Reset all capabilities
The default value is "empty".
.RE
.B \-\-no\-thread\-splitting
.B \-\-thread\-splitting
.RS
.B [Linux only, requires capabilities]
Don't split the main thread to privileged and non-privileged. This may be used
due to performance reasons. Performance vs security trade off.
The thread splitting is used only on Linux systems.
Split the main thread to privileged and non-privileged. This's an additional
way to secure your system from any bug in
.B clsync
while running it with capabilities or root privileges. But
.B clsync
will utilize in ~6 times more CPU resources. So it's a performance vs
security trade off.
Is not set by default.
.RE
... ...
... ... @@ -408,7 +408,7 @@ int privileged_init(ctx_t *ctx_p)
{
#ifdef CAPABILITIES_SUPPORT
if (ctx_p->flags[NOTHREADSPLITTING]) {
if (!ctx_p->flags[THREADSPLITTING]) {
#endif
privileged_fork_execvp = _privileged_fork_execvp;
... ...