Remove Rlimit only when eBPF does not account memory to cgroup (#207)

squashing for signing

Author: usamasaqib

examples/mapspec_editor/main.go

@@ -5,10 +5,8 @@ import (
 	_ "embed"
 	"fmt"
 	"log"
-	"math"
 
 	"github.com/cilium/ebpf"
-	"golang.org/x/sys/unix"
 
 	manager "github.com/DataDog/ebpf-manager"
 )
@@ -33,10 +31,7 @@ func run() error {
 				EditorFlag: manager.EditMaxEntries | manager.EditType,
 			},
 		},
-		RLimit: &unix.Rlimit{
-			Cur: math.MaxUint64,
-			Max: math.MaxUint64,
-		},
+		RemoveRlimit: true,
 	}
 
 	if err := m.InitWithOptions(bytes.NewReader(Probe), options); err != nil {

manager.go

@@ -14,7 +14,7 @@ import (
 	"github.com/cilium/ebpf/asm"
 	"github.com/cilium/ebpf/btf"
 	"github.com/cilium/ebpf/features"
-	"golang.org/x/sys/unix"
+	"github.com/cilium/ebpf/rlimit"
 )
 
 // FunctionExcluder - An interface for types that can be used for `AdditionalExcludedFunctionCollector`
@@ -104,9 +104,9 @@ type Options struct {
 	// ProbeRetryDelay - Defines the delay to wait before a probe should retry to attach / detach on error.
 	DefaultProbeRetryDelay time.Duration
 
-	// RLimit - The maps & programs provided to the manager might exceed the maximum allowed memory lock.
+	// RemoveRlimit - The maps & programs provided to the manager might exceed the maximum allowed memory lock.
 	// `RLIMIT_MEMLOCK` If a limit is provided here it will be applied when the manager is initialized.
-	RLimit *unix.Rlimit
+	RemoveRlimit bool
 
 	// KeepKernelBTF - Defines if the kernel types defined in VerifierOptions.Programs.KernelTypes and KernelModuleTypes should be cleaned up
 	// once the manager is done using them. By default, the manager will clean them up to save up space. DISCLAIMER: if
@@ -487,9 +487,11 @@ func (m *Manager) InitWithOptions(elf io.ReaderAt, options Options) error {
 	}
 
 	// set resource limit if requested
-	if m.options.RLimit != nil {
-		err := unix.Setrlimit(unix.RLIMIT_MEMLOCK, m.options.RLimit)
-		if err != nil {
+	if m.options.RemoveRlimit {
+		// rlimit.RemoveMemlock automatically detects if rlimit based accounting
+		// is used for eBPF maps. Only in this case is the rlimit removed.
+		// If cgroup based accounting is in effect, then rlimit is not removed.
+		if err := rlimit.RemoveMemlock(); err != nil {
 			m.stateLock.Unlock()
 			return fmt.Errorf("couldn't adjust RLIMIT_MEMLOCK: %w", err)
 		}

manager_test.go

@@ -4,15 +4,13 @@ import (
 	"bytes"
 	"errors"
 	"io"
-	"math"
 	"os"
 	"strings"
 	"testing"
 
 	"github.com/cilium/ebpf"
 	"github.com/cilium/ebpf/asm"
 	"github.com/cilium/ebpf/rlimit"
-	"golang.org/x/sys/unix"
 )
 
 func TestVerifierError(t *testing.T) {
@@ -60,10 +58,7 @@ func TestExclude(t *testing.T) {
 		},
 	}
 	opts := Options{
-		RLimit: &unix.Rlimit{
-			Cur: math.MaxUint64,
-			Max: math.MaxUint64,
-		},
+		RemoveRlimit: true,
 		ExcludedMaps: []string{"map_two"},
 	}