2019-04-29 21:25:05 +00:00
|
|
|
// Copyright 2018 The gVisor Authors.
|
2018-04-27 17:37:02 +00:00
|
|
|
//
|
|
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
// you may not use this file except in compliance with the License.
|
|
|
|
// You may obtain a copy of the License at
|
|
|
|
//
|
|
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
//
|
|
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
// See the License for the specific language governing permissions and
|
|
|
|
// limitations under the License.
|
|
|
|
|
|
|
|
package boot
|
|
|
|
|
2018-05-15 17:17:19 +00:00
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
"strconv"
|
|
|
|
"strings"
|
2018-06-28 16:45:52 +00:00
|
|
|
|
2019-08-05 15:15:48 +00:00
|
|
|
"gvisor.dev/gvisor/pkg/refs"
|
2019-06-13 23:49:09 +00:00
|
|
|
"gvisor.dev/gvisor/pkg/sentry/watchdog"
|
2018-05-15 17:17:19 +00:00
|
|
|
)
|
2018-04-27 17:37:02 +00:00
|
|
|
|
|
|
|
// FileAccessType tells how the filesystem is accessed.
|
|
|
|
type FileAccessType int
|
|
|
|
|
|
|
|
const (
|
2018-09-07 19:27:44 +00:00
|
|
|
// FileAccessShared sends IO requests to a Gofer process that validates the
|
2018-04-27 17:37:02 +00:00
|
|
|
// requests and forwards them to the host.
|
2018-09-07 19:27:44 +00:00
|
|
|
FileAccessShared FileAccessType = iota
|
2018-04-27 17:37:02 +00:00
|
|
|
|
2018-09-07 19:27:44 +00:00
|
|
|
// FileAccessExclusive is the same as FileAccessShared, but enables
|
runsc: Change cache policy for root fs and volume mounts.
Previously, gofer filesystems were configured with the default "fscache"
policy, which caches filesystem metadata and contents aggressively. While this
setting is best for performance, it means that changes from inside the sandbox
may not be immediately propagated outside the sandbox, and vice-versa.
This CL changes volumes and the root fs configuration to use a new
"remote-revalidate" cache policy which tries to retain as much caching as
possible while still making fs changes visible across the sandbox boundary.
This cache policy is enabled by default for the root filesystem. The default
value for the "--file-access" flag is still "proxy", but the behavior is
changed to use the new cache policy.
A new value for the "--file-access" flag is added, called "proxy-exclusive",
which turns on the previous aggressive caching behavior. As the name implies,
this flag should be used when the sandbox has "exclusive" access to the
filesystem.
All volume mounts are configured to use the new cache policy, since it is
safest and most likely to be correct. There is not currently a way to change
this behavior, but it's possible to add such a mechanism in the future. The
configurability is a smaller issue for volumes, since most of the expensive
application fs operations (walking + stating files) will likely served by the
root fs.
PiperOrigin-RevId: 208735037
Change-Id: Ife048fab1948205f6665df8563434dbc6ca8cfc9
2018-08-14 23:24:46 +00:00
|
|
|
// extra caching for improved performance. It should only be used if
|
|
|
|
// the sandbox has exclusive access to the filesystem.
|
2018-09-07 19:27:44 +00:00
|
|
|
FileAccessExclusive
|
2018-04-27 17:37:02 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
// MakeFileAccessType converts type from string.
|
|
|
|
func MakeFileAccessType(s string) (FileAccessType, error) {
|
|
|
|
switch s {
|
2018-09-07 19:27:44 +00:00
|
|
|
case "shared":
|
|
|
|
return FileAccessShared, nil
|
|
|
|
case "exclusive":
|
|
|
|
return FileAccessExclusive, nil
|
2018-04-27 17:37:02 +00:00
|
|
|
default:
|
|
|
|
return 0, fmt.Errorf("invalid file access type %q", s)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (f FileAccessType) String() string {
|
|
|
|
switch f {
|
2018-09-07 19:27:44 +00:00
|
|
|
case FileAccessShared:
|
|
|
|
return "shared"
|
|
|
|
case FileAccessExclusive:
|
|
|
|
return "exclusive"
|
2018-04-27 17:37:02 +00:00
|
|
|
default:
|
|
|
|
return fmt.Sprintf("unknown(%d)", f)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// NetworkType tells which network stack to use.
|
|
|
|
type NetworkType int
|
|
|
|
|
|
|
|
const (
|
|
|
|
// NetworkSandbox uses internal network stack, isolated from the host.
|
|
|
|
NetworkSandbox NetworkType = iota
|
|
|
|
|
|
|
|
// NetworkHost redirects network related syscalls to the host network.
|
|
|
|
NetworkHost
|
|
|
|
|
|
|
|
// NetworkNone sets up just loopback using netstack.
|
|
|
|
NetworkNone
|
|
|
|
)
|
|
|
|
|
|
|
|
// MakeNetworkType converts type from string.
|
|
|
|
func MakeNetworkType(s string) (NetworkType, error) {
|
|
|
|
switch s {
|
|
|
|
case "sandbox":
|
|
|
|
return NetworkSandbox, nil
|
|
|
|
case "host":
|
|
|
|
return NetworkHost, nil
|
|
|
|
case "none":
|
|
|
|
return NetworkNone, nil
|
|
|
|
default:
|
|
|
|
return 0, fmt.Errorf("invalid network type %q", s)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (n NetworkType) String() string {
|
|
|
|
switch n {
|
|
|
|
case NetworkSandbox:
|
|
|
|
return "sandbox"
|
|
|
|
case NetworkHost:
|
|
|
|
return "host"
|
|
|
|
case NetworkNone:
|
|
|
|
return "none"
|
|
|
|
default:
|
|
|
|
return fmt.Sprintf("unknown(%d)", n)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-06-28 16:45:52 +00:00
|
|
|
// MakeWatchdogAction converts type from string.
|
|
|
|
func MakeWatchdogAction(s string) (watchdog.Action, error) {
|
|
|
|
switch strings.ToLower(s) {
|
|
|
|
case "log", "logwarning":
|
|
|
|
return watchdog.LogWarning, nil
|
|
|
|
case "panic":
|
|
|
|
return watchdog.Panic, nil
|
|
|
|
default:
|
|
|
|
return 0, fmt.Errorf("invalid watchdog action %q", s)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-08-29 21:17:32 +00:00
|
|
|
// MakeRefsLeakMode converts type from string.
|
2019-08-05 15:15:48 +00:00
|
|
|
func MakeRefsLeakMode(s string) (refs.LeakMode, error) {
|
|
|
|
switch strings.ToLower(s) {
|
2019-08-06 01:57:50 +00:00
|
|
|
case "disabled":
|
2019-08-05 15:15:48 +00:00
|
|
|
return refs.NoLeakChecking, nil
|
2019-08-22 12:52:43 +00:00
|
|
|
case "log-names":
|
2019-08-05 15:15:48 +00:00
|
|
|
return refs.LeaksLogWarning, nil
|
2019-08-22 12:52:43 +00:00
|
|
|
case "log-traces":
|
2019-08-09 07:13:06 +00:00
|
|
|
return refs.LeaksLogTraces, nil
|
2019-08-05 15:15:48 +00:00
|
|
|
default:
|
|
|
|
return 0, fmt.Errorf("invalid refs leakmode %q", s)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-08-29 21:17:32 +00:00
|
|
|
func refsLeakModeToString(mode refs.LeakMode) string {
|
|
|
|
switch mode {
|
|
|
|
// If not set, default it to disabled.
|
|
|
|
case refs.UninitializedLeakChecking, refs.NoLeakChecking:
|
|
|
|
return "disabled"
|
|
|
|
case refs.LeaksLogWarning:
|
|
|
|
return "log-names"
|
|
|
|
case refs.LeaksLogTraces:
|
|
|
|
return "log-traces"
|
|
|
|
default:
|
|
|
|
panic(fmt.Sprintf("Invalid leakmode: %d", mode))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-04-27 17:37:02 +00:00
|
|
|
// Config holds configuration that is not part of the runtime spec.
|
|
|
|
type Config struct {
|
|
|
|
// RootDir is the runtime root directory.
|
|
|
|
RootDir string
|
|
|
|
|
2018-05-15 17:17:19 +00:00
|
|
|
// Debug indicates that debug logging should be enabled.
|
|
|
|
Debug bool
|
|
|
|
|
|
|
|
// LogFilename is the filename to log to, if not empty.
|
|
|
|
LogFilename string
|
|
|
|
|
2018-11-02 00:43:50 +00:00
|
|
|
// LogFormat is the log format.
|
2018-05-15 17:17:19 +00:00
|
|
|
LogFormat string
|
|
|
|
|
2018-10-11 21:28:15 +00:00
|
|
|
// DebugLog is the path to log debug information to, if not empty.
|
|
|
|
DebugLog string
|
2018-05-15 17:17:19 +00:00
|
|
|
|
2020-02-28 19:23:00 +00:00
|
|
|
// PanicLog is the path to log GO's runtime messages, if not empty.
|
|
|
|
PanicLog string
|
|
|
|
|
2018-11-02 00:43:50 +00:00
|
|
|
// DebugLogFormat is the log format for debug.
|
|
|
|
DebugLogFormat string
|
|
|
|
|
2018-04-27 17:37:02 +00:00
|
|
|
// FileAccess indicates how the filesystem is accessed.
|
|
|
|
FileAccess FileAccessType
|
|
|
|
|
|
|
|
// Overlay is whether to wrap the root filesystem in an overlay.
|
|
|
|
Overlay bool
|
|
|
|
|
2019-09-24 22:24:10 +00:00
|
|
|
// FSGoferHostUDS enables the gofer to mount a host UDS.
|
|
|
|
FSGoferHostUDS bool
|
2019-09-19 16:37:15 +00:00
|
|
|
|
2018-04-27 17:37:02 +00:00
|
|
|
// Network indicates what type of network to use.
|
|
|
|
Network NetworkType
|
|
|
|
|
2019-04-26 23:50:35 +00:00
|
|
|
// EnableRaw indicates whether raw sockets should be enabled. Raw
|
|
|
|
// sockets are disabled by stripping CAP_NET_RAW from the list of
|
|
|
|
// capabilities.
|
|
|
|
EnableRaw bool
|
|
|
|
|
2019-10-22 18:54:14 +00:00
|
|
|
// HardwareGSO indicates that hardware segmentation offload is enabled.
|
|
|
|
HardwareGSO bool
|
|
|
|
|
|
|
|
// SoftwareGSO indicates that software segmentation offload is enabled.
|
|
|
|
SoftwareGSO bool
|
2019-03-29 23:26:36 +00:00
|
|
|
|
2020-06-16 23:33:12 +00:00
|
|
|
// TXChecksumOffload indicates that TX Checksum Offload is enabled.
|
|
|
|
TXChecksumOffload bool
|
|
|
|
|
|
|
|
// RXChecksumOffload indicates that RX Checksum Offload is enabled.
|
|
|
|
RXChecksumOffload bool
|
|
|
|
|
2020-04-30 23:39:18 +00:00
|
|
|
// QDisc indicates the type of queuening discipline to use by default
|
|
|
|
// for non-loopback interfaces.
|
|
|
|
QDisc QueueingDiscipline
|
|
|
|
|
2018-04-27 17:37:02 +00:00
|
|
|
// LogPackets indicates that all network packets should be logged.
|
|
|
|
LogPackets bool
|
|
|
|
|
|
|
|
// Platform is the platform to run on.
|
2019-07-04 05:50:26 +00:00
|
|
|
Platform string
|
2018-04-27 17:37:02 +00:00
|
|
|
|
|
|
|
// Strace indicates that strace should be enabled.
|
|
|
|
Strace bool
|
|
|
|
|
|
|
|
// StraceSyscalls is the set of syscalls to trace. If StraceEnable is
|
|
|
|
// true and this list is empty, then all syscalls will be traced.
|
|
|
|
StraceSyscalls []string
|
|
|
|
|
|
|
|
// StraceLogSize is the max size of data blobs to display.
|
|
|
|
StraceLogSize uint
|
|
|
|
|
|
|
|
// DisableSeccomp indicates whether seccomp syscall filters should be
|
|
|
|
// disabled. Pardon the double negation, but default to enabled is important.
|
|
|
|
DisableSeccomp bool
|
2018-06-25 19:07:50 +00:00
|
|
|
|
2018-08-28 03:35:00 +00:00
|
|
|
// WatchdogAction sets what action the watchdog takes when triggered.
|
2018-06-28 16:45:52 +00:00
|
|
|
WatchdogAction watchdog.Action
|
2018-08-28 03:35:00 +00:00
|
|
|
|
2018-12-12 00:11:53 +00:00
|
|
|
// PanicSignal registers signal handling that panics. Usually set to
|
2018-08-28 03:35:00 +00:00
|
|
|
// SIGUSR2(12) to troubleshoot hangs. -1 disables it.
|
|
|
|
PanicSignal int
|
2018-09-05 03:31:52 +00:00
|
|
|
|
2019-03-11 18:46:18 +00:00
|
|
|
// ProfileEnable is set to prepare the sandbox to be profiled.
|
|
|
|
ProfileEnable bool
|
|
|
|
|
2019-05-04 04:40:48 +00:00
|
|
|
// RestoreFile is the path to the saved container image
|
|
|
|
RestoreFile string
|
|
|
|
|
2019-06-06 15:05:46 +00:00
|
|
|
// NumNetworkChannels controls the number of AF_PACKET sockets that map
|
|
|
|
// to the same underlying network device. This allows netstack to better
|
|
|
|
// scale for high throughput use cases.
|
|
|
|
NumNetworkChannels int
|
2019-06-12 16:40:50 +00:00
|
|
|
|
|
|
|
// Rootless allows the sandbox to be started with a user that is not root.
|
|
|
|
// Defense is depth measures are weaker with rootless. Specifically, the
|
|
|
|
// sandbox and Gofer process run as root inside a user namespace with root
|
|
|
|
// mapped to the caller's user.
|
|
|
|
Rootless bool
|
2019-07-26 23:52:28 +00:00
|
|
|
|
|
|
|
// AlsoLogToStderr allows to send log messages to stderr.
|
|
|
|
AlsoLogToStderr bool
|
2019-08-05 15:15:48 +00:00
|
|
|
|
|
|
|
// ReferenceLeakMode sets reference leak check mode
|
|
|
|
ReferenceLeakMode refs.LeakMode
|
2019-09-16 15:15:40 +00:00
|
|
|
|
Enable overlayfs_stale_read by default for runsc.
Linux 4.18 and later make reads and writes coherent between pre-copy-up and
post-copy-up FDs representing the same file on an overlay filesystem. However,
memory mappings remain incoherent:
- Documentation/filesystems/overlayfs.rst, "Non-standard behavior": "If a file
residing on a lower layer is opened for read-only and then memory mapped with
MAP_SHARED, then subsequent changes to the file are not reflected in the
memory mapping."
- fs/overlay/file.c:ovl_mmap() passes through to the underlying FD without any
management of coherence in the overlay.
- Experimentally on Linux 5.2:
```
$ cat mmap_cat_page.c
#include <err.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <sys/mman.h>
#include <unistd.h>
int main(int argc, char **argv) {
if (argc < 2) {
errx(1, "syntax: %s [FILE]", argv[0]);
}
const int fd = open(argv[1], O_RDONLY);
if (fd < 0) {
err(1, "open(%s)", argv[1]);
}
const size_t page_size = sysconf(_SC_PAGE_SIZE);
void* page = mmap(NULL, page_size, PROT_READ, MAP_SHARED, fd, 0);
if (page == MAP_FAILED) {
err(1, "mmap");
}
for (;;) {
write(1, page, strnlen(page, page_size));
if (getc(stdin) == EOF) {
break;
}
}
return 0;
}
$ gcc -O2 -o mmap_cat_page mmap_cat_page.c
$ mkdir lowerdir upperdir workdir overlaydir
$ echo old > lowerdir/file
$ sudo mount -t overlay -o "lowerdir=lowerdir,upperdir=upperdir,workdir=workdir" none overlaydir
$ ./mmap_cat_page overlaydir/file
old
^Z
[1]+ Stopped ./mmap_cat_page overlaydir/file
$ echo new > overlaydir/file
$ cat overlaydir/file
new
$ fg
./mmap_cat_page overlaydir/file
old
```
Therefore, while the VFS1 gofer client's behavior of reopening read FDs is only
necessary pre-4.18, replacing existing memory mappings (in both sentry and
application address spaces) with mappings of the new FD is required regardless
of kernel version, and this latter behavior is common to both VFS1 and VFS2.
Re-document accordingly, and change the runsc flag to enabled by default.
New test:
- Before this CL: https://source.cloud.google.com/results/invocations/5b222d2c-e918-4bae-afc4-407f5bac509b
- After this CL: https://source.cloud.google.com/results/invocations/f28c747e-d89c-4d8c-a461-602b33e71aab
PiperOrigin-RevId: 311361267
2020-05-13 17:51:50 +00:00
|
|
|
// OverlayfsStaleRead instructs the sandbox to assume that the root mount
|
|
|
|
// is on a Linux overlayfs mount, which does not necessarily preserve
|
|
|
|
// coherence between read-only and subsequent writable file descriptors
|
|
|
|
// representing the "same" file.
|
2019-10-16 21:33:23 +00:00
|
|
|
OverlayfsStaleRead bool
|
|
|
|
|
2019-09-16 15:15:40 +00:00
|
|
|
// TestOnlyAllowRunAsCurrentUserWithoutChroot should only be used in
|
|
|
|
// tests. It allows runsc to start the sandbox process as the current
|
|
|
|
// user, and without chrooting the sandbox process. This can be
|
|
|
|
// necessary in test environments that have limited capabilities.
|
|
|
|
TestOnlyAllowRunAsCurrentUserWithoutChroot bool
|
|
|
|
|
|
|
|
// TestOnlyTestNameEnv should only be used in tests. It looks up for the
|
|
|
|
// test name in the container environment variables and adds it to the debug
|
|
|
|
// log file name. This is done to help identify the log with the test when
|
|
|
|
// multiple tests are run in parallel, since there is no way to pass
|
|
|
|
// parameters to the runtime from docker.
|
|
|
|
TestOnlyTestNameEnv string
|
2019-12-15 17:57:23 +00:00
|
|
|
|
|
|
|
// CPUNumFromQuota sets CPU number count to available CPU quota, using
|
|
|
|
// least integer value greater than or equal to quota.
|
|
|
|
//
|
2019-12-17 10:06:42 +00:00
|
|
|
// E.g. 0.2 CPU quota will result in 1, and 1.9 in 2.
|
2019-12-15 17:57:23 +00:00
|
|
|
CPUNumFromQuota bool
|
2020-01-28 23:13:46 +00:00
|
|
|
|
|
|
|
// Enables VFS2 (not plumbled through yet).
|
|
|
|
VFS2 bool
|
2018-05-15 17:17:19 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// ToFlags returns a slice of flags that correspond to the given Config.
|
|
|
|
func (c *Config) ToFlags() []string {
|
2018-12-18 01:34:09 +00:00
|
|
|
f := []string{
|
2018-05-15 17:17:19 +00:00
|
|
|
"--root=" + c.RootDir,
|
|
|
|
"--debug=" + strconv.FormatBool(c.Debug),
|
|
|
|
"--log=" + c.LogFilename,
|
|
|
|
"--log-format=" + c.LogFormat,
|
2018-10-11 21:28:15 +00:00
|
|
|
"--debug-log=" + c.DebugLog,
|
2020-02-28 19:23:00 +00:00
|
|
|
"--panic-log=" + c.PanicLog,
|
2018-11-02 00:43:50 +00:00
|
|
|
"--debug-log-format=" + c.DebugLogFormat,
|
2018-05-15 17:17:19 +00:00
|
|
|
"--file-access=" + c.FileAccess.String(),
|
|
|
|
"--overlay=" + strconv.FormatBool(c.Overlay),
|
2019-09-24 22:24:10 +00:00
|
|
|
"--fsgofer-host-uds=" + strconv.FormatBool(c.FSGoferHostUDS),
|
2018-05-15 17:17:19 +00:00
|
|
|
"--network=" + c.Network.String(),
|
|
|
|
"--log-packets=" + strconv.FormatBool(c.LogPackets),
|
2019-07-04 05:50:26 +00:00
|
|
|
"--platform=" + c.Platform,
|
2018-05-15 17:17:19 +00:00
|
|
|
"--strace=" + strconv.FormatBool(c.Strace),
|
|
|
|
"--strace-syscalls=" + strings.Join(c.StraceSyscalls, ","),
|
|
|
|
"--strace-log-size=" + strconv.Itoa(int(c.StraceLogSize)),
|
2018-06-28 16:45:52 +00:00
|
|
|
"--watchdog-action=" + c.WatchdogAction.String(),
|
2018-08-28 03:35:00 +00:00
|
|
|
"--panic-signal=" + strconv.Itoa(c.PanicSignal),
|
2019-03-11 18:46:18 +00:00
|
|
|
"--profile=" + strconv.FormatBool(c.ProfileEnable),
|
2019-04-26 23:50:35 +00:00
|
|
|
"--net-raw=" + strconv.FormatBool(c.EnableRaw),
|
2019-06-06 15:05:46 +00:00
|
|
|
"--num-network-channels=" + strconv.Itoa(c.NumNetworkChannels),
|
2019-06-12 16:40:50 +00:00
|
|
|
"--rootless=" + strconv.FormatBool(c.Rootless),
|
2019-07-26 23:52:28 +00:00
|
|
|
"--alsologtostderr=" + strconv.FormatBool(c.AlsoLogToStderr),
|
2019-08-29 21:17:32 +00:00
|
|
|
"--ref-leak-mode=" + refsLeakModeToString(c.ReferenceLeakMode),
|
2019-10-22 18:54:14 +00:00
|
|
|
"--gso=" + strconv.FormatBool(c.HardwareGSO),
|
|
|
|
"--software-gso=" + strconv.FormatBool(c.SoftwareGSO),
|
2020-06-16 23:33:12 +00:00
|
|
|
"--rx-checksum-offload=" + strconv.FormatBool(c.RXChecksumOffload),
|
|
|
|
"--tx-checksum-offload=" + strconv.FormatBool(c.TXChecksumOffload),
|
2019-10-16 21:33:23 +00:00
|
|
|
"--overlayfs-stale-read=" + strconv.FormatBool(c.OverlayfsStaleRead),
|
2020-04-30 23:39:18 +00:00
|
|
|
"--qdisc=" + c.QDisc.String(),
|
2018-05-15 17:17:19 +00:00
|
|
|
}
|
2019-12-15 17:57:23 +00:00
|
|
|
if c.CPUNumFromQuota {
|
2019-12-17 17:41:02 +00:00
|
|
|
f = append(f, "--cpu-num-from-quota")
|
2019-12-15 17:57:23 +00:00
|
|
|
}
|
2019-09-16 15:15:40 +00:00
|
|
|
// Only include these if set since it is never to be used by users.
|
2018-12-18 01:34:09 +00:00
|
|
|
if c.TestOnlyAllowRunAsCurrentUserWithoutChroot {
|
2019-09-16 15:15:40 +00:00
|
|
|
f = append(f, "--TESTONLY-unsafe-nonroot=true")
|
|
|
|
}
|
|
|
|
if len(c.TestOnlyTestNameEnv) != 0 {
|
|
|
|
f = append(f, "--TESTONLY-test-name-env="+c.TestOnlyTestNameEnv)
|
2018-12-18 01:34:09 +00:00
|
|
|
}
|
2020-04-17 17:38:04 +00:00
|
|
|
|
|
|
|
if c.VFS2 {
|
|
|
|
f = append(f, "--vfs2=true")
|
|
|
|
}
|
|
|
|
|
2018-12-18 01:34:09 +00:00
|
|
|
return f
|
2018-04-27 17:37:02 +00:00
|
|
|
}
|