custom seccomp: Replace File with BufReader
This improves performance significantly when using a custom
seccomp filter.
For the intel and arm CI machines, this brings the startup
performance on par with using the default filters (the overhead
is now negligible, whereas before it was around 500us).
use seccomp::{deserialize_binary, BpfThreadMap, DeserializationError, InstallationError};
use std::fmt;
use std::fs::File;
+use std::io::BufReader;
const THREAD_CATEGORIES: [&str; 3] = ["vmm", "api", "vcpu"];
@@ -91,8 +92,9 @@ pub fn get_empty_filters() -> BpfThreadMap {
}
/// Retrieve custom seccomp filters.
-pub fn get_custom_filters(mut file: File) -> Result<BpfThreadMap, FilterError> {
- let map = deserialize_binary(&mut file, DESERIALIZATION_BYTES_LIMIT)
+pub fn get_custom_filters(file: File) -> Result<BpfThreadMap, FilterError> {
+ let mut reader = BufReader::new(file);
+ let map = deserialize_binary(&mut reader, DESERIALIZATION_BYTES_LIMIT)
.map_err(FilterError::Deserialization)?;
filter_thread_categories(map)
}
