]>
Commit | Line | Data |
---|---|---|
34829a32 LP |
1 | /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/ |
2 | ||
3 | /*** | |
4 | This file is part of systemd. | |
5 | ||
6 | Copyright 2015 Lennart Poettering | |
7 | ||
8 | systemd is free software; you can redistribute it and/or modify it | |
9 | under the terms of the GNU Lesser General Public License as published by | |
10 | the Free Software Foundation; either version 2.1 of the License, or | |
11 | (at your option) any later version. | |
12 | ||
13 | systemd is distributed in the hope that it will be useful, but | |
14 | WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
16 | Lesser General Public License for more details. | |
17 | ||
18 | You should have received a copy of the GNU Lesser General Public License | |
19 | along with systemd; If not, see <http://www.gnu.org/licenses/>. | |
20 | ***/ | |
21 | ||
22 | #include <sys/mount.h> | |
23 | ||
34829a32 | 24 | #include "cgroup-util.h" |
3ffd4af2 | 25 | #include "fd-util.h" |
07630cea LP |
26 | #include "fileio.h" |
27 | #include "mkdir.h" | |
3ffd4af2 | 28 | #include "nspawn-cgroup.h" |
07630cea LP |
29 | #include "string-util.h" |
30 | #include "strv.h" | |
31 | #include "util.h" | |
34829a32 LP |
32 | |
33 | int chown_cgroup(pid_t pid, uid_t uid_shift) { | |
34 | _cleanup_free_ char *path = NULL, *fs = NULL; | |
35 | _cleanup_close_ int fd = -1; | |
36 | const char *fn; | |
37 | int r; | |
38 | ||
39 | r = cg_pid_get_path(NULL, pid, &path); | |
40 | if (r < 0) | |
41 | return log_error_errno(r, "Failed to get container cgroup path: %m"); | |
42 | ||
43 | r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, path, NULL, &fs); | |
44 | if (r < 0) | |
45 | return log_error_errno(r, "Failed to get file system path for container cgroup: %m"); | |
46 | ||
47 | fd = open(fs, O_RDONLY|O_CLOEXEC|O_DIRECTORY); | |
48 | if (fd < 0) | |
49 | return log_error_errno(errno, "Failed to open %s: %m", fs); | |
50 | ||
51 | FOREACH_STRING(fn, | |
52 | ".", | |
53 | "tasks", | |
54 | "notify_on_release", | |
55 | "cgroup.procs", | |
56 | "cgroup.clone_children", | |
57 | "cgroup.controllers", | |
58 | "cgroup.subtree_control", | |
59 | "cgroup.populated") | |
60 | if (fchownat(fd, fn, uid_shift, uid_shift, 0) < 0) | |
61 | log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, | |
62 | "Failed to chown() cgroup file %s, ignoring: %m", fn); | |
63 | ||
64 | return 0; | |
65 | } | |
66 | ||
67 | int sync_cgroup(pid_t pid, bool unified_requested) { | |
68 | _cleanup_free_ char *cgroup = NULL; | |
69 | char tree[] = "/tmp/unifiedXXXXXX", pid_string[DECIMAL_STR_MAX(pid) + 1]; | |
70 | bool undo_mount = false; | |
71 | const char *fn; | |
72 | int unified, r; | |
73 | ||
74 | unified = cg_unified(); | |
75 | if (unified < 0) | |
76 | return log_error_errno(unified, "Failed to determine whether the unified hierachy is used: %m"); | |
77 | ||
78 | if ((unified > 0) == unified_requested) | |
79 | return 0; | |
80 | ||
81 | /* When the host uses the legacy cgroup setup, but the | |
82 | * container shall use the unified hierarchy, let's make sure | |
83 | * we copy the path from the name=systemd hierarchy into the | |
84 | * unified hierarchy. Similar for the reverse situation. */ | |
85 | ||
86 | r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, pid, &cgroup); | |
87 | if (r < 0) | |
88 | return log_error_errno(r, "Failed to get control group of " PID_FMT ": %m", pid); | |
89 | ||
90 | /* In order to access the unified hierarchy we need to mount it */ | |
91 | if (!mkdtemp(tree)) | |
92 | return log_error_errno(errno, "Failed to generate temporary mount point for unified hierarchy: %m"); | |
93 | ||
94 | if (unified) | |
95 | r = mount("cgroup", tree, "cgroup", MS_NOSUID|MS_NOEXEC|MS_NODEV, "none,name=systemd,xattr"); | |
96 | else | |
97 | r = mount("cgroup", tree, "cgroup", MS_NOSUID|MS_NOEXEC|MS_NODEV, "__DEVEL__sane_behavior"); | |
98 | if (r < 0) { | |
99 | r = log_error_errno(errno, "Failed to mount unified hierarchy: %m"); | |
100 | goto finish; | |
101 | } | |
102 | ||
103 | undo_mount = true; | |
104 | ||
105 | fn = strjoina(tree, cgroup, "/cgroup.procs"); | |
106 | (void) mkdir_parents(fn, 0755); | |
107 | ||
108 | sprintf(pid_string, PID_FMT, pid); | |
109 | r = write_string_file(fn, pid_string, 0); | |
110 | if (r < 0) | |
111 | log_error_errno(r, "Failed to move process: %m"); | |
112 | ||
113 | finish: | |
114 | if (undo_mount) | |
115 | (void) umount(tree); | |
116 | ||
117 | (void) rmdir(tree); | |
118 | return r; | |
119 | } | |
120 | ||
121 | int create_subcgroup(pid_t pid, bool unified_requested) { | |
122 | _cleanup_free_ char *cgroup = NULL; | |
123 | const char *child; | |
124 | int unified, r; | |
125 | CGroupMask supported; | |
126 | ||
127 | /* In the unified hierarchy inner nodes may only only contain | |
128 | * subgroups, but not processes. Hence, if we running in the | |
129 | * unified hierarchy and the container does the same, and we | |
130 | * did not create a scope unit for the container move us and | |
131 | * the container into two separate subcgroups. */ | |
132 | ||
133 | if (!unified_requested) | |
134 | return 0; | |
135 | ||
136 | unified = cg_unified(); | |
137 | if (unified < 0) | |
138 | return log_error_errno(unified, "Failed to determine whether the unified hierachy is used: %m"); | |
139 | if (unified == 0) | |
140 | return 0; | |
141 | ||
142 | r = cg_mask_supported(&supported); | |
143 | if (r < 0) | |
144 | return log_error_errno(r, "Failed to determine supported controllers: %m"); | |
145 | ||
146 | r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, 0, &cgroup); | |
147 | if (r < 0) | |
148 | return log_error_errno(r, "Failed to get our control group: %m"); | |
149 | ||
150 | child = strjoina(cgroup, "/payload"); | |
151 | r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, child, pid); | |
152 | if (r < 0) | |
153 | return log_error_errno(r, "Failed to create %s subcgroup: %m", child); | |
154 | ||
155 | child = strjoina(cgroup, "/supervisor"); | |
156 | r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, child, 0); | |
157 | if (r < 0) | |
158 | return log_error_errno(r, "Failed to create %s subcgroup: %m", child); | |
159 | ||
160 | /* Try to enable as many controllers as possible for the new payload. */ | |
161 | (void) cg_enable_everywhere(supported, supported, cgroup); | |
162 | return 0; | |
163 | } |