]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/core/cgroup.c
Merge pull request #20321 from bluca/state_dir_symlink
[thirdparty/systemd.git] / src / core / cgroup.c
1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3 #include <fcntl.h>
4
5 #include "sd-messages.h"
6
7 #include "af-list.h"
8 #include "alloc-util.h"
9 #include "blockdev-util.h"
10 #include "bpf-devices.h"
11 #include "bpf-firewall.h"
12 #include "bpf-foreign.h"
13 #include "bpf-socket-bind.h"
14 #include "btrfs-util.h"
15 #include "bus-error.h"
16 #include "cgroup-setup.h"
17 #include "cgroup-util.h"
18 #include "cgroup.h"
19 #include "fd-util.h"
20 #include "fileio.h"
21 #include "in-addr-prefix-util.h"
22 #include "inotify-util.h"
23 #include "io-util.h"
24 #include "ip-protocol-list.h"
25 #include "limits-util.h"
26 #include "nulstr-util.h"
27 #include "parse-util.h"
28 #include "path-util.h"
29 #include "percent-util.h"
30 #include "process-util.h"
31 #include "procfs-util.h"
32 #include "restrict-ifaces.h"
33 #include "special.h"
34 #include "stat-util.h"
35 #include "stdio-util.h"
36 #include "string-table.h"
37 #include "string-util.h"
38 #include "virt.h"
39
40 #if BPF_FRAMEWORK
41 #include "bpf-dlopen.h"
42 #include "bpf-link.h"
43 #include "bpf/restrict_fs/restrict-fs-skel.h"
44 #endif
45
46 #define CGROUP_CPU_QUOTA_DEFAULT_PERIOD_USEC ((usec_t) 100 * USEC_PER_MSEC)
47
48 /* Returns the log level to use when cgroup attribute writes fail. When an attribute is missing or we have access
49 * problems we downgrade to LOG_DEBUG. This is supposed to be nice to container managers and kernels which want to mask
50 * out specific attributes from us. */
51 #define LOG_LEVEL_CGROUP_WRITE(r) (IN_SET(abs(r), ENOENT, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING)
52
53 uint64_t tasks_max_resolve(const TasksMax *tasks_max) {
54 if (tasks_max->scale == 0)
55 return tasks_max->value;
56
57 return system_tasks_max_scale(tasks_max->value, tasks_max->scale);
58 }
59
60 bool manager_owns_host_root_cgroup(Manager *m) {
61 assert(m);
62
63 /* Returns true if we are managing the root cgroup. Note that it isn't sufficient to just check whether the
64 * group root path equals "/" since that will also be the case if CLONE_NEWCGROUP is in the mix. Since there's
65 * appears to be no nice way to detect whether we are in a CLONE_NEWCGROUP namespace we instead just check if
66 * we run in any kind of container virtualization. */
67
68 if (MANAGER_IS_USER(m))
69 return false;
70
71 if (detect_container() > 0)
72 return false;
73
74 return empty_or_root(m->cgroup_root);
75 }
76
77 bool unit_has_startup_cgroup_constraints(Unit *u) {
78 assert(u);
79
80 /* Returns true if this unit has any directives which apply during
81 * startup/shutdown phases. */
82
83 CGroupContext *c;
84
85 c = unit_get_cgroup_context(u);
86 if (!c)
87 return false;
88
89 return c->startup_cpu_shares != CGROUP_CPU_SHARES_INVALID ||
90 c->startup_io_weight != CGROUP_WEIGHT_INVALID ||
91 c->startup_blockio_weight != CGROUP_BLKIO_WEIGHT_INVALID ||
92 c->startup_cpuset_cpus.set ||
93 c->startup_cpuset_mems.set;
94 }
95
96 bool unit_has_host_root_cgroup(Unit *u) {
97 assert(u);
98
99 /* Returns whether this unit manages the root cgroup. This will return true if this unit is the root slice and
100 * the manager manages the root cgroup. */
101
102 if (!manager_owns_host_root_cgroup(u->manager))
103 return false;
104
105 return unit_has_name(u, SPECIAL_ROOT_SLICE);
106 }
107
108 static int set_attribute_and_warn(Unit *u, const char *controller, const char *attribute, const char *value) {
109 int r;
110
111 r = cg_set_attribute(controller, u->cgroup_path, attribute, value);
112 if (r < 0)
113 log_unit_full_errno(u, LOG_LEVEL_CGROUP_WRITE(r), r, "Failed to set '%s' attribute on '%s' to '%.*s': %m",
114 strna(attribute), empty_to_root(u->cgroup_path), (int) strcspn(value, NEWLINE), value);
115
116 return r;
117 }
118
119 static void cgroup_compat_warn(void) {
120 static bool cgroup_compat_warned = false;
121
122 if (cgroup_compat_warned)
123 return;
124
125 log_warning("cgroup compatibility translation between legacy and unified hierarchy settings activated. "
126 "See cgroup-compat debug messages for details.");
127
128 cgroup_compat_warned = true;
129 }
130
131 #define log_cgroup_compat(unit, fmt, ...) do { \
132 cgroup_compat_warn(); \
133 log_unit_debug(unit, "cgroup-compat: " fmt, ##__VA_ARGS__); \
134 } while (false)
135
136 void cgroup_context_init(CGroupContext *c) {
137 assert(c);
138
139 /* Initialize everything to the kernel defaults. */
140
141 *c = (CGroupContext) {
142 .cpu_weight = CGROUP_WEIGHT_INVALID,
143 .startup_cpu_weight = CGROUP_WEIGHT_INVALID,
144 .cpu_quota_per_sec_usec = USEC_INFINITY,
145 .cpu_quota_period_usec = USEC_INFINITY,
146
147 .cpu_shares = CGROUP_CPU_SHARES_INVALID,
148 .startup_cpu_shares = CGROUP_CPU_SHARES_INVALID,
149
150 .memory_high = CGROUP_LIMIT_MAX,
151 .memory_max = CGROUP_LIMIT_MAX,
152 .memory_swap_max = CGROUP_LIMIT_MAX,
153
154 .memory_limit = CGROUP_LIMIT_MAX,
155
156 .io_weight = CGROUP_WEIGHT_INVALID,
157 .startup_io_weight = CGROUP_WEIGHT_INVALID,
158
159 .blockio_weight = CGROUP_BLKIO_WEIGHT_INVALID,
160 .startup_blockio_weight = CGROUP_BLKIO_WEIGHT_INVALID,
161
162 .tasks_max = TASKS_MAX_UNSET,
163
164 .moom_swap = MANAGED_OOM_AUTO,
165 .moom_mem_pressure = MANAGED_OOM_AUTO,
166 .moom_preference = MANAGED_OOM_PREFERENCE_NONE,
167 };
168 }
169
170 void cgroup_context_free_device_allow(CGroupContext *c, CGroupDeviceAllow *a) {
171 assert(c);
172 assert(a);
173
174 LIST_REMOVE(device_allow, c->device_allow, a);
175 free(a->path);
176 free(a);
177 }
178
179 void cgroup_context_free_io_device_weight(CGroupContext *c, CGroupIODeviceWeight *w) {
180 assert(c);
181 assert(w);
182
183 LIST_REMOVE(device_weights, c->io_device_weights, w);
184 free(w->path);
185 free(w);
186 }
187
188 void cgroup_context_free_io_device_latency(CGroupContext *c, CGroupIODeviceLatency *l) {
189 assert(c);
190 assert(l);
191
192 LIST_REMOVE(device_latencies, c->io_device_latencies, l);
193 free(l->path);
194 free(l);
195 }
196
197 void cgroup_context_free_io_device_limit(CGroupContext *c, CGroupIODeviceLimit *l) {
198 assert(c);
199 assert(l);
200
201 LIST_REMOVE(device_limits, c->io_device_limits, l);
202 free(l->path);
203 free(l);
204 }
205
206 void cgroup_context_free_blockio_device_weight(CGroupContext *c, CGroupBlockIODeviceWeight *w) {
207 assert(c);
208 assert(w);
209
210 LIST_REMOVE(device_weights, c->blockio_device_weights, w);
211 free(w->path);
212 free(w);
213 }
214
215 void cgroup_context_free_blockio_device_bandwidth(CGroupContext *c, CGroupBlockIODeviceBandwidth *b) {
216 assert(c);
217 assert(b);
218
219 LIST_REMOVE(device_bandwidths, c->blockio_device_bandwidths, b);
220 free(b->path);
221 free(b);
222 }
223
224 void cgroup_context_remove_bpf_foreign_program(CGroupContext *c, CGroupBPFForeignProgram *p) {
225 assert(c);
226 assert(p);
227
228 LIST_REMOVE(programs, c->bpf_foreign_programs, p);
229 free(p->bpffs_path);
230 free(p);
231 }
232
233 void cgroup_context_remove_socket_bind(CGroupSocketBindItem **head) {
234 assert(head);
235
236 while (*head) {
237 CGroupSocketBindItem *h = *head;
238 LIST_REMOVE(socket_bind_items, *head, h);
239 free(h);
240 }
241 }
242
243 void cgroup_context_done(CGroupContext *c) {
244 assert(c);
245
246 while (c->io_device_weights)
247 cgroup_context_free_io_device_weight(c, c->io_device_weights);
248
249 while (c->io_device_latencies)
250 cgroup_context_free_io_device_latency(c, c->io_device_latencies);
251
252 while (c->io_device_limits)
253 cgroup_context_free_io_device_limit(c, c->io_device_limits);
254
255 while (c->blockio_device_weights)
256 cgroup_context_free_blockio_device_weight(c, c->blockio_device_weights);
257
258 while (c->blockio_device_bandwidths)
259 cgroup_context_free_blockio_device_bandwidth(c, c->blockio_device_bandwidths);
260
261 while (c->device_allow)
262 cgroup_context_free_device_allow(c, c->device_allow);
263
264 cgroup_context_remove_socket_bind(&c->socket_bind_allow);
265 cgroup_context_remove_socket_bind(&c->socket_bind_deny);
266
267 c->ip_address_allow = set_free(c->ip_address_allow);
268 c->ip_address_deny = set_free(c->ip_address_deny);
269
270 c->ip_filters_ingress = strv_free(c->ip_filters_ingress);
271 c->ip_filters_egress = strv_free(c->ip_filters_egress);
272
273 while (c->bpf_foreign_programs)
274 cgroup_context_remove_bpf_foreign_program(c, c->bpf_foreign_programs);
275
276 c->restrict_network_interfaces = set_free(c->restrict_network_interfaces);
277
278 cpu_set_reset(&c->cpuset_cpus);
279 cpu_set_reset(&c->startup_cpuset_cpus);
280 cpu_set_reset(&c->cpuset_mems);
281 cpu_set_reset(&c->startup_cpuset_mems);
282 }
283
284 static int unit_get_kernel_memory_limit(Unit *u, const char *file, uint64_t *ret) {
285 assert(u);
286
287 if (!u->cgroup_realized)
288 return -EOWNERDEAD;
289
290 return cg_get_attribute_as_uint64("memory", u->cgroup_path, file, ret);
291 }
292
293 static int unit_compare_memory_limit(Unit *u, const char *property_name, uint64_t *ret_unit_value, uint64_t *ret_kernel_value) {
294 CGroupContext *c;
295 CGroupMask m;
296 const char *file;
297 uint64_t unit_value;
298 int r;
299
300 /* Compare kernel memcg configuration against our internal systemd state. Unsupported (and will
301 * return -ENODATA) on cgroup v1.
302 *
303 * Returns:
304 *
305 * <0: On error.
306 * 0: If the kernel memory setting doesn't match our configuration.
307 * >0: If the kernel memory setting matches our configuration.
308 *
309 * The following values are only guaranteed to be populated on return >=0:
310 *
311 * - ret_unit_value will contain our internal expected value for the unit, page-aligned.
312 * - ret_kernel_value will contain the actual value presented by the kernel. */
313
314 assert(u);
315
316 r = cg_all_unified();
317 if (r < 0)
318 return log_debug_errno(r, "Failed to determine cgroup hierarchy version: %m");
319
320 /* Unsupported on v1.
321 *
322 * We don't return ENOENT, since that could actually mask a genuine problem where somebody else has
323 * silently masked the controller. */
324 if (r == 0)
325 return -ENODATA;
326
327 /* The root slice doesn't have any controller files, so we can't compare anything. */
328 if (unit_has_name(u, SPECIAL_ROOT_SLICE))
329 return -ENODATA;
330
331 /* It's possible to have MemoryFoo set without systemd wanting to have the memory controller enabled,
332 * for example, in the case of DisableControllers= or cgroup_disable on the kernel command line. To
333 * avoid specious errors in these scenarios, check that we even expect the memory controller to be
334 * enabled at all. */
335 m = unit_get_target_mask(u);
336 if (!FLAGS_SET(m, CGROUP_MASK_MEMORY))
337 return -ENODATA;
338
339 assert_se(c = unit_get_cgroup_context(u));
340
341 if (streq(property_name, "MemoryLow")) {
342 unit_value = unit_get_ancestor_memory_low(u);
343 file = "memory.low";
344 } else if (streq(property_name, "MemoryMin")) {
345 unit_value = unit_get_ancestor_memory_min(u);
346 file = "memory.min";
347 } else if (streq(property_name, "MemoryHigh")) {
348 unit_value = c->memory_high;
349 file = "memory.high";
350 } else if (streq(property_name, "MemoryMax")) {
351 unit_value = c->memory_max;
352 file = "memory.max";
353 } else if (streq(property_name, "MemorySwapMax")) {
354 unit_value = c->memory_swap_max;
355 file = "memory.swap.max";
356 } else
357 return -EINVAL;
358
359 r = unit_get_kernel_memory_limit(u, file, ret_kernel_value);
360 if (r < 0)
361 return log_unit_debug_errno(u, r, "Failed to parse %s: %m", file);
362
363 /* It's intended (soon) in a future kernel to not expose cgroup memory limits rounded to page
364 * boundaries, but instead separate the user-exposed limit, which is whatever userspace told us, from
365 * our internal page-counting. To support those future kernels, just check the value itself first
366 * without any page-alignment. */
367 if (*ret_kernel_value == unit_value) {
368 *ret_unit_value = unit_value;
369 return 1;
370 }
371
372 /* The current kernel behaviour, by comparison, is that even if you write a particular number of
373 * bytes into a cgroup memory file, it always returns that number page-aligned down (since the kernel
374 * internally stores cgroup limits in pages). As such, so long as it aligns properly, everything is
375 * cricket. */
376 if (unit_value != CGROUP_LIMIT_MAX)
377 unit_value = PAGE_ALIGN_DOWN(unit_value);
378
379 *ret_unit_value = unit_value;
380
381 return *ret_kernel_value == *ret_unit_value;
382 }
383
384 #define FORMAT_CGROUP_DIFF_MAX 128
385
386 static char *format_cgroup_memory_limit_comparison(char *buf, size_t l, Unit *u, const char *property_name) {
387 uint64_t kval, sval;
388 int r;
389
390 assert(u);
391 assert(buf);
392 assert(l > 0);
393
394 r = unit_compare_memory_limit(u, property_name, &sval, &kval);
395
396 /* memory.swap.max is special in that it relies on CONFIG_MEMCG_SWAP (and the default swapaccount=1).
397 * In the absence of reliably being able to detect whether memcg swap support is available or not,
398 * only complain if the error is not ENOENT. */
399 if (r > 0 || IN_SET(r, -ENODATA, -EOWNERDEAD) ||
400 (r == -ENOENT && streq(property_name, "MemorySwapMax"))) {
401 buf[0] = 0;
402 return buf;
403 }
404
405 if (r < 0) {
406 (void) snprintf(buf, l, " (error getting kernel value: %s)", strerror_safe(r));
407 return buf;
408 }
409
410 (void) snprintf(buf, l, " (different value in kernel: %" PRIu64 ")", kval);
411
412 return buf;
413 }
414
415 void cgroup_context_dump(Unit *u, FILE* f, const char *prefix) {
416 _cleanup_free_ char *disable_controllers_str = NULL, *cpuset_cpus = NULL, *cpuset_mems = NULL, *startup_cpuset_cpus = NULL, *startup_cpuset_mems = NULL;
417 CGroupIODeviceLimit *il;
418 CGroupIODeviceWeight *iw;
419 CGroupIODeviceLatency *l;
420 CGroupBlockIODeviceBandwidth *b;
421 CGroupBlockIODeviceWeight *w;
422 CGroupBPFForeignProgram *p;
423 CGroupDeviceAllow *a;
424 CGroupContext *c;
425 CGroupSocketBindItem *bi;
426 struct in_addr_prefix *iaai;
427 char **path;
428
429 char cda[FORMAT_CGROUP_DIFF_MAX];
430 char cdb[FORMAT_CGROUP_DIFF_MAX];
431 char cdc[FORMAT_CGROUP_DIFF_MAX];
432 char cdd[FORMAT_CGROUP_DIFF_MAX];
433 char cde[FORMAT_CGROUP_DIFF_MAX];
434
435 assert(u);
436 assert(f);
437
438 assert_se(c = unit_get_cgroup_context(u));
439
440 prefix = strempty(prefix);
441
442 (void) cg_mask_to_string(c->disable_controllers, &disable_controllers_str);
443
444 cpuset_cpus = cpu_set_to_range_string(&c->cpuset_cpus);
445 startup_cpuset_cpus = cpu_set_to_range_string(&c->startup_cpuset_cpus);
446 cpuset_mems = cpu_set_to_range_string(&c->cpuset_mems);
447 startup_cpuset_mems = cpu_set_to_range_string(&c->startup_cpuset_mems);
448
449 fprintf(f,
450 "%sCPUAccounting: %s\n"
451 "%sIOAccounting: %s\n"
452 "%sBlockIOAccounting: %s\n"
453 "%sMemoryAccounting: %s\n"
454 "%sTasksAccounting: %s\n"
455 "%sIPAccounting: %s\n"
456 "%sCPUWeight: %" PRIu64 "\n"
457 "%sStartupCPUWeight: %" PRIu64 "\n"
458 "%sCPUShares: %" PRIu64 "\n"
459 "%sStartupCPUShares: %" PRIu64 "\n"
460 "%sCPUQuotaPerSecSec: %s\n"
461 "%sCPUQuotaPeriodSec: %s\n"
462 "%sAllowedCPUs: %s\n"
463 "%sStartupAllowedCPUs: %s\n"
464 "%sAllowedMemoryNodes: %s\n"
465 "%sStartupAllowedMemoryNodes: %s\n"
466 "%sIOWeight: %" PRIu64 "\n"
467 "%sStartupIOWeight: %" PRIu64 "\n"
468 "%sBlockIOWeight: %" PRIu64 "\n"
469 "%sStartupBlockIOWeight: %" PRIu64 "\n"
470 "%sDefaultMemoryMin: %" PRIu64 "\n"
471 "%sDefaultMemoryLow: %" PRIu64 "\n"
472 "%sMemoryMin: %" PRIu64 "%s\n"
473 "%sMemoryLow: %" PRIu64 "%s\n"
474 "%sMemoryHigh: %" PRIu64 "%s\n"
475 "%sMemoryMax: %" PRIu64 "%s\n"
476 "%sMemorySwapMax: %" PRIu64 "%s\n"
477 "%sMemoryLimit: %" PRIu64 "\n"
478 "%sTasksMax: %" PRIu64 "\n"
479 "%sDevicePolicy: %s\n"
480 "%sDisableControllers: %s\n"
481 "%sDelegate: %s\n"
482 "%sManagedOOMSwap: %s\n"
483 "%sManagedOOMMemoryPressure: %s\n"
484 "%sManagedOOMMemoryPressureLimit: " PERMYRIAD_AS_PERCENT_FORMAT_STR "\n"
485 "%sManagedOOMPreference: %s\n",
486 prefix, yes_no(c->cpu_accounting),
487 prefix, yes_no(c->io_accounting),
488 prefix, yes_no(c->blockio_accounting),
489 prefix, yes_no(c->memory_accounting),
490 prefix, yes_no(c->tasks_accounting),
491 prefix, yes_no(c->ip_accounting),
492 prefix, c->cpu_weight,
493 prefix, c->startup_cpu_weight,
494 prefix, c->cpu_shares,
495 prefix, c->startup_cpu_shares,
496 prefix, FORMAT_TIMESPAN(c->cpu_quota_per_sec_usec, 1),
497 prefix, FORMAT_TIMESPAN(c->cpu_quota_period_usec, 1),
498 prefix, strempty(cpuset_cpus),
499 prefix, strempty(startup_cpuset_cpus),
500 prefix, strempty(cpuset_mems),
501 prefix, strempty(startup_cpuset_mems),
502 prefix, c->io_weight,
503 prefix, c->startup_io_weight,
504 prefix, c->blockio_weight,
505 prefix, c->startup_blockio_weight,
506 prefix, c->default_memory_min,
507 prefix, c->default_memory_low,
508 prefix, c->memory_min, format_cgroup_memory_limit_comparison(cda, sizeof(cda), u, "MemoryMin"),
509 prefix, c->memory_low, format_cgroup_memory_limit_comparison(cdb, sizeof(cdb), u, "MemoryLow"),
510 prefix, c->memory_high, format_cgroup_memory_limit_comparison(cdc, sizeof(cdc), u, "MemoryHigh"),
511 prefix, c->memory_max, format_cgroup_memory_limit_comparison(cdd, sizeof(cdd), u, "MemoryMax"),
512 prefix, c->memory_swap_max, format_cgroup_memory_limit_comparison(cde, sizeof(cde), u, "MemorySwapMax"),
513 prefix, c->memory_limit,
514 prefix, tasks_max_resolve(&c->tasks_max),
515 prefix, cgroup_device_policy_to_string(c->device_policy),
516 prefix, strempty(disable_controllers_str),
517 prefix, yes_no(c->delegate),
518 prefix, managed_oom_mode_to_string(c->moom_swap),
519 prefix, managed_oom_mode_to_string(c->moom_mem_pressure),
520 prefix, PERMYRIAD_AS_PERCENT_FORMAT_VAL(UINT32_SCALE_TO_PERMYRIAD(c->moom_mem_pressure_limit)),
521 prefix, managed_oom_preference_to_string(c->moom_preference));
522
523 if (c->delegate) {
524 _cleanup_free_ char *t = NULL;
525
526 (void) cg_mask_to_string(c->delegate_controllers, &t);
527
528 fprintf(f, "%sDelegateControllers: %s\n",
529 prefix,
530 strempty(t));
531 }
532
533 LIST_FOREACH(device_allow, a, c->device_allow)
534 fprintf(f,
535 "%sDeviceAllow: %s %s%s%s\n",
536 prefix,
537 a->path,
538 a->r ? "r" : "", a->w ? "w" : "", a->m ? "m" : "");
539
540 LIST_FOREACH(device_weights, iw, c->io_device_weights)
541 fprintf(f,
542 "%sIODeviceWeight: %s %" PRIu64 "\n",
543 prefix,
544 iw->path,
545 iw->weight);
546
547 LIST_FOREACH(device_latencies, l, c->io_device_latencies)
548 fprintf(f,
549 "%sIODeviceLatencyTargetSec: %s %s\n",
550 prefix,
551 l->path,
552 FORMAT_TIMESPAN(l->target_usec, 1));
553
554 LIST_FOREACH(device_limits, il, c->io_device_limits)
555 for (CGroupIOLimitType type = 0; type < _CGROUP_IO_LIMIT_TYPE_MAX; type++)
556 if (il->limits[type] != cgroup_io_limit_defaults[type])
557 fprintf(f,
558 "%s%s: %s %s\n",
559 prefix,
560 cgroup_io_limit_type_to_string(type),
561 il->path,
562 FORMAT_BYTES(il->limits[type]));
563
564 LIST_FOREACH(device_weights, w, c->blockio_device_weights)
565 fprintf(f,
566 "%sBlockIODeviceWeight: %s %" PRIu64,
567 prefix,
568 w->path,
569 w->weight);
570
571 LIST_FOREACH(device_bandwidths, b, c->blockio_device_bandwidths) {
572 if (b->rbps != CGROUP_LIMIT_MAX)
573 fprintf(f,
574 "%sBlockIOReadBandwidth: %s %s\n",
575 prefix,
576 b->path,
577 FORMAT_BYTES(b->rbps));
578 if (b->wbps != CGROUP_LIMIT_MAX)
579 fprintf(f,
580 "%sBlockIOWriteBandwidth: %s %s\n",
581 prefix,
582 b->path,
583 FORMAT_BYTES(b->wbps));
584 }
585
586 SET_FOREACH(iaai, c->ip_address_allow) {
587 _cleanup_free_ char *k = NULL;
588
589 (void) in_addr_prefix_to_string(iaai->family, &iaai->address, iaai->prefixlen, &k);
590 fprintf(f, "%sIPAddressAllow: %s\n", prefix, strnull(k));
591 }
592
593 SET_FOREACH(iaai, c->ip_address_deny) {
594 _cleanup_free_ char *k = NULL;
595
596 (void) in_addr_prefix_to_string(iaai->family, &iaai->address, iaai->prefixlen, &k);
597 fprintf(f, "%sIPAddressDeny: %s\n", prefix, strnull(k));
598 }
599
600 STRV_FOREACH(path, c->ip_filters_ingress)
601 fprintf(f, "%sIPIngressFilterPath: %s\n", prefix, *path);
602
603 STRV_FOREACH(path, c->ip_filters_egress)
604 fprintf(f, "%sIPEgressFilterPath: %s\n", prefix, *path);
605
606 LIST_FOREACH(programs, p, c->bpf_foreign_programs)
607 fprintf(f, "%sBPFProgram: %s:%s",
608 prefix, bpf_cgroup_attach_type_to_string(p->attach_type), p->bpffs_path);
609
610 if (c->socket_bind_allow) {
611 fprintf(f, "%sSocketBindAllow:", prefix);
612 LIST_FOREACH(socket_bind_items, bi, c->socket_bind_allow)
613 cgroup_context_dump_socket_bind_item(bi, f);
614 fputc('\n', f);
615 }
616
617 if (c->socket_bind_deny) {
618 fprintf(f, "%sSocketBindDeny:", prefix);
619 LIST_FOREACH(socket_bind_items, bi, c->socket_bind_deny)
620 cgroup_context_dump_socket_bind_item(bi, f);
621 fputc('\n', f);
622 }
623
624 if (c->restrict_network_interfaces) {
625 char *iface;
626 SET_FOREACH(iface, c->restrict_network_interfaces)
627 fprintf(f, "%sRestrictNetworkInterfaces: %s\n", prefix, iface);
628 }
629 }
630
631 void cgroup_context_dump_socket_bind_item(const CGroupSocketBindItem *item, FILE *f) {
632 const char *family, *colon1, *protocol = "", *colon2 = "";
633
634 family = strempty(af_to_ipv4_ipv6(item->address_family));
635 colon1 = isempty(family) ? "" : ":";
636
637 if (item->ip_protocol != 0) {
638 protocol = ip_protocol_to_tcp_udp(item->ip_protocol);
639 colon2 = ":";
640 }
641
642 if (item->nr_ports == 0)
643 fprintf(f, " %s%s%s%sany", family, colon1, protocol, colon2);
644 else if (item->nr_ports == 1)
645 fprintf(f, " %s%s%s%s%" PRIu16, family, colon1, protocol, colon2, item->port_min);
646 else {
647 uint16_t port_max = item->port_min + item->nr_ports - 1;
648 fprintf(f, " %s%s%s%s%" PRIu16 "-%" PRIu16, family, colon1, protocol, colon2,
649 item->port_min, port_max);
650 }
651 }
652
653 int cgroup_add_device_allow(CGroupContext *c, const char *dev, const char *mode) {
654 _cleanup_free_ CGroupDeviceAllow *a = NULL;
655 _cleanup_free_ char *d = NULL;
656
657 assert(c);
658 assert(dev);
659 assert(isempty(mode) || in_charset(mode, "rwm"));
660
661 a = new(CGroupDeviceAllow, 1);
662 if (!a)
663 return -ENOMEM;
664
665 d = strdup(dev);
666 if (!d)
667 return -ENOMEM;
668
669 *a = (CGroupDeviceAllow) {
670 .path = TAKE_PTR(d),
671 .r = isempty(mode) || strchr(mode, 'r'),
672 .w = isempty(mode) || strchr(mode, 'w'),
673 .m = isempty(mode) || strchr(mode, 'm'),
674 };
675
676 LIST_PREPEND(device_allow, c->device_allow, a);
677 TAKE_PTR(a);
678
679 return 0;
680 }
681
682 int cgroup_add_bpf_foreign_program(CGroupContext *c, uint32_t attach_type, const char *bpffs_path) {
683 CGroupBPFForeignProgram *p;
684 _cleanup_free_ char *d = NULL;
685
686 assert(c);
687 assert(bpffs_path);
688
689 if (!path_is_normalized(bpffs_path) || !path_is_absolute(bpffs_path))
690 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Path is not normalized: %m");
691
692 d = strdup(bpffs_path);
693 if (!d)
694 return log_oom();
695
696 p = new(CGroupBPFForeignProgram, 1);
697 if (!p)
698 return log_oom();
699
700 *p = (CGroupBPFForeignProgram) {
701 .attach_type = attach_type,
702 .bpffs_path = TAKE_PTR(d),
703 };
704
705 LIST_PREPEND(programs, c->bpf_foreign_programs, TAKE_PTR(p));
706
707 return 0;
708 }
709
710 #define UNIT_DEFINE_ANCESTOR_MEMORY_LOOKUP(entry) \
711 uint64_t unit_get_ancestor_##entry(Unit *u) { \
712 CGroupContext *c; \
713 \
714 /* 1. Is entry set in this unit? If so, use that. \
715 * 2. Is the default for this entry set in any \
716 * ancestor? If so, use that. \
717 * 3. Otherwise, return CGROUP_LIMIT_MIN. */ \
718 \
719 assert(u); \
720 \
721 c = unit_get_cgroup_context(u); \
722 if (c && c->entry##_set) \
723 return c->entry; \
724 \
725 while ((u = UNIT_GET_SLICE(u))) { \
726 c = unit_get_cgroup_context(u); \
727 if (c && c->default_##entry##_set) \
728 return c->default_##entry; \
729 } \
730 \
731 /* We've reached the root, but nobody had default for \
732 * this entry set, so set it to the kernel default. */ \
733 return CGROUP_LIMIT_MIN; \
734 }
735
736 UNIT_DEFINE_ANCESTOR_MEMORY_LOOKUP(memory_low);
737 UNIT_DEFINE_ANCESTOR_MEMORY_LOOKUP(memory_min);
738
739 void cgroup_oomd_xattr_apply(Unit *u, const char *cgroup_path) {
740 CGroupContext *c;
741 int r;
742
743 assert(u);
744
745 c = unit_get_cgroup_context(u);
746 if (!c)
747 return;
748
749 if (c->moom_preference == MANAGED_OOM_PREFERENCE_OMIT) {
750 r = cg_set_xattr(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, "user.oomd_omit", "1", 1, 0);
751 if (r < 0)
752 log_unit_debug_errno(u, r, "Failed to set oomd_omit flag on control group %s, ignoring: %m", empty_to_root(cgroup_path));
753 }
754
755 if (c->moom_preference == MANAGED_OOM_PREFERENCE_AVOID) {
756 r = cg_set_xattr(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, "user.oomd_avoid", "1", 1, 0);
757 if (r < 0)
758 log_unit_debug_errno(u, r, "Failed to set oomd_avoid flag on control group %s, ignoring: %m", empty_to_root(cgroup_path));
759 }
760
761 if (c->moom_preference != MANAGED_OOM_PREFERENCE_AVOID) {
762 r = cg_remove_xattr(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, "user.oomd_avoid");
763 if (r < 0 && r != -ENODATA)
764 log_unit_debug_errno(u, r, "Failed to remove oomd_avoid flag on control group %s, ignoring: %m", empty_to_root(cgroup_path));
765 }
766
767 if (c->moom_preference != MANAGED_OOM_PREFERENCE_OMIT) {
768 r = cg_remove_xattr(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, "user.oomd_omit");
769 if (r < 0 && r != -ENODATA)
770 log_unit_debug_errno(u, r, "Failed to remove oomd_omit flag on control group %s, ignoring: %m", empty_to_root(cgroup_path));
771 }
772 }
773
774 static void cgroup_xattr_apply(Unit *u) {
775 int r;
776
777 assert(u);
778
779 if (!MANAGER_IS_SYSTEM(u->manager))
780 return;
781
782 if (!sd_id128_is_null(u->invocation_id)) {
783 r = cg_set_xattr(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path,
784 "trusted.invocation_id",
785 SD_ID128_TO_STRING(u->invocation_id), 32,
786 0);
787 if (r < 0)
788 log_unit_debug_errno(u, r, "Failed to set invocation ID on control group %s, ignoring: %m", empty_to_root(u->cgroup_path));
789 }
790
791 if (unit_cgroup_delegate(u)) {
792 r = cg_set_xattr(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path,
793 "trusted.delegate",
794 "1", 1,
795 0);
796 if (r < 0)
797 log_unit_debug_errno(u, r, "Failed to set delegate flag on control group %s, ignoring: %m", empty_to_root(u->cgroup_path));
798 } else {
799 r = cg_remove_xattr(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, "trusted.delegate");
800 if (r < 0 && r != -ENODATA)
801 log_unit_debug_errno(u, r, "Failed to remove delegate flag on control group %s, ignoring: %m", empty_to_root(u->cgroup_path));
802 }
803
804 cgroup_oomd_xattr_apply(u, u->cgroup_path);
805 }
806
807 static int lookup_block_device(const char *p, dev_t *ret) {
808 dev_t rdev, dev = 0;
809 mode_t mode;
810 int r;
811
812 assert(p);
813 assert(ret);
814
815 r = device_path_parse_major_minor(p, &mode, &rdev);
816 if (r == -ENODEV) { /* not a parsable device node, need to go to disk */
817 struct stat st;
818
819 if (stat(p, &st) < 0)
820 return log_warning_errno(errno, "Couldn't stat device '%s': %m", p);
821
822 mode = st.st_mode;
823 rdev = st.st_rdev;
824 dev = st.st_dev;
825 } else if (r < 0)
826 return log_warning_errno(r, "Failed to parse major/minor from path '%s': %m", p);
827
828 if (S_ISCHR(mode))
829 return log_warning_errno(SYNTHETIC_ERRNO(ENOTBLK),
830 "Device node '%s' is a character device, but block device needed.", p);
831 if (S_ISBLK(mode))
832 *ret = rdev;
833 else if (major(dev) != 0)
834 *ret = dev; /* If this is not a device node then use the block device this file is stored on */
835 else {
836 /* If this is btrfs, getting the backing block device is a bit harder */
837 r = btrfs_get_block_device(p, ret);
838 if (r == -ENOTTY)
839 return log_warning_errno(SYNTHETIC_ERRNO(ENODEV),
840 "'%s' is not a block device node, and file system block device cannot be determined or is not local.", p);
841 if (r < 0)
842 return log_warning_errno(r, "Failed to determine block device backing btrfs file system '%s': %m", p);
843 }
844
845 /* If this is a LUKS/DM device, recursively try to get the originating block device */
846 while (block_get_originating(*ret, ret) > 0);
847
848 /* If this is a partition, try to get the originating block device */
849 (void) block_get_whole_disk(*ret, ret);
850 return 0;
851 }
852
853 static bool cgroup_context_has_cpu_weight(CGroupContext *c) {
854 return c->cpu_weight != CGROUP_WEIGHT_INVALID ||
855 c->startup_cpu_weight != CGROUP_WEIGHT_INVALID;
856 }
857
858 static bool cgroup_context_has_cpu_shares(CGroupContext *c) {
859 return c->cpu_shares != CGROUP_CPU_SHARES_INVALID ||
860 c->startup_cpu_shares != CGROUP_CPU_SHARES_INVALID;
861 }
862
863 static bool cgroup_context_has_allowed_cpus(CGroupContext *c) {
864 return c->cpuset_cpus.set || c->startup_cpuset_cpus.set;
865 }
866
867 static bool cgroup_context_has_allowed_mems(CGroupContext *c) {
868 return c->cpuset_mems.set || c->startup_cpuset_mems.set;
869 }
870
871 static uint64_t cgroup_context_cpu_weight(CGroupContext *c, ManagerState state) {
872 if (IN_SET(state, MANAGER_STARTING, MANAGER_INITIALIZING, MANAGER_STOPPING) &&
873 c->startup_cpu_weight != CGROUP_WEIGHT_INVALID)
874 return c->startup_cpu_weight;
875 else if (c->cpu_weight != CGROUP_WEIGHT_INVALID)
876 return c->cpu_weight;
877 else
878 return CGROUP_WEIGHT_DEFAULT;
879 }
880
881 static uint64_t cgroup_context_cpu_shares(CGroupContext *c, ManagerState state) {
882 if (IN_SET(state, MANAGER_STARTING, MANAGER_INITIALIZING, MANAGER_STOPPING) &&
883 c->startup_cpu_shares != CGROUP_CPU_SHARES_INVALID)
884 return c->startup_cpu_shares;
885 else if (c->cpu_shares != CGROUP_CPU_SHARES_INVALID)
886 return c->cpu_shares;
887 else
888 return CGROUP_CPU_SHARES_DEFAULT;
889 }
890
891 static CPUSet *cgroup_context_allowed_cpus(CGroupContext *c, ManagerState state) {
892 if (IN_SET(state, MANAGER_STARTING, MANAGER_INITIALIZING, MANAGER_STOPPING) &&
893 c->startup_cpuset_cpus.set)
894 return &c->startup_cpuset_cpus;
895 else
896 return &c->cpuset_cpus;
897 }
898
899 static CPUSet *cgroup_context_allowed_mems(CGroupContext *c, ManagerState state) {
900 if (IN_SET(state, MANAGER_STARTING, MANAGER_INITIALIZING, MANAGER_STOPPING) &&
901 c->startup_cpuset_mems.set)
902 return &c->startup_cpuset_mems;
903 else
904 return &c->cpuset_mems;
905 }
906
907 usec_t cgroup_cpu_adjust_period(usec_t period, usec_t quota, usec_t resolution, usec_t max_period) {
908 /* kernel uses a minimum resolution of 1ms, so both period and (quota * period)
909 * need to be higher than that boundary. quota is specified in USecPerSec.
910 * Additionally, period must be at most max_period. */
911 assert(quota > 0);
912
913 return MIN(MAX3(period, resolution, resolution * USEC_PER_SEC / quota), max_period);
914 }
915
916 static usec_t cgroup_cpu_adjust_period_and_log(Unit *u, usec_t period, usec_t quota) {
917 usec_t new_period;
918
919 if (quota == USEC_INFINITY)
920 /* Always use default period for infinity quota. */
921 return CGROUP_CPU_QUOTA_DEFAULT_PERIOD_USEC;
922
923 if (period == USEC_INFINITY)
924 /* Default period was requested. */
925 period = CGROUP_CPU_QUOTA_DEFAULT_PERIOD_USEC;
926
927 /* Clamp to interval [1ms, 1s] */
928 new_period = cgroup_cpu_adjust_period(period, quota, USEC_PER_MSEC, USEC_PER_SEC);
929
930 if (new_period != period) {
931 log_unit_full(u, u->warned_clamping_cpu_quota_period ? LOG_DEBUG : LOG_WARNING,
932 "Clamping CPU interval for cpu.max: period is now %s",
933 FORMAT_TIMESPAN(new_period, 1));
934 u->warned_clamping_cpu_quota_period = true;
935 }
936
937 return new_period;
938 }
939
940 static void cgroup_apply_unified_cpu_weight(Unit *u, uint64_t weight) {
941 char buf[DECIMAL_STR_MAX(uint64_t) + 2];
942
943 xsprintf(buf, "%" PRIu64 "\n", weight);
944 (void) set_attribute_and_warn(u, "cpu", "cpu.weight", buf);
945 }
946
947 static void cgroup_apply_unified_cpu_quota(Unit *u, usec_t quota, usec_t period) {
948 char buf[(DECIMAL_STR_MAX(usec_t) + 1) * 2 + 1];
949
950 period = cgroup_cpu_adjust_period_and_log(u, period, quota);
951 if (quota != USEC_INFINITY)
952 xsprintf(buf, USEC_FMT " " USEC_FMT "\n",
953 MAX(quota * period / USEC_PER_SEC, USEC_PER_MSEC), period);
954 else
955 xsprintf(buf, "max " USEC_FMT "\n", period);
956 (void) set_attribute_and_warn(u, "cpu", "cpu.max", buf);
957 }
958
959 static void cgroup_apply_legacy_cpu_shares(Unit *u, uint64_t shares) {
960 char buf[DECIMAL_STR_MAX(uint64_t) + 2];
961
962 xsprintf(buf, "%" PRIu64 "\n", shares);
963 (void) set_attribute_and_warn(u, "cpu", "cpu.shares", buf);
964 }
965
966 static void cgroup_apply_legacy_cpu_quota(Unit *u, usec_t quota, usec_t period) {
967 char buf[DECIMAL_STR_MAX(usec_t) + 2];
968
969 period = cgroup_cpu_adjust_period_and_log(u, period, quota);
970
971 xsprintf(buf, USEC_FMT "\n", period);
972 (void) set_attribute_and_warn(u, "cpu", "cpu.cfs_period_us", buf);
973
974 if (quota != USEC_INFINITY) {
975 xsprintf(buf, USEC_FMT "\n", MAX(quota * period / USEC_PER_SEC, USEC_PER_MSEC));
976 (void) set_attribute_and_warn(u, "cpu", "cpu.cfs_quota_us", buf);
977 } else
978 (void) set_attribute_and_warn(u, "cpu", "cpu.cfs_quota_us", "-1\n");
979 }
980
981 static uint64_t cgroup_cpu_shares_to_weight(uint64_t shares) {
982 return CLAMP(shares * CGROUP_WEIGHT_DEFAULT / CGROUP_CPU_SHARES_DEFAULT,
983 CGROUP_WEIGHT_MIN, CGROUP_WEIGHT_MAX);
984 }
985
986 static uint64_t cgroup_cpu_weight_to_shares(uint64_t weight) {
987 return CLAMP(weight * CGROUP_CPU_SHARES_DEFAULT / CGROUP_WEIGHT_DEFAULT,
988 CGROUP_CPU_SHARES_MIN, CGROUP_CPU_SHARES_MAX);
989 }
990
991 static void cgroup_apply_unified_cpuset(Unit *u, const CPUSet *cpus, const char *name) {
992 _cleanup_free_ char *buf = NULL;
993
994 buf = cpu_set_to_range_string(cpus);
995 if (!buf) {
996 log_oom();
997 return;
998 }
999
1000 (void) set_attribute_and_warn(u, "cpuset", name, buf);
1001 }
1002
1003 static bool cgroup_context_has_io_config(CGroupContext *c) {
1004 return c->io_accounting ||
1005 c->io_weight != CGROUP_WEIGHT_INVALID ||
1006 c->startup_io_weight != CGROUP_WEIGHT_INVALID ||
1007 c->io_device_weights ||
1008 c->io_device_latencies ||
1009 c->io_device_limits;
1010 }
1011
1012 static bool cgroup_context_has_blockio_config(CGroupContext *c) {
1013 return c->blockio_accounting ||
1014 c->blockio_weight != CGROUP_BLKIO_WEIGHT_INVALID ||
1015 c->startup_blockio_weight != CGROUP_BLKIO_WEIGHT_INVALID ||
1016 c->blockio_device_weights ||
1017 c->blockio_device_bandwidths;
1018 }
1019
1020 static uint64_t cgroup_context_io_weight(CGroupContext *c, ManagerState state) {
1021 if (IN_SET(state, MANAGER_STARTING, MANAGER_INITIALIZING, MANAGER_STOPPING) &&
1022 c->startup_io_weight != CGROUP_WEIGHT_INVALID)
1023 return c->startup_io_weight;
1024 else if (c->io_weight != CGROUP_WEIGHT_INVALID)
1025 return c->io_weight;
1026 else
1027 return CGROUP_WEIGHT_DEFAULT;
1028 }
1029
1030 static uint64_t cgroup_context_blkio_weight(CGroupContext *c, ManagerState state) {
1031 if (IN_SET(state, MANAGER_STARTING, MANAGER_INITIALIZING, MANAGER_STOPPING) &&
1032 c->startup_blockio_weight != CGROUP_BLKIO_WEIGHT_INVALID)
1033 return c->startup_blockio_weight;
1034 else if (c->blockio_weight != CGROUP_BLKIO_WEIGHT_INVALID)
1035 return c->blockio_weight;
1036 else
1037 return CGROUP_BLKIO_WEIGHT_DEFAULT;
1038 }
1039
1040 static uint64_t cgroup_weight_blkio_to_io(uint64_t blkio_weight) {
1041 return CLAMP(blkio_weight * CGROUP_WEIGHT_DEFAULT / CGROUP_BLKIO_WEIGHT_DEFAULT,
1042 CGROUP_WEIGHT_MIN, CGROUP_WEIGHT_MAX);
1043 }
1044
1045 static uint64_t cgroup_weight_io_to_blkio(uint64_t io_weight) {
1046 return CLAMP(io_weight * CGROUP_BLKIO_WEIGHT_DEFAULT / CGROUP_WEIGHT_DEFAULT,
1047 CGROUP_BLKIO_WEIGHT_MIN, CGROUP_BLKIO_WEIGHT_MAX);
1048 }
1049
1050 static void cgroup_apply_io_device_weight(Unit *u, const char *dev_path, uint64_t io_weight) {
1051 char buf[DECIMAL_STR_MAX(dev_t)*2+2+DECIMAL_STR_MAX(uint64_t)+1];
1052 dev_t dev;
1053 int r;
1054
1055 r = lookup_block_device(dev_path, &dev);
1056 if (r < 0)
1057 return;
1058
1059 xsprintf(buf, "%u:%u %" PRIu64 "\n", major(dev), minor(dev), io_weight);
1060 (void) set_attribute_and_warn(u, "io", "io.weight", buf);
1061 }
1062
1063 static void cgroup_apply_blkio_device_weight(Unit *u, const char *dev_path, uint64_t blkio_weight) {
1064 char buf[DECIMAL_STR_MAX(dev_t)*2+2+DECIMAL_STR_MAX(uint64_t)+1];
1065 dev_t dev;
1066 int r;
1067
1068 r = lookup_block_device(dev_path, &dev);
1069 if (r < 0)
1070 return;
1071
1072 xsprintf(buf, "%u:%u %" PRIu64 "\n", major(dev), minor(dev), blkio_weight);
1073 (void) set_attribute_and_warn(u, "blkio", "blkio.weight_device", buf);
1074 }
1075
1076 static void cgroup_apply_io_device_latency(Unit *u, const char *dev_path, usec_t target) {
1077 char buf[DECIMAL_STR_MAX(dev_t)*2+2+7+DECIMAL_STR_MAX(uint64_t)+1];
1078 dev_t dev;
1079 int r;
1080
1081 r = lookup_block_device(dev_path, &dev);
1082 if (r < 0)
1083 return;
1084
1085 if (target != USEC_INFINITY)
1086 xsprintf(buf, "%u:%u target=%" PRIu64 "\n", major(dev), minor(dev), target);
1087 else
1088 xsprintf(buf, "%u:%u target=max\n", major(dev), minor(dev));
1089
1090 (void) set_attribute_and_warn(u, "io", "io.latency", buf);
1091 }
1092
1093 static void cgroup_apply_io_device_limit(Unit *u, const char *dev_path, uint64_t *limits) {
1094 char limit_bufs[_CGROUP_IO_LIMIT_TYPE_MAX][DECIMAL_STR_MAX(uint64_t)],
1095 buf[DECIMAL_STR_MAX(dev_t)*2+2+(6+DECIMAL_STR_MAX(uint64_t)+1)*4];
1096 dev_t dev;
1097
1098 if (lookup_block_device(dev_path, &dev) < 0)
1099 return;
1100
1101 for (CGroupIOLimitType type = 0; type < _CGROUP_IO_LIMIT_TYPE_MAX; type++)
1102 if (limits[type] != cgroup_io_limit_defaults[type])
1103 xsprintf(limit_bufs[type], "%" PRIu64, limits[type]);
1104 else
1105 xsprintf(limit_bufs[type], "%s", limits[type] == CGROUP_LIMIT_MAX ? "max" : "0");
1106
1107 xsprintf(buf, "%u:%u rbps=%s wbps=%s riops=%s wiops=%s\n", major(dev), minor(dev),
1108 limit_bufs[CGROUP_IO_RBPS_MAX], limit_bufs[CGROUP_IO_WBPS_MAX],
1109 limit_bufs[CGROUP_IO_RIOPS_MAX], limit_bufs[CGROUP_IO_WIOPS_MAX]);
1110 (void) set_attribute_and_warn(u, "io", "io.max", buf);
1111 }
1112
1113 static void cgroup_apply_blkio_device_limit(Unit *u, const char *dev_path, uint64_t rbps, uint64_t wbps) {
1114 char buf[DECIMAL_STR_MAX(dev_t)*2+2+DECIMAL_STR_MAX(uint64_t)+1];
1115 dev_t dev;
1116
1117 if (lookup_block_device(dev_path, &dev) < 0)
1118 return;
1119
1120 sprintf(buf, "%u:%u %" PRIu64 "\n", major(dev), minor(dev), rbps);
1121 (void) set_attribute_and_warn(u, "blkio", "blkio.throttle.read_bps_device", buf);
1122
1123 sprintf(buf, "%u:%u %" PRIu64 "\n", major(dev), minor(dev), wbps);
1124 (void) set_attribute_and_warn(u, "blkio", "blkio.throttle.write_bps_device", buf);
1125 }
1126
1127 static bool unit_has_unified_memory_config(Unit *u) {
1128 CGroupContext *c;
1129
1130 assert(u);
1131
1132 assert_se(c = unit_get_cgroup_context(u));
1133
1134 return unit_get_ancestor_memory_min(u) > 0 || unit_get_ancestor_memory_low(u) > 0 ||
1135 c->memory_high != CGROUP_LIMIT_MAX || c->memory_max != CGROUP_LIMIT_MAX ||
1136 c->memory_swap_max != CGROUP_LIMIT_MAX;
1137 }
1138
1139 static void cgroup_apply_unified_memory_limit(Unit *u, const char *file, uint64_t v) {
1140 char buf[DECIMAL_STR_MAX(uint64_t) + 1] = "max\n";
1141
1142 if (v != CGROUP_LIMIT_MAX)
1143 xsprintf(buf, "%" PRIu64 "\n", v);
1144
1145 (void) set_attribute_and_warn(u, "memory", file, buf);
1146 }
1147
1148 static void cgroup_apply_firewall(Unit *u) {
1149 assert(u);
1150
1151 /* Best-effort: let's apply IP firewalling and/or accounting if that's enabled */
1152
1153 if (bpf_firewall_compile(u) < 0)
1154 return;
1155
1156 (void) bpf_firewall_load_custom(u);
1157 (void) bpf_firewall_install(u);
1158 }
1159
1160 static void cgroup_apply_socket_bind(Unit *u) {
1161 assert(u);
1162
1163 (void) bpf_socket_bind_install(u);
1164 }
1165
1166 static void cgroup_apply_restrict_network_interfaces(Unit *u) {
1167 assert(u);
1168
1169 (void) restrict_network_interfaces_install(u);
1170 }
1171
1172 static int cgroup_apply_devices(Unit *u) {
1173 _cleanup_(bpf_program_freep) BPFProgram *prog = NULL;
1174 const char *path;
1175 CGroupContext *c;
1176 CGroupDeviceAllow *a;
1177 CGroupDevicePolicy policy;
1178 int r;
1179
1180 assert_se(c = unit_get_cgroup_context(u));
1181 assert_se(path = u->cgroup_path);
1182
1183 policy = c->device_policy;
1184
1185 if (cg_all_unified() > 0) {
1186 r = bpf_devices_cgroup_init(&prog, policy, c->device_allow);
1187 if (r < 0)
1188 return log_unit_warning_errno(u, r, "Failed to initialize device control bpf program: %m");
1189
1190 } else {
1191 /* Changing the devices list of a populated cgroup might result in EINVAL, hence ignore
1192 * EINVAL here. */
1193
1194 if (c->device_allow || policy != CGROUP_DEVICE_POLICY_AUTO)
1195 r = cg_set_attribute("devices", path, "devices.deny", "a");
1196 else
1197 r = cg_set_attribute("devices", path, "devices.allow", "a");
1198 if (r < 0)
1199 log_unit_full_errno(u, IN_SET(r, -ENOENT, -EROFS, -EINVAL, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
1200 "Failed to reset devices.allow/devices.deny: %m");
1201 }
1202
1203 bool allow_list_static = policy == CGROUP_DEVICE_POLICY_CLOSED ||
1204 (policy == CGROUP_DEVICE_POLICY_AUTO && c->device_allow);
1205 if (allow_list_static)
1206 (void) bpf_devices_allow_list_static(prog, path);
1207
1208 bool any = allow_list_static;
1209 LIST_FOREACH(device_allow, a, c->device_allow) {
1210 char acc[4], *val;
1211 unsigned k = 0;
1212
1213 if (a->r)
1214 acc[k++] = 'r';
1215 if (a->w)
1216 acc[k++] = 'w';
1217 if (a->m)
1218 acc[k++] = 'm';
1219 if (k == 0)
1220 continue;
1221 acc[k++] = 0;
1222
1223 if (path_startswith(a->path, "/dev/"))
1224 r = bpf_devices_allow_list_device(prog, path, a->path, acc);
1225 else if ((val = startswith(a->path, "block-")))
1226 r = bpf_devices_allow_list_major(prog, path, val, 'b', acc);
1227 else if ((val = startswith(a->path, "char-")))
1228 r = bpf_devices_allow_list_major(prog, path, val, 'c', acc);
1229 else {
1230 log_unit_debug(u, "Ignoring device '%s' while writing cgroup attribute.", a->path);
1231 continue;
1232 }
1233
1234 if (r >= 0)
1235 any = true;
1236 }
1237
1238 if (prog && !any) {
1239 log_unit_warning_errno(u, SYNTHETIC_ERRNO(ENODEV), "No devices matched by device filter.");
1240
1241 /* The kernel verifier would reject a program we would build with the normal intro and outro
1242 but no allow-listing rules (outro would contain an unreachable instruction for successful
1243 return). */
1244 policy = CGROUP_DEVICE_POLICY_STRICT;
1245 }
1246
1247 r = bpf_devices_apply_policy(&prog, policy, any, path, &u->bpf_device_control_installed);
1248 if (r < 0) {
1249 static bool warned = false;
1250
1251 log_full_errno(warned ? LOG_DEBUG : LOG_WARNING, r,
1252 "Unit %s configures device ACL, but the local system doesn't seem to support the BPF-based device controller.\n"
1253 "Proceeding WITHOUT applying ACL (all devices will be accessible)!\n"
1254 "(This warning is only shown for the first loaded unit using device ACL.)", u->id);
1255
1256 warned = true;
1257 }
1258 return r;
1259 }
1260
1261 static void set_io_weight(Unit *u, const char *controller, uint64_t weight) {
1262 char buf[8+DECIMAL_STR_MAX(uint64_t)+1];
1263 const char *p;
1264
1265 p = strjoina(controller, ".weight");
1266 xsprintf(buf, "default %" PRIu64 "\n", weight);
1267 (void) set_attribute_and_warn(u, controller, p, buf);
1268
1269 /* FIXME: drop this when distro kernels properly support BFQ through "io.weight"
1270 * See also: https://github.com/systemd/systemd/pull/13335 and
1271 * https://github.com/torvalds/linux/commit/65752aef0a407e1ef17ec78a7fc31ba4e0b360f9.
1272 * The range is 1..1000 apparently. */
1273 p = strjoina(controller, ".bfq.weight");
1274 xsprintf(buf, "%" PRIu64 "\n", (weight + 9) / 10);
1275 (void) set_attribute_and_warn(u, controller, p, buf);
1276 }
1277
1278 static void cgroup_apply_bpf_foreign_program(Unit *u) {
1279 assert(u);
1280
1281 (void) bpf_foreign_install(u);
1282 }
1283
1284 static void cgroup_context_apply(
1285 Unit *u,
1286 CGroupMask apply_mask,
1287 ManagerState state) {
1288
1289 const char *path;
1290 CGroupContext *c;
1291 bool is_host_root, is_local_root;
1292 int r;
1293
1294 assert(u);
1295
1296 /* Nothing to do? Exit early! */
1297 if (apply_mask == 0)
1298 return;
1299
1300 /* Some cgroup attributes are not supported on the host root cgroup, hence silently ignore them here. And other
1301 * attributes should only be managed for cgroups further down the tree. */
1302 is_local_root = unit_has_name(u, SPECIAL_ROOT_SLICE);
1303 is_host_root = unit_has_host_root_cgroup(u);
1304
1305 assert_se(c = unit_get_cgroup_context(u));
1306 assert_se(path = u->cgroup_path);
1307
1308 if (is_local_root) /* Make sure we don't try to display messages with an empty path. */
1309 path = "/";
1310
1311 /* We generally ignore errors caused by read-only mounted cgroup trees (assuming we are running in a container
1312 * then), and missing cgroups, i.e. EROFS and ENOENT. */
1313
1314 /* In fully unified mode these attributes don't exist on the host cgroup root. On legacy the weights exist, but
1315 * setting the weight makes very little sense on the host root cgroup, as there are no other cgroups at this
1316 * level. The quota exists there too, but any attempt to write to it is refused with EINVAL. Inside of
1317 * containers we want to leave control of these to the container manager (and if cgroup v2 delegation is used
1318 * we couldn't even write to them if we wanted to). */
1319 if ((apply_mask & CGROUP_MASK_CPU) && !is_local_root) {
1320
1321 if (cg_all_unified() > 0) {
1322 uint64_t weight;
1323
1324 if (cgroup_context_has_cpu_weight(c))
1325 weight = cgroup_context_cpu_weight(c, state);
1326 else if (cgroup_context_has_cpu_shares(c)) {
1327 uint64_t shares;
1328
1329 shares = cgroup_context_cpu_shares(c, state);
1330 weight = cgroup_cpu_shares_to_weight(shares);
1331
1332 log_cgroup_compat(u, "Applying [Startup]CPUShares=%" PRIu64 " as [Startup]CPUWeight=%" PRIu64 " on %s",
1333 shares, weight, path);
1334 } else
1335 weight = CGROUP_WEIGHT_DEFAULT;
1336
1337 cgroup_apply_unified_cpu_weight(u, weight);
1338 cgroup_apply_unified_cpu_quota(u, c->cpu_quota_per_sec_usec, c->cpu_quota_period_usec);
1339
1340 } else {
1341 uint64_t shares;
1342
1343 if (cgroup_context_has_cpu_weight(c)) {
1344 uint64_t weight;
1345
1346 weight = cgroup_context_cpu_weight(c, state);
1347 shares = cgroup_cpu_weight_to_shares(weight);
1348
1349 log_cgroup_compat(u, "Applying [Startup]CPUWeight=%" PRIu64 " as [Startup]CPUShares=%" PRIu64 " on %s",
1350 weight, shares, path);
1351 } else if (cgroup_context_has_cpu_shares(c))
1352 shares = cgroup_context_cpu_shares(c, state);
1353 else
1354 shares = CGROUP_CPU_SHARES_DEFAULT;
1355
1356 cgroup_apply_legacy_cpu_shares(u, shares);
1357 cgroup_apply_legacy_cpu_quota(u, c->cpu_quota_per_sec_usec, c->cpu_quota_period_usec);
1358 }
1359 }
1360
1361 if ((apply_mask & CGROUP_MASK_CPUSET) && !is_local_root) {
1362 cgroup_apply_unified_cpuset(u, cgroup_context_allowed_cpus(c, state), "cpuset.cpus");
1363 cgroup_apply_unified_cpuset(u, cgroup_context_allowed_mems(c, state), "cpuset.mems");
1364 }
1365
1366 /* The 'io' controller attributes are not exported on the host's root cgroup (being a pure cgroup v2
1367 * controller), and in case of containers we want to leave control of these attributes to the container manager
1368 * (and we couldn't access that stuff anyway, even if we tried if proper delegation is used). */
1369 if ((apply_mask & CGROUP_MASK_IO) && !is_local_root) {
1370 bool has_io, has_blockio;
1371 uint64_t weight;
1372
1373 has_io = cgroup_context_has_io_config(c);
1374 has_blockio = cgroup_context_has_blockio_config(c);
1375
1376 if (has_io)
1377 weight = cgroup_context_io_weight(c, state);
1378 else if (has_blockio) {
1379 uint64_t blkio_weight;
1380
1381 blkio_weight = cgroup_context_blkio_weight(c, state);
1382 weight = cgroup_weight_blkio_to_io(blkio_weight);
1383
1384 log_cgroup_compat(u, "Applying [Startup]BlockIOWeight=%" PRIu64 " as [Startup]IOWeight=%" PRIu64,
1385 blkio_weight, weight);
1386 } else
1387 weight = CGROUP_WEIGHT_DEFAULT;
1388
1389 set_io_weight(u, "io", weight);
1390
1391 if (has_io) {
1392 CGroupIODeviceLatency *latency;
1393 CGroupIODeviceLimit *limit;
1394 CGroupIODeviceWeight *w;
1395
1396 LIST_FOREACH(device_weights, w, c->io_device_weights)
1397 cgroup_apply_io_device_weight(u, w->path, w->weight);
1398
1399 LIST_FOREACH(device_limits, limit, c->io_device_limits)
1400 cgroup_apply_io_device_limit(u, limit->path, limit->limits);
1401
1402 LIST_FOREACH(device_latencies, latency, c->io_device_latencies)
1403 cgroup_apply_io_device_latency(u, latency->path, latency->target_usec);
1404
1405 } else if (has_blockio) {
1406 CGroupBlockIODeviceWeight *w;
1407 CGroupBlockIODeviceBandwidth *b;
1408
1409 LIST_FOREACH(device_weights, w, c->blockio_device_weights) {
1410 weight = cgroup_weight_blkio_to_io(w->weight);
1411
1412 log_cgroup_compat(u, "Applying BlockIODeviceWeight=%" PRIu64 " as IODeviceWeight=%" PRIu64 " for %s",
1413 w->weight, weight, w->path);
1414
1415 cgroup_apply_io_device_weight(u, w->path, weight);
1416 }
1417
1418 LIST_FOREACH(device_bandwidths, b, c->blockio_device_bandwidths) {
1419 uint64_t limits[_CGROUP_IO_LIMIT_TYPE_MAX];
1420
1421 for (CGroupIOLimitType type = 0; type < _CGROUP_IO_LIMIT_TYPE_MAX; type++)
1422 limits[type] = cgroup_io_limit_defaults[type];
1423
1424 limits[CGROUP_IO_RBPS_MAX] = b->rbps;
1425 limits[CGROUP_IO_WBPS_MAX] = b->wbps;
1426
1427 log_cgroup_compat(u, "Applying BlockIO{Read|Write}Bandwidth=%" PRIu64 " %" PRIu64 " as IO{Read|Write}BandwidthMax= for %s",
1428 b->rbps, b->wbps, b->path);
1429
1430 cgroup_apply_io_device_limit(u, b->path, limits);
1431 }
1432 }
1433 }
1434
1435 if (apply_mask & CGROUP_MASK_BLKIO) {
1436 bool has_io, has_blockio;
1437
1438 has_io = cgroup_context_has_io_config(c);
1439 has_blockio = cgroup_context_has_blockio_config(c);
1440
1441 /* Applying a 'weight' never makes sense for the host root cgroup, and for containers this should be
1442 * left to our container manager, too. */
1443 if (!is_local_root) {
1444 uint64_t weight;
1445
1446 if (has_io) {
1447 uint64_t io_weight;
1448
1449 io_weight = cgroup_context_io_weight(c, state);
1450 weight = cgroup_weight_io_to_blkio(cgroup_context_io_weight(c, state));
1451
1452 log_cgroup_compat(u, "Applying [Startup]IOWeight=%" PRIu64 " as [Startup]BlockIOWeight=%" PRIu64,
1453 io_weight, weight);
1454 } else if (has_blockio)
1455 weight = cgroup_context_blkio_weight(c, state);
1456 else
1457 weight = CGROUP_BLKIO_WEIGHT_DEFAULT;
1458
1459 set_io_weight(u, "blkio", weight);
1460
1461 if (has_io) {
1462 CGroupIODeviceWeight *w;
1463
1464 LIST_FOREACH(device_weights, w, c->io_device_weights) {
1465 weight = cgroup_weight_io_to_blkio(w->weight);
1466
1467 log_cgroup_compat(u, "Applying IODeviceWeight=%" PRIu64 " as BlockIODeviceWeight=%" PRIu64 " for %s",
1468 w->weight, weight, w->path);
1469
1470 cgroup_apply_blkio_device_weight(u, w->path, weight);
1471 }
1472 } else if (has_blockio) {
1473 CGroupBlockIODeviceWeight *w;
1474
1475 LIST_FOREACH(device_weights, w, c->blockio_device_weights)
1476 cgroup_apply_blkio_device_weight(u, w->path, w->weight);
1477 }
1478 }
1479
1480 /* The bandwidth limits are something that make sense to be applied to the host's root but not container
1481 * roots, as there we want the container manager to handle it */
1482 if (is_host_root || !is_local_root) {
1483 if (has_io) {
1484 CGroupIODeviceLimit *l;
1485
1486 LIST_FOREACH(device_limits, l, c->io_device_limits) {
1487 log_cgroup_compat(u, "Applying IO{Read|Write}Bandwidth=%" PRIu64 " %" PRIu64 " as BlockIO{Read|Write}BandwidthMax= for %s",
1488 l->limits[CGROUP_IO_RBPS_MAX], l->limits[CGROUP_IO_WBPS_MAX], l->path);
1489
1490 cgroup_apply_blkio_device_limit(u, l->path, l->limits[CGROUP_IO_RBPS_MAX], l->limits[CGROUP_IO_WBPS_MAX]);
1491 }
1492 } else if (has_blockio) {
1493 CGroupBlockIODeviceBandwidth *b;
1494
1495 LIST_FOREACH(device_bandwidths, b, c->blockio_device_bandwidths)
1496 cgroup_apply_blkio_device_limit(u, b->path, b->rbps, b->wbps);
1497 }
1498 }
1499 }
1500
1501 /* In unified mode 'memory' attributes do not exist on the root cgroup. In legacy mode 'memory.limit_in_bytes'
1502 * exists on the root cgroup, but any writes to it are refused with EINVAL. And if we run in a container we
1503 * want to leave control to the container manager (and if proper cgroup v2 delegation is used we couldn't even
1504 * write to this if we wanted to.) */
1505 if ((apply_mask & CGROUP_MASK_MEMORY) && !is_local_root) {
1506
1507 if (cg_all_unified() > 0) {
1508 uint64_t max, swap_max = CGROUP_LIMIT_MAX;
1509
1510 if (unit_has_unified_memory_config(u)) {
1511 max = c->memory_max;
1512 swap_max = c->memory_swap_max;
1513 } else {
1514 max = c->memory_limit;
1515
1516 if (max != CGROUP_LIMIT_MAX)
1517 log_cgroup_compat(u, "Applying MemoryLimit=%" PRIu64 " as MemoryMax=", max);
1518 }
1519
1520 cgroup_apply_unified_memory_limit(u, "memory.min", unit_get_ancestor_memory_min(u));
1521 cgroup_apply_unified_memory_limit(u, "memory.low", unit_get_ancestor_memory_low(u));
1522 cgroup_apply_unified_memory_limit(u, "memory.high", c->memory_high);
1523 cgroup_apply_unified_memory_limit(u, "memory.max", max);
1524 cgroup_apply_unified_memory_limit(u, "memory.swap.max", swap_max);
1525
1526 (void) set_attribute_and_warn(u, "memory", "memory.oom.group", one_zero(c->memory_oom_group));
1527
1528 } else {
1529 char buf[DECIMAL_STR_MAX(uint64_t) + 1];
1530 uint64_t val;
1531
1532 if (unit_has_unified_memory_config(u)) {
1533 val = c->memory_max;
1534 log_cgroup_compat(u, "Applying MemoryMax=%" PRIi64 " as MemoryLimit=", val);
1535 } else
1536 val = c->memory_limit;
1537
1538 if (val == CGROUP_LIMIT_MAX)
1539 strncpy(buf, "-1\n", sizeof(buf));
1540 else
1541 xsprintf(buf, "%" PRIu64 "\n", val);
1542
1543 (void) set_attribute_and_warn(u, "memory", "memory.limit_in_bytes", buf);
1544 }
1545 }
1546
1547 /* On cgroup v2 we can apply BPF everywhere. On cgroup v1 we apply it everywhere except for the root of
1548 * containers, where we leave this to the manager */
1549 if ((apply_mask & (CGROUP_MASK_DEVICES | CGROUP_MASK_BPF_DEVICES)) &&
1550 (is_host_root || cg_all_unified() > 0 || !is_local_root))
1551 (void) cgroup_apply_devices(u);
1552
1553 if (apply_mask & CGROUP_MASK_PIDS) {
1554
1555 if (is_host_root) {
1556 /* So, the "pids" controller does not expose anything on the root cgroup, in order not to
1557 * replicate knobs exposed elsewhere needlessly. We abstract this away here however, and when
1558 * the knobs of the root cgroup are modified propagate this to the relevant sysctls. There's a
1559 * non-obvious asymmetry however: unlike the cgroup properties we don't really want to take
1560 * exclusive ownership of the sysctls, but we still want to honour things if the user sets
1561 * limits. Hence we employ sort of a one-way strategy: when the user sets a bounded limit
1562 * through us it counts. When the user afterwards unsets it again (i.e. sets it to unbounded)
1563 * it also counts. But if the user never set a limit through us (i.e. we are the default of
1564 * "unbounded") we leave things unmodified. For this we manage a global boolean that we turn on
1565 * the first time we set a limit. Note that this boolean is flushed out on manager reload,
1566 * which is desirable so that there's an official way to release control of the sysctl from
1567 * systemd: set the limit to unbounded and reload. */
1568
1569 if (tasks_max_isset(&c->tasks_max)) {
1570 u->manager->sysctl_pid_max_changed = true;
1571 r = procfs_tasks_set_limit(tasks_max_resolve(&c->tasks_max));
1572 } else if (u->manager->sysctl_pid_max_changed)
1573 r = procfs_tasks_set_limit(TASKS_MAX);
1574 else
1575 r = 0;
1576 if (r < 0)
1577 log_unit_full_errno(u, LOG_LEVEL_CGROUP_WRITE(r), r,
1578 "Failed to write to tasks limit sysctls: %m");
1579 }
1580
1581 /* The attribute itself is not available on the host root cgroup, and in the container case we want to
1582 * leave it for the container manager. */
1583 if (!is_local_root) {
1584 if (tasks_max_isset(&c->tasks_max)) {
1585 char buf[DECIMAL_STR_MAX(uint64_t) + 1];
1586
1587 xsprintf(buf, "%" PRIu64 "\n", tasks_max_resolve(&c->tasks_max));
1588 (void) set_attribute_and_warn(u, "pids", "pids.max", buf);
1589 } else
1590 (void) set_attribute_and_warn(u, "pids", "pids.max", "max\n");
1591 }
1592 }
1593
1594 if (apply_mask & CGROUP_MASK_BPF_FIREWALL)
1595 cgroup_apply_firewall(u);
1596
1597 if (apply_mask & CGROUP_MASK_BPF_FOREIGN)
1598 cgroup_apply_bpf_foreign_program(u);
1599
1600 if (apply_mask & CGROUP_MASK_BPF_SOCKET_BIND)
1601 cgroup_apply_socket_bind(u);
1602
1603 if (apply_mask & CGROUP_MASK_BPF_RESTRICT_NETWORK_INTERFACES)
1604 cgroup_apply_restrict_network_interfaces(u);
1605 }
1606
1607 static bool unit_get_needs_bpf_firewall(Unit *u) {
1608 CGroupContext *c;
1609 assert(u);
1610
1611 c = unit_get_cgroup_context(u);
1612 if (!c)
1613 return false;
1614
1615 if (c->ip_accounting ||
1616 !set_isempty(c->ip_address_allow) ||
1617 !set_isempty(c->ip_address_deny) ||
1618 c->ip_filters_ingress ||
1619 c->ip_filters_egress)
1620 return true;
1621
1622 /* If any parent slice has an IP access list defined, it applies too */
1623 for (Unit *p = UNIT_GET_SLICE(u); p; p = UNIT_GET_SLICE(p)) {
1624 c = unit_get_cgroup_context(p);
1625 if (!c)
1626 return false;
1627
1628 if (!set_isempty(c->ip_address_allow) ||
1629 !set_isempty(c->ip_address_deny))
1630 return true;
1631 }
1632
1633 return false;
1634 }
1635
1636 static bool unit_get_needs_bpf_foreign_program(Unit *u) {
1637 CGroupContext *c;
1638 assert(u);
1639
1640 c = unit_get_cgroup_context(u);
1641 if (!c)
1642 return false;
1643
1644 return !LIST_IS_EMPTY(c->bpf_foreign_programs);
1645 }
1646
1647 static bool unit_get_needs_socket_bind(Unit *u) {
1648 CGroupContext *c;
1649 assert(u);
1650
1651 c = unit_get_cgroup_context(u);
1652 if (!c)
1653 return false;
1654
1655 return c->socket_bind_allow || c->socket_bind_deny;
1656 }
1657
1658 static bool unit_get_needs_restrict_network_interfaces(Unit *u) {
1659 CGroupContext *c;
1660 assert(u);
1661
1662 c = unit_get_cgroup_context(u);
1663 if (!c)
1664 return false;
1665
1666 return !set_isempty(c->restrict_network_interfaces);
1667 }
1668
1669 static CGroupMask unit_get_cgroup_mask(Unit *u) {
1670 CGroupMask mask = 0;
1671 CGroupContext *c;
1672
1673 assert(u);
1674
1675 assert_se(c = unit_get_cgroup_context(u));
1676
1677 /* Figure out which controllers we need, based on the cgroup context object */
1678
1679 if (c->cpu_accounting)
1680 mask |= get_cpu_accounting_mask();
1681
1682 if (cgroup_context_has_cpu_weight(c) ||
1683 cgroup_context_has_cpu_shares(c) ||
1684 c->cpu_quota_per_sec_usec != USEC_INFINITY)
1685 mask |= CGROUP_MASK_CPU;
1686
1687 if (cgroup_context_has_allowed_cpus(c) || cgroup_context_has_allowed_mems(c))
1688 mask |= CGROUP_MASK_CPUSET;
1689
1690 if (cgroup_context_has_io_config(c) || cgroup_context_has_blockio_config(c))
1691 mask |= CGROUP_MASK_IO | CGROUP_MASK_BLKIO;
1692
1693 if (c->memory_accounting ||
1694 c->memory_limit != CGROUP_LIMIT_MAX ||
1695 unit_has_unified_memory_config(u))
1696 mask |= CGROUP_MASK_MEMORY;
1697
1698 if (c->device_allow ||
1699 c->device_policy != CGROUP_DEVICE_POLICY_AUTO)
1700 mask |= CGROUP_MASK_DEVICES | CGROUP_MASK_BPF_DEVICES;
1701
1702 if (c->tasks_accounting ||
1703 tasks_max_isset(&c->tasks_max))
1704 mask |= CGROUP_MASK_PIDS;
1705
1706 return CGROUP_MASK_EXTEND_JOINED(mask);
1707 }
1708
1709 static CGroupMask unit_get_bpf_mask(Unit *u) {
1710 CGroupMask mask = 0;
1711
1712 /* Figure out which controllers we need, based on the cgroup context, possibly taking into account children
1713 * too. */
1714
1715 if (unit_get_needs_bpf_firewall(u))
1716 mask |= CGROUP_MASK_BPF_FIREWALL;
1717
1718 if (unit_get_needs_bpf_foreign_program(u))
1719 mask |= CGROUP_MASK_BPF_FOREIGN;
1720
1721 if (unit_get_needs_socket_bind(u))
1722 mask |= CGROUP_MASK_BPF_SOCKET_BIND;
1723
1724 if (unit_get_needs_restrict_network_interfaces(u))
1725 mask |= CGROUP_MASK_BPF_RESTRICT_NETWORK_INTERFACES;
1726
1727 return mask;
1728 }
1729
1730 CGroupMask unit_get_own_mask(Unit *u) {
1731 CGroupContext *c;
1732
1733 /* Returns the mask of controllers the unit needs for itself. If a unit is not properly loaded, return an empty
1734 * mask, as we shouldn't reflect it in the cgroup hierarchy then. */
1735
1736 if (u->load_state != UNIT_LOADED)
1737 return 0;
1738
1739 c = unit_get_cgroup_context(u);
1740 if (!c)
1741 return 0;
1742
1743 return unit_get_cgroup_mask(u) | unit_get_bpf_mask(u) | unit_get_delegate_mask(u);
1744 }
1745
1746 CGroupMask unit_get_delegate_mask(Unit *u) {
1747 CGroupContext *c;
1748
1749 /* If delegation is turned on, then turn on selected controllers, unless we are on the legacy hierarchy and the
1750 * process we fork into is known to drop privileges, and hence shouldn't get access to the controllers.
1751 *
1752 * Note that on the unified hierarchy it is safe to delegate controllers to unprivileged services. */
1753
1754 if (!unit_cgroup_delegate(u))
1755 return 0;
1756
1757 if (cg_all_unified() <= 0) {
1758 ExecContext *e;
1759
1760 e = unit_get_exec_context(u);
1761 if (e && !exec_context_maintains_privileges(e))
1762 return 0;
1763 }
1764
1765 assert_se(c = unit_get_cgroup_context(u));
1766 return CGROUP_MASK_EXTEND_JOINED(c->delegate_controllers);
1767 }
1768
1769 static CGroupMask unit_get_subtree_mask(Unit *u) {
1770
1771 /* Returns the mask of this subtree, meaning of the group
1772 * itself and its children. */
1773
1774 return unit_get_own_mask(u) | unit_get_members_mask(u);
1775 }
1776
1777 CGroupMask unit_get_members_mask(Unit *u) {
1778 assert(u);
1779
1780 /* Returns the mask of controllers all of the unit's children require, merged */
1781
1782 if (u->cgroup_members_mask_valid)
1783 return u->cgroup_members_mask; /* Use cached value if possible */
1784
1785 u->cgroup_members_mask = 0;
1786
1787 if (u->type == UNIT_SLICE) {
1788 Unit *member;
1789
1790 UNIT_FOREACH_DEPENDENCY(member, u, UNIT_ATOM_SLICE_OF)
1791 u->cgroup_members_mask |= unit_get_subtree_mask(member); /* note that this calls ourselves again, for the children */
1792 }
1793
1794 u->cgroup_members_mask_valid = true;
1795 return u->cgroup_members_mask;
1796 }
1797
1798 CGroupMask unit_get_siblings_mask(Unit *u) {
1799 Unit *slice;
1800 assert(u);
1801
1802 /* Returns the mask of controllers all of the unit's siblings
1803 * require, i.e. the members mask of the unit's parent slice
1804 * if there is one. */
1805
1806 slice = UNIT_GET_SLICE(u);
1807 if (slice)
1808 return unit_get_members_mask(slice);
1809
1810 return unit_get_subtree_mask(u); /* we are the top-level slice */
1811 }
1812
1813 static CGroupMask unit_get_disable_mask(Unit *u) {
1814 CGroupContext *c;
1815
1816 c = unit_get_cgroup_context(u);
1817 if (!c)
1818 return 0;
1819
1820 return c->disable_controllers;
1821 }
1822
1823 CGroupMask unit_get_ancestor_disable_mask(Unit *u) {
1824 CGroupMask mask;
1825 Unit *slice;
1826
1827 assert(u);
1828 mask = unit_get_disable_mask(u);
1829
1830 /* Returns the mask of controllers which are marked as forcibly
1831 * disabled in any ancestor unit or the unit in question. */
1832
1833 slice = UNIT_GET_SLICE(u);
1834 if (slice)
1835 mask |= unit_get_ancestor_disable_mask(slice);
1836
1837 return mask;
1838 }
1839
1840 CGroupMask unit_get_target_mask(Unit *u) {
1841 CGroupMask own_mask, mask;
1842
1843 /* This returns the cgroup mask of all controllers to enable for a specific cgroup, i.e. everything
1844 * it needs itself, plus all that its children need, plus all that its siblings need. This is
1845 * primarily useful on the legacy cgroup hierarchy, where we need to duplicate each cgroup in each
1846 * hierarchy that shall be enabled for it. */
1847
1848 own_mask = unit_get_own_mask(u);
1849
1850 if (own_mask & CGROUP_MASK_BPF_FIREWALL & ~u->manager->cgroup_supported)
1851 emit_bpf_firewall_warning(u);
1852
1853 mask = own_mask | unit_get_members_mask(u) | unit_get_siblings_mask(u);
1854
1855 mask &= u->manager->cgroup_supported;
1856 mask &= ~unit_get_ancestor_disable_mask(u);
1857
1858 return mask;
1859 }
1860
1861 CGroupMask unit_get_enable_mask(Unit *u) {
1862 CGroupMask mask;
1863
1864 /* This returns the cgroup mask of all controllers to enable
1865 * for the children of a specific cgroup. This is primarily
1866 * useful for the unified cgroup hierarchy, where each cgroup
1867 * controls which controllers are enabled for its children. */
1868
1869 mask = unit_get_members_mask(u);
1870 mask &= u->manager->cgroup_supported;
1871 mask &= ~unit_get_ancestor_disable_mask(u);
1872
1873 return mask;
1874 }
1875
1876 void unit_invalidate_cgroup_members_masks(Unit *u) {
1877 Unit *slice;
1878
1879 assert(u);
1880
1881 /* Recurse invalidate the member masks cache all the way up the tree */
1882 u->cgroup_members_mask_valid = false;
1883
1884 slice = UNIT_GET_SLICE(u);
1885 if (slice)
1886 unit_invalidate_cgroup_members_masks(slice);
1887 }
1888
1889 const char *unit_get_realized_cgroup_path(Unit *u, CGroupMask mask) {
1890
1891 /* Returns the realized cgroup path of the specified unit where all specified controllers are available. */
1892
1893 while (u) {
1894
1895 if (u->cgroup_path &&
1896 u->cgroup_realized &&
1897 FLAGS_SET(u->cgroup_realized_mask, mask))
1898 return u->cgroup_path;
1899
1900 u = UNIT_GET_SLICE(u);
1901 }
1902
1903 return NULL;
1904 }
1905
1906 static const char *migrate_callback(CGroupMask mask, void *userdata) {
1907 /* If not realized at all, migrate to root ("").
1908 * It may happen if we're upgrading from older version that didn't clean up.
1909 */
1910 return strempty(unit_get_realized_cgroup_path(userdata, mask));
1911 }
1912
1913 char *unit_default_cgroup_path(const Unit *u) {
1914 _cleanup_free_ char *escaped = NULL, *slice_path = NULL;
1915 Unit *slice;
1916 int r;
1917
1918 assert(u);
1919
1920 if (unit_has_name(u, SPECIAL_ROOT_SLICE))
1921 return strdup(u->manager->cgroup_root);
1922
1923 slice = UNIT_GET_SLICE(u);
1924 if (slice && !unit_has_name(slice, SPECIAL_ROOT_SLICE)) {
1925 r = cg_slice_to_path(slice->id, &slice_path);
1926 if (r < 0)
1927 return NULL;
1928 }
1929
1930 escaped = cg_escape(u->id);
1931 if (!escaped)
1932 return NULL;
1933
1934 return path_join(empty_to_root(u->manager->cgroup_root), slice_path, escaped);
1935 }
1936
1937 int unit_set_cgroup_path(Unit *u, const char *path) {
1938 _cleanup_free_ char *p = NULL;
1939 int r;
1940
1941 assert(u);
1942
1943 if (streq_ptr(u->cgroup_path, path))
1944 return 0;
1945
1946 if (path) {
1947 p = strdup(path);
1948 if (!p)
1949 return -ENOMEM;
1950 }
1951
1952 if (p) {
1953 r = hashmap_put(u->manager->cgroup_unit, p, u);
1954 if (r < 0)
1955 return r;
1956 }
1957
1958 unit_release_cgroup(u);
1959 u->cgroup_path = TAKE_PTR(p);
1960
1961 return 1;
1962 }
1963
1964 int unit_watch_cgroup(Unit *u) {
1965 _cleanup_free_ char *events = NULL;
1966 int r;
1967
1968 assert(u);
1969
1970 /* Watches the "cgroups.events" attribute of this unit's cgroup for "empty" events, but only if
1971 * cgroupv2 is available. */
1972
1973 if (!u->cgroup_path)
1974 return 0;
1975
1976 if (u->cgroup_control_inotify_wd >= 0)
1977 return 0;
1978
1979 /* Only applies to the unified hierarchy */
1980 r = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
1981 if (r < 0)
1982 return log_error_errno(r, "Failed to determine whether the name=systemd hierarchy is unified: %m");
1983 if (r == 0)
1984 return 0;
1985
1986 /* No point in watch the top-level slice, it's never going to run empty. */
1987 if (unit_has_name(u, SPECIAL_ROOT_SLICE))
1988 return 0;
1989
1990 r = hashmap_ensure_allocated(&u->manager->cgroup_control_inotify_wd_unit, &trivial_hash_ops);
1991 if (r < 0)
1992 return log_oom();
1993
1994 r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, "cgroup.events", &events);
1995 if (r < 0)
1996 return log_oom();
1997
1998 u->cgroup_control_inotify_wd = inotify_add_watch(u->manager->cgroup_inotify_fd, events, IN_MODIFY);
1999 if (u->cgroup_control_inotify_wd < 0) {
2000
2001 if (errno == ENOENT) /* If the directory is already gone we don't need to track it, so this
2002 * is not an error */
2003 return 0;
2004
2005 return log_unit_error_errno(u, errno, "Failed to add control inotify watch descriptor for control group %s: %m", empty_to_root(u->cgroup_path));
2006 }
2007
2008 r = hashmap_put(u->manager->cgroup_control_inotify_wd_unit, INT_TO_PTR(u->cgroup_control_inotify_wd), u);
2009 if (r < 0)
2010 return log_unit_error_errno(u, r, "Failed to add control inotify watch descriptor for control group %s to hash map: %m", empty_to_root(u->cgroup_path));
2011
2012 return 0;
2013 }
2014
2015 int unit_watch_cgroup_memory(Unit *u) {
2016 _cleanup_free_ char *events = NULL;
2017 CGroupContext *c;
2018 int r;
2019
2020 assert(u);
2021
2022 /* Watches the "memory.events" attribute of this unit's cgroup for "oom_kill" events, but only if
2023 * cgroupv2 is available. */
2024
2025 if (!u->cgroup_path)
2026 return 0;
2027
2028 c = unit_get_cgroup_context(u);
2029 if (!c)
2030 return 0;
2031
2032 /* The "memory.events" attribute is only available if the memory controller is on. Let's hence tie
2033 * this to memory accounting, in a way watching for OOM kills is a form of memory accounting after
2034 * all. */
2035 if (!c->memory_accounting)
2036 return 0;
2037
2038 /* Don't watch inner nodes, as the kernel doesn't report oom_kill events recursively currently, and
2039 * we also don't want to generate a log message for each parent cgroup of a process. */
2040 if (u->type == UNIT_SLICE)
2041 return 0;
2042
2043 if (u->cgroup_memory_inotify_wd >= 0)
2044 return 0;
2045
2046 /* Only applies to the unified hierarchy */
2047 r = cg_all_unified();
2048 if (r < 0)
2049 return log_error_errno(r, "Failed to determine whether the memory controller is unified: %m");
2050 if (r == 0)
2051 return 0;
2052
2053 r = hashmap_ensure_allocated(&u->manager->cgroup_memory_inotify_wd_unit, &trivial_hash_ops);
2054 if (r < 0)
2055 return log_oom();
2056
2057 r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, "memory.events", &events);
2058 if (r < 0)
2059 return log_oom();
2060
2061 u->cgroup_memory_inotify_wd = inotify_add_watch(u->manager->cgroup_inotify_fd, events, IN_MODIFY);
2062 if (u->cgroup_memory_inotify_wd < 0) {
2063
2064 if (errno == ENOENT) /* If the directory is already gone we don't need to track it, so this
2065 * is not an error */
2066 return 0;
2067
2068 return log_unit_error_errno(u, errno, "Failed to add memory inotify watch descriptor for control group %s: %m", empty_to_root(u->cgroup_path));
2069 }
2070
2071 r = hashmap_put(u->manager->cgroup_memory_inotify_wd_unit, INT_TO_PTR(u->cgroup_memory_inotify_wd), u);
2072 if (r < 0)
2073 return log_unit_error_errno(u, r, "Failed to add memory inotify watch descriptor for control group %s to hash map: %m", empty_to_root(u->cgroup_path));
2074
2075 return 0;
2076 }
2077
2078 int unit_pick_cgroup_path(Unit *u) {
2079 _cleanup_free_ char *path = NULL;
2080 int r;
2081
2082 assert(u);
2083
2084 if (u->cgroup_path)
2085 return 0;
2086
2087 if (!UNIT_HAS_CGROUP_CONTEXT(u))
2088 return -EINVAL;
2089
2090 path = unit_default_cgroup_path(u);
2091 if (!path)
2092 return log_oom();
2093
2094 r = unit_set_cgroup_path(u, path);
2095 if (r == -EEXIST)
2096 return log_unit_error_errno(u, r, "Control group %s exists already.", empty_to_root(path));
2097 if (r < 0)
2098 return log_unit_error_errno(u, r, "Failed to set unit's control group path to %s: %m", empty_to_root(path));
2099
2100 return 0;
2101 }
2102
2103 static int unit_update_cgroup(
2104 Unit *u,
2105 CGroupMask target_mask,
2106 CGroupMask enable_mask,
2107 ManagerState state) {
2108
2109 bool created, is_root_slice;
2110 CGroupMask migrate_mask = 0;
2111 _cleanup_free_ char *cgroup_full_path = NULL;
2112 uint64_t cgroup_id = 0;
2113 int r;
2114
2115 assert(u);
2116
2117 if (!UNIT_HAS_CGROUP_CONTEXT(u))
2118 return 0;
2119
2120 /* Figure out our cgroup path */
2121 r = unit_pick_cgroup_path(u);
2122 if (r < 0)
2123 return r;
2124
2125 /* First, create our own group */
2126 r = cg_create_everywhere(u->manager->cgroup_supported, target_mask, u->cgroup_path);
2127 if (r < 0)
2128 return log_unit_error_errno(u, r, "Failed to create cgroup %s: %m", empty_to_root(u->cgroup_path));
2129 created = r;
2130
2131 if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0) {
2132 r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, NULL, &cgroup_full_path);
2133 if (r == 0) {
2134 r = cg_path_get_cgroupid(cgroup_full_path, &cgroup_id);
2135 if (r < 0)
2136 log_unit_warning_errno(u, r, "Failed to get cgroup ID on cgroup %s, ignoring: %m", cgroup_full_path);
2137 } else
2138 log_unit_warning_errno(u, r, "Failed to get full cgroup path on cgroup %s, ignoring: %m", empty_to_root(u->cgroup_path));
2139
2140 u->cgroup_id = cgroup_id;
2141 }
2142
2143 /* Start watching it */
2144 (void) unit_watch_cgroup(u);
2145 (void) unit_watch_cgroup_memory(u);
2146
2147
2148 /* For v2 we preserve enabled controllers in delegated units, adjust others,
2149 * for v1 we figure out which controller hierarchies need migration. */
2150 if (created || !u->cgroup_realized || !unit_cgroup_delegate(u)) {
2151 CGroupMask result_mask = 0;
2152
2153 /* Enable all controllers we need */
2154 r = cg_enable_everywhere(u->manager->cgroup_supported, enable_mask, u->cgroup_path, &result_mask);
2155 if (r < 0)
2156 log_unit_warning_errno(u, r, "Failed to enable/disable controllers on cgroup %s, ignoring: %m", empty_to_root(u->cgroup_path));
2157
2158 /* Remember what's actually enabled now */
2159 u->cgroup_enabled_mask = result_mask;
2160
2161 migrate_mask = u->cgroup_realized_mask ^ target_mask;
2162 }
2163
2164 /* Keep track that this is now realized */
2165 u->cgroup_realized = true;
2166 u->cgroup_realized_mask = target_mask;
2167
2168 /* Migrate processes in controller hierarchies both downwards (enabling) and upwards (disabling).
2169 *
2170 * Unnecessary controller cgroups are trimmed (after emptied by upward migration).
2171 * We perform migration also with whole slices for cases when users don't care about leave
2172 * granularity. Since delegated_mask is subset of target mask, we won't trim slice subtree containing
2173 * delegated units.
2174 */
2175 if (cg_all_unified() == 0) {
2176 r = cg_migrate_v1_controllers(u->manager->cgroup_supported, migrate_mask, u->cgroup_path, migrate_callback, u);
2177 if (r < 0)
2178 log_unit_warning_errno(u, r, "Failed to migrate controller cgroups from %s, ignoring: %m", empty_to_root(u->cgroup_path));
2179
2180 is_root_slice = unit_has_name(u, SPECIAL_ROOT_SLICE);
2181 r = cg_trim_v1_controllers(u->manager->cgroup_supported, ~target_mask, u->cgroup_path, !is_root_slice);
2182 if (r < 0)
2183 log_unit_warning_errno(u, r, "Failed to delete controller cgroups %s, ignoring: %m", empty_to_root(u->cgroup_path));
2184 }
2185
2186 /* Set attributes */
2187 cgroup_context_apply(u, target_mask, state);
2188 cgroup_xattr_apply(u);
2189
2190 return 0;
2191 }
2192
2193 static int unit_attach_pid_to_cgroup_via_bus(Unit *u, pid_t pid, const char *suffix_path) {
2194 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2195 char *pp;
2196 int r;
2197
2198 assert(u);
2199
2200 if (MANAGER_IS_SYSTEM(u->manager))
2201 return -EINVAL;
2202
2203 if (!u->manager->system_bus)
2204 return -EIO;
2205
2206 if (!u->cgroup_path)
2207 return -EINVAL;
2208
2209 /* Determine this unit's cgroup path relative to our cgroup root */
2210 pp = path_startswith(u->cgroup_path, u->manager->cgroup_root);
2211 if (!pp)
2212 return -EINVAL;
2213
2214 pp = strjoina("/", pp, suffix_path);
2215 path_simplify(pp);
2216
2217 r = sd_bus_call_method(u->manager->system_bus,
2218 "org.freedesktop.systemd1",
2219 "/org/freedesktop/systemd1",
2220 "org.freedesktop.systemd1.Manager",
2221 "AttachProcessesToUnit",
2222 &error, NULL,
2223 "ssau",
2224 NULL /* empty unit name means client's unit, i.e. us */, pp, 1, (uint32_t) pid);
2225 if (r < 0)
2226 return log_unit_debug_errno(u, r, "Failed to attach unit process " PID_FMT " via the bus: %s", pid, bus_error_message(&error, r));
2227
2228 return 0;
2229 }
2230
2231 int unit_attach_pids_to_cgroup(Unit *u, Set *pids, const char *suffix_path) {
2232 CGroupMask delegated_mask;
2233 const char *p;
2234 void *pidp;
2235 int r, q;
2236
2237 assert(u);
2238
2239 if (!UNIT_HAS_CGROUP_CONTEXT(u))
2240 return -EINVAL;
2241
2242 if (set_isempty(pids))
2243 return 0;
2244
2245 /* Load any custom firewall BPF programs here once to test if they are existing and actually loadable.
2246 * Fail here early since later errors in the call chain unit_realize_cgroup to cgroup_context_apply are ignored. */
2247 r = bpf_firewall_load_custom(u);
2248 if (r < 0)
2249 return r;
2250
2251 r = unit_realize_cgroup(u);
2252 if (r < 0)
2253 return r;
2254
2255 if (isempty(suffix_path))
2256 p = u->cgroup_path;
2257 else
2258 p = prefix_roota(u->cgroup_path, suffix_path);
2259
2260 delegated_mask = unit_get_delegate_mask(u);
2261
2262 r = 0;
2263 SET_FOREACH(pidp, pids) {
2264 pid_t pid = PTR_TO_PID(pidp);
2265
2266 /* First, attach the PID to the main cgroup hierarchy */
2267 q = cg_attach(SYSTEMD_CGROUP_CONTROLLER, p, pid);
2268 if (q < 0) {
2269 bool again = MANAGER_IS_USER(u->manager) && ERRNO_IS_PRIVILEGE(q);
2270
2271 log_unit_full_errno(u, again ? LOG_DEBUG : LOG_INFO, q,
2272 "Couldn't move process "PID_FMT" to%s requested cgroup '%s': %m",
2273 pid, again ? " directly" : "", empty_to_root(p));
2274
2275 if (again) {
2276 int z;
2277
2278 /* If we are in a user instance, and we can't move the process ourselves due
2279 * to permission problems, let's ask the system instance about it instead.
2280 * Since it's more privileged it might be able to move the process across the
2281 * leaves of a subtree whose top node is not owned by us. */
2282
2283 z = unit_attach_pid_to_cgroup_via_bus(u, pid, suffix_path);
2284 if (z < 0)
2285 log_unit_info_errno(u, z, "Couldn't move process "PID_FMT" to requested cgroup '%s' (directly or via the system bus): %m", pid, empty_to_root(p));
2286 else
2287 continue; /* When the bus thing worked via the bus we are fully done for this PID. */
2288 }
2289
2290 if (r >= 0)
2291 r = q; /* Remember first error */
2292
2293 continue;
2294 }
2295
2296 q = cg_all_unified();
2297 if (q < 0)
2298 return q;
2299 if (q > 0)
2300 continue;
2301
2302 /* In the legacy hierarchy, attach the process to the request cgroup if possible, and if not to the
2303 * innermost realized one */
2304
2305 for (CGroupController c = 0; c < _CGROUP_CONTROLLER_MAX; c++) {
2306 CGroupMask bit = CGROUP_CONTROLLER_TO_MASK(c);
2307 const char *realized;
2308
2309 if (!(u->manager->cgroup_supported & bit))
2310 continue;
2311
2312 /* If this controller is delegated and realized, honour the caller's request for the cgroup suffix. */
2313 if (delegated_mask & u->cgroup_realized_mask & bit) {
2314 q = cg_attach(cgroup_controller_to_string(c), p, pid);
2315 if (q >= 0)
2316 continue; /* Success! */
2317
2318 log_unit_debug_errno(u, q, "Failed to attach PID " PID_FMT " to requested cgroup %s in controller %s, falling back to unit's cgroup: %m",
2319 pid, empty_to_root(p), cgroup_controller_to_string(c));
2320 }
2321
2322 /* So this controller is either not delegate or realized, or something else weird happened. In
2323 * that case let's attach the PID at least to the closest cgroup up the tree that is
2324 * realized. */
2325 realized = unit_get_realized_cgroup_path(u, bit);
2326 if (!realized)
2327 continue; /* Not even realized in the root slice? Then let's not bother */
2328
2329 q = cg_attach(cgroup_controller_to_string(c), realized, pid);
2330 if (q < 0)
2331 log_unit_debug_errno(u, q, "Failed to attach PID " PID_FMT " to realized cgroup %s in controller %s, ignoring: %m",
2332 pid, realized, cgroup_controller_to_string(c));
2333 }
2334 }
2335
2336 return r;
2337 }
2338
2339 static bool unit_has_mask_realized(
2340 Unit *u,
2341 CGroupMask target_mask,
2342 CGroupMask enable_mask) {
2343
2344 assert(u);
2345
2346 /* Returns true if this unit is fully realized. We check four things:
2347 *
2348 * 1. Whether the cgroup was created at all
2349 * 2. Whether the cgroup was created in all the hierarchies we need it to be created in (in case of cgroup v1)
2350 * 3. Whether the cgroup has all the right controllers enabled (in case of cgroup v2)
2351 * 4. Whether the invalidation mask is currently zero
2352 *
2353 * If you wonder why we mask the target realization and enable mask with CGROUP_MASK_V1/CGROUP_MASK_V2: note
2354 * that there are three sets of bitmasks: CGROUP_MASK_V1 (for real cgroup v1 controllers), CGROUP_MASK_V2 (for
2355 * real cgroup v2 controllers) and CGROUP_MASK_BPF (for BPF-based pseudo-controllers). Now, cgroup_realized_mask
2356 * is only matters for cgroup v1 controllers, and cgroup_enabled_mask only used for cgroup v2, and if they
2357 * differ in the others, we don't really care. (After all, the cgroup_enabled_mask tracks with controllers are
2358 * enabled through cgroup.subtree_control, and since the BPF pseudo-controllers don't show up there, they
2359 * simply don't matter. */
2360
2361 return u->cgroup_realized &&
2362 ((u->cgroup_realized_mask ^ target_mask) & CGROUP_MASK_V1) == 0 &&
2363 ((u->cgroup_enabled_mask ^ enable_mask) & CGROUP_MASK_V2) == 0 &&
2364 u->cgroup_invalidated_mask == 0;
2365 }
2366
2367 static bool unit_has_mask_disables_realized(
2368 Unit *u,
2369 CGroupMask target_mask,
2370 CGroupMask enable_mask) {
2371
2372 assert(u);
2373
2374 /* Returns true if all controllers which should be disabled are indeed disabled.
2375 *
2376 * Unlike unit_has_mask_realized, we don't care what was enabled, only that anything we want to remove is
2377 * already removed. */
2378
2379 return !u->cgroup_realized ||
2380 (FLAGS_SET(u->cgroup_realized_mask, target_mask & CGROUP_MASK_V1) &&
2381 FLAGS_SET(u->cgroup_enabled_mask, enable_mask & CGROUP_MASK_V2));
2382 }
2383
2384 static bool unit_has_mask_enables_realized(
2385 Unit *u,
2386 CGroupMask target_mask,
2387 CGroupMask enable_mask) {
2388
2389 assert(u);
2390
2391 /* Returns true if all controllers which should be enabled are indeed enabled.
2392 *
2393 * Unlike unit_has_mask_realized, we don't care about the controllers that are not present, only that anything
2394 * we want to add is already added. */
2395
2396 return u->cgroup_realized &&
2397 ((u->cgroup_realized_mask | target_mask) & CGROUP_MASK_V1) == (u->cgroup_realized_mask & CGROUP_MASK_V1) &&
2398 ((u->cgroup_enabled_mask | enable_mask) & CGROUP_MASK_V2) == (u->cgroup_enabled_mask & CGROUP_MASK_V2);
2399 }
2400
2401 static void unit_add_to_cgroup_realize_queue(Unit *u) {
2402 assert(u);
2403
2404 if (u->in_cgroup_realize_queue)
2405 return;
2406
2407 LIST_APPEND(cgroup_realize_queue, u->manager->cgroup_realize_queue, u);
2408 u->in_cgroup_realize_queue = true;
2409 }
2410
2411 static void unit_remove_from_cgroup_realize_queue(Unit *u) {
2412 assert(u);
2413
2414 if (!u->in_cgroup_realize_queue)
2415 return;
2416
2417 LIST_REMOVE(cgroup_realize_queue, u->manager->cgroup_realize_queue, u);
2418 u->in_cgroup_realize_queue = false;
2419 }
2420
2421 /* Controllers can only be enabled breadth-first, from the root of the
2422 * hierarchy downwards to the unit in question. */
2423 static int unit_realize_cgroup_now_enable(Unit *u, ManagerState state) {
2424 CGroupMask target_mask, enable_mask, new_target_mask, new_enable_mask;
2425 Unit *slice;
2426 int r;
2427
2428 assert(u);
2429
2430 /* First go deal with this unit's parent, or we won't be able to enable
2431 * any new controllers at this layer. */
2432 slice = UNIT_GET_SLICE(u);
2433 if (slice) {
2434 r = unit_realize_cgroup_now_enable(slice, state);
2435 if (r < 0)
2436 return r;
2437 }
2438
2439 target_mask = unit_get_target_mask(u);
2440 enable_mask = unit_get_enable_mask(u);
2441
2442 /* We can only enable in this direction, don't try to disable anything.
2443 */
2444 if (unit_has_mask_enables_realized(u, target_mask, enable_mask))
2445 return 0;
2446
2447 new_target_mask = u->cgroup_realized_mask | target_mask;
2448 new_enable_mask = u->cgroup_enabled_mask | enable_mask;
2449
2450 return unit_update_cgroup(u, new_target_mask, new_enable_mask, state);
2451 }
2452
2453 /* Controllers can only be disabled depth-first, from the leaves of the
2454 * hierarchy upwards to the unit in question. */
2455 static int unit_realize_cgroup_now_disable(Unit *u, ManagerState state) {
2456 Unit *m;
2457
2458 assert(u);
2459
2460 if (u->type != UNIT_SLICE)
2461 return 0;
2462
2463 UNIT_FOREACH_DEPENDENCY(m, u, UNIT_ATOM_SLICE_OF) {
2464 CGroupMask target_mask, enable_mask, new_target_mask, new_enable_mask;
2465 int r;
2466
2467 /* The cgroup for this unit might not actually be fully realised yet, in which case it isn't
2468 * holding any controllers open anyway. */
2469 if (!m->cgroup_realized)
2470 continue;
2471
2472 /* We must disable those below us first in order to release the controller. */
2473 if (m->type == UNIT_SLICE)
2474 (void) unit_realize_cgroup_now_disable(m, state);
2475
2476 target_mask = unit_get_target_mask(m);
2477 enable_mask = unit_get_enable_mask(m);
2478
2479 /* We can only disable in this direction, don't try to enable anything. */
2480 if (unit_has_mask_disables_realized(m, target_mask, enable_mask))
2481 continue;
2482
2483 new_target_mask = m->cgroup_realized_mask & target_mask;
2484 new_enable_mask = m->cgroup_enabled_mask & enable_mask;
2485
2486 r = unit_update_cgroup(m, new_target_mask, new_enable_mask, state);
2487 if (r < 0)
2488 return r;
2489 }
2490
2491 return 0;
2492 }
2493
2494 /* Check if necessary controllers and attributes for a unit are in place.
2495 *
2496 * - If so, do nothing.
2497 * - If not, create paths, move processes over, and set attributes.
2498 *
2499 * Controllers can only be *enabled* in a breadth-first way, and *disabled* in
2500 * a depth-first way. As such the process looks like this:
2501 *
2502 * Suppose we have a cgroup hierarchy which looks like this:
2503 *
2504 * root
2505 * / \
2506 * / \
2507 * / \
2508 * a b
2509 * / \ / \
2510 * / \ / \
2511 * c d e f
2512 * / \ / \ / \ / \
2513 * h i j k l m n o
2514 *
2515 * 1. We want to realise cgroup "d" now.
2516 * 2. cgroup "a" has DisableControllers=cpu in the associated unit.
2517 * 3. cgroup "k" just started requesting the memory controller.
2518 *
2519 * To make this work we must do the following in order:
2520 *
2521 * 1. Disable CPU controller in k, j
2522 * 2. Disable CPU controller in d
2523 * 3. Enable memory controller in root
2524 * 4. Enable memory controller in a
2525 * 5. Enable memory controller in d
2526 * 6. Enable memory controller in k
2527 *
2528 * Notice that we need to touch j in one direction, but not the other. We also
2529 * don't go beyond d when disabling -- it's up to "a" to get realized if it
2530 * wants to disable further. The basic rules are therefore:
2531 *
2532 * - If you're disabling something, you need to realise all of the cgroups from
2533 * your recursive descendants to the root. This starts from the leaves.
2534 * - If you're enabling something, you need to realise from the root cgroup
2535 * downwards, but you don't need to iterate your recursive descendants.
2536 *
2537 * Returns 0 on success and < 0 on failure. */
2538 static int unit_realize_cgroup_now(Unit *u, ManagerState state) {
2539 CGroupMask target_mask, enable_mask;
2540 Unit *slice;
2541 int r;
2542
2543 assert(u);
2544
2545 unit_remove_from_cgroup_realize_queue(u);
2546
2547 target_mask = unit_get_target_mask(u);
2548 enable_mask = unit_get_enable_mask(u);
2549
2550 if (unit_has_mask_realized(u, target_mask, enable_mask))
2551 return 0;
2552
2553 /* Disable controllers below us, if there are any */
2554 r = unit_realize_cgroup_now_disable(u, state);
2555 if (r < 0)
2556 return r;
2557
2558 /* Enable controllers above us, if there are any */
2559 slice = UNIT_GET_SLICE(u);
2560 if (slice) {
2561 r = unit_realize_cgroup_now_enable(slice, state);
2562 if (r < 0)
2563 return r;
2564 }
2565
2566 /* Now actually deal with the cgroup we were trying to realise and set attributes */
2567 r = unit_update_cgroup(u, target_mask, enable_mask, state);
2568 if (r < 0)
2569 return r;
2570
2571 /* Now, reset the invalidation mask */
2572 u->cgroup_invalidated_mask = 0;
2573 return 0;
2574 }
2575
2576 unsigned manager_dispatch_cgroup_realize_queue(Manager *m) {
2577 ManagerState state;
2578 unsigned n = 0;
2579 Unit *i;
2580 int r;
2581
2582 assert(m);
2583
2584 state = manager_state(m);
2585
2586 while ((i = m->cgroup_realize_queue)) {
2587 assert(i->in_cgroup_realize_queue);
2588
2589 if (UNIT_IS_INACTIVE_OR_FAILED(unit_active_state(i))) {
2590 /* Maybe things changed, and the unit is not actually active anymore? */
2591 unit_remove_from_cgroup_realize_queue(i);
2592 continue;
2593 }
2594
2595 r = unit_realize_cgroup_now(i, state);
2596 if (r < 0)
2597 log_warning_errno(r, "Failed to realize cgroups for queued unit %s, ignoring: %m", i->id);
2598
2599 n++;
2600 }
2601
2602 return n;
2603 }
2604
2605 void unit_add_family_to_cgroup_realize_queue(Unit *u) {
2606 assert(u);
2607 assert(u->type == UNIT_SLICE);
2608
2609 /* Family of a unit for is defined as (immediate) children of the unit and immediate children of all
2610 * its ancestors.
2611 *
2612 * Ideally we would enqueue ancestor path only (bottom up). However, on cgroup-v1 scheduling becomes
2613 * very weird if two units that own processes reside in the same slice, but one is realized in the
2614 * "cpu" hierarchy and one is not (for example because one has CPUWeight= set and the other does
2615 * not), because that means individual processes need to be scheduled against whole cgroups. Let's
2616 * avoid this asymmetry by always ensuring that siblings of a unit are always realized in their v1
2617 * controller hierarchies too (if unit requires the controller to be realized).
2618 *
2619 * The function must invalidate cgroup_members_mask of all ancestors in order to calculate up to date
2620 * masks. */
2621
2622 do {
2623 Unit *m;
2624
2625 /* Children of u likely changed when we're called */
2626 u->cgroup_members_mask_valid = false;
2627
2628 UNIT_FOREACH_DEPENDENCY(m, u, UNIT_ATOM_SLICE_OF) {
2629
2630 /* No point in doing cgroup application for units without active processes. */
2631 if (UNIT_IS_INACTIVE_OR_FAILED(unit_active_state(m)))
2632 continue;
2633
2634 /* We only enqueue siblings if they were realized once at least, in the main
2635 * hierarchy. */
2636 if (!m->cgroup_realized)
2637 continue;
2638
2639 /* If the unit doesn't need any new controllers and has current ones
2640 * realized, it doesn't need any changes. */
2641 if (unit_has_mask_realized(m,
2642 unit_get_target_mask(m),
2643 unit_get_enable_mask(m)))
2644 continue;
2645
2646 unit_add_to_cgroup_realize_queue(m);
2647 }
2648
2649 /* Parent comes after children */
2650 unit_add_to_cgroup_realize_queue(u);
2651
2652 u = UNIT_GET_SLICE(u);
2653 } while (u);
2654 }
2655
2656 int unit_realize_cgroup(Unit *u) {
2657 Unit *slice;
2658
2659 assert(u);
2660
2661 if (!UNIT_HAS_CGROUP_CONTEXT(u))
2662 return 0;
2663
2664 /* So, here's the deal: when realizing the cgroups for this unit, we need to first create all
2665 * parents, but there's more actually: for the weight-based controllers we also need to make sure
2666 * that all our siblings (i.e. units that are in the same slice as we are) have cgroups, too. On the
2667 * other hand, when a controller is removed from realized set, it may become unnecessary in siblings
2668 * and ancestors and they should be (de)realized too.
2669 *
2670 * This call will defer work on the siblings and derealized ancestors to the next event loop
2671 * iteration and synchronously creates the parent cgroups (unit_realize_cgroup_now). */
2672
2673 slice = UNIT_GET_SLICE(u);
2674 if (slice)
2675 unit_add_family_to_cgroup_realize_queue(slice);
2676
2677 /* And realize this one now (and apply the values) */
2678 return unit_realize_cgroup_now(u, manager_state(u->manager));
2679 }
2680
2681 void unit_release_cgroup(Unit *u) {
2682 assert(u);
2683
2684 /* Forgets all cgroup details for this cgroup — but does *not* destroy the cgroup. This is hence OK to call
2685 * when we close down everything for reexecution, where we really want to leave the cgroup in place. */
2686
2687 if (u->cgroup_path) {
2688 (void) hashmap_remove(u->manager->cgroup_unit, u->cgroup_path);
2689 u->cgroup_path = mfree(u->cgroup_path);
2690 }
2691
2692 if (u->cgroup_control_inotify_wd >= 0) {
2693 if (inotify_rm_watch(u->manager->cgroup_inotify_fd, u->cgroup_control_inotify_wd) < 0)
2694 log_unit_debug_errno(u, errno, "Failed to remove cgroup control inotify watch %i for %s, ignoring: %m", u->cgroup_control_inotify_wd, u->id);
2695
2696 (void) hashmap_remove(u->manager->cgroup_control_inotify_wd_unit, INT_TO_PTR(u->cgroup_control_inotify_wd));
2697 u->cgroup_control_inotify_wd = -1;
2698 }
2699
2700 if (u->cgroup_memory_inotify_wd >= 0) {
2701 if (inotify_rm_watch(u->manager->cgroup_inotify_fd, u->cgroup_memory_inotify_wd) < 0)
2702 log_unit_debug_errno(u, errno, "Failed to remove cgroup memory inotify watch %i for %s, ignoring: %m", u->cgroup_memory_inotify_wd, u->id);
2703
2704 (void) hashmap_remove(u->manager->cgroup_memory_inotify_wd_unit, INT_TO_PTR(u->cgroup_memory_inotify_wd));
2705 u->cgroup_memory_inotify_wd = -1;
2706 }
2707 }
2708
2709 bool unit_maybe_release_cgroup(Unit *u) {
2710 int r;
2711
2712 assert(u);
2713
2714 if (!u->cgroup_path)
2715 return true;
2716
2717 /* Don't release the cgroup if there are still processes under it. If we get notified later when all the
2718 * processes exit (e.g. the processes were in D-state and exited after the unit was marked as failed)
2719 * we need the cgroup paths to continue to be tracked by the manager so they can be looked up and cleaned
2720 * up later. */
2721 r = cg_is_empty_recursive(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path);
2722 if (r < 0)
2723 log_unit_debug_errno(u, r, "Error checking if the cgroup is recursively empty, ignoring: %m");
2724 else if (r == 1) {
2725 unit_release_cgroup(u);
2726 return true;
2727 }
2728
2729 return false;
2730 }
2731
2732 void unit_prune_cgroup(Unit *u) {
2733 int r;
2734 bool is_root_slice;
2735
2736 assert(u);
2737
2738 /* Removes the cgroup, if empty and possible, and stops watching it. */
2739
2740 if (!u->cgroup_path)
2741 return;
2742
2743 (void) unit_get_cpu_usage(u, NULL); /* Cache the last CPU usage value before we destroy the cgroup */
2744
2745 #if BPF_FRAMEWORK
2746 (void) lsm_bpf_cleanup(u); /* Remove cgroup from the global LSM BPF map */
2747 #endif
2748
2749 is_root_slice = unit_has_name(u, SPECIAL_ROOT_SLICE);
2750
2751 r = cg_trim_everywhere(u->manager->cgroup_supported, u->cgroup_path, !is_root_slice);
2752 if (r < 0)
2753 /* One reason we could have failed here is, that the cgroup still contains a process.
2754 * However, if the cgroup becomes removable at a later time, it might be removed when
2755 * the containing slice is stopped. So even if we failed now, this unit shouldn't assume
2756 * that the cgroup is still realized the next time it is started. Do not return early
2757 * on error, continue cleanup. */
2758 log_unit_full_errno(u, r == -EBUSY ? LOG_DEBUG : LOG_WARNING, r, "Failed to destroy cgroup %s, ignoring: %m", empty_to_root(u->cgroup_path));
2759
2760 if (is_root_slice)
2761 return;
2762
2763 if (!unit_maybe_release_cgroup(u)) /* Returns true if the cgroup was released */
2764 return;
2765
2766 u->cgroup_realized = false;
2767 u->cgroup_realized_mask = 0;
2768 u->cgroup_enabled_mask = 0;
2769
2770 u->bpf_device_control_installed = bpf_program_free(u->bpf_device_control_installed);
2771 }
2772
2773 int unit_search_main_pid(Unit *u, pid_t *ret) {
2774 _cleanup_fclose_ FILE *f = NULL;
2775 pid_t pid = 0, npid;
2776 int r;
2777
2778 assert(u);
2779 assert(ret);
2780
2781 if (!u->cgroup_path)
2782 return -ENXIO;
2783
2784 r = cg_enumerate_processes(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, &f);
2785 if (r < 0)
2786 return r;
2787
2788 while (cg_read_pid(f, &npid) > 0) {
2789
2790 if (npid == pid)
2791 continue;
2792
2793 if (pid_is_my_child(npid) == 0)
2794 continue;
2795
2796 if (pid != 0)
2797 /* Dang, there's more than one daemonized PID
2798 in this group, so we don't know what process
2799 is the main process. */
2800
2801 return -ENODATA;
2802
2803 pid = npid;
2804 }
2805
2806 *ret = pid;
2807 return 0;
2808 }
2809
2810 static int unit_watch_pids_in_path(Unit *u, const char *path) {
2811 _cleanup_closedir_ DIR *d = NULL;
2812 _cleanup_fclose_ FILE *f = NULL;
2813 int ret = 0, r;
2814
2815 assert(u);
2816 assert(path);
2817
2818 r = cg_enumerate_processes(SYSTEMD_CGROUP_CONTROLLER, path, &f);
2819 if (r < 0)
2820 ret = r;
2821 else {
2822 pid_t pid;
2823
2824 while ((r = cg_read_pid(f, &pid)) > 0) {
2825 r = unit_watch_pid(u, pid, false);
2826 if (r < 0 && ret >= 0)
2827 ret = r;
2828 }
2829
2830 if (r < 0 && ret >= 0)
2831 ret = r;
2832 }
2833
2834 r = cg_enumerate_subgroups(SYSTEMD_CGROUP_CONTROLLER, path, &d);
2835 if (r < 0) {
2836 if (ret >= 0)
2837 ret = r;
2838 } else {
2839 char *fn;
2840
2841 while ((r = cg_read_subgroup(d, &fn)) > 0) {
2842 _cleanup_free_ char *p = NULL;
2843
2844 p = path_join(empty_to_root(path), fn);
2845 free(fn);
2846
2847 if (!p)
2848 return -ENOMEM;
2849
2850 r = unit_watch_pids_in_path(u, p);
2851 if (r < 0 && ret >= 0)
2852 ret = r;
2853 }
2854
2855 if (r < 0 && ret >= 0)
2856 ret = r;
2857 }
2858
2859 return ret;
2860 }
2861
2862 int unit_synthesize_cgroup_empty_event(Unit *u) {
2863 int r;
2864
2865 assert(u);
2866
2867 /* Enqueue a synthetic cgroup empty event if this unit doesn't watch any PIDs anymore. This is compatibility
2868 * support for non-unified systems where notifications aren't reliable, and hence need to take whatever we can
2869 * get as notification source as soon as we stopped having any useful PIDs to watch for. */
2870
2871 if (!u->cgroup_path)
2872 return -ENOENT;
2873
2874 r = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
2875 if (r < 0)
2876 return r;
2877 if (r > 0) /* On unified we have reliable notifications, and don't need this */
2878 return 0;
2879
2880 if (!set_isempty(u->pids))
2881 return 0;
2882
2883 unit_add_to_cgroup_empty_queue(u);
2884 return 0;
2885 }
2886
2887 int unit_watch_all_pids(Unit *u) {
2888 int r;
2889
2890 assert(u);
2891
2892 /* Adds all PIDs from our cgroup to the set of PIDs we
2893 * watch. This is a fallback logic for cases where we do not
2894 * get reliable cgroup empty notifications: we try to use
2895 * SIGCHLD as replacement. */
2896
2897 if (!u->cgroup_path)
2898 return -ENOENT;
2899
2900 r = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
2901 if (r < 0)
2902 return r;
2903 if (r > 0) /* On unified we can use proper notifications */
2904 return 0;
2905
2906 return unit_watch_pids_in_path(u, u->cgroup_path);
2907 }
2908
2909 static int on_cgroup_empty_event(sd_event_source *s, void *userdata) {
2910 Manager *m = userdata;
2911 Unit *u;
2912 int r;
2913
2914 assert(s);
2915 assert(m);
2916
2917 u = m->cgroup_empty_queue;
2918 if (!u)
2919 return 0;
2920
2921 assert(u->in_cgroup_empty_queue);
2922 u->in_cgroup_empty_queue = false;
2923 LIST_REMOVE(cgroup_empty_queue, m->cgroup_empty_queue, u);
2924
2925 if (m->cgroup_empty_queue) {
2926 /* More stuff queued, let's make sure we remain enabled */
2927 r = sd_event_source_set_enabled(s, SD_EVENT_ONESHOT);
2928 if (r < 0)
2929 log_debug_errno(r, "Failed to reenable cgroup empty event source, ignoring: %m");
2930 }
2931
2932 unit_add_to_gc_queue(u);
2933
2934 if (UNIT_VTABLE(u)->notify_cgroup_empty)
2935 UNIT_VTABLE(u)->notify_cgroup_empty(u);
2936
2937 return 0;
2938 }
2939
2940 void unit_add_to_cgroup_empty_queue(Unit *u) {
2941 int r;
2942
2943 assert(u);
2944
2945 /* Note that there are four different ways how cgroup empty events reach us:
2946 *
2947 * 1. On the unified hierarchy we get an inotify event on the cgroup
2948 *
2949 * 2. On the legacy hierarchy, when running in system mode, we get a datagram on the cgroup agent socket
2950 *
2951 * 3. On the legacy hierarchy, when running in user mode, we get a D-Bus signal on the system bus
2952 *
2953 * 4. On the legacy hierarchy, in service units we start watching all processes of the cgroup for SIGCHLD as
2954 * soon as we get one SIGCHLD, to deal with unreliable cgroup notifications.
2955 *
2956 * Regardless which way we got the notification, we'll verify it here, and then add it to a separate
2957 * queue. This queue will be dispatched at a lower priority than the SIGCHLD handler, so that we always use
2958 * SIGCHLD if we can get it first, and only use the cgroup empty notifications if there's no SIGCHLD pending
2959 * (which might happen if the cgroup doesn't contain processes that are our own child, which is typically the
2960 * case for scope units). */
2961
2962 if (u->in_cgroup_empty_queue)
2963 return;
2964
2965 /* Let's verify that the cgroup is really empty */
2966 if (!u->cgroup_path)
2967 return;
2968
2969 r = cg_is_empty_recursive(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path);
2970 if (r < 0) {
2971 log_unit_debug_errno(u, r, "Failed to determine whether cgroup %s is empty: %m", empty_to_root(u->cgroup_path));
2972 return;
2973 }
2974 if (r == 0)
2975 return;
2976
2977 LIST_PREPEND(cgroup_empty_queue, u->manager->cgroup_empty_queue, u);
2978 u->in_cgroup_empty_queue = true;
2979
2980 /* Trigger the defer event */
2981 r = sd_event_source_set_enabled(u->manager->cgroup_empty_event_source, SD_EVENT_ONESHOT);
2982 if (r < 0)
2983 log_debug_errno(r, "Failed to enable cgroup empty event source: %m");
2984 }
2985
2986 static void unit_remove_from_cgroup_empty_queue(Unit *u) {
2987 assert(u);
2988
2989 if (!u->in_cgroup_empty_queue)
2990 return;
2991
2992 LIST_REMOVE(cgroup_empty_queue, u->manager->cgroup_empty_queue, u);
2993 u->in_cgroup_empty_queue = false;
2994 }
2995
2996 int unit_check_oomd_kill(Unit *u) {
2997 _cleanup_free_ char *value = NULL;
2998 bool increased;
2999 uint64_t n = 0;
3000 int r;
3001
3002 if (!u->cgroup_path)
3003 return 0;
3004
3005 r = cg_all_unified();
3006 if (r < 0)
3007 return log_unit_debug_errno(u, r, "Couldn't determine whether we are in all unified mode: %m");
3008 else if (r == 0)
3009 return 0;
3010
3011 r = cg_get_xattr_malloc(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, "user.oomd_kill", &value);
3012 if (r < 0 && r != -ENODATA)
3013 return r;
3014
3015 if (!isempty(value)) {
3016 r = safe_atou64(value, &n);
3017 if (r < 0)
3018 return r;
3019 }
3020
3021 increased = n > u->managed_oom_kill_last;
3022 u->managed_oom_kill_last = n;
3023
3024 if (!increased)
3025 return 0;
3026
3027 if (n > 0)
3028 log_unit_struct(u, LOG_NOTICE,
3029 "MESSAGE_ID=" SD_MESSAGE_UNIT_OOMD_KILL_STR,
3030 LOG_UNIT_INVOCATION_ID(u),
3031 LOG_UNIT_MESSAGE(u, "systemd-oomd killed %"PRIu64" process(es) in this unit.", n));
3032
3033 return 1;
3034 }
3035
3036 int unit_check_oom(Unit *u) {
3037 _cleanup_free_ char *oom_kill = NULL;
3038 bool increased;
3039 uint64_t c;
3040 int r;
3041
3042 if (!u->cgroup_path)
3043 return 0;
3044
3045 r = cg_get_keyed_attribute("memory", u->cgroup_path, "memory.events", STRV_MAKE("oom_kill"), &oom_kill);
3046 if (IN_SET(r, -ENOENT, -ENXIO)) /* Handle gracefully if cgroup or oom_kill attribute don't exist */
3047 c = 0;
3048 else if (r < 0)
3049 return log_unit_debug_errno(u, r, "Failed to read oom_kill field of memory.events cgroup attribute: %m");
3050 else {
3051 r = safe_atou64(oom_kill, &c);
3052 if (r < 0)
3053 return log_unit_debug_errno(u, r, "Failed to parse oom_kill field: %m");
3054 }
3055
3056 increased = c > u->oom_kill_last;
3057 u->oom_kill_last = c;
3058
3059 if (!increased)
3060 return 0;
3061
3062 log_unit_struct(u, LOG_NOTICE,
3063 "MESSAGE_ID=" SD_MESSAGE_UNIT_OUT_OF_MEMORY_STR,
3064 LOG_UNIT_INVOCATION_ID(u),
3065 LOG_UNIT_MESSAGE(u, "A process of this unit has been killed by the OOM killer."));
3066
3067 if (UNIT_VTABLE(u)->notify_cgroup_oom)
3068 UNIT_VTABLE(u)->notify_cgroup_oom(u);
3069
3070 return 1;
3071 }
3072
3073 static int on_cgroup_oom_event(sd_event_source *s, void *userdata) {
3074 Manager *m = userdata;
3075 Unit *u;
3076 int r;
3077
3078 assert(s);
3079 assert(m);
3080
3081 u = m->cgroup_oom_queue;
3082 if (!u)
3083 return 0;
3084
3085 assert(u->in_cgroup_oom_queue);
3086 u->in_cgroup_oom_queue = false;
3087 LIST_REMOVE(cgroup_oom_queue, m->cgroup_oom_queue, u);
3088
3089 if (m->cgroup_oom_queue) {
3090 /* More stuff queued, let's make sure we remain enabled */
3091 r = sd_event_source_set_enabled(s, SD_EVENT_ONESHOT);
3092 if (r < 0)
3093 log_debug_errno(r, "Failed to reenable cgroup oom event source, ignoring: %m");
3094 }
3095
3096 (void) unit_check_oom(u);
3097 return 0;
3098 }
3099
3100 static void unit_add_to_cgroup_oom_queue(Unit *u) {
3101 int r;
3102
3103 assert(u);
3104
3105 if (u->in_cgroup_oom_queue)
3106 return;
3107 if (!u->cgroup_path)
3108 return;
3109
3110 LIST_PREPEND(cgroup_oom_queue, u->manager->cgroup_oom_queue, u);
3111 u->in_cgroup_oom_queue = true;
3112
3113 /* Trigger the defer event */
3114 if (!u->manager->cgroup_oom_event_source) {
3115 _cleanup_(sd_event_source_unrefp) sd_event_source *s = NULL;
3116
3117 r = sd_event_add_defer(u->manager->event, &s, on_cgroup_oom_event, u->manager);
3118 if (r < 0) {
3119 log_error_errno(r, "Failed to create cgroup oom event source: %m");
3120 return;
3121 }
3122
3123 r = sd_event_source_set_priority(s, SD_EVENT_PRIORITY_NORMAL-8);
3124 if (r < 0) {
3125 log_error_errno(r, "Failed to set priority of cgroup oom event source: %m");
3126 return;
3127 }
3128
3129 (void) sd_event_source_set_description(s, "cgroup-oom");
3130 u->manager->cgroup_oom_event_source = TAKE_PTR(s);
3131 }
3132
3133 r = sd_event_source_set_enabled(u->manager->cgroup_oom_event_source, SD_EVENT_ONESHOT);
3134 if (r < 0)
3135 log_error_errno(r, "Failed to enable cgroup oom event source: %m");
3136 }
3137
3138 static int unit_check_cgroup_events(Unit *u) {
3139 char *values[2] = {};
3140 int r;
3141
3142 assert(u);
3143
3144 if (!u->cgroup_path)
3145 return 0;
3146
3147 r = cg_get_keyed_attribute_graceful(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, "cgroup.events",
3148 STRV_MAKE("populated", "frozen"), values);
3149 if (r < 0)
3150 return r;
3151
3152 /* The cgroup.events notifications can be merged together so act as we saw the given state for the
3153 * first time. The functions we call to handle given state are idempotent, which makes them
3154 * effectively remember the previous state. */
3155 if (values[0]) {
3156 if (streq(values[0], "1"))
3157 unit_remove_from_cgroup_empty_queue(u);
3158 else
3159 unit_add_to_cgroup_empty_queue(u);
3160 }
3161
3162 /* Disregard freezer state changes due to operations not initiated by us */
3163 if (values[1] && IN_SET(u->freezer_state, FREEZER_FREEZING, FREEZER_THAWING)) {
3164 if (streq(values[1], "0"))
3165 unit_thawed(u);
3166 else
3167 unit_frozen(u);
3168 }
3169
3170 free(values[0]);
3171 free(values[1]);
3172
3173 return 0;
3174 }
3175
3176 static int on_cgroup_inotify_event(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
3177 Manager *m = userdata;
3178
3179 assert(s);
3180 assert(fd >= 0);
3181 assert(m);
3182
3183 for (;;) {
3184 union inotify_event_buffer buffer;
3185 struct inotify_event *e;
3186 ssize_t l;
3187
3188 l = read(fd, &buffer, sizeof(buffer));
3189 if (l < 0) {
3190 if (IN_SET(errno, EINTR, EAGAIN))
3191 return 0;
3192
3193 return log_error_errno(errno, "Failed to read control group inotify events: %m");
3194 }
3195
3196 FOREACH_INOTIFY_EVENT(e, buffer, l) {
3197 Unit *u;
3198
3199 if (e->wd < 0)
3200 /* Queue overflow has no watch descriptor */
3201 continue;
3202
3203 if (e->mask & IN_IGNORED)
3204 /* The watch was just removed */
3205 continue;
3206
3207 /* Note that inotify might deliver events for a watch even after it was removed,
3208 * because it was queued before the removal. Let's ignore this here safely. */
3209
3210 u = hashmap_get(m->cgroup_control_inotify_wd_unit, INT_TO_PTR(e->wd));
3211 if (u)
3212 unit_check_cgroup_events(u);
3213
3214 u = hashmap_get(m->cgroup_memory_inotify_wd_unit, INT_TO_PTR(e->wd));
3215 if (u)
3216 unit_add_to_cgroup_oom_queue(u);
3217 }
3218 }
3219 }
3220
3221 static int cg_bpf_mask_supported(CGroupMask *ret) {
3222 CGroupMask mask = 0;
3223 int r;
3224
3225 /* BPF-based firewall */
3226 r = bpf_firewall_supported();
3227 if (r > 0)
3228 mask |= CGROUP_MASK_BPF_FIREWALL;
3229
3230 /* BPF-based device access control */
3231 r = bpf_devices_supported();
3232 if (r > 0)
3233 mask |= CGROUP_MASK_BPF_DEVICES;
3234
3235 /* BPF pinned prog */
3236 r = bpf_foreign_supported();
3237 if (r > 0)
3238 mask |= CGROUP_MASK_BPF_FOREIGN;
3239
3240 /* BPF-based bind{4|6} hooks */
3241 r = bpf_socket_bind_supported();
3242 if (r > 0)
3243 mask |= CGROUP_MASK_BPF_SOCKET_BIND;
3244
3245 /* BPF-based cgroup_skb/{egress|ingress} hooks */
3246 r = restrict_network_interfaces_supported();
3247 if (r > 0)
3248 mask |= CGROUP_MASK_BPF_RESTRICT_NETWORK_INTERFACES;
3249
3250 *ret = mask;
3251 return 0;
3252 }
3253
3254 int manager_setup_cgroup(Manager *m) {
3255 _cleanup_free_ char *path = NULL;
3256 const char *scope_path;
3257 int r, all_unified;
3258 CGroupMask mask;
3259 char *e;
3260
3261 assert(m);
3262
3263 /* 1. Determine hierarchy */
3264 m->cgroup_root = mfree(m->cgroup_root);
3265 r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, 0, &m->cgroup_root);
3266 if (r < 0)
3267 return log_error_errno(r, "Cannot determine cgroup we are running in: %m");
3268
3269 /* Chop off the init scope, if we are already located in it */
3270 e = endswith(m->cgroup_root, "/" SPECIAL_INIT_SCOPE);
3271
3272 /* LEGACY: Also chop off the system slice if we are in
3273 * it. This is to support live upgrades from older systemd
3274 * versions where PID 1 was moved there. Also see
3275 * cg_get_root_path(). */
3276 if (!e && MANAGER_IS_SYSTEM(m)) {
3277 e = endswith(m->cgroup_root, "/" SPECIAL_SYSTEM_SLICE);
3278 if (!e)
3279 e = endswith(m->cgroup_root, "/system"); /* even more legacy */
3280 }
3281 if (e)
3282 *e = 0;
3283
3284 /* And make sure to store away the root value without trailing slash, even for the root dir, so that we can
3285 * easily prepend it everywhere. */
3286 delete_trailing_chars(m->cgroup_root, "/");
3287
3288 /* 2. Show data */
3289 r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, m->cgroup_root, NULL, &path);
3290 if (r < 0)
3291 return log_error_errno(r, "Cannot find cgroup mount point: %m");
3292
3293 r = cg_unified();
3294 if (r < 0)
3295 return log_error_errno(r, "Couldn't determine if we are running in the unified hierarchy: %m");
3296
3297 all_unified = cg_all_unified();
3298 if (all_unified < 0)
3299 return log_error_errno(all_unified, "Couldn't determine whether we are in all unified mode: %m");
3300 if (all_unified > 0)
3301 log_debug("Unified cgroup hierarchy is located at %s.", path);
3302 else {
3303 r = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
3304 if (r < 0)
3305 return log_error_errno(r, "Failed to determine whether systemd's own controller is in unified mode: %m");
3306 if (r > 0)
3307 log_debug("Unified cgroup hierarchy is located at %s. Controllers are on legacy hierarchies.", path);
3308 else
3309 log_debug("Using cgroup controller " SYSTEMD_CGROUP_CONTROLLER_LEGACY ". File system hierarchy is at %s.", path);
3310 }
3311
3312 /* 3. Allocate cgroup empty defer event source */
3313 m->cgroup_empty_event_source = sd_event_source_disable_unref(m->cgroup_empty_event_source);
3314 r = sd_event_add_defer(m->event, &m->cgroup_empty_event_source, on_cgroup_empty_event, m);
3315 if (r < 0)
3316 return log_error_errno(r, "Failed to create cgroup empty event source: %m");
3317
3318 /* Schedule cgroup empty checks early, but after having processed service notification messages or
3319 * SIGCHLD signals, so that a cgroup running empty is always just the last safety net of
3320 * notification, and we collected the metadata the notification and SIGCHLD stuff offers first. */
3321 r = sd_event_source_set_priority(m->cgroup_empty_event_source, SD_EVENT_PRIORITY_NORMAL-5);
3322 if (r < 0)
3323 return log_error_errno(r, "Failed to set priority of cgroup empty event source: %m");
3324
3325 r = sd_event_source_set_enabled(m->cgroup_empty_event_source, SD_EVENT_OFF);
3326 if (r < 0)
3327 return log_error_errno(r, "Failed to disable cgroup empty event source: %m");
3328
3329 (void) sd_event_source_set_description(m->cgroup_empty_event_source, "cgroup-empty");
3330
3331 /* 4. Install notifier inotify object, or agent */
3332 if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0) {
3333
3334 /* In the unified hierarchy we can get cgroup empty notifications via inotify. */
3335
3336 m->cgroup_inotify_event_source = sd_event_source_disable_unref(m->cgroup_inotify_event_source);
3337 safe_close(m->cgroup_inotify_fd);
3338
3339 m->cgroup_inotify_fd = inotify_init1(IN_NONBLOCK|IN_CLOEXEC);
3340 if (m->cgroup_inotify_fd < 0)
3341 return log_error_errno(errno, "Failed to create control group inotify object: %m");
3342
3343 r = sd_event_add_io(m->event, &m->cgroup_inotify_event_source, m->cgroup_inotify_fd, EPOLLIN, on_cgroup_inotify_event, m);
3344 if (r < 0)
3345 return log_error_errno(r, "Failed to watch control group inotify object: %m");
3346
3347 /* Process cgroup empty notifications early. Note that when this event is dispatched it'll
3348 * just add the unit to a cgroup empty queue, hence let's run earlier than that. Also see
3349 * handling of cgroup agent notifications, for the classic cgroup hierarchy support. */
3350 r = sd_event_source_set_priority(m->cgroup_inotify_event_source, SD_EVENT_PRIORITY_NORMAL-9);
3351 if (r < 0)
3352 return log_error_errno(r, "Failed to set priority of inotify event source: %m");
3353
3354 (void) sd_event_source_set_description(m->cgroup_inotify_event_source, "cgroup-inotify");
3355
3356 } else if (MANAGER_IS_SYSTEM(m) && manager_owns_host_root_cgroup(m) && !MANAGER_IS_TEST_RUN(m)) {
3357
3358 /* On the legacy hierarchy we only get notifications via cgroup agents. (Which isn't really reliable,
3359 * since it does not generate events when control groups with children run empty. */
3360
3361 r = cg_install_release_agent(SYSTEMD_CGROUP_CONTROLLER, SYSTEMD_CGROUPS_AGENT_PATH);
3362 if (r < 0)
3363 log_warning_errno(r, "Failed to install release agent, ignoring: %m");
3364 else if (r > 0)
3365 log_debug("Installed release agent.");
3366 else if (r == 0)
3367 log_debug("Release agent already installed.");
3368 }
3369
3370 /* 5. Make sure we are in the special "init.scope" unit in the root slice. */
3371 scope_path = strjoina(m->cgroup_root, "/" SPECIAL_INIT_SCOPE);
3372 r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, scope_path, 0);
3373 if (r >= 0) {
3374 /* Also, move all other userspace processes remaining in the root cgroup into that scope. */
3375 r = cg_migrate(SYSTEMD_CGROUP_CONTROLLER, m->cgroup_root, SYSTEMD_CGROUP_CONTROLLER, scope_path, 0);
3376 if (r < 0)
3377 log_warning_errno(r, "Couldn't move remaining userspace processes, ignoring: %m");
3378
3379 /* 6. And pin it, so that it cannot be unmounted */
3380 safe_close(m->pin_cgroupfs_fd);
3381 m->pin_cgroupfs_fd = open(path, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY|O_NONBLOCK);
3382 if (m->pin_cgroupfs_fd < 0)
3383 return log_error_errno(errno, "Failed to open pin file: %m");
3384
3385 } else if (!MANAGER_IS_TEST_RUN(m))
3386 return log_error_errno(r, "Failed to create %s control group: %m", scope_path);
3387
3388 /* 7. Always enable hierarchical support if it exists... */
3389 if (!all_unified && !MANAGER_IS_TEST_RUN(m))
3390 (void) cg_set_attribute("memory", "/", "memory.use_hierarchy", "1");
3391
3392 /* 8. Figure out which controllers are supported */
3393 r = cg_mask_supported_subtree(m->cgroup_root, &m->cgroup_supported);
3394 if (r < 0)
3395 return log_error_errno(r, "Failed to determine supported controllers: %m");
3396
3397 /* 9. Figure out which bpf-based pseudo-controllers are supported */
3398 r = cg_bpf_mask_supported(&mask);
3399 if (r < 0)
3400 return log_error_errno(r, "Failed to determine supported bpf-based pseudo-controllers: %m");
3401 m->cgroup_supported |= mask;
3402
3403 /* 10. Log which controllers are supported */
3404 for (CGroupController c = 0; c < _CGROUP_CONTROLLER_MAX; c++)
3405 log_debug("Controller '%s' supported: %s", cgroup_controller_to_string(c),
3406 yes_no(m->cgroup_supported & CGROUP_CONTROLLER_TO_MASK(c)));
3407
3408 return 0;
3409 }
3410
3411 void manager_shutdown_cgroup(Manager *m, bool delete) {
3412 assert(m);
3413
3414 /* We can't really delete the group, since we are in it. But
3415 * let's trim it. */
3416 if (delete && m->cgroup_root && !FLAGS_SET(m->test_run_flags, MANAGER_TEST_RUN_MINIMAL))
3417 (void) cg_trim(SYSTEMD_CGROUP_CONTROLLER, m->cgroup_root, false);
3418
3419 m->cgroup_empty_event_source = sd_event_source_disable_unref(m->cgroup_empty_event_source);
3420
3421 m->cgroup_control_inotify_wd_unit = hashmap_free(m->cgroup_control_inotify_wd_unit);
3422 m->cgroup_memory_inotify_wd_unit = hashmap_free(m->cgroup_memory_inotify_wd_unit);
3423
3424 m->cgroup_inotify_event_source = sd_event_source_disable_unref(m->cgroup_inotify_event_source);
3425 m->cgroup_inotify_fd = safe_close(m->cgroup_inotify_fd);
3426
3427 m->pin_cgroupfs_fd = safe_close(m->pin_cgroupfs_fd);
3428
3429 m->cgroup_root = mfree(m->cgroup_root);
3430 }
3431
3432 Unit* manager_get_unit_by_cgroup(Manager *m, const char *cgroup) {
3433 char *p;
3434 Unit *u;
3435
3436 assert(m);
3437 assert(cgroup);
3438
3439 u = hashmap_get(m->cgroup_unit, cgroup);
3440 if (u)
3441 return u;
3442
3443 p = strdupa_safe(cgroup);
3444 for (;;) {
3445 char *e;
3446
3447 e = strrchr(p, '/');
3448 if (!e || e == p)
3449 return hashmap_get(m->cgroup_unit, SPECIAL_ROOT_SLICE);
3450
3451 *e = 0;
3452
3453 u = hashmap_get(m->cgroup_unit, p);
3454 if (u)
3455 return u;
3456 }
3457 }
3458
3459 Unit *manager_get_unit_by_pid_cgroup(Manager *m, pid_t pid) {
3460 _cleanup_free_ char *cgroup = NULL;
3461
3462 assert(m);
3463
3464 if (!pid_is_valid(pid))
3465 return NULL;
3466
3467 if (cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, pid, &cgroup) < 0)
3468 return NULL;
3469
3470 return manager_get_unit_by_cgroup(m, cgroup);
3471 }
3472
3473 Unit *manager_get_unit_by_pid(Manager *m, pid_t pid) {
3474 Unit *u, **array;
3475
3476 assert(m);
3477
3478 /* Note that a process might be owned by multiple units, we return only one here, which is good enough for most
3479 * cases, though not strictly correct. We prefer the one reported by cgroup membership, as that's the most
3480 * relevant one as children of the process will be assigned to that one, too, before all else. */
3481
3482 if (!pid_is_valid(pid))
3483 return NULL;
3484
3485 if (pid == getpid_cached())
3486 return hashmap_get(m->units, SPECIAL_INIT_SCOPE);
3487
3488 u = manager_get_unit_by_pid_cgroup(m, pid);
3489 if (u)
3490 return u;
3491
3492 u = hashmap_get(m->watch_pids, PID_TO_PTR(pid));
3493 if (u)
3494 return u;
3495
3496 array = hashmap_get(m->watch_pids, PID_TO_PTR(-pid));
3497 if (array)
3498 return array[0];
3499
3500 return NULL;
3501 }
3502
3503 int manager_notify_cgroup_empty(Manager *m, const char *cgroup) {
3504 Unit *u;
3505
3506 assert(m);
3507 assert(cgroup);
3508
3509 /* Called on the legacy hierarchy whenever we get an explicit cgroup notification from the cgroup agent process
3510 * or from the --system instance */
3511
3512 log_debug("Got cgroup empty notification for: %s", cgroup);
3513
3514 u = manager_get_unit_by_cgroup(m, cgroup);
3515 if (!u)
3516 return 0;
3517
3518 unit_add_to_cgroup_empty_queue(u);
3519 return 1;
3520 }
3521
3522 int unit_get_memory_available(Unit *u, uint64_t *ret) {
3523 uint64_t unit_current, available = UINT64_MAX;
3524 CGroupContext *unit_context;
3525 const char *memory_file;
3526 int r;
3527
3528 assert(u);
3529 assert(ret);
3530
3531 /* If data from cgroups can be accessed, try to find out how much more memory a unit can
3532 * claim before hitting the configured cgroup limits (if any). Consider both MemoryHigh
3533 * and MemoryMax, and also any slice the unit might be nested below. */
3534
3535 if (!UNIT_CGROUP_BOOL(u, memory_accounting))
3536 return -ENODATA;
3537
3538 if (!u->cgroup_path)
3539 return -ENODATA;
3540
3541 /* The root cgroup doesn't expose this information */
3542 if (unit_has_host_root_cgroup(u))
3543 return -ENODATA;
3544
3545 if ((u->cgroup_realized_mask & CGROUP_MASK_MEMORY) == 0)
3546 return -ENODATA;
3547
3548 r = cg_all_unified();
3549 if (r < 0)
3550 return r;
3551 memory_file = r > 0 ? "memory.current" : "memory.usage_in_bytes";
3552
3553 r = cg_get_attribute_as_uint64("memory", u->cgroup_path, memory_file, &unit_current);
3554 if (r < 0)
3555 return r;
3556
3557 assert_se(unit_context = unit_get_cgroup_context(u));
3558
3559 if (unit_context->memory_max != UINT64_MAX || unit_context->memory_high != UINT64_MAX)
3560 available = LESS_BY(MIN(unit_context->memory_max, unit_context->memory_high), unit_current);
3561
3562 for (Unit *slice = UNIT_GET_SLICE(u); slice; slice = UNIT_GET_SLICE(slice)) {
3563 uint64_t slice_current, slice_available = UINT64_MAX;
3564 CGroupContext *slice_context;
3565
3566 /* No point in continuing if we can't go any lower */
3567 if (available == 0)
3568 break;
3569
3570 if (!slice->cgroup_path)
3571 continue;
3572
3573 slice_context = unit_get_cgroup_context(slice);
3574 if (!slice_context)
3575 continue;
3576
3577 if (slice_context->memory_max == UINT64_MAX && slice_context->memory_high == UINT64_MAX)
3578 continue;
3579
3580 r = cg_get_attribute_as_uint64("memory", slice->cgroup_path, memory_file, &slice_current);
3581 if (r < 0)
3582 continue;
3583
3584 slice_available = LESS_BY(MIN(slice_context->memory_max, slice_context->memory_high), slice_current);
3585 available = MIN(slice_available, available);
3586 }
3587
3588 *ret = available;
3589
3590 return 0;
3591 }
3592
3593 int unit_get_memory_current(Unit *u, uint64_t *ret) {
3594 int r;
3595
3596 assert(u);
3597 assert(ret);
3598
3599 if (!UNIT_CGROUP_BOOL(u, memory_accounting))
3600 return -ENODATA;
3601
3602 if (!u->cgroup_path)
3603 return -ENODATA;
3604
3605 /* The root cgroup doesn't expose this information, let's get it from /proc instead */
3606 if (unit_has_host_root_cgroup(u))
3607 return procfs_memory_get_used(ret);
3608
3609 if ((u->cgroup_realized_mask & CGROUP_MASK_MEMORY) == 0)
3610 return -ENODATA;
3611
3612 r = cg_all_unified();
3613 if (r < 0)
3614 return r;
3615
3616 return cg_get_attribute_as_uint64("memory", u->cgroup_path, r > 0 ? "memory.current" : "memory.usage_in_bytes", ret);
3617 }
3618
3619 int unit_get_tasks_current(Unit *u, uint64_t *ret) {
3620 assert(u);
3621 assert(ret);
3622
3623 if (!UNIT_CGROUP_BOOL(u, tasks_accounting))
3624 return -ENODATA;
3625
3626 if (!u->cgroup_path)
3627 return -ENODATA;
3628
3629 /* The root cgroup doesn't expose this information, let's get it from /proc instead */
3630 if (unit_has_host_root_cgroup(u))
3631 return procfs_tasks_get_current(ret);
3632
3633 if ((u->cgroup_realized_mask & CGROUP_MASK_PIDS) == 0)
3634 return -ENODATA;
3635
3636 return cg_get_attribute_as_uint64("pids", u->cgroup_path, "pids.current", ret);
3637 }
3638
3639 static int unit_get_cpu_usage_raw(Unit *u, nsec_t *ret) {
3640 uint64_t ns;
3641 int r;
3642
3643 assert(u);
3644 assert(ret);
3645
3646 if (!u->cgroup_path)
3647 return -ENODATA;
3648
3649 /* The root cgroup doesn't expose this information, let's get it from /proc instead */
3650 if (unit_has_host_root_cgroup(u))
3651 return procfs_cpu_get_usage(ret);
3652
3653 /* Requisite controllers for CPU accounting are not enabled */
3654 if ((get_cpu_accounting_mask() & ~u->cgroup_realized_mask) != 0)
3655 return -ENODATA;
3656
3657 r = cg_all_unified();
3658 if (r < 0)
3659 return r;
3660 if (r > 0) {
3661 _cleanup_free_ char *val = NULL;
3662 uint64_t us;
3663
3664 r = cg_get_keyed_attribute("cpu", u->cgroup_path, "cpu.stat", STRV_MAKE("usage_usec"), &val);
3665 if (IN_SET(r, -ENOENT, -ENXIO))
3666 return -ENODATA;
3667 if (r < 0)
3668 return r;
3669
3670 r = safe_atou64(val, &us);
3671 if (r < 0)
3672 return r;
3673
3674 ns = us * NSEC_PER_USEC;
3675 } else
3676 return cg_get_attribute_as_uint64("cpuacct", u->cgroup_path, "cpuacct.usage", ret);
3677
3678 *ret = ns;
3679 return 0;
3680 }
3681
3682 int unit_get_cpu_usage(Unit *u, nsec_t *ret) {
3683 nsec_t ns;
3684 int r;
3685
3686 assert(u);
3687
3688 /* Retrieve the current CPU usage counter. This will subtract the CPU counter taken when the unit was
3689 * started. If the cgroup has been removed already, returns the last cached value. To cache the value, simply
3690 * call this function with a NULL return value. */
3691
3692 if (!UNIT_CGROUP_BOOL(u, cpu_accounting))
3693 return -ENODATA;
3694
3695 r = unit_get_cpu_usage_raw(u, &ns);
3696 if (r == -ENODATA && u->cpu_usage_last != NSEC_INFINITY) {
3697 /* If we can't get the CPU usage anymore (because the cgroup was already removed, for example), use our
3698 * cached value. */
3699
3700 if (ret)
3701 *ret = u->cpu_usage_last;
3702 return 0;
3703 }
3704 if (r < 0)
3705 return r;
3706
3707 if (ns > u->cpu_usage_base)
3708 ns -= u->cpu_usage_base;
3709 else
3710 ns = 0;
3711
3712 u->cpu_usage_last = ns;
3713 if (ret)
3714 *ret = ns;
3715
3716 return 0;
3717 }
3718
3719 int unit_get_ip_accounting(
3720 Unit *u,
3721 CGroupIPAccountingMetric metric,
3722 uint64_t *ret) {
3723
3724 uint64_t value;
3725 int fd, r;
3726
3727 assert(u);
3728 assert(metric >= 0);
3729 assert(metric < _CGROUP_IP_ACCOUNTING_METRIC_MAX);
3730 assert(ret);
3731
3732 if (!UNIT_CGROUP_BOOL(u, ip_accounting))
3733 return -ENODATA;
3734
3735 fd = IN_SET(metric, CGROUP_IP_INGRESS_BYTES, CGROUP_IP_INGRESS_PACKETS) ?
3736 u->ip_accounting_ingress_map_fd :
3737 u->ip_accounting_egress_map_fd;
3738 if (fd < 0)
3739 return -ENODATA;
3740
3741 if (IN_SET(metric, CGROUP_IP_INGRESS_BYTES, CGROUP_IP_EGRESS_BYTES))
3742 r = bpf_firewall_read_accounting(fd, &value, NULL);
3743 else
3744 r = bpf_firewall_read_accounting(fd, NULL, &value);
3745 if (r < 0)
3746 return r;
3747
3748 /* Add in additional metrics from a previous runtime. Note that when reexecing/reloading the daemon we compile
3749 * all BPF programs and maps anew, but serialize the old counters. When deserializing we store them in the
3750 * ip_accounting_extra[] field, and add them in here transparently. */
3751
3752 *ret = value + u->ip_accounting_extra[metric];
3753
3754 return r;
3755 }
3756
3757 static int unit_get_io_accounting_raw(Unit *u, uint64_t ret[static _CGROUP_IO_ACCOUNTING_METRIC_MAX]) {
3758 static const char *const field_names[_CGROUP_IO_ACCOUNTING_METRIC_MAX] = {
3759 [CGROUP_IO_READ_BYTES] = "rbytes=",
3760 [CGROUP_IO_WRITE_BYTES] = "wbytes=",
3761 [CGROUP_IO_READ_OPERATIONS] = "rios=",
3762 [CGROUP_IO_WRITE_OPERATIONS] = "wios=",
3763 };
3764 uint64_t acc[_CGROUP_IO_ACCOUNTING_METRIC_MAX] = {};
3765 _cleanup_free_ char *path = NULL;
3766 _cleanup_fclose_ FILE *f = NULL;
3767 int r;
3768
3769 assert(u);
3770
3771 if (!u->cgroup_path)
3772 return -ENODATA;
3773
3774 if (unit_has_host_root_cgroup(u))
3775 return -ENODATA; /* TODO: return useful data for the top-level cgroup */
3776
3777 r = cg_all_unified();
3778 if (r < 0)
3779 return r;
3780 if (r == 0) /* TODO: support cgroupv1 */
3781 return -ENODATA;
3782
3783 if (!FLAGS_SET(u->cgroup_realized_mask, CGROUP_MASK_IO))
3784 return -ENODATA;
3785
3786 r = cg_get_path("io", u->cgroup_path, "io.stat", &path);
3787 if (r < 0)
3788 return r;
3789
3790 f = fopen(path, "re");
3791 if (!f)
3792 return -errno;
3793
3794 for (;;) {
3795 _cleanup_free_ char *line = NULL;
3796 const char *p;
3797
3798 r = read_line(f, LONG_LINE_MAX, &line);
3799 if (r < 0)
3800 return r;
3801 if (r == 0)
3802 break;
3803
3804 p = line;
3805 p += strcspn(p, WHITESPACE); /* Skip over device major/minor */
3806 p += strspn(p, WHITESPACE); /* Skip over following whitespace */
3807
3808 for (;;) {
3809 _cleanup_free_ char *word = NULL;
3810
3811 r = extract_first_word(&p, &word, NULL, EXTRACT_RETAIN_ESCAPE);
3812 if (r < 0)
3813 return r;
3814 if (r == 0)
3815 break;
3816
3817 for (CGroupIOAccountingMetric i = 0; i < _CGROUP_IO_ACCOUNTING_METRIC_MAX; i++) {
3818 const char *x;
3819
3820 x = startswith(word, field_names[i]);
3821 if (x) {
3822 uint64_t w;
3823
3824 r = safe_atou64(x, &w);
3825 if (r < 0)
3826 return r;
3827
3828 /* Sum up the stats of all devices */
3829 acc[i] += w;
3830 break;
3831 }
3832 }
3833 }
3834 }
3835
3836 memcpy(ret, acc, sizeof(acc));
3837 return 0;
3838 }
3839
3840 int unit_get_io_accounting(
3841 Unit *u,
3842 CGroupIOAccountingMetric metric,
3843 bool allow_cache,
3844 uint64_t *ret) {
3845
3846 uint64_t raw[_CGROUP_IO_ACCOUNTING_METRIC_MAX];
3847 int r;
3848
3849 /* Retrieve an IO account parameter. This will subtract the counter when the unit was started. */
3850
3851 if (!UNIT_CGROUP_BOOL(u, io_accounting))
3852 return -ENODATA;
3853
3854 if (allow_cache && u->io_accounting_last[metric] != UINT64_MAX)
3855 goto done;
3856
3857 r = unit_get_io_accounting_raw(u, raw);
3858 if (r == -ENODATA && u->io_accounting_last[metric] != UINT64_MAX)
3859 goto done;
3860 if (r < 0)
3861 return r;
3862
3863 for (CGroupIOAccountingMetric i = 0; i < _CGROUP_IO_ACCOUNTING_METRIC_MAX; i++) {
3864 /* Saturated subtraction */
3865 if (raw[i] > u->io_accounting_base[i])
3866 u->io_accounting_last[i] = raw[i] - u->io_accounting_base[i];
3867 else
3868 u->io_accounting_last[i] = 0;
3869 }
3870
3871 done:
3872 if (ret)
3873 *ret = u->io_accounting_last[metric];
3874
3875 return 0;
3876 }
3877
3878 int unit_reset_cpu_accounting(Unit *u) {
3879 int r;
3880
3881 assert(u);
3882
3883 u->cpu_usage_last = NSEC_INFINITY;
3884
3885 r = unit_get_cpu_usage_raw(u, &u->cpu_usage_base);
3886 if (r < 0) {
3887 u->cpu_usage_base = 0;
3888 return r;
3889 }
3890
3891 return 0;
3892 }
3893
3894 int unit_reset_ip_accounting(Unit *u) {
3895 int r = 0, q = 0;
3896
3897 assert(u);
3898
3899 if (u->ip_accounting_ingress_map_fd >= 0)
3900 r = bpf_firewall_reset_accounting(u->ip_accounting_ingress_map_fd);
3901
3902 if (u->ip_accounting_egress_map_fd >= 0)
3903 q = bpf_firewall_reset_accounting(u->ip_accounting_egress_map_fd);
3904
3905 zero(u->ip_accounting_extra);
3906
3907 return r < 0 ? r : q;
3908 }
3909
3910 int unit_reset_io_accounting(Unit *u) {
3911 int r;
3912
3913 assert(u);
3914
3915 for (CGroupIOAccountingMetric i = 0; i < _CGROUP_IO_ACCOUNTING_METRIC_MAX; i++)
3916 u->io_accounting_last[i] = UINT64_MAX;
3917
3918 r = unit_get_io_accounting_raw(u, u->io_accounting_base);
3919 if (r < 0) {
3920 zero(u->io_accounting_base);
3921 return r;
3922 }
3923
3924 return 0;
3925 }
3926
3927 int unit_reset_accounting(Unit *u) {
3928 int r, q, v;
3929
3930 assert(u);
3931
3932 r = unit_reset_cpu_accounting(u);
3933 q = unit_reset_io_accounting(u);
3934 v = unit_reset_ip_accounting(u);
3935
3936 return r < 0 ? r : q < 0 ? q : v;
3937 }
3938
3939 void unit_invalidate_cgroup(Unit *u, CGroupMask m) {
3940 assert(u);
3941
3942 if (!UNIT_HAS_CGROUP_CONTEXT(u))
3943 return;
3944
3945 if (m == 0)
3946 return;
3947
3948 /* always invalidate compat pairs together */
3949 if (m & (CGROUP_MASK_IO | CGROUP_MASK_BLKIO))
3950 m |= CGROUP_MASK_IO | CGROUP_MASK_BLKIO;
3951
3952 if (m & (CGROUP_MASK_CPU | CGROUP_MASK_CPUACCT))
3953 m |= CGROUP_MASK_CPU | CGROUP_MASK_CPUACCT;
3954
3955 if (FLAGS_SET(u->cgroup_invalidated_mask, m)) /* NOP? */
3956 return;
3957
3958 u->cgroup_invalidated_mask |= m;
3959 unit_add_to_cgroup_realize_queue(u);
3960 }
3961
3962 void unit_invalidate_cgroup_bpf(Unit *u) {
3963 assert(u);
3964
3965 if (!UNIT_HAS_CGROUP_CONTEXT(u))
3966 return;
3967
3968 if (u->cgroup_invalidated_mask & CGROUP_MASK_BPF_FIREWALL) /* NOP? */
3969 return;
3970
3971 u->cgroup_invalidated_mask |= CGROUP_MASK_BPF_FIREWALL;
3972 unit_add_to_cgroup_realize_queue(u);
3973
3974 /* If we are a slice unit, we also need to put compile a new BPF program for all our children, as the IP access
3975 * list of our children includes our own. */
3976 if (u->type == UNIT_SLICE) {
3977 Unit *member;
3978
3979 UNIT_FOREACH_DEPENDENCY(member, u, UNIT_ATOM_SLICE_OF)
3980 unit_invalidate_cgroup_bpf(member);
3981 }
3982 }
3983
3984 void unit_cgroup_catchup(Unit *u) {
3985 assert(u);
3986
3987 if (!UNIT_HAS_CGROUP_CONTEXT(u))
3988 return;
3989
3990 /* We dropped the inotify watch during reexec/reload, so we need to
3991 * check these as they may have changed.
3992 * Note that (currently) the kernel doesn't actually update cgroup
3993 * file modification times, so we can't just serialize and then check
3994 * the mtime for file(s) we are interested in. */
3995 (void) unit_check_cgroup_events(u);
3996 unit_add_to_cgroup_oom_queue(u);
3997 }
3998
3999 bool unit_cgroup_delegate(Unit *u) {
4000 CGroupContext *c;
4001
4002 assert(u);
4003
4004 if (!UNIT_VTABLE(u)->can_delegate)
4005 return false;
4006
4007 c = unit_get_cgroup_context(u);
4008 if (!c)
4009 return false;
4010
4011 return c->delegate;
4012 }
4013
4014 void manager_invalidate_startup_units(Manager *m) {
4015 Unit *u;
4016
4017 assert(m);
4018
4019 SET_FOREACH(u, m->startup_units)
4020 unit_invalidate_cgroup(u, CGROUP_MASK_CPU|CGROUP_MASK_IO|CGROUP_MASK_BLKIO|CGROUP_MASK_CPUSET);
4021 }
4022
4023 static int unit_get_nice(Unit *u) {
4024 ExecContext *ec;
4025
4026 ec = unit_get_exec_context(u);
4027 return ec ? ec->nice : 0;
4028 }
4029
4030 static uint64_t unit_get_cpu_weight(Unit *u) {
4031 ManagerState state = manager_state(u->manager);
4032 CGroupContext *cc;
4033
4034 cc = unit_get_cgroup_context(u);
4035 return cc ? cgroup_context_cpu_weight(cc, state) : CGROUP_WEIGHT_DEFAULT;
4036 }
4037
4038 int compare_job_priority(const void *a, const void *b) {
4039 const Job *x = a, *y = b;
4040 int nice_x, nice_y;
4041 uint64_t weight_x, weight_y;
4042 int ret;
4043
4044 if ((ret = CMP(x->unit->type, y->unit->type)) != 0)
4045 return -ret;
4046
4047 weight_x = unit_get_cpu_weight(x->unit);
4048 weight_y = unit_get_cpu_weight(y->unit);
4049
4050 if ((ret = CMP(weight_x, weight_y)) != 0)
4051 return -ret;
4052
4053 nice_x = unit_get_nice(x->unit);
4054 nice_y = unit_get_nice(y->unit);
4055
4056 if ((ret = CMP(nice_x, nice_y)) != 0)
4057 return ret;
4058
4059 return strcmp(x->unit->id, y->unit->id);
4060 }
4061
4062 int unit_cgroup_freezer_action(Unit *u, FreezerAction action) {
4063 _cleanup_free_ char *path = NULL;
4064 FreezerState target, kernel = _FREEZER_STATE_INVALID;
4065 int r;
4066
4067 assert(u);
4068 assert(IN_SET(action, FREEZER_FREEZE, FREEZER_THAW));
4069
4070 if (!cg_freezer_supported())
4071 return 0;
4072
4073 if (!u->cgroup_realized)
4074 return -EBUSY;
4075
4076 target = action == FREEZER_FREEZE ? FREEZER_FROZEN : FREEZER_RUNNING;
4077
4078 r = unit_freezer_state_kernel(u, &kernel);
4079 if (r < 0)
4080 log_unit_debug_errno(u, r, "Failed to obtain cgroup freezer state: %m");
4081
4082 if (target == kernel) {
4083 u->freezer_state = target;
4084 return 0;
4085 }
4086
4087 r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, "cgroup.freeze", &path);
4088 if (r < 0)
4089 return r;
4090
4091 log_unit_debug(u, "%s unit.", action == FREEZER_FREEZE ? "Freezing" : "Thawing");
4092
4093 if (action == FREEZER_FREEZE)
4094 u->freezer_state = FREEZER_FREEZING;
4095 else
4096 u->freezer_state = FREEZER_THAWING;
4097
4098 r = write_string_file(path, one_zero(action == FREEZER_FREEZE), WRITE_STRING_FILE_DISABLE_BUFFER);
4099 if (r < 0)
4100 return r;
4101
4102 return 1;
4103 }
4104
4105 int unit_get_cpuset(Unit *u, CPUSet *cpus, const char *name) {
4106 _cleanup_free_ char *v = NULL;
4107 int r;
4108
4109 assert(u);
4110 assert(cpus);
4111
4112 if (!u->cgroup_path)
4113 return -ENODATA;
4114
4115 if ((u->cgroup_realized_mask & CGROUP_MASK_CPUSET) == 0)
4116 return -ENODATA;
4117
4118 r = cg_all_unified();
4119 if (r < 0)
4120 return r;
4121 if (r == 0)
4122 return -ENODATA;
4123
4124 r = cg_get_attribute("cpuset", u->cgroup_path, name, &v);
4125 if (r == -ENOENT)
4126 return -ENODATA;
4127 if (r < 0)
4128 return r;
4129
4130 return parse_cpu_set_full(v, cpus, false, NULL, NULL, 0, NULL);
4131 }
4132
4133 static const char* const cgroup_device_policy_table[_CGROUP_DEVICE_POLICY_MAX] = {
4134 [CGROUP_DEVICE_POLICY_AUTO] = "auto",
4135 [CGROUP_DEVICE_POLICY_CLOSED] = "closed",
4136 [CGROUP_DEVICE_POLICY_STRICT] = "strict",
4137 };
4138
4139 DEFINE_STRING_TABLE_LOOKUP(cgroup_device_policy, CGroupDevicePolicy);
4140
4141 static const char* const freezer_action_table[_FREEZER_ACTION_MAX] = {
4142 [FREEZER_FREEZE] = "freeze",
4143 [FREEZER_THAW] = "thaw",
4144 };
4145
4146 DEFINE_STRING_TABLE_LOOKUP(freezer_action, FreezerAction);