/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include "core-varlink.h"
-#include "mkdir.h"
+#include "mkdir-label.h"
#include "strv.h"
#include "user-util.h"
#include "varlink.h"
+#include "varlink-io.systemd.UserDatabase.h"
+#include "varlink-io.systemd.ManagedOOM.h"
typedef struct LookupParameters {
const char *user_name;
JSON_BUILD_PAIR("userName", JSON_BUILD_STRING(user_name)),
JSON_BUILD_PAIR("uid", JSON_BUILD_UNSIGNED(uid)),
JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(uid)),
- JSON_BUILD_PAIR("realName", JSON_BUILD_STRING("Dynamic User")),
- JSON_BUILD_PAIR("homeDirectory", JSON_BUILD_STRING("/")),
- JSON_BUILD_PAIR("shell", JSON_BUILD_STRING(NOLOGIN)),
+ JSON_BUILD_PAIR("realName", JSON_BUILD_CONST_STRING("Dynamic User")),
+ JSON_BUILD_PAIR("homeDirectory", JSON_BUILD_CONST_STRING("/")),
+ JSON_BUILD_PAIR("shell", JSON_BUILD_CONST_STRING(NOLOGIN)),
JSON_BUILD_PAIR("locked", JSON_BUILD_BOOLEAN(true)),
- JSON_BUILD_PAIR("service", JSON_BUILD_STRING("io.systemd.DynamicUser")),
- JSON_BUILD_PAIR("disposition", JSON_BUILD_STRING("dynamic"))))));
+ JSON_BUILD_PAIR("service", JSON_BUILD_CONST_STRING("io.systemd.DynamicUser")),
+ JSON_BUILD_PAIR("disposition", JSON_BUILD_CONST_STRING("dynamic"))))));
}
static bool user_match_lookup_parameters(LookupParameters *p, const char *name, uid_t uid) {
if (!c)
return -EINVAL;
+ CGroupRuntime *crt = unit_get_cgroup_runtime(u);
+ if (!crt)
+ return -EINVAL;
+
if (UNIT_IS_INACTIVE_OR_FAILED(unit_active_state(u)))
/* systemd-oomd should always treat inactive units as though they didn't enable any action since they
* should not have a valid cgroup */
return json_build(ret_v, JSON_BUILD_OBJECT(
JSON_BUILD_PAIR("mode", JSON_BUILD_STRING(mode)),
- JSON_BUILD_PAIR("path", JSON_BUILD_STRING(u->cgroup_path)),
+ JSON_BUILD_PAIR("path", JSON_BUILD_STRING(crt->cgroup_path)),
JSON_BUILD_PAIR("property", JSON_BUILD_STRING(property)),
JSON_BUILD_PAIR_CONDITION(use_limit, "limit", JSON_BUILD_UNSIGNED(c->moom_mem_pressure_limit))));
}
int manager_varlink_send_managed_oom_update(Unit *u) {
_cleanup_(json_variant_unrefp) JsonVariant *arr = NULL, *v = NULL;
+ CGroupRuntime *crt;
CGroupContext *c;
int r;
assert(u);
- if (!UNIT_VTABLE(u)->can_set_managed_oom || !u->manager || !u->manager->managed_oom_varlink_request || !u->cgroup_path)
+ if (!UNIT_VTABLE(u)->can_set_managed_oom || !u->manager)
return 0;
+ crt = unit_get_cgroup_runtime(u);
+ if (!crt || !crt->cgroup_path)
+ return 0;
+
+ if (MANAGER_IS_SYSTEM(u->manager)) {
+ /* In system mode we can't send any notifications unless oomd connected back to us. In this
+ * mode oomd must initiate communication, not us. */
+ if (!u->manager->managed_oom_varlink)
+ return 0;
+ } else {
+ /* If we are in user mode, let's connect to oomd if we aren't connected yet. In this mode we
+ * must initiate communication to oomd, not the other way round. */
+ r = manager_varlink_init(u->manager);
+ if (r <= 0)
+ return r;
+ }
+
c = unit_get_cgroup_context(u);
if (!c)
return 0;
if (r < 0)
return r;
- return varlink_notify(u->manager->managed_oom_varlink_request, v);
+ if (MANAGER_IS_SYSTEM(u->manager))
+ /* in system mode, oomd is our client, thus send out notifications as replies to the
+ * initiating method call from them. */
+ r = varlink_notify(u->manager->managed_oom_varlink, v);
+ else
+ /* in user mode, we are oomd's client, thus send out notifications as method calls that do
+ * not expect a reply. */
+ r = varlink_send(u->manager->managed_oom_varlink, "io.systemd.oom.ReportManagedOOMCGroups", v);
+
+ return r;
}
-static int vl_method_subscribe_managed_oom_cgroups(
- Varlink *link,
- JsonVariant *parameters,
- VarlinkMethodFlags flags,
- void *userdata) {
- static const UnitType supported_unit_types[] = { UNIT_SLICE, UNIT_SERVICE, UNIT_SCOPE };
+static int build_managed_oom_cgroups_json(Manager *m, JsonVariant **ret) {
_cleanup_(json_variant_unrefp) JsonVariant *v = NULL, *arr = NULL;
- Manager *m = userdata;
int r;
- assert(link);
assert(m);
-
- if (json_variant_elements(parameters) > 0)
- return varlink_error_invalid_parameter(link, parameters);
-
- /* We only take one subscriber for this method so return an error if there's already an existing one.
- * This shouldn't happen since systemd-oomd is the only client of this method. */
- if (FLAGS_SET(flags, VARLINK_METHOD_MORE) && m->managed_oom_varlink_request)
- return varlink_error(link, VARLINK_ERROR_SUBSCRIPTION_TAKEN, NULL);
+ assert(ret);
r = json_build(&arr, JSON_BUILD_EMPTY_ARRAY);
if (r < 0)
return r;
- for (size_t i = 0; i < ELEMENTSOF(supported_unit_types); i++) {
- Unit *u;
+ for (UnitType t = 0; t < _UNIT_TYPE_MAX; t++) {
+
+ if (!unit_vtable[t]->can_set_managed_oom)
+ continue;
- LIST_FOREACH(units_by_type, u, m->units_by_type[supported_unit_types[i]]) {
+ LIST_FOREACH(units_by_type, u, m->units_by_type[t]) {
CGroupContext *c;
if (UNIT_IS_INACTIVE_OR_FAILED(unit_active_state(u)))
if (r < 0)
return r;
+ *ret = TAKE_PTR(v);
+ return 0;
+}
+
+static int vl_method_subscribe_managed_oom_cgroups(
+ Varlink *link,
+ JsonVariant *parameters,
+ VarlinkMethodFlags flags,
+ void *userdata) {
+
+ _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
+ Manager *m = ASSERT_PTR(userdata);
+ pid_t pid;
+ Unit *u;
+ int r;
+
+ assert(link);
+
+ r = varlink_get_peer_pid(link, &pid);
+ if (r < 0)
+ return r;
+
+ u = manager_get_unit_by_pid(m, pid);
+ if (!u)
+ return varlink_error(link, VARLINK_ERROR_PERMISSION_DENIED, NULL);
+
+ /* This is meant to be a deterrent and not actual security. The alternative is to check for the systemd-oom
+ * user that this unit runs as, but NSS lookups are blocking and not allowed from PID 1. */
+ if (!streq(u->id, "systemd-oomd.service"))
+ return varlink_error(link, VARLINK_ERROR_PERMISSION_DENIED, NULL);
+
+ if (json_variant_elements(parameters) > 0)
+ return varlink_error_invalid_parameter(link, parameters);
+
+ /* We only take one subscriber for this method so return an error if there's already an existing one.
+ * This shouldn't happen since systemd-oomd is the only client of this method. */
+ if (FLAGS_SET(flags, VARLINK_METHOD_MORE) && m->managed_oom_varlink)
+ return varlink_error(link, "io.systemd.ManagedOOM.SubscriptionTaken", NULL);
+
+ r = build_managed_oom_cgroups_json(m, &v);
+ if (r < 0)
+ return r;
+
if (!FLAGS_SET(flags, VARLINK_METHOD_MORE))
return varlink_reply(link, v);
- assert(!m->managed_oom_varlink_request);
- m->managed_oom_varlink_request = varlink_ref(link);
- return varlink_notify(m->managed_oom_varlink_request, v);
+ assert(!m->managed_oom_varlink);
+ m->managed_oom_varlink = varlink_ref(link);
+ return varlink_notify(m->managed_oom_varlink, v);
+}
+
+static int manager_varlink_send_managed_oom_initial(Manager *m) {
+ _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
+ int r;
+
+ assert(m);
+
+ if (MANAGER_IS_SYSTEM(m))
+ return 0;
+
+ assert(m->managed_oom_varlink);
+
+ r = build_managed_oom_cgroups_json(m, &v);
+ if (r < 0)
+ return r;
+
+ return varlink_send(m->managed_oom_varlink, "io.systemd.oom.ReportManagedOOMCGroups", v);
}
static int vl_method_get_user_record(Varlink *link, JsonVariant *parameters, VarlinkMethodFlags flags, void *userdata) {
};
_cleanup_free_ char *found_name = NULL;
uid_t found_uid = UID_INVALID, uid;
- Manager *m = userdata;
+ Manager *m = ASSERT_PTR(userdata);
const char *un;
int r;
assert(parameters);
- assert(m);
- r = json_dispatch(parameters, dispatch_table, NULL, 0, &p);
- if (r < 0)
+ r = varlink_dispatch(link, parameters, dispatch_table, &p);
+ if (r != 0)
return r;
if (!streq_ptr(p.service, "io.systemd.DynamicUser"))
return json_build(ret, JSON_BUILD_OBJECT(
JSON_BUILD_PAIR("record", JSON_BUILD_OBJECT(
JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING(group_name)),
- JSON_BUILD_PAIR("description", JSON_BUILD_STRING("Dynamic Group")),
+ JSON_BUILD_PAIR("description", JSON_BUILD_CONST_STRING("Dynamic Group")),
JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(gid)),
- JSON_BUILD_PAIR("service", JSON_BUILD_STRING("io.systemd.DynamicUser")),
- JSON_BUILD_PAIR("disposition", JSON_BUILD_STRING("dynamic"))))));
+ JSON_BUILD_PAIR("service", JSON_BUILD_CONST_STRING("io.systemd.DynamicUser")),
+ JSON_BUILD_PAIR("disposition", JSON_BUILD_CONST_STRING("dynamic"))))));
}
static bool group_match_lookup_parameters(LookupParameters *p, const char *name, gid_t gid) {
};
_cleanup_free_ char *found_name = NULL;
uid_t found_gid = GID_INVALID, gid;
- Manager *m = userdata;
+ Manager *m = ASSERT_PTR(userdata);
const char *gn;
int r;
assert(parameters);
- assert(m);
- r = json_dispatch(parameters, dispatch_table, NULL, 0, &p);
- if (r < 0)
+ r = varlink_dispatch(link, parameters, dispatch_table, &p);
+ if (r != 0)
return r;
if (!streq_ptr(p.service, "io.systemd.DynamicUser"))
assert(parameters);
- r = json_dispatch(parameters, dispatch_table, NULL, 0, &p);
- if (r < 0)
+ r = varlink_dispatch(link, parameters, dispatch_table, &p);
+ if (r != 0)
return r;
if (!streq_ptr(p.service, "io.systemd.DynamicUser"))
}
static void vl_disconnect(VarlinkServer *s, Varlink *link, void *userdata) {
- Manager *m = userdata;
+ Manager *m = ASSERT_PTR(userdata);
- assert(m);
assert(s);
assert(link);
- if (link == m->managed_oom_varlink_request)
- m->managed_oom_varlink_request = varlink_unref(link);
+ if (link == m->managed_oom_varlink)
+ m->managed_oom_varlink = varlink_unref(link);
}
-int manager_varlink_init(Manager *m) {
+static int manager_varlink_init_system(Manager *m) {
_cleanup_(varlink_server_unrefp) VarlinkServer *s = NULL;
int r;
assert(m);
if (m->varlink_server)
- return 0;
+ return 1;
if (!MANAGER_IS_SYSTEM(m))
return 0;
+ r = manager_setup_varlink_server(m, &s);
+ if (r < 0)
+ return log_error_errno(r, "Failed to set up varlink server: %m");
+
+ if (!MANAGER_IS_TEST_RUN(m)) {
+ (void) mkdir_p_label("/run/systemd/userdb", 0755);
+
+ FOREACH_STRING(address, "/run/systemd/userdb/io.systemd.DynamicUser", VARLINK_ADDR_PATH_MANAGED_OOM_SYSTEM) {
+ if (MANAGER_IS_RELOADING(m)) {
+ /* If manager is reloading, we skip listening on existing addresses, since
+ * the fd should be acquired later through deserialization. */
+ if (access(address, F_OK) >= 0)
+ continue;
+ if (errno != ENOENT)
+ return log_error_errno(errno,
+ "Failed to check if varlink socket '%s' exists: %m", address);
+ }
+
+ r = varlink_server_listen_address(s, address, 0666);
+ if (r < 0)
+ return log_error_errno(r, "Failed to bind to varlink socket '%s': %m", address);
+ }
+ }
+
+ r = varlink_server_attach_event(s, m->event, EVENT_PRIORITY_IPC);
+ if (r < 0)
+ return log_error_errno(r, "Failed to attach varlink connection to event loop: %m");
+
+ m->varlink_server = TAKE_PTR(s);
+ return 1;
+}
+
+static int vl_reply(Varlink *link, JsonVariant *parameters, const char *error_id, VarlinkReplyFlags flags, void *userdata) {
+ Manager *m = ASSERT_PTR(userdata);
+ int r;
+
+ if (error_id)
+ log_debug("varlink systemd-oomd client error: %s", error_id);
+
+ if (FLAGS_SET(flags, VARLINK_REPLY_ERROR) && FLAGS_SET(flags, VARLINK_REPLY_LOCAL)) {
+ /* Varlink connection was closed, likely because of systemd-oomd restart. Let's try to
+ * reconnect and send the initial ManagedOOM update again. */
+
+ m->managed_oom_varlink = varlink_unref(link);
+
+ log_debug("Reconnecting to %s", VARLINK_ADDR_PATH_MANAGED_OOM_USER);
+
+ r = manager_varlink_init(m);
+ if (r <= 0)
+ return r;
+ }
+
+ return 0;
+}
+
+static int manager_varlink_init_user(Manager *m) {
+ _cleanup_(varlink_close_unrefp) Varlink *link = NULL;
+ int r;
+
+ assert(m);
+
+ if (m->managed_oom_varlink)
+ return 1;
+
+ if (MANAGER_IS_TEST_RUN(m))
+ return 0;
+
+ r = varlink_connect_address(&link, VARLINK_ADDR_PATH_MANAGED_OOM_USER);
+ if (r < 0) {
+ if (r == -ENOENT || ERRNO_IS_DISCONNECT(r)) {
+ log_debug("systemd-oomd varlink unix socket not found, skipping user manager varlink setup");
+ return 0;
+ }
+ return log_error_errno(r, "Failed to connect to %s: %m", VARLINK_ADDR_PATH_MANAGED_OOM_USER);
+ }
+
+ varlink_set_userdata(link, m);
+
+ r = varlink_bind_reply(link, vl_reply);
+ if (r < 0)
+ return r;
+
+ r = varlink_attach_event(link, m->event, EVENT_PRIORITY_IPC);
+ if (r < 0)
+ return log_error_errno(r, "Failed to attach varlink connection to event loop: %m");
+
+ m->managed_oom_varlink = TAKE_PTR(link);
+
+ /* Queue the initial ManagedOOM update. */
+ (void) manager_varlink_send_managed_oom_initial(m);
+
+ return 1;
+}
+
+int manager_setup_varlink_server(Manager *m, VarlinkServer **ret) {
+ _cleanup_(varlink_server_unrefp) VarlinkServer *s = NULL;
+ int r;
+
+ assert(m);
+ assert(ret);
+
r = varlink_server_new(&s, VARLINK_SERVER_ACCOUNT_UID|VARLINK_SERVER_INHERIT_USERDATA);
if (r < 0)
- return log_error_errno(r, "Failed to allocate varlink server object: %m");
+ return log_debug_errno(r, "Failed to allocate varlink server object: %m");
varlink_server_set_userdata(s, m);
+ r = varlink_server_add_interface_many(
+ s,
+ &vl_interface_io_systemd_UserDatabase,
+ &vl_interface_io_systemd_ManagedOOM);
+ if (r < 0)
+ return log_error_errno(r, "Failed to add interfaces to varlink server: %m");
+
r = varlink_server_bind_method_many(
s,
"io.systemd.UserDatabase.GetUserRecord", vl_method_get_user_record,
"io.systemd.UserDatabase.GetMemberships", vl_method_get_memberships,
"io.systemd.ManagedOOM.SubscribeManagedOOMCGroups", vl_method_subscribe_managed_oom_cgroups);
if (r < 0)
- return log_error_errno(r, "Failed to register varlink methods: %m");
+ return log_debug_errno(r, "Failed to register varlink methods: %m");
r = varlink_server_bind_disconnect(s, vl_disconnect);
if (r < 0)
- return log_error_errno(r, "Failed to register varlink disconnect handler: %m");
-
- if (!MANAGER_IS_TEST_RUN(m)) {
- (void) mkdir_p_label("/run/systemd/userdb", 0755);
-
- r = varlink_server_listen_address(s, "/run/systemd/userdb/io.systemd.DynamicUser", 0666);
- if (r < 0)
- return log_error_errno(r, "Failed to bind to varlink socket: %m");
-
- r = varlink_server_listen_address(s, VARLINK_ADDR_PATH_MANAGED_OOM, 0666);
- if (r < 0)
- return log_error_errno(r, "Failed to bind to varlink socket: %m");
- }
-
- r = varlink_server_attach_event(s, m->event, SD_EVENT_PRIORITY_NORMAL);
- if (r < 0)
- return log_error_errno(r, "Failed to attach varlink connection to event loop: %m");
+ return log_debug_errno(r, "Failed to register varlink disconnect handler: %m");
- m->varlink_server = TAKE_PTR(s);
+ *ret = TAKE_PTR(s);
return 0;
}
+int manager_varlink_init(Manager *m) {
+ return MANAGER_IS_SYSTEM(m) ? manager_varlink_init_system(m) : manager_varlink_init_user(m);
+}
+
void manager_varlink_done(Manager *m) {
assert(m);
* the manager, and only then disconnect it — in two steps – so that we don't end up accidentally
* unreffing it twice. After all, closing the connection might cause the disconnect handler we
* installed (vl_disconnect() above) to be called, where we will unref it too. */
- varlink_close_unref(TAKE_PTR(m->managed_oom_varlink_request));
+ varlink_close_unref(TAKE_PTR(m->managed_oom_varlink));
m->varlink_server = varlink_server_unref(m->varlink_server);
+ m->managed_oom_varlink = varlink_close_unref(m->managed_oom_varlink);
}
projects / thirdparty / systemd.git / blobdiff