]>
Commit | Line | Data |
---|---|---|
53e1b683 | 1 | /* SPDX-License-Identifier: LGPL-2.1+ */ |
34829a32 LP |
2 | /*** |
3 | This file is part of systemd. | |
4 | ||
5 | Copyright 2015 Lennart Poettering | |
34829a32 LP |
6 | ***/ |
7 | ||
8 | #include <sys/mount.h> | |
9 | ||
b5efdb8a | 10 | #include "alloc-util.h" |
3ffd4af2 | 11 | #include "fd-util.h" |
07630cea LP |
12 | #include "fileio.h" |
13 | #include "mkdir.h" | |
60e76d48 | 14 | #include "mount-util.h" |
3ffd4af2 | 15 | #include "nspawn-cgroup.h" |
f0bef277 | 16 | #include "rm-rf.h" |
07630cea LP |
17 | #include "string-util.h" |
18 | #include "strv.h" | |
19 | #include "util.h" | |
34829a32 | 20 | |
f0bef277 | 21 | static int chown_cgroup_path(const char *path, uid_t uid_shift) { |
34829a32 LP |
22 | _cleanup_close_ int fd = -1; |
23 | const char *fn; | |
34829a32 | 24 | |
f0bef277 | 25 | fd = open(path, O_RDONLY|O_CLOEXEC|O_DIRECTORY); |
34829a32 | 26 | if (fd < 0) |
f0bef277 | 27 | return -errno; |
34829a32 LP |
28 | |
29 | FOREACH_STRING(fn, | |
30 | ".", | |
34829a32 LP |
31 | "cgroup.clone_children", |
32 | "cgroup.controllers", | |
1cfdbe29 LP |
33 | "cgroup.events", |
34 | "cgroup.procs", | |
35 | "cgroup.stat", | |
36 | "cgroup.subtree_control", | |
37 | "cgroup.threads", | |
38 | "notify_on_release", | |
39 | "tasks") | |
34829a32 LP |
40 | if (fchownat(fd, fn, uid_shift, uid_shift, 0) < 0) |
41 | log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno, | |
bd68e99b | 42 | "Failed to chown \"%s/%s\", ignoring: %m", path, fn); |
34829a32 LP |
43 | |
44 | return 0; | |
45 | } | |
46 | ||
de54e02d | 47 | int chown_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t uid_shift) { |
f0bef277 | 48 | _cleanup_free_ char *path = NULL, *fs = NULL; |
f0bef277 EV |
49 | int r; |
50 | ||
51 | r = cg_pid_get_path(NULL, pid, &path); | |
52 | if (r < 0) | |
53 | return log_error_errno(r, "Failed to get container cgroup path: %m"); | |
54 | ||
55 | r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, path, NULL, &fs); | |
56 | if (r < 0) | |
57 | return log_error_errno(r, "Failed to get file system path for container cgroup: %m"); | |
58 | ||
59 | r = chown_cgroup_path(fs, uid_shift); | |
60 | if (r < 0) | |
61 | return log_error_errno(r, "Failed to chown() cgroup %s: %m", fs); | |
62 | ||
de54e02d LP |
63 | if (unified_requested == CGROUP_UNIFIED_SYSTEMD) { |
64 | _cleanup_free_ char *lfs = NULL; | |
65 | /* Always propagate access rights from unified to legacy controller */ | |
66 | ||
67 | r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER_LEGACY, path, NULL, &lfs); | |
68 | if (r < 0) | |
69 | return log_error_errno(r, "Failed to get file system path for container cgroup: %m"); | |
70 | ||
71 | r = chown_cgroup_path(lfs, uid_shift); | |
72 | if (r < 0) | |
73 | return log_error_errno(r, "Failed to chown() cgroup %s: %m", lfs); | |
74 | } | |
75 | ||
f0bef277 EV |
76 | return 0; |
77 | } | |
78 | ||
79 | int sync_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t arg_uid_shift) { | |
34829a32 LP |
80 | _cleanup_free_ char *cgroup = NULL; |
81 | char tree[] = "/tmp/unifiedXXXXXX", pid_string[DECIMAL_STR_MAX(pid) + 1]; | |
82 | bool undo_mount = false; | |
83 | const char *fn; | |
b4cccbc1 | 84 | int r, unified_controller; |
34829a32 | 85 | |
c22800e4 | 86 | unified_controller = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER); |
b4cccbc1 LP |
87 | if (unified_controller < 0) |
88 | return log_error_errno(unified_controller, "Failed to determine whether the systemd hierarchy is unified: %m"); | |
89 | if ((unified_controller > 0) == (unified_requested >= CGROUP_UNIFIED_SYSTEMD)) | |
34829a32 LP |
90 | return 0; |
91 | ||
92 | /* When the host uses the legacy cgroup setup, but the | |
93 | * container shall use the unified hierarchy, let's make sure | |
94 | * we copy the path from the name=systemd hierarchy into the | |
95 | * unified hierarchy. Similar for the reverse situation. */ | |
96 | ||
97 | r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, pid, &cgroup); | |
98 | if (r < 0) | |
99 | return log_error_errno(r, "Failed to get control group of " PID_FMT ": %m", pid); | |
100 | ||
101 | /* In order to access the unified hierarchy we need to mount it */ | |
102 | if (!mkdtemp(tree)) | |
103 | return log_error_errno(errno, "Failed to generate temporary mount point for unified hierarchy: %m"); | |
104 | ||
b4cccbc1 | 105 | if (unified_controller > 0) |
60e76d48 ZJS |
106 | r = mount_verbose(LOG_ERR, "cgroup", tree, "cgroup", |
107 | MS_NOSUID|MS_NOEXEC|MS_NODEV, "none,name=systemd,xattr"); | |
34829a32 | 108 | else |
60e76d48 ZJS |
109 | r = mount_verbose(LOG_ERR, "cgroup", tree, "cgroup2", |
110 | MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL); | |
111 | if (r < 0) | |
34829a32 | 112 | goto finish; |
34829a32 LP |
113 | |
114 | undo_mount = true; | |
115 | ||
f0bef277 EV |
116 | /* If nspawn dies abruptly the cgroup hierarchy created below |
117 | * its unit isn't cleaned up. So, let's remove it | |
118 | * https://github.com/systemd/systemd/pull/4223#issuecomment-252519810 */ | |
119 | fn = strjoina(tree, cgroup); | |
120 | (void) rm_rf(fn, REMOVE_ROOT|REMOVE_ONLY_DIRECTORIES); | |
121 | ||
34829a32 LP |
122 | fn = strjoina(tree, cgroup, "/cgroup.procs"); |
123 | (void) mkdir_parents(fn, 0755); | |
124 | ||
125 | sprintf(pid_string, PID_FMT, pid); | |
126 | r = write_string_file(fn, pid_string, 0); | |
f0bef277 | 127 | if (r < 0) { |
34829a32 | 128 | log_error_errno(r, "Failed to move process: %m"); |
f0bef277 EV |
129 | goto finish; |
130 | } | |
34829a32 | 131 | |
f0bef277 EV |
132 | fn = strjoina(tree, cgroup); |
133 | r = chown_cgroup_path(fn, arg_uid_shift); | |
134 | if (r < 0) | |
135 | log_error_errno(r, "Failed to chown() cgroup %s: %m", fn); | |
34829a32 LP |
136 | finish: |
137 | if (undo_mount) | |
60e76d48 | 138 | (void) umount_verbose(tree); |
34829a32 LP |
139 | |
140 | (void) rmdir(tree); | |
141 | return r; | |
142 | } | |
143 | ||
5da38d07 | 144 | int create_subcgroup(pid_t pid, CGroupUnified unified_requested) { |
34829a32 LP |
145 | _cleanup_free_ char *cgroup = NULL; |
146 | const char *child; | |
415fc41c | 147 | int r; |
34829a32 LP |
148 | CGroupMask supported; |
149 | ||
61233823 | 150 | /* In the unified hierarchy inner nodes may only contain |
34829a32 LP |
151 | * subgroups, but not processes. Hence, if we running in the |
152 | * unified hierarchy and the container does the same, and we | |
153 | * did not create a scope unit for the container move us and | |
154 | * the container into two separate subcgroups. */ | |
155 | ||
5da38d07 | 156 | if (unified_requested == CGROUP_UNIFIED_NONE) |
34829a32 LP |
157 | return 0; |
158 | ||
c22800e4 | 159 | r = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER); |
b4cccbc1 LP |
160 | if (r < 0) |
161 | return log_error_errno(r, "Failed to determine whether the systemd controller is unified: %m"); | |
162 | if (r == 0) | |
34829a32 LP |
163 | return 0; |
164 | ||
165 | r = cg_mask_supported(&supported); | |
166 | if (r < 0) | |
167 | return log_error_errno(r, "Failed to determine supported controllers: %m"); | |
168 | ||
169 | r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, 0, &cgroup); | |
170 | if (r < 0) | |
171 | return log_error_errno(r, "Failed to get our control group: %m"); | |
172 | ||
173 | child = strjoina(cgroup, "/payload"); | |
174 | r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, child, pid); | |
175 | if (r < 0) | |
176 | return log_error_errno(r, "Failed to create %s subcgroup: %m", child); | |
177 | ||
178 | child = strjoina(cgroup, "/supervisor"); | |
179 | r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, child, 0); | |
180 | if (r < 0) | |
181 | return log_error_errno(r, "Failed to create %s subcgroup: %m", child); | |
182 | ||
183 | /* Try to enable as many controllers as possible for the new payload. */ | |
184 | (void) cg_enable_everywhere(supported, supported, cgroup); | |
185 | return 0; | |
186 | } |