src/nspawn/nspawn-cgroup.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2015 Lennart Poettering
   6 ***/
   7
   8 #include <sys/mount.h>
   9
  10 #include "alloc-util.h"
  11 #include "fd-util.h"
  12 #include "fileio.h"
  13 #include "mkdir.h"
  14 #include "mount-util.h"
  15 #include "nspawn-cgroup.h"
  16 #include "rm-rf.h"
  17 #include "string-util.h"
  18 #include "strv.h"
  19 #include "util.h"
  20
  21 static int chown_cgroup_path(const char *path, uid_t uid_shift) {
  22         _cleanup_close_ int fd = -1;
  23         const char *fn;
  24
  25         fd = open(path, O_RDONLY|O_CLOEXEC|O_DIRECTORY);
  26         if (fd < 0)
  27                 return -errno;
  28
  29         FOREACH_STRING(fn,
  30                        ".",
  31                        "cgroup.clone_children",
  32                        "cgroup.controllers",
  33                        "cgroup.events",
  34                        "cgroup.procs",
  35                        "cgroup.stat",
  36                        "cgroup.subtree_control",
  37                        "cgroup.threads",
  38                        "notify_on_release",
  39                        "tasks")
  40                 if (fchownat(fd, fn, uid_shift, uid_shift, 0) < 0)
  41                         log_full_errno(errno == ENOENT ? LOG_DEBUG :  LOG_WARNING, errno,
  42                                        "Failed to chown \"%s/%s\", ignoring: %m", path, fn);
  43
  44         return 0;
  45 }
  46
  47 int chown_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t uid_shift) {
  48         _cleanup_free_ char *path = NULL, *fs = NULL;
  49         int r;
  50
  51         r = cg_pid_get_path(NULL, pid, &path);
  52         if (r < 0)
  53                 return log_error_errno(r, "Failed to get container cgroup path: %m");
  54
  55         r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, path, NULL, &fs);
  56         if (r < 0)
  57                 return log_error_errno(r, "Failed to get file system path for container cgroup: %m");
  58
  59         r = chown_cgroup_path(fs, uid_shift);
  60         if (r < 0)
  61                 return log_error_errno(r, "Failed to chown() cgroup %s: %m", fs);
  62
  63         if (unified_requested == CGROUP_UNIFIED_SYSTEMD) {
  64                 _cleanup_free_ char *lfs = NULL;
  65                 /* Always propagate access rights from unified to legacy controller */
  66
  67                 r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER_LEGACY, path, NULL, &lfs);
  68                 if (r < 0)
  69                         return log_error_errno(r, "Failed to get file system path for container cgroup: %m");
  70
  71                 r = chown_cgroup_path(lfs, uid_shift);
  72                 if (r < 0)
  73                         return log_error_errno(r, "Failed to chown() cgroup %s: %m", lfs);
  74         }
  75
  76         return 0;
  77 }
  78
  79 int sync_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t arg_uid_shift) {
  80         _cleanup_free_ char *cgroup = NULL;
  81         char tree[] = "/tmp/unifiedXXXXXX", pid_string[DECIMAL_STR_MAX(pid) + 1];
  82         bool undo_mount = false;
  83         const char *fn;
  84         int r, unified_controller;
  85
  86         unified_controller = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
  87         if (unified_controller < 0)
  88                 return log_error_errno(unified_controller, "Failed to determine whether the systemd hierarchy is unified: %m");
  89         if ((unified_controller > 0) == (unified_requested >= CGROUP_UNIFIED_SYSTEMD))
  90                 return 0;
  91
  92         /* When the host uses the legacy cgroup setup, but the
  93          * container shall use the unified hierarchy, let's make sure
  94          * we copy the path from the name=systemd hierarchy into the
  95          * unified hierarchy. Similar for the reverse situation. */
  96
  97         r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, pid, &cgroup);
  98         if (r < 0)
  99                 return log_error_errno(r, "Failed to get control group of " PID_FMT ": %m", pid);
 100
 101         /* In order to access the unified hierarchy we need to mount it */
 102         if (!mkdtemp(tree))
 103                 return log_error_errno(errno, "Failed to generate temporary mount point for unified hierarchy: %m");
 104
 105         if (unified_controller > 0)
 106                 r = mount_verbose(LOG_ERR, "cgroup", tree, "cgroup",
 107                                   MS_NOSUID|MS_NOEXEC|MS_NODEV, "none,name=systemd,xattr");
 108         else
 109                 r = mount_verbose(LOG_ERR, "cgroup", tree, "cgroup2",
 110                                   MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
 111         if (r < 0)
 112                 goto finish;
 113
 114         undo_mount = true;
 115
 116         /* If nspawn dies abruptly the cgroup hierarchy created below
 117          * its unit isn't cleaned up. So, let's remove it
 118          * https://github.com/systemd/systemd/pull/4223#issuecomment-252519810 */
 119         fn = strjoina(tree, cgroup);
 120         (void) rm_rf(fn, REMOVE_ROOT|REMOVE_ONLY_DIRECTORIES);
 121
 122         fn = strjoina(tree, cgroup, "/cgroup.procs");
 123         (void) mkdir_parents(fn, 0755);
 124
 125         sprintf(pid_string, PID_FMT, pid);
 126         r = write_string_file(fn, pid_string, 0);
 127         if (r < 0) {
 128                 log_error_errno(r, "Failed to move process: %m");
 129                 goto finish;
 130         }
 131
 132         fn = strjoina(tree, cgroup);
 133         r = chown_cgroup_path(fn, arg_uid_shift);
 134         if (r < 0)
 135                 log_error_errno(r, "Failed to chown() cgroup %s: %m", fn);
 136 finish:
 137         if (undo_mount)
 138                 (void) umount_verbose(tree);
 139
 140         (void) rmdir(tree);
 141         return r;
 142 }
 143
 144 int create_subcgroup(pid_t pid, bool keep_unit, CGroupUnified unified_requested) {
 145         _cleanup_free_ char *cgroup = NULL;
 146         CGroupMask supported;
 147         const char *payload;
 148         int r;
 149
 150         assert(pid > 1);
 151
 152         /* In the unified hierarchy inner nodes may only contain subgroups, but not processes. Hence, if we running in
 153          * the unified hierarchy and the container does the same, and we did not create a scope unit for the container
 154          * move us and the container into two separate subcgroups.
 155          *
 156          * Moreover, container payloads such as systemd try to manage the cgroup they run in in full (i.e. including
 157          * its attributes), while the host systemd will only delegate cgroups for children of the cgroup created for a
 158          * delegation unit, instead of the cgroup itself. This means, if we'd pass on the cgroup allocated from the
 159          * host systemd directly to the payload, the host and payload systemd might fight for the cgroup
 160          * attributes. Hence, let's insert an intermediary cgroup to cover that case too.
 161          *
 162          * Note that we only bother with the main hierarchy here, not with any secondary ones. On the unified setup
 163          * that's fine because there's only one hiearchy anyway and controllers are enabled directly on it. On the
 164          * legacy setup, this is fine too, since delegation of controllers is generally not safe there, hence we won't
 165          * do it. */
 166
 167         r = cg_mask_supported(&supported);
 168         if (r < 0)
 169                 return log_error_errno(r, "Failed to determine supported controllers: %m");
 170
 171         if (keep_unit)
 172                 r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, 0, &cgroup);
 173         else
 174                 r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, pid, &cgroup);
 175         if (r < 0)
 176                 return log_error_errno(r, "Failed to get our control group: %m");
 177
 178         payload = strjoina(cgroup, "/payload");
 179         r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, payload, pid);
 180         if (r < 0)
 181                 return log_error_errno(r, "Failed to create %s subcgroup: %m", payload);
 182
 183         if (keep_unit) {
 184                 const char *supervisor;
 185
 186                 supervisor = strjoina(cgroup, "/supervisor");
 187                 r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, supervisor, 0);
 188                 if (r < 0)
 189                         return log_error_errno(r, "Failed to create %s subcgroup: %m", supervisor);
 190         }
 191
 192         /* Try to enable as many controllers as possible for the new payload. */
 193         (void) cg_enable_everywhere(supported, supported, cgroup);
 194         return 0;
 195 }