]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/core/cgroup.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge pull request #12366 from lkundrak/lr/olpc-xo-175-keyboard
[thirdparty/systemd.git] / src / core / cgroup.c
1 /* SPDX-License-Identifier: LGPL-2.1+ */
2
3 #include <fcntl.h>
4 #include <fnmatch.h>
5
6 #include "sd-messages.h"
7
8 #include "alloc-util.h"
9 #include "blockdev-util.h"
10 #include "bpf-devices.h"
11 #include "bpf-firewall.h"
12 #include "btrfs-util.h"
13 #include "bus-error.h"
14 #include "cgroup-util.h"
15 #include "cgroup.h"
16 #include "fd-util.h"
17 #include "fileio.h"
18 #include "fs-util.h"
19 #include "nulstr-util.h"
20 #include "parse-util.h"
21 #include "path-util.h"
22 #include "process-util.h"
23 #include "procfs-util.h"
24 #include "special.h"
25 #include "stat-util.h"
26 #include "stdio-util.h"
27 #include "string-table.h"
28 #include "string-util.h"
29 #include "virt.h"
30
31 #define CGROUP_CPU_QUOTA_DEFAULT_PERIOD_USEC ((usec_t) 100 * USEC_PER_MSEC)
32
33 /* Returns the log level to use when cgroup attribute writes fail. When an attribute is missing or we have access
34 * problems we downgrade to LOG_DEBUG. This is supposed to be nice to container managers and kernels which want to mask
35 * out specific attributes from us. */
36 #define LOG_LEVEL_CGROUP_WRITE(r) (IN_SET(abs(r), ENOENT, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING)
37
38 bool manager_owns_host_root_cgroup(Manager *m) {
39 assert(m);
40
41 /* Returns true if we are managing the root cgroup. Note that it isn't sufficient to just check whether the
42 * group root path equals "/" since that will also be the case if CLONE_NEWCGROUP is in the mix. Since there's
43 * appears to be no nice way to detect whether we are in a CLONE_NEWCGROUP namespace we instead just check if
44 * we run in any kind of container virtualization. */
45
46 if (MANAGER_IS_USER(m))
47 return false;
48
49 if (detect_container() > 0)
50 return false;
51
52 return empty_or_root(m->cgroup_root);
53 }
54
55 bool unit_has_host_root_cgroup(Unit *u) {
56 assert(u);
57
58 /* Returns whether this unit manages the root cgroup. This will return true if this unit is the root slice and
59 * the manager manages the root cgroup. */
60
61 if (!manager_owns_host_root_cgroup(u->manager))
62 return false;
63
64 return unit_has_name(u, SPECIAL_ROOT_SLICE);
65 }
66
67 static int set_attribute_and_warn(Unit *u, const char *controller, const char *attribute, const char *value) {
68 int r;
69
70 r = cg_set_attribute(controller, u->cgroup_path, attribute, value);
71 if (r < 0)
72 log_unit_full(u, LOG_LEVEL_CGROUP_WRITE(r), r, "Failed to set '%s' attribute on '%s' to '%.*s': %m",
73 strna(attribute), isempty(u->cgroup_path) ? "/" : u->cgroup_path, (int) strcspn(value, NEWLINE), value);
74
75 return r;
76 }
77
78 static void cgroup_compat_warn(void) {
79 static bool cgroup_compat_warned = false;
80
81 if (cgroup_compat_warned)
82 return;
83
84 log_warning("cgroup compatibility translation between legacy and unified hierarchy settings activated. "
85 "See cgroup-compat debug messages for details.");
86
87 cgroup_compat_warned = true;
88 }
89
90 #define log_cgroup_compat(unit, fmt, ...) do { \
91 cgroup_compat_warn(); \
92 log_unit_debug(unit, "cgroup-compat: " fmt, ##__VA_ARGS__); \
93 } while (false)
94
95 void cgroup_context_init(CGroupContext *c) {
96 assert(c);
97
98 /* Initialize everything to the kernel defaults. */
99
100 *c = (CGroupContext) {
101 .cpu_weight = CGROUP_WEIGHT_INVALID,
102 .startup_cpu_weight = CGROUP_WEIGHT_INVALID,
103 .cpu_quota_per_sec_usec = USEC_INFINITY,
104 .cpu_quota_period_usec = USEC_INFINITY,
105
106 .cpu_shares = CGROUP_CPU_SHARES_INVALID,
107 .startup_cpu_shares = CGROUP_CPU_SHARES_INVALID,
108
109 .memory_high = CGROUP_LIMIT_MAX,
110 .memory_max = CGROUP_LIMIT_MAX,
111 .memory_swap_max = CGROUP_LIMIT_MAX,
112
113 .memory_limit = CGROUP_LIMIT_MAX,
114
115 .io_weight = CGROUP_WEIGHT_INVALID,
116 .startup_io_weight = CGROUP_WEIGHT_INVALID,
117
118 .blockio_weight = CGROUP_BLKIO_WEIGHT_INVALID,
119 .startup_blockio_weight = CGROUP_BLKIO_WEIGHT_INVALID,
120
121 .tasks_max = CGROUP_LIMIT_MAX,
122 };
123 }
124
125 void cgroup_context_free_device_allow(CGroupContext *c, CGroupDeviceAllow *a) {
126 assert(c);
127 assert(a);
128
129 LIST_REMOVE(device_allow, c->device_allow, a);
130 free(a->path);
131 free(a);
132 }
133
134 void cgroup_context_free_io_device_weight(CGroupContext *c, CGroupIODeviceWeight *w) {
135 assert(c);
136 assert(w);
137
138 LIST_REMOVE(device_weights, c->io_device_weights, w);
139 free(w->path);
140 free(w);
141 }
142
143 void cgroup_context_free_io_device_latency(CGroupContext *c, CGroupIODeviceLatency *l) {
144 assert(c);
145 assert(l);
146
147 LIST_REMOVE(device_latencies, c->io_device_latencies, l);
148 free(l->path);
149 free(l);
150 }
151
152 void cgroup_context_free_io_device_limit(CGroupContext *c, CGroupIODeviceLimit *l) {
153 assert(c);
154 assert(l);
155
156 LIST_REMOVE(device_limits, c->io_device_limits, l);
157 free(l->path);
158 free(l);
159 }
160
161 void cgroup_context_free_blockio_device_weight(CGroupContext *c, CGroupBlockIODeviceWeight *w) {
162 assert(c);
163 assert(w);
164
165 LIST_REMOVE(device_weights, c->blockio_device_weights, w);
166 free(w->path);
167 free(w);
168 }
169
170 void cgroup_context_free_blockio_device_bandwidth(CGroupContext *c, CGroupBlockIODeviceBandwidth *b) {
171 assert(c);
172 assert(b);
173
174 LIST_REMOVE(device_bandwidths, c->blockio_device_bandwidths, b);
175 free(b->path);
176 free(b);
177 }
178
179 void cgroup_context_done(CGroupContext *c) {
180 assert(c);
181
182 while (c->io_device_weights)
183 cgroup_context_free_io_device_weight(c, c->io_device_weights);
184
185 while (c->io_device_latencies)
186 cgroup_context_free_io_device_latency(c, c->io_device_latencies);
187
188 while (c->io_device_limits)
189 cgroup_context_free_io_device_limit(c, c->io_device_limits);
190
191 while (c->blockio_device_weights)
192 cgroup_context_free_blockio_device_weight(c, c->blockio_device_weights);
193
194 while (c->blockio_device_bandwidths)
195 cgroup_context_free_blockio_device_bandwidth(c, c->blockio_device_bandwidths);
196
197 while (c->device_allow)
198 cgroup_context_free_device_allow(c, c->device_allow);
199
200 c->ip_address_allow = ip_address_access_free_all(c->ip_address_allow);
201 c->ip_address_deny = ip_address_access_free_all(c->ip_address_deny);
202 }
203
204 void cgroup_context_dump(CGroupContext *c, FILE* f, const char *prefix) {
205 _cleanup_free_ char *disable_controllers_str = NULL;
206 CGroupIODeviceLimit *il;
207 CGroupIODeviceWeight *iw;
208 CGroupIODeviceLatency *l;
209 CGroupBlockIODeviceBandwidth *b;
210 CGroupBlockIODeviceWeight *w;
211 CGroupDeviceAllow *a;
212 IPAddressAccessItem *iaai;
213 char u[FORMAT_TIMESPAN_MAX];
214 char v[FORMAT_TIMESPAN_MAX];
215
216 assert(c);
217 assert(f);
218
219 prefix = strempty(prefix);
220
221 (void) cg_mask_to_string(c->disable_controllers, &disable_controllers_str);
222
223 fprintf(f,
224 "%sCPUAccounting=%s\n"
225 "%sIOAccounting=%s\n"
226 "%sBlockIOAccounting=%s\n"
227 "%sMemoryAccounting=%s\n"
228 "%sTasksAccounting=%s\n"
229 "%sIPAccounting=%s\n"
230 "%sCPUWeight=%" PRIu64 "\n"
231 "%sStartupCPUWeight=%" PRIu64 "\n"
232 "%sCPUShares=%" PRIu64 "\n"
233 "%sStartupCPUShares=%" PRIu64 "\n"
234 "%sCPUQuotaPerSecSec=%s\n"
235 "%sCPUQuotaPeriodSec=%s\n"
236 "%sIOWeight=%" PRIu64 "\n"
237 "%sStartupIOWeight=%" PRIu64 "\n"
238 "%sBlockIOWeight=%" PRIu64 "\n"
239 "%sStartupBlockIOWeight=%" PRIu64 "\n"
240 "%sDefaultMemoryLow=%" PRIu64 "\n"
241 "%sMemoryMin=%" PRIu64 "\n"
242 "%sMemoryLow=%" PRIu64 "\n"
243 "%sMemoryHigh=%" PRIu64 "\n"
244 "%sMemoryMax=%" PRIu64 "\n"
245 "%sMemorySwapMax=%" PRIu64 "\n"
246 "%sMemoryLimit=%" PRIu64 "\n"
247 "%sTasksMax=%" PRIu64 "\n"
248 "%sDevicePolicy=%s\n"
249 "%sDisableControllers=%s\n"
250 "%sDelegate=%s\n",
251 prefix, yes_no(c->cpu_accounting),
252 prefix, yes_no(c->io_accounting),
253 prefix, yes_no(c->blockio_accounting),
254 prefix, yes_no(c->memory_accounting),
255 prefix, yes_no(c->tasks_accounting),
256 prefix, yes_no(c->ip_accounting),
257 prefix, c->cpu_weight,
258 prefix, c->startup_cpu_weight,
259 prefix, c->cpu_shares,
260 prefix, c->startup_cpu_shares,
261 prefix, format_timespan(u, sizeof(u), c->cpu_quota_per_sec_usec, 1),
262 prefix, format_timespan(v, sizeof(v), c->cpu_quota_period_usec, 1),
263 prefix, c->io_weight,
264 prefix, c->startup_io_weight,
265 prefix, c->blockio_weight,
266 prefix, c->startup_blockio_weight,
267 prefix, c->default_memory_low,
268 prefix, c->memory_min,
269 prefix, c->memory_low,
270 prefix, c->memory_high,
271 prefix, c->memory_max,
272 prefix, c->memory_swap_max,
273 prefix, c->memory_limit,
274 prefix, c->tasks_max,
275 prefix, cgroup_device_policy_to_string(c->device_policy),
276 prefix, strnull(disable_controllers_str),
277 prefix, yes_no(c->delegate));
278
279 if (c->delegate) {
280 _cleanup_free_ char *t = NULL;
281
282 (void) cg_mask_to_string(c->delegate_controllers, &t);
283
284 fprintf(f, "%sDelegateControllers=%s\n",
285 prefix,
286 strempty(t));
287 }
288
289 LIST_FOREACH(device_allow, a, c->device_allow)
290 fprintf(f,
291 "%sDeviceAllow=%s %s%s%s\n",
292 prefix,
293 a->path,
294 a->r ? "r" : "", a->w ? "w" : "", a->m ? "m" : "");
295
296 LIST_FOREACH(device_weights, iw, c->io_device_weights)
297 fprintf(f,
298 "%sIODeviceWeight=%s %" PRIu64 "\n",
299 prefix,
300 iw->path,
301 iw->weight);
302
303 LIST_FOREACH(device_latencies, l, c->io_device_latencies)
304 fprintf(f,
305 "%sIODeviceLatencyTargetSec=%s %s\n",
306 prefix,
307 l->path,
308 format_timespan(u, sizeof(u), l->target_usec, 1));
309
310 LIST_FOREACH(device_limits, il, c->io_device_limits) {
311 char buf[FORMAT_BYTES_MAX];
312 CGroupIOLimitType type;
313
314 for (type = 0; type < _CGROUP_IO_LIMIT_TYPE_MAX; type++)
315 if (il->limits[type] != cgroup_io_limit_defaults[type])
316 fprintf(f,
317 "%s%s=%s %s\n",
318 prefix,
319 cgroup_io_limit_type_to_string(type),
320 il->path,
321 format_bytes(buf, sizeof(buf), il->limits[type]));
322 }
323
324 LIST_FOREACH(device_weights, w, c->blockio_device_weights)
325 fprintf(f,
326 "%sBlockIODeviceWeight=%s %" PRIu64,
327 prefix,
328 w->path,
329 w->weight);
330
331 LIST_FOREACH(device_bandwidths, b, c->blockio_device_bandwidths) {
332 char buf[FORMAT_BYTES_MAX];
333
334 if (b->rbps != CGROUP_LIMIT_MAX)
335 fprintf(f,
336 "%sBlockIOReadBandwidth=%s %s\n",
337 prefix,
338 b->path,
339 format_bytes(buf, sizeof(buf), b->rbps));
340 if (b->wbps != CGROUP_LIMIT_MAX)
341 fprintf(f,
342 "%sBlockIOWriteBandwidth=%s %s\n",
343 prefix,
344 b->path,
345 format_bytes(buf, sizeof(buf), b->wbps));
346 }
347
348 LIST_FOREACH(items, iaai, c->ip_address_allow) {
349 _cleanup_free_ char *k = NULL;
350
351 (void) in_addr_to_string(iaai->family, &iaai->address, &k);
352 fprintf(f, "%sIPAddressAllow=%s/%u\n", prefix, strnull(k), iaai->prefixlen);
353 }
354
355 LIST_FOREACH(items, iaai, c->ip_address_deny) {
356 _cleanup_free_ char *k = NULL;
357
358 (void) in_addr_to_string(iaai->family, &iaai->address, &k);
359 fprintf(f, "%sIPAddressDeny=%s/%u\n", prefix, strnull(k), iaai->prefixlen);
360 }
361 }
362
363 int cgroup_add_device_allow(CGroupContext *c, const char *dev, const char *mode) {
364 _cleanup_free_ CGroupDeviceAllow *a = NULL;
365 _cleanup_free_ char *d = NULL;
366
367 assert(c);
368 assert(dev);
369 assert(isempty(mode) || in_charset(mode, "rwm"));
370
371 a = new(CGroupDeviceAllow, 1);
372 if (!a)
373 return -ENOMEM;
374
375 d = strdup(dev);
376 if (!d)
377 return -ENOMEM;
378
379 *a = (CGroupDeviceAllow) {
380 .path = TAKE_PTR(d),
381 .r = isempty(mode) || strchr(mode, 'r'),
382 .w = isempty(mode) || strchr(mode, 'w'),
383 .m = isempty(mode) || strchr(mode, 'm'),
384 };
385
386 LIST_PREPEND(device_allow, c->device_allow, a);
387 TAKE_PTR(a);
388
389 return 0;
390 }
391
392 uint64_t unit_get_ancestor_memory_low(Unit *u) {
393 CGroupContext *c;
394
395 /* 1. Is MemoryLow set in this unit? If so, use that.
396 * 2. Is DefaultMemoryLow set in any ancestor? If so, use that.
397 * 3. Otherwise, return CGROUP_LIMIT_MIN. */
398
399 assert(u);
400
401 c = unit_get_cgroup_context(u);
402
403 if (c->memory_low_set)
404 return c->memory_low;
405
406 while (UNIT_ISSET(u->slice)) {
407 u = UNIT_DEREF(u->slice);
408 c = unit_get_cgroup_context(u);
409
410 if (c->default_memory_low_set)
411 return c->default_memory_low;
412 }
413
414 /* We've reached the root, but nobody had DefaultMemoryLow set, so set it to the kernel default. */
415 return CGROUP_LIMIT_MIN;
416 }
417
418 static void cgroup_xattr_apply(Unit *u) {
419 char ids[SD_ID128_STRING_MAX];
420 int r;
421
422 assert(u);
423
424 if (!MANAGER_IS_SYSTEM(u->manager))
425 return;
426
427 if (sd_id128_is_null(u->invocation_id))
428 return;
429
430 r = cg_set_xattr(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path,
431 "trusted.invocation_id",
432 sd_id128_to_string(u->invocation_id, ids), 32,
433 0);
434 if (r < 0)
435 log_unit_debug_errno(u, r, "Failed to set invocation ID on control group %s, ignoring: %m", u->cgroup_path);
436 }
437
438 static int lookup_block_device(const char *p, dev_t *ret) {
439 dev_t rdev, dev = 0;
440 mode_t mode;
441 int r;
442
443 assert(p);
444 assert(ret);
445
446 r = device_path_parse_major_minor(p, &mode, &rdev);
447 if (r == -ENODEV) { /* not a parsable device node, need to go to disk */
448 struct stat st;
449 if (stat(p, &st) < 0)
450 return log_warning_errno(errno, "Couldn't stat device '%s': %m", p);
451 rdev = (dev_t)st.st_rdev;
452 dev = (dev_t)st.st_dev;
453 mode = st.st_mode;
454 } else if (r < 0)
455 return log_warning_errno(r, "Failed to parse major/minor from path '%s': %m", p);
456
457 if (S_ISCHR(mode)) {
458 log_warning("Device node '%s' is a character device, but block device needed.", p);
459 return -ENOTBLK;
460 } else if (S_ISBLK(mode))
461 *ret = rdev;
462 else if (major(dev) != 0)
463 *ret = dev; /* If this is not a device node then use the block device this file is stored on */
464 else {
465 /* If this is btrfs, getting the backing block device is a bit harder */
466 r = btrfs_get_block_device(p, ret);
467 if (r < 0 && r != -ENOTTY)
468 return log_warning_errno(r, "Failed to determine block device backing btrfs file system '%s': %m", p);
469 if (r == -ENOTTY) {
470 log_warning("'%s' is not a block device node, and file system block device cannot be determined or is not local.", p);
471 return -ENODEV;
472 }
473 }
474
475 /* If this is a LUKS device, try to get the originating block device */
476 (void) block_get_originating(*ret, ret);
477
478 /* If this is a partition, try to get the originating block device */
479 (void) block_get_whole_disk(*ret, ret);
480 return 0;
481 }
482
483 static int whitelist_device(BPFProgram *prog, const char *path, const char *node, const char *acc) {
484 dev_t rdev;
485 mode_t mode;
486 int r;
487
488 assert(path);
489 assert(acc);
490
491 /* Some special handling for /dev/block/%u:%u, /dev/char/%u:%u, /run/systemd/inaccessible/chr and
492 * /run/systemd/inaccessible/blk paths. Instead of stat()ing these we parse out the major/minor directly. This
493 * means clients can use these path without the device node actually around */
494 r = device_path_parse_major_minor(node, &mode, &rdev);
495 if (r < 0) {
496 if (r != -ENODEV)
497 return log_warning_errno(r, "Couldn't parse major/minor from device path '%s': %m", node);
498
499 struct stat st;
500 if (stat(node, &st) < 0)
501 return log_warning_errno(errno, "Couldn't stat device %s: %m", node);
502
503 if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode)) {
504 log_warning("%s is not a device.", node);
505 return -ENODEV;
506 }
507 rdev = (dev_t) st.st_rdev;
508 mode = st.st_mode;
509 }
510
511 if (cg_all_unified() > 0) {
512 if (!prog)
513 return 0;
514
515 return cgroup_bpf_whitelist_device(prog, S_ISCHR(mode) ? BPF_DEVCG_DEV_CHAR : BPF_DEVCG_DEV_BLOCK,
516 major(rdev), minor(rdev), acc);
517
518 } else {
519 char buf[2+DECIMAL_STR_MAX(dev_t)*2+2+4];
520
521 sprintf(buf,
522 "%c %u:%u %s",
523 S_ISCHR(mode) ? 'c' : 'b',
524 major(rdev), minor(rdev),
525 acc);
526
527 /* Changing the devices list of a populated cgroup might result in EINVAL, hence ignore EINVAL here. */
528
529 r = cg_set_attribute("devices", path, "devices.allow", buf);
530 if (r < 0)
531 return log_full_errno(IN_SET(r, -ENOENT, -EROFS, -EINVAL, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING,
532 r, "Failed to set devices.allow on %s: %m", path);
533
534 return 0;
535 }
536 }
537
538 static int whitelist_major(BPFProgram *prog, const char *path, const char *name, char type, const char *acc) {
539 _cleanup_fclose_ FILE *f = NULL;
540 char buf[2+DECIMAL_STR_MAX(unsigned)+3+4];
541 bool good = false;
542 unsigned maj;
543 int r;
544
545 assert(path);
546 assert(acc);
547 assert(IN_SET(type, 'b', 'c'));
548
549 if (streq(name, "*")) {
550 /* If the name is a wildcard, then apply this list to all devices of this type */
551
552 if (cg_all_unified() > 0) {
553 if (!prog)
554 return 0;
555
556 (void) cgroup_bpf_whitelist_class(prog, type == 'c' ? BPF_DEVCG_DEV_CHAR : BPF_DEVCG_DEV_BLOCK, acc);
557 } else {
558 xsprintf(buf, "%c *:* %s", type, acc);
559
560 r = cg_set_attribute("devices", path, "devices.allow", buf);
561 if (r < 0)
562 log_full_errno(IN_SET(r, -ENOENT, -EROFS, -EINVAL, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
563 "Failed to set devices.allow on %s: %m", path);
564 return 0;
565 }
566 }
567
568 if (safe_atou(name, &maj) >= 0 && DEVICE_MAJOR_VALID(maj)) {
569 /* The name is numeric and suitable as major. In that case, let's take is major, and create the entry
570 * directly */
571
572 if (cg_all_unified() > 0) {
573 if (!prog)
574 return 0;
575
576 (void) cgroup_bpf_whitelist_major(prog,
577 type == 'c' ? BPF_DEVCG_DEV_CHAR : BPF_DEVCG_DEV_BLOCK,
578 maj, acc);
579 } else {
580 xsprintf(buf, "%c %u:* %s", type, maj, acc);
581
582 r = cg_set_attribute("devices", path, "devices.allow", buf);
583 if (r < 0)
584 log_full_errno(IN_SET(r, -ENOENT, -EROFS, -EINVAL, -EACCES) ? LOG_DEBUG : LOG_WARNING, r,
585 "Failed to set devices.allow on %s: %m", path);
586 }
587
588 return 0;
589 }
590
591 f = fopen("/proc/devices", "re");
592 if (!f)
593 return log_warning_errno(errno, "Cannot open /proc/devices to resolve %s (%c): %m", name, type);
594
595 for (;;) {
596 _cleanup_free_ char *line = NULL;
597 char *w, *p;
598
599 r = read_line(f, LONG_LINE_MAX, &line);
600 if (r < 0)
601 return log_warning_errno(r, "Failed to read /proc/devices: %m");
602 if (r == 0)
603 break;
604
605 if (type == 'c' && streq(line, "Character devices:")) {
606 good = true;
607 continue;
608 }
609
610 if (type == 'b' && streq(line, "Block devices:")) {
611 good = true;
612 continue;
613 }
614
615 if (isempty(line)) {
616 good = false;
617 continue;
618 }
619
620 if (!good)
621 continue;
622
623 p = strstrip(line);
624
625 w = strpbrk(p, WHITESPACE);
626 if (!w)
627 continue;
628 *w = 0;
629
630 r = safe_atou(p, &maj);
631 if (r < 0)
632 continue;
633 if (maj <= 0)
634 continue;
635
636 w++;
637 w += strspn(w, WHITESPACE);
638
639 if (fnmatch(name, w, 0) != 0)
640 continue;
641
642 if (cg_all_unified() > 0) {
643 if (!prog)
644 continue;
645
646 (void) cgroup_bpf_whitelist_major(prog,
647 type == 'c' ? BPF_DEVCG_DEV_CHAR : BPF_DEVCG_DEV_BLOCK,
648 maj, acc);
649 } else {
650 sprintf(buf,
651 "%c %u:* %s",
652 type,
653 maj,
654 acc);
655
656 /* Changing the devices list of a populated cgroup might result in EINVAL, hence ignore EINVAL
657 * here. */
658
659 r = cg_set_attribute("devices", path, "devices.allow", buf);
660 if (r < 0)
661 log_full_errno(IN_SET(r, -ENOENT, -EROFS, -EINVAL, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING,
662 r, "Failed to set devices.allow on %s: %m", path);
663 }
664 }
665
666 return 0;
667 }
668
669 static bool cgroup_context_has_cpu_weight(CGroupContext *c) {
670 return c->cpu_weight != CGROUP_WEIGHT_INVALID ||
671 c->startup_cpu_weight != CGROUP_WEIGHT_INVALID;
672 }
673
674 static bool cgroup_context_has_cpu_shares(CGroupContext *c) {
675 return c->cpu_shares != CGROUP_CPU_SHARES_INVALID ||
676 c->startup_cpu_shares != CGROUP_CPU_SHARES_INVALID;
677 }
678
679 static uint64_t cgroup_context_cpu_weight(CGroupContext *c, ManagerState state) {
680 if (IN_SET(state, MANAGER_STARTING, MANAGER_INITIALIZING) &&
681 c->startup_cpu_weight != CGROUP_WEIGHT_INVALID)
682 return c->startup_cpu_weight;
683 else if (c->cpu_weight != CGROUP_WEIGHT_INVALID)
684 return c->cpu_weight;
685 else
686 return CGROUP_WEIGHT_DEFAULT;
687 }
688
689 static uint64_t cgroup_context_cpu_shares(CGroupContext *c, ManagerState state) {
690 if (IN_SET(state, MANAGER_STARTING, MANAGER_INITIALIZING) &&
691 c->startup_cpu_shares != CGROUP_CPU_SHARES_INVALID)
692 return c->startup_cpu_shares;
693 else if (c->cpu_shares != CGROUP_CPU_SHARES_INVALID)
694 return c->cpu_shares;
695 else
696 return CGROUP_CPU_SHARES_DEFAULT;
697 }
698
699 usec_t cgroup_cpu_adjust_period(usec_t period, usec_t quota, usec_t resolution, usec_t max_period) {
700 /* kernel uses a minimum resolution of 1ms, so both period and (quota * period)
701 * need to be higher than that boundary. quota is specified in USecPerSec.
702 * Additionally, period must be at most max_period. */
703 assert(quota > 0);
704
705 return MIN(MAX3(period, resolution, resolution * USEC_PER_SEC / quota), max_period);
706 }
707
708 static usec_t cgroup_cpu_adjust_period_and_log(Unit *u, usec_t period, usec_t quota) {
709 usec_t new_period;
710
711 if (quota == USEC_INFINITY)
712 /* Always use default period for infinity quota. */
713 return CGROUP_CPU_QUOTA_DEFAULT_PERIOD_USEC;
714
715 if (period == USEC_INFINITY)
716 /* Default period was requested. */
717 period = CGROUP_CPU_QUOTA_DEFAULT_PERIOD_USEC;
718
719 /* Clamp to interval [1ms, 1s] */
720 new_period = cgroup_cpu_adjust_period(period, quota, USEC_PER_MSEC, USEC_PER_SEC);
721
722 if (new_period != period) {
723 char v[FORMAT_TIMESPAN_MAX];
724 log_unit_full(u, u->warned_clamping_cpu_quota_period ? LOG_DEBUG : LOG_WARNING, 0,
725 "Clamping CPU interval for cpu.max: period is now %s",
726 format_timespan(v, sizeof(v), new_period, 1));
727 u->warned_clamping_cpu_quota_period = true;
728 }
729
730 return new_period;
731 }
732
733 static void cgroup_apply_unified_cpu_weight(Unit *u, uint64_t weight) {
734 char buf[DECIMAL_STR_MAX(uint64_t) + 2];
735
736 xsprintf(buf, "%" PRIu64 "\n", weight);
737 (void) set_attribute_and_warn(u, "cpu", "cpu.weight", buf);
738 }
739
740 static void cgroup_apply_unified_cpu_quota(Unit *u, usec_t quota, usec_t period) {
741 char buf[(DECIMAL_STR_MAX(usec_t) + 1) * 2 + 1];
742
743 period = cgroup_cpu_adjust_period_and_log(u, period, quota);
744 if (quota != USEC_INFINITY)
745 xsprintf(buf, USEC_FMT " " USEC_FMT "\n",
746 MAX(quota * period / USEC_PER_SEC, USEC_PER_MSEC), period);
747 else
748 xsprintf(buf, "max " USEC_FMT "\n", period);
749 (void) set_attribute_and_warn(u, "cpu", "cpu.max", buf);
750 }
751
752 static void cgroup_apply_legacy_cpu_shares(Unit *u, uint64_t shares) {
753 char buf[DECIMAL_STR_MAX(uint64_t) + 2];
754
755 xsprintf(buf, "%" PRIu64 "\n", shares);
756 (void) set_attribute_and_warn(u, "cpu", "cpu.shares", buf);
757 }
758
759 static void cgroup_apply_legacy_cpu_quota(Unit *u, usec_t quota, usec_t period) {
760 char buf[DECIMAL_STR_MAX(usec_t) + 2];
761
762 period = cgroup_cpu_adjust_period_and_log(u, period, quota);
763
764 xsprintf(buf, USEC_FMT "\n", period);
765 (void) set_attribute_and_warn(u, "cpu", "cpu.cfs_period_us", buf);
766
767 if (quota != USEC_INFINITY) {
768 xsprintf(buf, USEC_FMT "\n", MAX(quota * period / USEC_PER_SEC, USEC_PER_MSEC));
769 (void) set_attribute_and_warn(u, "cpu", "cpu.cfs_quota_us", buf);
770 } else
771 (void) set_attribute_and_warn(u, "cpu", "cpu.cfs_quota_us", "-1\n");
772 }
773
774 static uint64_t cgroup_cpu_shares_to_weight(uint64_t shares) {
775 return CLAMP(shares * CGROUP_WEIGHT_DEFAULT / CGROUP_CPU_SHARES_DEFAULT,
776 CGROUP_WEIGHT_MIN, CGROUP_WEIGHT_MAX);
777 }
778
779 static uint64_t cgroup_cpu_weight_to_shares(uint64_t weight) {
780 return CLAMP(weight * CGROUP_CPU_SHARES_DEFAULT / CGROUP_WEIGHT_DEFAULT,
781 CGROUP_CPU_SHARES_MIN, CGROUP_CPU_SHARES_MAX);
782 }
783
784 static bool cgroup_context_has_io_config(CGroupContext *c) {
785 return c->io_accounting ||
786 c->io_weight != CGROUP_WEIGHT_INVALID ||
787 c->startup_io_weight != CGROUP_WEIGHT_INVALID ||
788 c->io_device_weights ||
789 c->io_device_latencies ||
790 c->io_device_limits;
791 }
792
793 static bool cgroup_context_has_blockio_config(CGroupContext *c) {
794 return c->blockio_accounting ||
795 c->blockio_weight != CGROUP_BLKIO_WEIGHT_INVALID ||
796 c->startup_blockio_weight != CGROUP_BLKIO_WEIGHT_INVALID ||
797 c->blockio_device_weights ||
798 c->blockio_device_bandwidths;
799 }
800
801 static uint64_t cgroup_context_io_weight(CGroupContext *c, ManagerState state) {
802 if (IN_SET(state, MANAGER_STARTING, MANAGER_INITIALIZING) &&
803 c->startup_io_weight != CGROUP_WEIGHT_INVALID)
804 return c->startup_io_weight;
805 else if (c->io_weight != CGROUP_WEIGHT_INVALID)
806 return c->io_weight;
807 else
808 return CGROUP_WEIGHT_DEFAULT;
809 }
810
811 static uint64_t cgroup_context_blkio_weight(CGroupContext *c, ManagerState state) {
812 if (IN_SET(state, MANAGER_STARTING, MANAGER_INITIALIZING) &&
813 c->startup_blockio_weight != CGROUP_BLKIO_WEIGHT_INVALID)
814 return c->startup_blockio_weight;
815 else if (c->blockio_weight != CGROUP_BLKIO_WEIGHT_INVALID)
816 return c->blockio_weight;
817 else
818 return CGROUP_BLKIO_WEIGHT_DEFAULT;
819 }
820
821 static uint64_t cgroup_weight_blkio_to_io(uint64_t blkio_weight) {
822 return CLAMP(blkio_weight * CGROUP_WEIGHT_DEFAULT / CGROUP_BLKIO_WEIGHT_DEFAULT,
823 CGROUP_WEIGHT_MIN, CGROUP_WEIGHT_MAX);
824 }
825
826 static uint64_t cgroup_weight_io_to_blkio(uint64_t io_weight) {
827 return CLAMP(io_weight * CGROUP_BLKIO_WEIGHT_DEFAULT / CGROUP_WEIGHT_DEFAULT,
828 CGROUP_BLKIO_WEIGHT_MIN, CGROUP_BLKIO_WEIGHT_MAX);
829 }
830
831 static void cgroup_apply_io_device_weight(Unit *u, const char *dev_path, uint64_t io_weight) {
832 char buf[DECIMAL_STR_MAX(dev_t)*2+2+DECIMAL_STR_MAX(uint64_t)+1];
833 dev_t dev;
834 int r;
835
836 r = lookup_block_device(dev_path, &dev);
837 if (r < 0)
838 return;
839
840 xsprintf(buf, "%u:%u %" PRIu64 "\n", major(dev), minor(dev), io_weight);
841 (void) set_attribute_and_warn(u, "io", "io.weight", buf);
842 }
843
844 static void cgroup_apply_blkio_device_weight(Unit *u, const char *dev_path, uint64_t blkio_weight) {
845 char buf[DECIMAL_STR_MAX(dev_t)*2+2+DECIMAL_STR_MAX(uint64_t)+1];
846 dev_t dev;
847 int r;
848
849 r = lookup_block_device(dev_path, &dev);
850 if (r < 0)
851 return;
852
853 xsprintf(buf, "%u:%u %" PRIu64 "\n", major(dev), minor(dev), blkio_weight);
854 (void) set_attribute_and_warn(u, "blkio", "blkio.weight_device", buf);
855 }
856
857 static void cgroup_apply_io_device_latency(Unit *u, const char *dev_path, usec_t target) {
858 char buf[DECIMAL_STR_MAX(dev_t)*2+2+7+DECIMAL_STR_MAX(uint64_t)+1];
859 dev_t dev;
860 int r;
861
862 r = lookup_block_device(dev_path, &dev);
863 if (r < 0)
864 return;
865
866 if (target != USEC_INFINITY)
867 xsprintf(buf, "%u:%u target=%" PRIu64 "\n", major(dev), minor(dev), target);
868 else
869 xsprintf(buf, "%u:%u target=max\n", major(dev), minor(dev));
870
871 (void) set_attribute_and_warn(u, "io", "io.latency", buf);
872 }
873
874 static void cgroup_apply_io_device_limit(Unit *u, const char *dev_path, uint64_t *limits) {
875 char limit_bufs[_CGROUP_IO_LIMIT_TYPE_MAX][DECIMAL_STR_MAX(uint64_t)];
876 char buf[DECIMAL_STR_MAX(dev_t)*2+2+(6+DECIMAL_STR_MAX(uint64_t)+1)*4];
877 CGroupIOLimitType type;
878 dev_t dev;
879 int r;
880
881 r = lookup_block_device(dev_path, &dev);
882 if (r < 0)
883 return;
884
885 for (type = 0; type < _CGROUP_IO_LIMIT_TYPE_MAX; type++)
886 if (limits[type] != cgroup_io_limit_defaults[type])
887 xsprintf(limit_bufs[type], "%" PRIu64, limits[type]);
888 else
889 xsprintf(limit_bufs[type], "%s", limits[type] == CGROUP_LIMIT_MAX ? "max" : "0");
890
891 xsprintf(buf, "%u:%u rbps=%s wbps=%s riops=%s wiops=%s\n", major(dev), minor(dev),
892 limit_bufs[CGROUP_IO_RBPS_MAX], limit_bufs[CGROUP_IO_WBPS_MAX],
893 limit_bufs[CGROUP_IO_RIOPS_MAX], limit_bufs[CGROUP_IO_WIOPS_MAX]);
894 (void) set_attribute_and_warn(u, "io", "io.max", buf);
895 }
896
897 static void cgroup_apply_blkio_device_limit(Unit *u, const char *dev_path, uint64_t rbps, uint64_t wbps) {
898 char buf[DECIMAL_STR_MAX(dev_t)*2+2+DECIMAL_STR_MAX(uint64_t)+1];
899 dev_t dev;
900 int r;
901
902 r = lookup_block_device(dev_path, &dev);
903 if (r < 0)
904 return;
905
906 sprintf(buf, "%u:%u %" PRIu64 "\n", major(dev), minor(dev), rbps);
907 (void) set_attribute_and_warn(u, "blkio", "blkio.throttle.read_bps_device", buf);
908
909 sprintf(buf, "%u:%u %" PRIu64 "\n", major(dev), minor(dev), wbps);
910 (void) set_attribute_and_warn(u, "blkio", "blkio.throttle.write_bps_device", buf);
911 }
912
913 static bool unit_has_unified_memory_config(Unit *u) {
914 CGroupContext *c;
915
916 assert(u);
917
918 c = unit_get_cgroup_context(u);
919 assert(c);
920
921 return c->memory_min > 0 || unit_get_ancestor_memory_low(u) > 0 ||
922 c->memory_high != CGROUP_LIMIT_MAX || c->memory_max != CGROUP_LIMIT_MAX ||
923 c->memory_swap_max != CGROUP_LIMIT_MAX;
924 }
925
926 static void cgroup_apply_unified_memory_limit(Unit *u, const char *file, uint64_t v) {
927 char buf[DECIMAL_STR_MAX(uint64_t) + 1] = "max\n";
928
929 if (v != CGROUP_LIMIT_MAX)
930 xsprintf(buf, "%" PRIu64 "\n", v);
931
932 (void) set_attribute_and_warn(u, "memory", file, buf);
933 }
934
935 static void cgroup_apply_firewall(Unit *u) {
936 assert(u);
937
938 /* Best-effort: let's apply IP firewalling and/or accounting if that's enabled */
939
940 if (bpf_firewall_compile(u) < 0)
941 return;
942
943 (void) bpf_firewall_install(u);
944 }
945
946 static void cgroup_context_apply(
947 Unit *u,
948 CGroupMask apply_mask,
949 ManagerState state) {
950
951 const char *path;
952 CGroupContext *c;
953 bool is_host_root, is_local_root;
954 int r;
955
956 assert(u);
957
958 /* Nothing to do? Exit early! */
959 if (apply_mask == 0)
960 return;
961
962 /* Some cgroup attributes are not supported on the host root cgroup, hence silently ignore them here. And other
963 * attributes should only be managed for cgroups further down the tree. */
964 is_local_root = unit_has_name(u, SPECIAL_ROOT_SLICE);
965 is_host_root = unit_has_host_root_cgroup(u);
966
967 assert_se(c = unit_get_cgroup_context(u));
968 assert_se(path = u->cgroup_path);
969
970 if (is_local_root) /* Make sure we don't try to display messages with an empty path. */
971 path = "/";
972
973 /* We generally ignore errors caused by read-only mounted cgroup trees (assuming we are running in a container
974 * then), and missing cgroups, i.e. EROFS and ENOENT. */
975
976 /* In fully unified mode these attributes don't exist on the host cgroup root. On legacy the weights exist, but
977 * setting the weight makes very little sense on the host root cgroup, as there are no other cgroups at this
978 * level. The quota exists there too, but any attempt to write to it is refused with EINVAL. Inside of
979 * containers we want to leave control of these to the container manager (and if cgroup v2 delegation is used
980 * we couldn't even write to them if we wanted to). */
981 if ((apply_mask & CGROUP_MASK_CPU) && !is_local_root) {
982
983 if (cg_all_unified() > 0) {
984 uint64_t weight;
985
986 if (cgroup_context_has_cpu_weight(c))
987 weight = cgroup_context_cpu_weight(c, state);
988 else if (cgroup_context_has_cpu_shares(c)) {
989 uint64_t shares;
990
991 shares = cgroup_context_cpu_shares(c, state);
992 weight = cgroup_cpu_shares_to_weight(shares);
993
994 log_cgroup_compat(u, "Applying [Startup]CPUShares=%" PRIu64 " as [Startup]CPUWeight=%" PRIu64 " on %s",
995 shares, weight, path);
996 } else
997 weight = CGROUP_WEIGHT_DEFAULT;
998
999 cgroup_apply_unified_cpu_weight(u, weight);
1000 cgroup_apply_unified_cpu_quota(u, c->cpu_quota_per_sec_usec, c->cpu_quota_period_usec);
1001
1002 } else {
1003 uint64_t shares;
1004
1005 if (cgroup_context_has_cpu_weight(c)) {
1006 uint64_t weight;
1007
1008 weight = cgroup_context_cpu_weight(c, state);
1009 shares = cgroup_cpu_weight_to_shares(weight);
1010
1011 log_cgroup_compat(u, "Applying [Startup]CPUWeight=%" PRIu64 " as [Startup]CPUShares=%" PRIu64 " on %s",
1012 weight, shares, path);
1013 } else if (cgroup_context_has_cpu_shares(c))
1014 shares = cgroup_context_cpu_shares(c, state);
1015 else
1016 shares = CGROUP_CPU_SHARES_DEFAULT;
1017
1018 cgroup_apply_legacy_cpu_shares(u, shares);
1019 cgroup_apply_legacy_cpu_quota(u, c->cpu_quota_per_sec_usec, c->cpu_quota_period_usec);
1020 }
1021 }
1022
1023 /* The 'io' controller attributes are not exported on the host's root cgroup (being a pure cgroup v2
1024 * controller), and in case of containers we want to leave control of these attributes to the container manager
1025 * (and we couldn't access that stuff anyway, even if we tried if proper delegation is used). */
1026 if ((apply_mask & CGROUP_MASK_IO) && !is_local_root) {
1027 char buf[8+DECIMAL_STR_MAX(uint64_t)+1];
1028 bool has_io, has_blockio;
1029 uint64_t weight;
1030
1031 has_io = cgroup_context_has_io_config(c);
1032 has_blockio = cgroup_context_has_blockio_config(c);
1033
1034 if (has_io)
1035 weight = cgroup_context_io_weight(c, state);
1036 else if (has_blockio) {
1037 uint64_t blkio_weight;
1038
1039 blkio_weight = cgroup_context_blkio_weight(c, state);
1040 weight = cgroup_weight_blkio_to_io(blkio_weight);
1041
1042 log_cgroup_compat(u, "Applying [Startup]BlockIOWeight=%" PRIu64 " as [Startup]IOWeight=%" PRIu64,
1043 blkio_weight, weight);
1044 } else
1045 weight = CGROUP_WEIGHT_DEFAULT;
1046
1047 xsprintf(buf, "default %" PRIu64 "\n", weight);
1048 (void) set_attribute_and_warn(u, "io", "io.weight", buf);
1049
1050 if (has_io) {
1051 CGroupIODeviceLatency *latency;
1052 CGroupIODeviceLimit *limit;
1053 CGroupIODeviceWeight *w;
1054
1055 LIST_FOREACH(device_weights, w, c->io_device_weights)
1056 cgroup_apply_io_device_weight(u, w->path, w->weight);
1057
1058 LIST_FOREACH(device_limits, limit, c->io_device_limits)
1059 cgroup_apply_io_device_limit(u, limit->path, limit->limits);
1060
1061 LIST_FOREACH(device_latencies, latency, c->io_device_latencies)
1062 cgroup_apply_io_device_latency(u, latency->path, latency->target_usec);
1063
1064 } else if (has_blockio) {
1065 CGroupBlockIODeviceWeight *w;
1066 CGroupBlockIODeviceBandwidth *b;
1067
1068 LIST_FOREACH(device_weights, w, c->blockio_device_weights) {
1069 weight = cgroup_weight_blkio_to_io(w->weight);
1070
1071 log_cgroup_compat(u, "Applying BlockIODeviceWeight=%" PRIu64 " as IODeviceWeight=%" PRIu64 " for %s",
1072 w->weight, weight, w->path);
1073
1074 cgroup_apply_io_device_weight(u, w->path, weight);
1075 }
1076
1077 LIST_FOREACH(device_bandwidths, b, c->blockio_device_bandwidths) {
1078 uint64_t limits[_CGROUP_IO_LIMIT_TYPE_MAX];
1079 CGroupIOLimitType type;
1080
1081 for (type = 0; type < _CGROUP_IO_LIMIT_TYPE_MAX; type++)
1082 limits[type] = cgroup_io_limit_defaults[type];
1083
1084 limits[CGROUP_IO_RBPS_MAX] = b->rbps;
1085 limits[CGROUP_IO_WBPS_MAX] = b->wbps;
1086
1087 log_cgroup_compat(u, "Applying BlockIO{Read|Write}Bandwidth=%" PRIu64 " %" PRIu64 " as IO{Read|Write}BandwidthMax= for %s",
1088 b->rbps, b->wbps, b->path);
1089
1090 cgroup_apply_io_device_limit(u, b->path, limits);
1091 }
1092 }
1093 }
1094
1095 if (apply_mask & CGROUP_MASK_BLKIO) {
1096 bool has_io, has_blockio;
1097
1098 has_io = cgroup_context_has_io_config(c);
1099 has_blockio = cgroup_context_has_blockio_config(c);
1100
1101 /* Applying a 'weight' never makes sense for the host root cgroup, and for containers this should be
1102 * left to our container manager, too. */
1103 if (!is_local_root) {
1104 char buf[DECIMAL_STR_MAX(uint64_t)+1];
1105 uint64_t weight;
1106
1107 if (has_io) {
1108 uint64_t io_weight;
1109
1110 io_weight = cgroup_context_io_weight(c, state);
1111 weight = cgroup_weight_io_to_blkio(cgroup_context_io_weight(c, state));
1112
1113 log_cgroup_compat(u, "Applying [Startup]IOWeight=%" PRIu64 " as [Startup]BlockIOWeight=%" PRIu64,
1114 io_weight, weight);
1115 } else if (has_blockio)
1116 weight = cgroup_context_blkio_weight(c, state);
1117 else
1118 weight = CGROUP_BLKIO_WEIGHT_DEFAULT;
1119
1120 xsprintf(buf, "%" PRIu64 "\n", weight);
1121 (void) set_attribute_and_warn(u, "blkio", "blkio.weight", buf);
1122
1123 if (has_io) {
1124 CGroupIODeviceWeight *w;
1125
1126 LIST_FOREACH(device_weights, w, c->io_device_weights) {
1127 weight = cgroup_weight_io_to_blkio(w->weight);
1128
1129 log_cgroup_compat(u, "Applying IODeviceWeight=%" PRIu64 " as BlockIODeviceWeight=%" PRIu64 " for %s",
1130 w->weight, weight, w->path);
1131
1132 cgroup_apply_blkio_device_weight(u, w->path, weight);
1133 }
1134 } else if (has_blockio) {
1135 CGroupBlockIODeviceWeight *w;
1136
1137 LIST_FOREACH(device_weights, w, c->blockio_device_weights)
1138 cgroup_apply_blkio_device_weight(u, w->path, w->weight);
1139 }
1140 }
1141
1142 /* The bandwith limits are something that make sense to be applied to the host's root but not container
1143 * roots, as there we want the container manager to handle it */
1144 if (is_host_root || !is_local_root) {
1145 if (has_io) {
1146 CGroupIODeviceLimit *l;
1147
1148 LIST_FOREACH(device_limits, l, c->io_device_limits) {
1149 log_cgroup_compat(u, "Applying IO{Read|Write}Bandwidth=%" PRIu64 " %" PRIu64 " as BlockIO{Read|Write}BandwidthMax= for %s",
1150 l->limits[CGROUP_IO_RBPS_MAX], l->limits[CGROUP_IO_WBPS_MAX], l->path);
1151
1152 cgroup_apply_blkio_device_limit(u, l->path, l->limits[CGROUP_IO_RBPS_MAX], l->limits[CGROUP_IO_WBPS_MAX]);
1153 }
1154 } else if (has_blockio) {
1155 CGroupBlockIODeviceBandwidth *b;
1156
1157 LIST_FOREACH(device_bandwidths, b, c->blockio_device_bandwidths)
1158 cgroup_apply_blkio_device_limit(u, b->path, b->rbps, b->wbps);
1159 }
1160 }
1161 }
1162
1163 /* In unified mode 'memory' attributes do not exist on the root cgroup. In legacy mode 'memory.limit_in_bytes'
1164 * exists on the root cgroup, but any writes to it are refused with EINVAL. And if we run in a container we
1165 * want to leave control to the container manager (and if proper cgroup v2 delegation is used we couldn't even
1166 * write to this if we wanted to.) */
1167 if ((apply_mask & CGROUP_MASK_MEMORY) && !is_local_root) {
1168
1169 if (cg_all_unified() > 0) {
1170 uint64_t max, swap_max = CGROUP_LIMIT_MAX;
1171
1172 if (unit_has_unified_memory_config(u)) {
1173 max = c->memory_max;
1174 swap_max = c->memory_swap_max;
1175 } else {
1176 max = c->memory_limit;
1177
1178 if (max != CGROUP_LIMIT_MAX)
1179 log_cgroup_compat(u, "Applying MemoryLimit=%" PRIu64 " as MemoryMax=", max);
1180 }
1181
1182 cgroup_apply_unified_memory_limit(u, "memory.min", c->memory_min);
1183 cgroup_apply_unified_memory_limit(u, "memory.low", unit_get_ancestor_memory_low(u));
1184 cgroup_apply_unified_memory_limit(u, "memory.high", c->memory_high);
1185 cgroup_apply_unified_memory_limit(u, "memory.max", max);
1186 cgroup_apply_unified_memory_limit(u, "memory.swap.max", swap_max);
1187
1188 (void) set_attribute_and_warn(u, "memory", "memory.oom.group", one_zero(c->memory_oom_group));
1189
1190 } else {
1191 char buf[DECIMAL_STR_MAX(uint64_t) + 1];
1192 uint64_t val;
1193
1194 if (unit_has_unified_memory_config(u)) {
1195 val = c->memory_max;
1196 log_cgroup_compat(u, "Applying MemoryMax=%" PRIi64 " as MemoryLimit=", val);
1197 } else
1198 val = c->memory_limit;
1199
1200 if (val == CGROUP_LIMIT_MAX)
1201 strncpy(buf, "-1\n", sizeof(buf));
1202 else
1203 xsprintf(buf, "%" PRIu64 "\n", val);
1204
1205 (void) set_attribute_and_warn(u, "memory", "memory.limit_in_bytes", buf);
1206 }
1207 }
1208
1209 /* On cgroup v2 we can apply BPF everywhere. On cgroup v1 we apply it everywhere except for the root of
1210 * containers, where we leave this to the manager */
1211 if ((apply_mask & (CGROUP_MASK_DEVICES | CGROUP_MASK_BPF_DEVICES)) &&
1212 (is_host_root || cg_all_unified() > 0 || !is_local_root)) {
1213 _cleanup_(bpf_program_unrefp) BPFProgram *prog = NULL;
1214 CGroupDeviceAllow *a;
1215
1216 if (cg_all_unified() > 0) {
1217 r = cgroup_init_device_bpf(&prog, c->device_policy, c->device_allow);
1218 if (r < 0)
1219 log_unit_warning_errno(u, r, "Failed to initialize device control bpf program: %m");
1220 } else {
1221 /* Changing the devices list of a populated cgroup might result in EINVAL, hence ignore EINVAL
1222 * here. */
1223
1224 if (c->device_allow || c->device_policy != CGROUP_AUTO)
1225 r = cg_set_attribute("devices", path, "devices.deny", "a");
1226 else
1227 r = cg_set_attribute("devices", path, "devices.allow", "a");
1228 if (r < 0)
1229 log_unit_full(u, IN_SET(r, -ENOENT, -EROFS, -EINVAL, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
1230 "Failed to reset devices.allow/devices.deny: %m");
1231 }
1232
1233 if (c->device_policy == CGROUP_CLOSED ||
1234 (c->device_policy == CGROUP_AUTO && c->device_allow)) {
1235 static const char auto_devices[] =
1236 "/dev/null\0" "rwm\0"
1237 "/dev/zero\0" "rwm\0"
1238 "/dev/full\0" "rwm\0"
1239 "/dev/random\0" "rwm\0"
1240 "/dev/urandom\0" "rwm\0"
1241 "/dev/tty\0" "rwm\0"
1242 "/dev/ptmx\0" "rwm\0"
1243 /* Allow /run/systemd/inaccessible/{chr,blk} devices for mapping InaccessiblePaths */
1244 "/run/systemd/inaccessible/chr\0" "rwm\0"
1245 "/run/systemd/inaccessible/blk\0" "rwm\0";
1246
1247 const char *x, *y;
1248
1249 NULSTR_FOREACH_PAIR(x, y, auto_devices)
1250 (void) whitelist_device(prog, path, x, y);
1251
1252 /* PTS (/dev/pts) devices may not be duplicated, but accessed */
1253 (void) whitelist_major(prog, path, "pts", 'c', "rw");
1254 }
1255
1256 LIST_FOREACH(device_allow, a, c->device_allow) {
1257 char acc[4], *val;
1258 unsigned k = 0;
1259
1260 if (a->r)
1261 acc[k++] = 'r';
1262 if (a->w)
1263 acc[k++] = 'w';
1264 if (a->m)
1265 acc[k++] = 'm';
1266
1267 if (k == 0)
1268 continue;
1269
1270 acc[k++] = 0;
1271
1272 if (path_startswith(a->path, "/dev/"))
1273 (void) whitelist_device(prog, path, a->path, acc);
1274 else if ((val = startswith(a->path, "block-")))
1275 (void) whitelist_major(prog, path, val, 'b', acc);
1276 else if ((val = startswith(a->path, "char-")))
1277 (void) whitelist_major(prog, path, val, 'c', acc);
1278 else
1279 log_unit_debug(u, "Ignoring device '%s' while writing cgroup attribute.", a->path);
1280 }
1281
1282 r = cgroup_apply_device_bpf(u, prog, c->device_policy, c->device_allow);
1283 if (r < 0) {
1284 static bool warned = false;
1285
1286 log_full_errno(warned ? LOG_DEBUG : LOG_WARNING, r,
1287 "Unit %s configures device ACL, but the local system doesn't seem to support the BPF-based device controller.\n"
1288 "Proceeding WITHOUT applying ACL (all devices will be accessible)!\n"
1289 "(This warning is only shown for the first loaded unit using device ACL.)", u->id);
1290
1291 warned = true;
1292 }
1293 }
1294
1295 if (apply_mask & CGROUP_MASK_PIDS) {
1296
1297 if (is_host_root) {
1298 /* So, the "pids" controller does not expose anything on the root cgroup, in order not to
1299 * replicate knobs exposed elsewhere needlessly. We abstract this away here however, and when
1300 * the knobs of the root cgroup are modified propagate this to the relevant sysctls. There's a
1301 * non-obvious asymmetry however: unlike the cgroup properties we don't really want to take
1302 * exclusive ownership of the sysctls, but we still want to honour things if the user sets
1303 * limits. Hence we employ sort of a one-way strategy: when the user sets a bounded limit
1304 * through us it counts. When the user afterwards unsets it again (i.e. sets it to unbounded)
1305 * it also counts. But if the user never set a limit through us (i.e. we are the default of
1306 * "unbounded") we leave things unmodified. For this we manage a global boolean that we turn on
1307 * the first time we set a limit. Note that this boolean is flushed out on manager reload,
1308 * which is desirable so that there's an offical way to release control of the sysctl from
1309 * systemd: set the limit to unbounded and reload. */
1310
1311 if (c->tasks_max != CGROUP_LIMIT_MAX) {
1312 u->manager->sysctl_pid_max_changed = true;
1313 r = procfs_tasks_set_limit(c->tasks_max);
1314 } else if (u->manager->sysctl_pid_max_changed)
1315 r = procfs_tasks_set_limit(TASKS_MAX);
1316 else
1317 r = 0;
1318 if (r < 0)
1319 log_unit_full(u, LOG_LEVEL_CGROUP_WRITE(r), r,
1320 "Failed to write to tasks limit sysctls: %m");
1321 }
1322
1323 /* The attribute itself is not available on the host root cgroup, and in the container case we want to
1324 * leave it for the container manager. */
1325 if (!is_local_root) {
1326 if (c->tasks_max != CGROUP_LIMIT_MAX) {
1327 char buf[DECIMAL_STR_MAX(uint64_t) + 2];
1328
1329 sprintf(buf, "%" PRIu64 "\n", c->tasks_max);
1330 (void) set_attribute_and_warn(u, "pids", "pids.max", buf);
1331 } else
1332 (void) set_attribute_and_warn(u, "pids", "pids.max", "max\n");
1333 }
1334 }
1335
1336 if (apply_mask & CGROUP_MASK_BPF_FIREWALL)
1337 cgroup_apply_firewall(u);
1338 }
1339
1340 static bool unit_get_needs_bpf_firewall(Unit *u) {
1341 CGroupContext *c;
1342 Unit *p;
1343 assert(u);
1344
1345 c = unit_get_cgroup_context(u);
1346 if (!c)
1347 return false;
1348
1349 if (c->ip_accounting ||
1350 c->ip_address_allow ||
1351 c->ip_address_deny)
1352 return true;
1353
1354 /* If any parent slice has an IP access list defined, it applies too */
1355 for (p = UNIT_DEREF(u->slice); p; p = UNIT_DEREF(p->slice)) {
1356 c = unit_get_cgroup_context(p);
1357 if (!c)
1358 return false;
1359
1360 if (c->ip_address_allow ||
1361 c->ip_address_deny)
1362 return true;
1363 }
1364
1365 return false;
1366 }
1367
1368 static CGroupMask unit_get_cgroup_mask(Unit *u) {
1369 CGroupMask mask = 0;
1370 CGroupContext *c;
1371
1372 assert(u);
1373
1374 c = unit_get_cgroup_context(u);
1375
1376 /* Figure out which controllers we need, based on the cgroup context object */
1377
1378 if (c->cpu_accounting)
1379 mask |= get_cpu_accounting_mask();
1380
1381 if (cgroup_context_has_cpu_weight(c) ||
1382 cgroup_context_has_cpu_shares(c) ||
1383 c->cpu_quota_per_sec_usec != USEC_INFINITY)
1384 mask |= CGROUP_MASK_CPU;
1385
1386 if (cgroup_context_has_io_config(c) || cgroup_context_has_blockio_config(c))
1387 mask |= CGROUP_MASK_IO | CGROUP_MASK_BLKIO;
1388
1389 if (c->memory_accounting ||
1390 c->memory_limit != CGROUP_LIMIT_MAX ||
1391 unit_has_unified_memory_config(u))
1392 mask |= CGROUP_MASK_MEMORY;
1393
1394 if (c->device_allow ||
1395 c->device_policy != CGROUP_AUTO)
1396 mask |= CGROUP_MASK_DEVICES | CGROUP_MASK_BPF_DEVICES;
1397
1398 if (c->tasks_accounting ||
1399 c->tasks_max != CGROUP_LIMIT_MAX)
1400 mask |= CGROUP_MASK_PIDS;
1401
1402 return CGROUP_MASK_EXTEND_JOINED(mask);
1403 }
1404
1405 static CGroupMask unit_get_bpf_mask(Unit *u) {
1406 CGroupMask mask = 0;
1407
1408 /* Figure out which controllers we need, based on the cgroup context, possibly taking into account children
1409 * too. */
1410
1411 if (unit_get_needs_bpf_firewall(u))
1412 mask |= CGROUP_MASK_BPF_FIREWALL;
1413
1414 return mask;
1415 }
1416
1417 CGroupMask unit_get_own_mask(Unit *u) {
1418 CGroupContext *c;
1419
1420 /* Returns the mask of controllers the unit needs for itself. If a unit is not properly loaded, return an empty
1421 * mask, as we shouldn't reflect it in the cgroup hierarchy then. */
1422
1423 if (u->load_state != UNIT_LOADED)
1424 return 0;
1425
1426 c = unit_get_cgroup_context(u);
1427 if (!c)
1428 return 0;
1429
1430 return (unit_get_cgroup_mask(u) | unit_get_bpf_mask(u) | unit_get_delegate_mask(u)) & ~unit_get_ancestor_disable_mask(u);
1431 }
1432
1433 CGroupMask unit_get_delegate_mask(Unit *u) {
1434 CGroupContext *c;
1435
1436 /* If delegation is turned on, then turn on selected controllers, unless we are on the legacy hierarchy and the
1437 * process we fork into is known to drop privileges, and hence shouldn't get access to the controllers.
1438 *
1439 * Note that on the unified hierarchy it is safe to delegate controllers to unprivileged services. */
1440
1441 if (!unit_cgroup_delegate(u))
1442 return 0;
1443
1444 if (cg_all_unified() <= 0) {
1445 ExecContext *e;
1446
1447 e = unit_get_exec_context(u);
1448 if (e && !exec_context_maintains_privileges(e))
1449 return 0;
1450 }
1451
1452 assert_se(c = unit_get_cgroup_context(u));
1453 return CGROUP_MASK_EXTEND_JOINED(c->delegate_controllers);
1454 }
1455
1456 CGroupMask unit_get_members_mask(Unit *u) {
1457 assert(u);
1458
1459 /* Returns the mask of controllers all of the unit's children require, merged */
1460
1461 if (u->cgroup_members_mask_valid)
1462 return u->cgroup_members_mask; /* Use cached value if possible */
1463
1464 u->cgroup_members_mask = 0;
1465
1466 if (u->type == UNIT_SLICE) {
1467 void *v;
1468 Unit *member;
1469 Iterator i;
1470
1471 HASHMAP_FOREACH_KEY(v, member, u->dependencies[UNIT_BEFORE], i) {
1472 if (UNIT_DEREF(member->slice) == u)
1473 u->cgroup_members_mask |= unit_get_subtree_mask(member); /* note that this calls ourselves again, for the children */
1474 }
1475 }
1476
1477 u->cgroup_members_mask_valid = true;
1478 return u->cgroup_members_mask;
1479 }
1480
1481 CGroupMask unit_get_siblings_mask(Unit *u) {
1482 assert(u);
1483
1484 /* Returns the mask of controllers all of the unit's siblings
1485 * require, i.e. the members mask of the unit's parent slice
1486 * if there is one. */
1487
1488 if (UNIT_ISSET(u->slice))
1489 return unit_get_members_mask(UNIT_DEREF(u->slice));
1490
1491 return unit_get_subtree_mask(u); /* we are the top-level slice */
1492 }
1493
1494 CGroupMask unit_get_disable_mask(Unit *u) {
1495 CGroupContext *c;
1496
1497 c = unit_get_cgroup_context(u);
1498 if (!c)
1499 return 0;
1500
1501 return c->disable_controllers;
1502 }
1503
1504 CGroupMask unit_get_ancestor_disable_mask(Unit *u) {
1505 CGroupMask mask;
1506
1507 assert(u);
1508 mask = unit_get_disable_mask(u);
1509
1510 /* Returns the mask of controllers which are marked as forcibly
1511 * disabled in any ancestor unit or the unit in question. */
1512
1513 if (UNIT_ISSET(u->slice))
1514 mask |= unit_get_ancestor_disable_mask(UNIT_DEREF(u->slice));
1515
1516 return mask;
1517 }
1518
1519 CGroupMask unit_get_subtree_mask(Unit *u) {
1520
1521 /* Returns the mask of this subtree, meaning of the group
1522 * itself and its children. */
1523
1524 return unit_get_own_mask(u) | unit_get_members_mask(u);
1525 }
1526
1527 CGroupMask unit_get_target_mask(Unit *u) {
1528 CGroupMask mask;
1529
1530 /* This returns the cgroup mask of all controllers to enable
1531 * for a specific cgroup, i.e. everything it needs itself,
1532 * plus all that its children need, plus all that its siblings
1533 * need. This is primarily useful on the legacy cgroup
1534 * hierarchy, where we need to duplicate each cgroup in each
1535 * hierarchy that shall be enabled for it. */
1536
1537 mask = unit_get_own_mask(u) | unit_get_members_mask(u) | unit_get_siblings_mask(u);
1538 mask &= u->manager->cgroup_supported;
1539 mask &= ~unit_get_ancestor_disable_mask(u);
1540
1541 return mask;
1542 }
1543
1544 CGroupMask unit_get_enable_mask(Unit *u) {
1545 CGroupMask mask;
1546
1547 /* This returns the cgroup mask of all controllers to enable
1548 * for the children of a specific cgroup. This is primarily
1549 * useful for the unified cgroup hierarchy, where each cgroup
1550 * controls which controllers are enabled for its children. */
1551
1552 mask = unit_get_members_mask(u);
1553 mask &= u->manager->cgroup_supported;
1554 mask &= ~unit_get_ancestor_disable_mask(u);
1555
1556 return mask;
1557 }
1558
1559 void unit_invalidate_cgroup_members_masks(Unit *u) {
1560 assert(u);
1561
1562 /* Recurse invalidate the member masks cache all the way up the tree */
1563 u->cgroup_members_mask_valid = false;
1564
1565 if (UNIT_ISSET(u->slice))
1566 unit_invalidate_cgroup_members_masks(UNIT_DEREF(u->slice));
1567 }
1568
1569 const char *unit_get_realized_cgroup_path(Unit *u, CGroupMask mask) {
1570
1571 /* Returns the realized cgroup path of the specified unit where all specified controllers are available. */
1572
1573 while (u) {
1574
1575 if (u->cgroup_path &&
1576 u->cgroup_realized &&
1577 FLAGS_SET(u->cgroup_realized_mask, mask))
1578 return u->cgroup_path;
1579
1580 u = UNIT_DEREF(u->slice);
1581 }
1582
1583 return NULL;
1584 }
1585
1586 static const char *migrate_callback(CGroupMask mask, void *userdata) {
1587 return unit_get_realized_cgroup_path(userdata, mask);
1588 }
1589
1590 char *unit_default_cgroup_path(const Unit *u) {
1591 _cleanup_free_ char *escaped = NULL, *slice = NULL;
1592 int r;
1593
1594 assert(u);
1595
1596 if (unit_has_name(u, SPECIAL_ROOT_SLICE))
1597 return strdup(u->manager->cgroup_root);
1598
1599 if (UNIT_ISSET(u->slice) && !unit_has_name(UNIT_DEREF(u->slice), SPECIAL_ROOT_SLICE)) {
1600 r = cg_slice_to_path(UNIT_DEREF(u->slice)->id, &slice);
1601 if (r < 0)
1602 return NULL;
1603 }
1604
1605 escaped = cg_escape(u->id);
1606 if (!escaped)
1607 return NULL;
1608
1609 if (slice)
1610 return strjoin(u->manager->cgroup_root, "/", slice, "/",
1611 escaped);
1612 else
1613 return strjoin(u->manager->cgroup_root, "/", escaped);
1614 }
1615
1616 int unit_set_cgroup_path(Unit *u, const char *path) {
1617 _cleanup_free_ char *p = NULL;
1618 int r;
1619
1620 assert(u);
1621
1622 if (streq_ptr(u->cgroup_path, path))
1623 return 0;
1624
1625 if (path) {
1626 p = strdup(path);
1627 if (!p)
1628 return -ENOMEM;
1629 }
1630
1631 if (p) {
1632 r = hashmap_put(u->manager->cgroup_unit, p, u);
1633 if (r < 0)
1634 return r;
1635 }
1636
1637 unit_release_cgroup(u);
1638 u->cgroup_path = TAKE_PTR(p);
1639
1640 return 1;
1641 }
1642
1643 int unit_watch_cgroup(Unit *u) {
1644 _cleanup_free_ char *events = NULL;
1645 int r;
1646
1647 assert(u);
1648
1649 /* Watches the "cgroups.events" attribute of this unit's cgroup for "empty" events, but only if
1650 * cgroupv2 is available. */
1651
1652 if (!u->cgroup_path)
1653 return 0;
1654
1655 if (u->cgroup_control_inotify_wd >= 0)
1656 return 0;
1657
1658 /* Only applies to the unified hierarchy */
1659 r = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
1660 if (r < 0)
1661 return log_error_errno(r, "Failed to determine whether the name=systemd hierarchy is unified: %m");
1662 if (r == 0)
1663 return 0;
1664
1665 /* No point in watch the top-level slice, it's never going to run empty. */
1666 if (unit_has_name(u, SPECIAL_ROOT_SLICE))
1667 return 0;
1668
1669 r = hashmap_ensure_allocated(&u->manager->cgroup_control_inotify_wd_unit, &trivial_hash_ops);
1670 if (r < 0)
1671 return log_oom();
1672
1673 r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, "cgroup.events", &events);
1674 if (r < 0)
1675 return log_oom();
1676
1677 u->cgroup_control_inotify_wd = inotify_add_watch(u->manager->cgroup_inotify_fd, events, IN_MODIFY);
1678 if (u->cgroup_control_inotify_wd < 0) {
1679
1680 if (errno == ENOENT) /* If the directory is already gone we don't need to track it, so this
1681 * is not an error */
1682 return 0;
1683
1684 return log_unit_error_errno(u, errno, "Failed to add control inotify watch descriptor for control group %s: %m", u->cgroup_path);
1685 }
1686
1687 r = hashmap_put(u->manager->cgroup_control_inotify_wd_unit, INT_TO_PTR(u->cgroup_control_inotify_wd), u);
1688 if (r < 0)
1689 return log_unit_error_errno(u, r, "Failed to add control inotify watch descriptor to hash map: %m");
1690
1691 return 0;
1692 }
1693
1694 int unit_watch_cgroup_memory(Unit *u) {
1695 _cleanup_free_ char *events = NULL;
1696 CGroupContext *c;
1697 int r;
1698
1699 assert(u);
1700
1701 /* Watches the "memory.events" attribute of this unit's cgroup for "oom_kill" events, but only if
1702 * cgroupv2 is available. */
1703
1704 if (!u->cgroup_path)
1705 return 0;
1706
1707 c = unit_get_cgroup_context(u);
1708 if (!c)
1709 return 0;
1710
1711 /* The "memory.events" attribute is only available if the memory controller is on. Let's hence tie
1712 * this to memory accounting, in a way watching for OOM kills is a form of memory accounting after
1713 * all. */
1714 if (!c->memory_accounting)
1715 return 0;
1716
1717 /* Don't watch inner nodes, as the kernel doesn't report oom_kill events recursively currently, and
1718 * we also don't want to generate a log message for each parent cgroup of a process. */
1719 if (u->type == UNIT_SLICE)
1720 return 0;
1721
1722 if (u->cgroup_memory_inotify_wd >= 0)
1723 return 0;
1724
1725 /* Only applies to the unified hierarchy */
1726 r = cg_all_unified();
1727 if (r < 0)
1728 return log_error_errno(r, "Failed to determine whether the memory controller is unified: %m");
1729 if (r == 0)
1730 return 0;
1731
1732 r = hashmap_ensure_allocated(&u->manager->cgroup_memory_inotify_wd_unit, &trivial_hash_ops);
1733 if (r < 0)
1734 return log_oom();
1735
1736 r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, "memory.events", &events);
1737 if (r < 0)
1738 return log_oom();
1739
1740 u->cgroup_memory_inotify_wd = inotify_add_watch(u->manager->cgroup_inotify_fd, events, IN_MODIFY);
1741 if (u->cgroup_memory_inotify_wd < 0) {
1742
1743 if (errno == ENOENT) /* If the directory is already gone we don't need to track it, so this
1744 * is not an error */
1745 return 0;
1746
1747 return log_unit_error_errno(u, errno, "Failed to add memory inotify watch descriptor for control group %s: %m", u->cgroup_path);
1748 }
1749
1750 r = hashmap_put(u->manager->cgroup_memory_inotify_wd_unit, INT_TO_PTR(u->cgroup_memory_inotify_wd), u);
1751 if (r < 0)
1752 return log_unit_error_errno(u, r, "Failed to add memory inotify watch descriptor to hash map: %m");
1753
1754 return 0;
1755 }
1756
1757 int unit_pick_cgroup_path(Unit *u) {
1758 _cleanup_free_ char *path = NULL;
1759 int r;
1760
1761 assert(u);
1762
1763 if (u->cgroup_path)
1764 return 0;
1765
1766 if (!UNIT_HAS_CGROUP_CONTEXT(u))
1767 return -EINVAL;
1768
1769 path = unit_default_cgroup_path(u);
1770 if (!path)
1771 return log_oom();
1772
1773 r = unit_set_cgroup_path(u, path);
1774 if (r == -EEXIST)
1775 return log_unit_error_errno(u, r, "Control group %s exists already.", path);
1776 if (r < 0)
1777 return log_unit_error_errno(u, r, "Failed to set unit's control group path to %s: %m", path);
1778
1779 return 0;
1780 }
1781
1782 static int unit_create_cgroup(
1783 Unit *u,
1784 CGroupMask target_mask,
1785 CGroupMask enable_mask,
1786 ManagerState state) {
1787
1788 bool created;
1789 int r;
1790
1791 assert(u);
1792
1793 if (!UNIT_HAS_CGROUP_CONTEXT(u))
1794 return 0;
1795
1796 /* Figure out our cgroup path */
1797 r = unit_pick_cgroup_path(u);
1798 if (r < 0)
1799 return r;
1800
1801 /* First, create our own group */
1802 r = cg_create_everywhere(u->manager->cgroup_supported, target_mask, u->cgroup_path);
1803 if (r < 0)
1804 return log_unit_error_errno(u, r, "Failed to create cgroup %s: %m", u->cgroup_path);
1805 created = r;
1806
1807 /* Start watching it */
1808 (void) unit_watch_cgroup(u);
1809 (void) unit_watch_cgroup_memory(u);
1810
1811 /* Preserve enabled controllers in delegated units, adjust others. */
1812 if (created || !u->cgroup_realized || !unit_cgroup_delegate(u)) {
1813 CGroupMask result_mask = 0;
1814
1815 /* Enable all controllers we need */
1816 r = cg_enable_everywhere(u->manager->cgroup_supported, enable_mask, u->cgroup_path, &result_mask);
1817 if (r < 0)
1818 log_unit_warning_errno(u, r, "Failed to enable/disable controllers on cgroup %s, ignoring: %m", u->cgroup_path);
1819
1820 /* If we just turned off a controller, this might release the controller for our parent too, let's
1821 * enqueue the parent for re-realization in that case again. */
1822 if (UNIT_ISSET(u->slice)) {
1823 CGroupMask turned_off;
1824
1825 turned_off = (u->cgroup_realized ? u->cgroup_enabled_mask & ~result_mask : 0);
1826 if (turned_off != 0) {
1827 Unit *parent;
1828
1829 /* Force the parent to propagate the enable mask to the kernel again, by invalidating
1830 * the controller we just turned off. */
1831
1832 for (parent = UNIT_DEREF(u->slice); parent; parent = UNIT_DEREF(parent->slice))
1833 unit_invalidate_cgroup(parent, turned_off);
1834 }
1835 }
1836
1837 /* Remember what's actually enabled now */
1838 u->cgroup_enabled_mask = result_mask;
1839 }
1840
1841 /* Keep track that this is now realized */
1842 u->cgroup_realized = true;
1843 u->cgroup_realized_mask = target_mask;
1844
1845 if (u->type != UNIT_SLICE && !unit_cgroup_delegate(u)) {
1846
1847 /* Then, possibly move things over, but not if
1848 * subgroups may contain processes, which is the case
1849 * for slice and delegation units. */
1850 r = cg_migrate_everywhere(u->manager->cgroup_supported, u->cgroup_path, u->cgroup_path, migrate_callback, u);
1851 if (r < 0)
1852 log_unit_warning_errno(u, r, "Failed to migrate cgroup from to %s, ignoring: %m", u->cgroup_path);
1853 }
1854
1855 /* Set attributes */
1856 cgroup_context_apply(u, target_mask, state);
1857 cgroup_xattr_apply(u);
1858
1859 return 0;
1860 }
1861
1862 static int unit_attach_pid_to_cgroup_via_bus(Unit *u, pid_t pid, const char *suffix_path) {
1863 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
1864 char *pp;
1865 int r;
1866
1867 assert(u);
1868
1869 if (MANAGER_IS_SYSTEM(u->manager))
1870 return -EINVAL;
1871
1872 if (!u->manager->system_bus)
1873 return -EIO;
1874
1875 if (!u->cgroup_path)
1876 return -EINVAL;
1877
1878 /* Determine this unit's cgroup path relative to our cgroup root */
1879 pp = path_startswith(u->cgroup_path, u->manager->cgroup_root);
1880 if (!pp)
1881 return -EINVAL;
1882
1883 pp = strjoina("/", pp, suffix_path);
1884 path_simplify(pp, false);
1885
1886 r = sd_bus_call_method(u->manager->system_bus,
1887 "org.freedesktop.systemd1",
1888 "/org/freedesktop/systemd1",
1889 "org.freedesktop.systemd1.Manager",
1890 "AttachProcessesToUnit",
1891 &error, NULL,
1892 "ssau",
1893 NULL /* empty unit name means client's unit, i.e. us */, pp, 1, (uint32_t) pid);
1894 if (r < 0)
1895 return log_unit_debug_errno(u, r, "Failed to attach unit process " PID_FMT " via the bus: %s", pid, bus_error_message(&error, r));
1896
1897 return 0;
1898 }
1899
1900 int unit_attach_pids_to_cgroup(Unit *u, Set *pids, const char *suffix_path) {
1901 CGroupMask delegated_mask;
1902 const char *p;
1903 Iterator i;
1904 void *pidp;
1905 int r, q;
1906
1907 assert(u);
1908
1909 if (!UNIT_HAS_CGROUP_CONTEXT(u))
1910 return -EINVAL;
1911
1912 if (set_isempty(pids))
1913 return 0;
1914
1915 r = unit_realize_cgroup(u);
1916 if (r < 0)
1917 return r;
1918
1919 if (isempty(suffix_path))
1920 p = u->cgroup_path;
1921 else
1922 p = strjoina(u->cgroup_path, "/", suffix_path);
1923
1924 delegated_mask = unit_get_delegate_mask(u);
1925
1926 r = 0;
1927 SET_FOREACH(pidp, pids, i) {
1928 pid_t pid = PTR_TO_PID(pidp);
1929 CGroupController c;
1930
1931 /* First, attach the PID to the main cgroup hierarchy */
1932 q = cg_attach(SYSTEMD_CGROUP_CONTROLLER, p, pid);
1933 if (q < 0) {
1934 log_unit_debug_errno(u, q, "Couldn't move process " PID_FMT " to requested cgroup '%s': %m", pid, p);
1935
1936 if (MANAGER_IS_USER(u->manager) && IN_SET(q, -EPERM, -EACCES)) {
1937 int z;
1938
1939 /* If we are in a user instance, and we can't move the process ourselves due to
1940 * permission problems, let's ask the system instance about it instead. Since it's more
1941 * privileged it might be able to move the process across the leaves of a subtree who's
1942 * top node is not owned by us. */
1943
1944 z = unit_attach_pid_to_cgroup_via_bus(u, pid, suffix_path);
1945 if (z < 0)
1946 log_unit_debug_errno(u, z, "Couldn't move process " PID_FMT " to requested cgroup '%s' via the system bus either: %m", pid, p);
1947 else
1948 continue; /* When the bus thing worked via the bus we are fully done for this PID. */
1949 }
1950
1951 if (r >= 0)
1952 r = q; /* Remember first error */
1953
1954 continue;
1955 }
1956
1957 q = cg_all_unified();
1958 if (q < 0)
1959 return q;
1960 if (q > 0)
1961 continue;
1962
1963 /* In the legacy hierarchy, attach the process to the request cgroup if possible, and if not to the
1964 * innermost realized one */
1965
1966 for (c = 0; c < _CGROUP_CONTROLLER_MAX; c++) {
1967 CGroupMask bit = CGROUP_CONTROLLER_TO_MASK(c);
1968 const char *realized;
1969
1970 if (!(u->manager->cgroup_supported & bit))
1971 continue;
1972
1973 /* If this controller is delegated and realized, honour the caller's request for the cgroup suffix. */
1974 if (delegated_mask & u->cgroup_realized_mask & bit) {
1975 q = cg_attach(cgroup_controller_to_string(c), p, pid);
1976 if (q >= 0)
1977 continue; /* Success! */
1978
1979 log_unit_debug_errno(u, q, "Failed to attach PID " PID_FMT " to requested cgroup %s in controller %s, falling back to unit's cgroup: %m",
1980 pid, p, cgroup_controller_to_string(c));
1981 }
1982
1983 /* So this controller is either not delegate or realized, or something else weird happened. In
1984 * that case let's attach the PID at least to the closest cgroup up the tree that is
1985 * realized. */
1986 realized = unit_get_realized_cgroup_path(u, bit);
1987 if (!realized)
1988 continue; /* Not even realized in the root slice? Then let's not bother */
1989
1990 q = cg_attach(cgroup_controller_to_string(c), realized, pid);
1991 if (q < 0)
1992 log_unit_debug_errno(u, q, "Failed to attach PID " PID_FMT " to realized cgroup %s in controller %s, ignoring: %m",
1993 pid, realized, cgroup_controller_to_string(c));
1994 }
1995 }
1996
1997 return r;
1998 }
1999
2000 static bool unit_has_mask_realized(
2001 Unit *u,
2002 CGroupMask target_mask,
2003 CGroupMask enable_mask) {
2004
2005 assert(u);
2006
2007 /* Returns true if this unit is fully realized. We check four things:
2008 *
2009 * 1. Whether the cgroup was created at all
2010 * 2. Whether the cgroup was created in all the hierarchies we need it to be created in (in case of cgroup v1)
2011 * 3. Whether the cgroup has all the right controllers enabled (in case of cgroup v2)
2012 * 4. Whether the invalidation mask is currently zero
2013 *
2014 * If you wonder why we mask the target realization and enable mask with CGROUP_MASK_V1/CGROUP_MASK_V2: note
2015 * that there are three sets of bitmasks: CGROUP_MASK_V1 (for real cgroup v1 controllers), CGROUP_MASK_V2 (for
2016 * real cgroup v2 controllers) and CGROUP_MASK_BPF (for BPF-based pseudo-controllers). Now, cgroup_realized_mask
2017 * is only matters for cgroup v1 controllers, and cgroup_enabled_mask only used for cgroup v2, and if they
2018 * differ in the others, we don't really care. (After all, the cgroup_enabled_mask tracks with controllers are
2019 * enabled through cgroup.subtree_control, and since the BPF pseudo-controllers don't show up there, they
2020 * simply don't matter. */
2021
2022 return u->cgroup_realized &&
2023 ((u->cgroup_realized_mask ^ target_mask) & CGROUP_MASK_V1) == 0 &&
2024 ((u->cgroup_enabled_mask ^ enable_mask) & CGROUP_MASK_V2) == 0 &&
2025 u->cgroup_invalidated_mask == 0;
2026 }
2027
2028 static bool unit_has_mask_disables_realized(
2029 Unit *u,
2030 CGroupMask target_mask,
2031 CGroupMask enable_mask) {
2032
2033 assert(u);
2034
2035 /* Returns true if all controllers which should be disabled are indeed disabled.
2036 *
2037 * Unlike unit_has_mask_realized, we don't care what was enabled, only that anything we want to remove is
2038 * already removed. */
2039
2040 return !u->cgroup_realized ||
2041 (FLAGS_SET(u->cgroup_realized_mask, target_mask & CGROUP_MASK_V1) &&
2042 FLAGS_SET(u->cgroup_enabled_mask, enable_mask & CGROUP_MASK_V2));
2043 }
2044
2045 static bool unit_has_mask_enables_realized(
2046 Unit *u,
2047 CGroupMask target_mask,
2048 CGroupMask enable_mask) {
2049
2050 assert(u);
2051
2052 /* Returns true if all controllers which should be enabled are indeed enabled.
2053 *
2054 * Unlike unit_has_mask_realized, we don't care about the controllers that are not present, only that anything
2055 * we want to add is already added. */
2056
2057 return u->cgroup_realized &&
2058 ((u->cgroup_realized_mask | target_mask) & CGROUP_MASK_V1) == (u->cgroup_realized_mask & CGROUP_MASK_V1) &&
2059 ((u->cgroup_enabled_mask | enable_mask) & CGROUP_MASK_V2) == (u->cgroup_enabled_mask & CGROUP_MASK_V2);
2060 }
2061
2062 void unit_add_to_cgroup_realize_queue(Unit *u) {
2063 assert(u);
2064
2065 if (u->in_cgroup_realize_queue)
2066 return;
2067
2068 LIST_PREPEND(cgroup_realize_queue, u->manager->cgroup_realize_queue, u);
2069 u->in_cgroup_realize_queue = true;
2070 }
2071
2072 static void unit_remove_from_cgroup_realize_queue(Unit *u) {
2073 assert(u);
2074
2075 if (!u->in_cgroup_realize_queue)
2076 return;
2077
2078 LIST_REMOVE(cgroup_realize_queue, u->manager->cgroup_realize_queue, u);
2079 u->in_cgroup_realize_queue = false;
2080 }
2081
2082 /* Controllers can only be enabled breadth-first, from the root of the
2083 * hierarchy downwards to the unit in question. */
2084 static int unit_realize_cgroup_now_enable(Unit *u, ManagerState state) {
2085 CGroupMask target_mask, enable_mask, new_target_mask, new_enable_mask;
2086 int r;
2087
2088 assert(u);
2089
2090 /* First go deal with this unit's parent, or we won't be able to enable
2091 * any new controllers at this layer. */
2092 if (UNIT_ISSET(u->slice)) {
2093 r = unit_realize_cgroup_now_enable(UNIT_DEREF(u->slice), state);
2094 if (r < 0)
2095 return r;
2096 }
2097
2098 target_mask = unit_get_target_mask(u);
2099 enable_mask = unit_get_enable_mask(u);
2100
2101 /* We can only enable in this direction, don't try to disable anything.
2102 */
2103 if (unit_has_mask_enables_realized(u, target_mask, enable_mask))
2104 return 0;
2105
2106 new_target_mask = u->cgroup_realized_mask | target_mask;
2107 new_enable_mask = u->cgroup_enabled_mask | enable_mask;
2108
2109 return unit_create_cgroup(u, new_target_mask, new_enable_mask, state);
2110 }
2111
2112 /* Controllers can only be disabled depth-first, from the leaves of the
2113 * hierarchy upwards to the unit in question. */
2114 static int unit_realize_cgroup_now_disable(Unit *u, ManagerState state) {
2115 Iterator i;
2116 Unit *m;
2117 void *v;
2118
2119 assert(u);
2120
2121 if (u->type != UNIT_SLICE)
2122 return 0;
2123
2124 HASHMAP_FOREACH_KEY(v, m, u->dependencies[UNIT_BEFORE], i) {
2125 CGroupMask target_mask, enable_mask, new_target_mask, new_enable_mask;
2126 int r;
2127
2128 if (UNIT_DEREF(m->slice) != u)
2129 continue;
2130
2131 /* The cgroup for this unit might not actually be fully
2132 * realised yet, in which case it isn't holding any controllers
2133 * open anyway. */
2134 if (!m->cgroup_path)
2135 continue;
2136
2137 /* We must disable those below us first in order to release the
2138 * controller. */
2139 if (m->type == UNIT_SLICE)
2140 (void) unit_realize_cgroup_now_disable(m, state);
2141
2142 target_mask = unit_get_target_mask(m);
2143 enable_mask = unit_get_enable_mask(m);
2144
2145 /* We can only disable in this direction, don't try to enable
2146 * anything. */
2147 if (unit_has_mask_disables_realized(m, target_mask, enable_mask))
2148 continue;
2149
2150 new_target_mask = m->cgroup_realized_mask & target_mask;
2151 new_enable_mask = m->cgroup_enabled_mask & enable_mask;
2152
2153 r = unit_create_cgroup(m, new_target_mask, new_enable_mask, state);
2154 if (r < 0)
2155 return r;
2156 }
2157
2158 return 0;
2159 }
2160
2161 /* Check if necessary controllers and attributes for a unit are in place.
2162 *
2163 * - If so, do nothing.
2164 * - If not, create paths, move processes over, and set attributes.
2165 *
2166 * Controllers can only be *enabled* in a breadth-first way, and *disabled* in
2167 * a depth-first way. As such the process looks like this:
2168 *
2169 * Suppose we have a cgroup hierarchy which looks like this:
2170 *
2171 * root
2172 * / \
2173 * / \
2174 * / \
2175 * a b
2176 * / \ / \
2177 * / \ / \
2178 * c d e f
2179 * / \ / \ / \ / \
2180 * h i j k l m n o
2181 *
2182 * 1. We want to realise cgroup "d" now.
2183 * 2. cgroup "a" has DisableControllers=cpu in the associated unit.
2184 * 3. cgroup "k" just started requesting the memory controller.
2185 *
2186 * To make this work we must do the following in order:
2187 *
2188 * 1. Disable CPU controller in k, j
2189 * 2. Disable CPU controller in d
2190 * 3. Enable memory controller in root
2191 * 4. Enable memory controller in a
2192 * 5. Enable memory controller in d
2193 * 6. Enable memory controller in k
2194 *
2195 * Notice that we need to touch j in one direction, but not the other. We also
2196 * don't go beyond d when disabling -- it's up to "a" to get realized if it
2197 * wants to disable further. The basic rules are therefore:
2198 *
2199 * - If you're disabling something, you need to realise all of the cgroups from
2200 * your recursive descendants to the root. This starts from the leaves.
2201 * - If you're enabling something, you need to realise from the root cgroup
2202 * downwards, but you don't need to iterate your recursive descendants.
2203 *
2204 * Returns 0 on success and < 0 on failure. */
2205 static int unit_realize_cgroup_now(Unit *u, ManagerState state) {
2206 CGroupMask target_mask, enable_mask;
2207 int r;
2208
2209 assert(u);
2210
2211 unit_remove_from_cgroup_realize_queue(u);
2212
2213 target_mask = unit_get_target_mask(u);
2214 enable_mask = unit_get_enable_mask(u);
2215
2216 if (unit_has_mask_realized(u, target_mask, enable_mask))
2217 return 0;
2218
2219 /* Disable controllers below us, if there are any */
2220 r = unit_realize_cgroup_now_disable(u, state);
2221 if (r < 0)
2222 return r;
2223
2224 /* Enable controllers above us, if there are any */
2225 if (UNIT_ISSET(u->slice)) {
2226 r = unit_realize_cgroup_now_enable(UNIT_DEREF(u->slice), state);
2227 if (r < 0)
2228 return r;
2229 }
2230
2231 /* Now actually deal with the cgroup we were trying to realise and set attributes */
2232 r = unit_create_cgroup(u, target_mask, enable_mask, state);
2233 if (r < 0)
2234 return r;
2235
2236 /* Now, reset the invalidation mask */
2237 u->cgroup_invalidated_mask = 0;
2238 return 0;
2239 }
2240
2241 unsigned manager_dispatch_cgroup_realize_queue(Manager *m) {
2242 ManagerState state;
2243 unsigned n = 0;
2244 Unit *i;
2245 int r;
2246
2247 assert(m);
2248
2249 state = manager_state(m);
2250
2251 while ((i = m->cgroup_realize_queue)) {
2252 assert(i->in_cgroup_realize_queue);
2253
2254 if (UNIT_IS_INACTIVE_OR_FAILED(unit_active_state(i))) {
2255 /* Maybe things changed, and the unit is not actually active anymore? */
2256 unit_remove_from_cgroup_realize_queue(i);
2257 continue;
2258 }
2259
2260 r = unit_realize_cgroup_now(i, state);
2261 if (r < 0)
2262 log_warning_errno(r, "Failed to realize cgroups for queued unit %s, ignoring: %m", i->id);
2263
2264 n++;
2265 }
2266
2267 return n;
2268 }
2269
2270 static void unit_add_siblings_to_cgroup_realize_queue(Unit *u) {
2271 Unit *slice;
2272
2273 /* This adds the siblings of the specified unit and the
2274 * siblings of all parent units to the cgroup queue. (But
2275 * neither the specified unit itself nor the parents.) */
2276
2277 while ((slice = UNIT_DEREF(u->slice))) {
2278 Iterator i;
2279 Unit *m;
2280 void *v;
2281
2282 HASHMAP_FOREACH_KEY(v, m, u->dependencies[UNIT_BEFORE], i) {
2283 /* Skip units that have a dependency on the slice
2284 * but aren't actually in it. */
2285 if (UNIT_DEREF(m->slice) != slice)
2286 continue;
2287
2288 /* No point in doing cgroup application for units
2289 * without active processes. */
2290 if (UNIT_IS_INACTIVE_OR_FAILED(unit_active_state(m)))
2291 continue;
2292
2293 /* If the unit doesn't need any new controllers
2294 * and has current ones realized, it doesn't need
2295 * any changes. */
2296 if (unit_has_mask_realized(m,
2297 unit_get_target_mask(m),
2298 unit_get_enable_mask(m)))
2299 continue;
2300
2301 unit_add_to_cgroup_realize_queue(m);
2302 }
2303
2304 u = slice;
2305 }
2306 }
2307
2308 int unit_realize_cgroup(Unit *u) {
2309 assert(u);
2310
2311 if (!UNIT_HAS_CGROUP_CONTEXT(u))
2312 return 0;
2313
2314 /* So, here's the deal: when realizing the cgroups for this
2315 * unit, we need to first create all parents, but there's more
2316 * actually: for the weight-based controllers we also need to
2317 * make sure that all our siblings (i.e. units that are in the
2318 * same slice as we are) have cgroups, too. Otherwise, things
2319 * would become very uneven as each of their processes would
2320 * get as much resources as all our group together. This call
2321 * will synchronously create the parent cgroups, but will
2322 * defer work on the siblings to the next event loop
2323 * iteration. */
2324
2325 /* Add all sibling slices to the cgroup queue. */
2326 unit_add_siblings_to_cgroup_realize_queue(u);
2327
2328 /* And realize this one now (and apply the values) */
2329 return unit_realize_cgroup_now(u, manager_state(u->manager));
2330 }
2331
2332 void unit_release_cgroup(Unit *u) {
2333 assert(u);
2334
2335 /* Forgets all cgroup details for this cgroup — but does *not* destroy the cgroup. This is hence OK to call
2336 * when we close down everything for reexecution, where we really want to leave the cgroup in place. */
2337
2338 if (u->cgroup_path) {
2339 (void) hashmap_remove(u->manager->cgroup_unit, u->cgroup_path);
2340 u->cgroup_path = mfree(u->cgroup_path);
2341 }
2342
2343 if (u->cgroup_control_inotify_wd >= 0) {
2344 if (inotify_rm_watch(u->manager->cgroup_inotify_fd, u->cgroup_control_inotify_wd) < 0)
2345 log_unit_debug_errno(u, errno, "Failed to remove cgroup control inotify watch %i for %s, ignoring: %m", u->cgroup_control_inotify_wd, u->id);
2346
2347 (void) hashmap_remove(u->manager->cgroup_control_inotify_wd_unit, INT_TO_PTR(u->cgroup_control_inotify_wd));
2348 u->cgroup_control_inotify_wd = -1;
2349 }
2350
2351 if (u->cgroup_memory_inotify_wd >= 0) {
2352 if (inotify_rm_watch(u->manager->cgroup_inotify_fd, u->cgroup_memory_inotify_wd) < 0)
2353 log_unit_debug_errno(u, errno, "Failed to remove cgroup memory inotify watch %i for %s, ignoring: %m", u->cgroup_memory_inotify_wd, u->id);
2354
2355 (void) hashmap_remove(u->manager->cgroup_memory_inotify_wd_unit, INT_TO_PTR(u->cgroup_memory_inotify_wd));
2356 u->cgroup_memory_inotify_wd = -1;
2357 }
2358 }
2359
2360 void unit_prune_cgroup(Unit *u) {
2361 int r;
2362 bool is_root_slice;
2363
2364 assert(u);
2365
2366 /* Removes the cgroup, if empty and possible, and stops watching it. */
2367
2368 if (!u->cgroup_path)
2369 return;
2370
2371 (void) unit_get_cpu_usage(u, NULL); /* Cache the last CPU usage value before we destroy the cgroup */
2372
2373 is_root_slice = unit_has_name(u, SPECIAL_ROOT_SLICE);
2374
2375 r = cg_trim_everywhere(u->manager->cgroup_supported, u->cgroup_path, !is_root_slice);
2376 if (r < 0) {
2377 log_unit_debug_errno(u, r, "Failed to destroy cgroup %s, ignoring: %m", u->cgroup_path);
2378 return;
2379 }
2380
2381 if (is_root_slice)
2382 return;
2383
2384 unit_release_cgroup(u);
2385
2386 u->cgroup_realized = false;
2387 u->cgroup_realized_mask = 0;
2388 u->cgroup_enabled_mask = 0;
2389
2390 u->bpf_device_control_installed = bpf_program_unref(u->bpf_device_control_installed);
2391 }
2392
2393 int unit_search_main_pid(Unit *u, pid_t *ret) {
2394 _cleanup_fclose_ FILE *f = NULL;
2395 pid_t pid = 0, npid;
2396 int r;
2397
2398 assert(u);
2399 assert(ret);
2400
2401 if (!u->cgroup_path)
2402 return -ENXIO;
2403
2404 r = cg_enumerate_processes(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, &f);
2405 if (r < 0)
2406 return r;
2407
2408 while (cg_read_pid(f, &npid) > 0) {
2409
2410 if (npid == pid)
2411 continue;
2412
2413 if (pid_is_my_child(npid) == 0)
2414 continue;
2415
2416 if (pid != 0)
2417 /* Dang, there's more than one daemonized PID
2418 in this group, so we don't know what process
2419 is the main process. */
2420
2421 return -ENODATA;
2422
2423 pid = npid;
2424 }
2425
2426 *ret = pid;
2427 return 0;
2428 }
2429
2430 static int unit_watch_pids_in_path(Unit *u, const char *path) {
2431 _cleanup_closedir_ DIR *d = NULL;
2432 _cleanup_fclose_ FILE *f = NULL;
2433 int ret = 0, r;
2434
2435 assert(u);
2436 assert(path);
2437
2438 r = cg_enumerate_processes(SYSTEMD_CGROUP_CONTROLLER, path, &f);
2439 if (r < 0)
2440 ret = r;
2441 else {
2442 pid_t pid;
2443
2444 while ((r = cg_read_pid(f, &pid)) > 0) {
2445 r = unit_watch_pid(u, pid, false);
2446 if (r < 0 && ret >= 0)
2447 ret = r;
2448 }
2449
2450 if (r < 0 && ret >= 0)
2451 ret = r;
2452 }
2453
2454 r = cg_enumerate_subgroups(SYSTEMD_CGROUP_CONTROLLER, path, &d);
2455 if (r < 0) {
2456 if (ret >= 0)
2457 ret = r;
2458 } else {
2459 char *fn;
2460
2461 while ((r = cg_read_subgroup(d, &fn)) > 0) {
2462 _cleanup_free_ char *p = NULL;
2463
2464 p = strjoin(path, "/", fn);
2465 free(fn);
2466
2467 if (!p)
2468 return -ENOMEM;
2469
2470 r = unit_watch_pids_in_path(u, p);
2471 if (r < 0 && ret >= 0)
2472 ret = r;
2473 }
2474
2475 if (r < 0 && ret >= 0)
2476 ret = r;
2477 }
2478
2479 return ret;
2480 }
2481
2482 int unit_synthesize_cgroup_empty_event(Unit *u) {
2483 int r;
2484
2485 assert(u);
2486
2487 /* Enqueue a synthetic cgroup empty event if this unit doesn't watch any PIDs anymore. This is compatibility
2488 * support for non-unified systems where notifications aren't reliable, and hence need to take whatever we can
2489 * get as notification source as soon as we stopped having any useful PIDs to watch for. */
2490
2491 if (!u->cgroup_path)
2492 return -ENOENT;
2493
2494 r = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
2495 if (r < 0)
2496 return r;
2497 if (r > 0) /* On unified we have reliable notifications, and don't need this */
2498 return 0;
2499
2500 if (!set_isempty(u->pids))
2501 return 0;
2502
2503 unit_add_to_cgroup_empty_queue(u);
2504 return 0;
2505 }
2506
2507 int unit_watch_all_pids(Unit *u) {
2508 int r;
2509
2510 assert(u);
2511
2512 /* Adds all PIDs from our cgroup to the set of PIDs we
2513 * watch. This is a fallback logic for cases where we do not
2514 * get reliable cgroup empty notifications: we try to use
2515 * SIGCHLD as replacement. */
2516
2517 if (!u->cgroup_path)
2518 return -ENOENT;
2519
2520 r = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
2521 if (r < 0)
2522 return r;
2523 if (r > 0) /* On unified we can use proper notifications */
2524 return 0;
2525
2526 return unit_watch_pids_in_path(u, u->cgroup_path);
2527 }
2528
2529 static int on_cgroup_empty_event(sd_event_source *s, void *userdata) {
2530 Manager *m = userdata;
2531 Unit *u;
2532 int r;
2533
2534 assert(s);
2535 assert(m);
2536
2537 u = m->cgroup_empty_queue;
2538 if (!u)
2539 return 0;
2540
2541 assert(u->in_cgroup_empty_queue);
2542 u->in_cgroup_empty_queue = false;
2543 LIST_REMOVE(cgroup_empty_queue, m->cgroup_empty_queue, u);
2544
2545 if (m->cgroup_empty_queue) {
2546 /* More stuff queued, let's make sure we remain enabled */
2547 r = sd_event_source_set_enabled(s, SD_EVENT_ONESHOT);
2548 if (r < 0)
2549 log_debug_errno(r, "Failed to reenable cgroup empty event source, ignoring: %m");
2550 }
2551
2552 unit_add_to_gc_queue(u);
2553
2554 if (UNIT_VTABLE(u)->notify_cgroup_empty)
2555 UNIT_VTABLE(u)->notify_cgroup_empty(u);
2556
2557 return 0;
2558 }
2559
2560 void unit_add_to_cgroup_empty_queue(Unit *u) {
2561 int r;
2562
2563 assert(u);
2564
2565 /* Note that there are four different ways how cgroup empty events reach us:
2566 *
2567 * 1. On the unified hierarchy we get an inotify event on the cgroup
2568 *
2569 * 2. On the legacy hierarchy, when running in system mode, we get a datagram on the cgroup agent socket
2570 *
2571 * 3. On the legacy hierarchy, when running in user mode, we get a D-Bus signal on the system bus
2572 *
2573 * 4. On the legacy hierarchy, in service units we start watching all processes of the cgroup for SIGCHLD as
2574 * soon as we get one SIGCHLD, to deal with unreliable cgroup notifications.
2575 *
2576 * Regardless which way we got the notification, we'll verify it here, and then add it to a separate
2577 * queue. This queue will be dispatched at a lower priority than the SIGCHLD handler, so that we always use
2578 * SIGCHLD if we can get it first, and only use the cgroup empty notifications if there's no SIGCHLD pending
2579 * (which might happen if the cgroup doesn't contain processes that are our own child, which is typically the
2580 * case for scope units). */
2581
2582 if (u->in_cgroup_empty_queue)
2583 return;
2584
2585 /* Let's verify that the cgroup is really empty */
2586 if (!u->cgroup_path)
2587 return;
2588 r = cg_is_empty_recursive(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path);
2589 if (r < 0) {
2590 log_unit_debug_errno(u, r, "Failed to determine whether cgroup %s is empty: %m", u->cgroup_path);
2591 return;
2592 }
2593 if (r == 0)
2594 return;
2595
2596 LIST_PREPEND(cgroup_empty_queue, u->manager->cgroup_empty_queue, u);
2597 u->in_cgroup_empty_queue = true;
2598
2599 /* Trigger the defer event */
2600 r = sd_event_source_set_enabled(u->manager->cgroup_empty_event_source, SD_EVENT_ONESHOT);
2601 if (r < 0)
2602 log_debug_errno(r, "Failed to enable cgroup empty event source: %m");
2603 }
2604
2605 static int unit_check_oom(Unit *u) {
2606 _cleanup_free_ char *oom_kill = NULL;
2607 bool increased;
2608 uint64_t c;
2609 int r;
2610
2611 if (!u->cgroup_path)
2612 return 0;
2613
2614 r = cg_get_keyed_attribute("memory", u->cgroup_path, "memory.events", STRV_MAKE("oom_kill"), &oom_kill);
2615 if (r < 0)
2616 return log_unit_debug_errno(u, r, "Failed to read oom_kill field of memory.events cgroup attribute: %m");
2617
2618 r = safe_atou64(oom_kill, &c);
2619 if (r < 0)
2620 return log_unit_debug_errno(u, r, "Failed to parse oom_kill field: %m");
2621
2622 increased = c > u->oom_kill_last;
2623 u->oom_kill_last = c;
2624
2625 if (!increased)
2626 return 0;
2627
2628 log_struct(LOG_NOTICE,
2629 "MESSAGE_ID=" SD_MESSAGE_UNIT_OUT_OF_MEMORY_STR,
2630 LOG_UNIT_ID(u),
2631 LOG_UNIT_INVOCATION_ID(u),
2632 LOG_UNIT_MESSAGE(u, "A process of this unit has been killed by the OOM killer."));
2633
2634 if (UNIT_VTABLE(u)->notify_cgroup_oom)
2635 UNIT_VTABLE(u)->notify_cgroup_oom(u);
2636
2637 return 1;
2638 }
2639
2640 static int on_cgroup_oom_event(sd_event_source *s, void *userdata) {
2641 Manager *m = userdata;
2642 Unit *u;
2643 int r;
2644
2645 assert(s);
2646 assert(m);
2647
2648 u = m->cgroup_oom_queue;
2649 if (!u)
2650 return 0;
2651
2652 assert(u->in_cgroup_oom_queue);
2653 u->in_cgroup_oom_queue = false;
2654 LIST_REMOVE(cgroup_oom_queue, m->cgroup_oom_queue, u);
2655
2656 if (m->cgroup_oom_queue) {
2657 /* More stuff queued, let's make sure we remain enabled */
2658 r = sd_event_source_set_enabled(s, SD_EVENT_ONESHOT);
2659 if (r < 0)
2660 log_debug_errno(r, "Failed to reenable cgroup oom event source, ignoring: %m");
2661 }
2662
2663 (void) unit_check_oom(u);
2664 return 0;
2665 }
2666
2667 static void unit_add_to_cgroup_oom_queue(Unit *u) {
2668 int r;
2669
2670 assert(u);
2671
2672 if (u->in_cgroup_oom_queue)
2673 return;
2674 if (!u->cgroup_path)
2675 return;
2676
2677 LIST_PREPEND(cgroup_oom_queue, u->manager->cgroup_oom_queue, u);
2678 u->in_cgroup_oom_queue = true;
2679
2680 /* Trigger the defer event */
2681 if (!u->manager->cgroup_oom_event_source) {
2682 _cleanup_(sd_event_source_unrefp) sd_event_source *s = NULL;
2683
2684 r = sd_event_add_defer(u->manager->event, &s, on_cgroup_oom_event, u->manager);
2685 if (r < 0) {
2686 log_error_errno(r, "Failed to create cgroup oom event source: %m");
2687 return;
2688 }
2689
2690 r = sd_event_source_set_priority(s, SD_EVENT_PRIORITY_NORMAL-8);
2691 if (r < 0) {
2692 log_error_errno(r, "Failed to set priority of cgroup oom event source: %m");
2693 return;
2694 }
2695
2696 (void) sd_event_source_set_description(s, "cgroup-oom");
2697 u->manager->cgroup_oom_event_source = TAKE_PTR(s);
2698 }
2699
2700 r = sd_event_source_set_enabled(u->manager->cgroup_oom_event_source, SD_EVENT_ONESHOT);
2701 if (r < 0)
2702 log_error_errno(r, "Failed to enable cgroup oom event source: %m");
2703 }
2704
2705 static int on_cgroup_inotify_event(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
2706 Manager *m = userdata;
2707
2708 assert(s);
2709 assert(fd >= 0);
2710 assert(m);
2711
2712 for (;;) {
2713 union inotify_event_buffer buffer;
2714 struct inotify_event *e;
2715 ssize_t l;
2716
2717 l = read(fd, &buffer, sizeof(buffer));
2718 if (l < 0) {
2719 if (IN_SET(errno, EINTR, EAGAIN))
2720 return 0;
2721
2722 return log_error_errno(errno, "Failed to read control group inotify events: %m");
2723 }
2724
2725 FOREACH_INOTIFY_EVENT(e, buffer, l) {
2726 Unit *u;
2727
2728 if (e->wd < 0)
2729 /* Queue overflow has no watch descriptor */
2730 continue;
2731
2732 if (e->mask & IN_IGNORED)
2733 /* The watch was just removed */
2734 continue;
2735
2736 /* Note that inotify might deliver events for a watch even after it was removed,
2737 * because it was queued before the removal. Let's ignore this here safely. */
2738
2739 u = hashmap_get(m->cgroup_control_inotify_wd_unit, INT_TO_PTR(e->wd));
2740 if (u)
2741 unit_add_to_cgroup_empty_queue(u);
2742
2743 u = hashmap_get(m->cgroup_memory_inotify_wd_unit, INT_TO_PTR(e->wd));
2744 if (u)
2745 unit_add_to_cgroup_oom_queue(u);
2746 }
2747 }
2748 }
2749
2750 static int cg_bpf_mask_supported(CGroupMask *ret) {
2751 CGroupMask mask = 0;
2752 int r;
2753
2754 /* BPF-based firewall */
2755 r = bpf_firewall_supported();
2756 if (r > 0)
2757 mask |= CGROUP_MASK_BPF_FIREWALL;
2758
2759 /* BPF-based device access control */
2760 r = bpf_devices_supported();
2761 if (r > 0)
2762 mask |= CGROUP_MASK_BPF_DEVICES;
2763
2764 *ret = mask;
2765 return 0;
2766 }
2767
2768 int manager_setup_cgroup(Manager *m) {
2769 _cleanup_free_ char *path = NULL;
2770 const char *scope_path;
2771 CGroupController c;
2772 int r, all_unified;
2773 CGroupMask mask;
2774 char *e;
2775
2776 assert(m);
2777
2778 /* 1. Determine hierarchy */
2779 m->cgroup_root = mfree(m->cgroup_root);
2780 r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, 0, &m->cgroup_root);
2781 if (r < 0)
2782 return log_error_errno(r, "Cannot determine cgroup we are running in: %m");
2783
2784 /* Chop off the init scope, if we are already located in it */
2785 e = endswith(m->cgroup_root, "/" SPECIAL_INIT_SCOPE);
2786
2787 /* LEGACY: Also chop off the system slice if we are in
2788 * it. This is to support live upgrades from older systemd
2789 * versions where PID 1 was moved there. Also see
2790 * cg_get_root_path(). */
2791 if (!e && MANAGER_IS_SYSTEM(m)) {
2792 e = endswith(m->cgroup_root, "/" SPECIAL_SYSTEM_SLICE);
2793 if (!e)
2794 e = endswith(m->cgroup_root, "/system"); /* even more legacy */
2795 }
2796 if (e)
2797 *e = 0;
2798
2799 /* And make sure to store away the root value without trailing slash, even for the root dir, so that we can
2800 * easily prepend it everywhere. */
2801 delete_trailing_chars(m->cgroup_root, "/");
2802
2803 /* 2. Show data */
2804 r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, m->cgroup_root, NULL, &path);
2805 if (r < 0)
2806 return log_error_errno(r, "Cannot find cgroup mount point: %m");
2807
2808 r = cg_unified_flush();
2809 if (r < 0)
2810 return log_error_errno(r, "Couldn't determine if we are running in the unified hierarchy: %m");
2811
2812 all_unified = cg_all_unified();
2813 if (all_unified < 0)
2814 return log_error_errno(all_unified, "Couldn't determine whether we are in all unified mode: %m");
2815 if (all_unified > 0)
2816 log_debug("Unified cgroup hierarchy is located at %s.", path);
2817 else {
2818 r = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
2819 if (r < 0)
2820 return log_error_errno(r, "Failed to determine whether systemd's own controller is in unified mode: %m");
2821 if (r > 0)
2822 log_debug("Unified cgroup hierarchy is located at %s. Controllers are on legacy hierarchies.", path);
2823 else
2824 log_debug("Using cgroup controller " SYSTEMD_CGROUP_CONTROLLER_LEGACY ". File system hierarchy is at %s.", path);
2825 }
2826
2827 /* 3. Allocate cgroup empty defer event source */
2828 m->cgroup_empty_event_source = sd_event_source_unref(m->cgroup_empty_event_source);
2829 r = sd_event_add_defer(m->event, &m->cgroup_empty_event_source, on_cgroup_empty_event, m);
2830 if (r < 0)
2831 return log_error_errno(r, "Failed to create cgroup empty event source: %m");
2832
2833 /* Schedule cgroup empty checks early, but after having processed service notification messages or
2834 * SIGCHLD signals, so that a cgroup running empty is always just the last safety net of
2835 * notification, and we collected the metadata the notification and SIGCHLD stuff offers first. */
2836 r = sd_event_source_set_priority(m->cgroup_empty_event_source, SD_EVENT_PRIORITY_NORMAL-5);
2837 if (r < 0)
2838 return log_error_errno(r, "Failed to set priority of cgroup empty event source: %m");
2839
2840 r = sd_event_source_set_enabled(m->cgroup_empty_event_source, SD_EVENT_OFF);
2841 if (r < 0)
2842 return log_error_errno(r, "Failed to disable cgroup empty event source: %m");
2843
2844 (void) sd_event_source_set_description(m->cgroup_empty_event_source, "cgroup-empty");
2845
2846 /* 4. Install notifier inotify object, or agent */
2847 if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0) {
2848
2849 /* In the unified hierarchy we can get cgroup empty notifications via inotify. */
2850
2851 m->cgroup_inotify_event_source = sd_event_source_unref(m->cgroup_inotify_event_source);
2852 safe_close(m->cgroup_inotify_fd);
2853
2854 m->cgroup_inotify_fd = inotify_init1(IN_NONBLOCK|IN_CLOEXEC);
2855 if (m->cgroup_inotify_fd < 0)
2856 return log_error_errno(errno, "Failed to create control group inotify object: %m");
2857
2858 r = sd_event_add_io(m->event, &m->cgroup_inotify_event_source, m->cgroup_inotify_fd, EPOLLIN, on_cgroup_inotify_event, m);
2859 if (r < 0)
2860 return log_error_errno(r, "Failed to watch control group inotify object: %m");
2861
2862 /* Process cgroup empty notifications early. Note that when this event is dispatched it'll
2863 * just add the unit to a cgroup empty queue, hence let's run earlier than that. Also see
2864 * handling of cgroup agent notifications, for the classic cgroup hierarchy support. */
2865 r = sd_event_source_set_priority(m->cgroup_inotify_event_source, SD_EVENT_PRIORITY_NORMAL-9);
2866 if (r < 0)
2867 return log_error_errno(r, "Failed to set priority of inotify event source: %m");
2868
2869 (void) sd_event_source_set_description(m->cgroup_inotify_event_source, "cgroup-inotify");
2870
2871 } else if (MANAGER_IS_SYSTEM(m) && manager_owns_host_root_cgroup(m) && !MANAGER_IS_TEST_RUN(m)) {
2872
2873 /* On the legacy hierarchy we only get notifications via cgroup agents. (Which isn't really reliable,
2874 * since it does not generate events when control groups with children run empty. */
2875
2876 r = cg_install_release_agent(SYSTEMD_CGROUP_CONTROLLER, SYSTEMD_CGROUP_AGENT_PATH);
2877 if (r < 0)
2878 log_warning_errno(r, "Failed to install release agent, ignoring: %m");
2879 else if (r > 0)
2880 log_debug("Installed release agent.");
2881 else if (r == 0)
2882 log_debug("Release agent already installed.");
2883 }
2884
2885 /* 5. Make sure we are in the special "init.scope" unit in the root slice. */
2886 scope_path = strjoina(m->cgroup_root, "/" SPECIAL_INIT_SCOPE);
2887 r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, scope_path, 0);
2888 if (r >= 0) {
2889 /* Also, move all other userspace processes remaining in the root cgroup into that scope. */
2890 r = cg_migrate(SYSTEMD_CGROUP_CONTROLLER, m->cgroup_root, SYSTEMD_CGROUP_CONTROLLER, scope_path, 0);
2891 if (r < 0)
2892 log_warning_errno(r, "Couldn't move remaining userspace processes, ignoring: %m");
2893
2894 /* 6. And pin it, so that it cannot be unmounted */
2895 safe_close(m->pin_cgroupfs_fd);
2896 m->pin_cgroupfs_fd = open(path, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY|O_NONBLOCK);
2897 if (m->pin_cgroupfs_fd < 0)
2898 return log_error_errno(errno, "Failed to open pin file: %m");
2899
2900 } else if (!MANAGER_IS_TEST_RUN(m))
2901 return log_error_errno(r, "Failed to create %s control group: %m", scope_path);
2902
2903 /* 7. Always enable hierarchical support if it exists... */
2904 if (!all_unified && !MANAGER_IS_TEST_RUN(m))
2905 (void) cg_set_attribute("memory", "/", "memory.use_hierarchy", "1");
2906
2907 /* 8. Figure out which controllers are supported */
2908 r = cg_mask_supported(&m->cgroup_supported);
2909 if (r < 0)
2910 return log_error_errno(r, "Failed to determine supported controllers: %m");
2911
2912 /* 9. Figure out which bpf-based pseudo-controllers are supported */
2913 r = cg_bpf_mask_supported(&mask);
2914 if (r < 0)
2915 return log_error_errno(r, "Failed to determine supported bpf-based pseudo-controllers: %m");
2916 m->cgroup_supported |= mask;
2917
2918 /* 10. Log which controllers are supported */
2919 for (c = 0; c < _CGROUP_CONTROLLER_MAX; c++)
2920 log_debug("Controller '%s' supported: %s", cgroup_controller_to_string(c), yes_no(m->cgroup_supported & CGROUP_CONTROLLER_TO_MASK(c)));
2921
2922 return 0;
2923 }
2924
2925 void manager_shutdown_cgroup(Manager *m, bool delete) {
2926 assert(m);
2927
2928 /* We can't really delete the group, since we are in it. But
2929 * let's trim it. */
2930 if (delete && m->cgroup_root && m->test_run_flags != MANAGER_TEST_RUN_MINIMAL)
2931 (void) cg_trim(SYSTEMD_CGROUP_CONTROLLER, m->cgroup_root, false);
2932
2933 m->cgroup_empty_event_source = sd_event_source_unref(m->cgroup_empty_event_source);
2934
2935 m->cgroup_control_inotify_wd_unit = hashmap_free(m->cgroup_control_inotify_wd_unit);
2936 m->cgroup_memory_inotify_wd_unit = hashmap_free(m->cgroup_memory_inotify_wd_unit);
2937
2938 m->cgroup_inotify_event_source = sd_event_source_unref(m->cgroup_inotify_event_source);
2939 m->cgroup_inotify_fd = safe_close(m->cgroup_inotify_fd);
2940
2941 m->pin_cgroupfs_fd = safe_close(m->pin_cgroupfs_fd);
2942
2943 m->cgroup_root = mfree(m->cgroup_root);
2944 }
2945
2946 Unit* manager_get_unit_by_cgroup(Manager *m, const char *cgroup) {
2947 char *p;
2948 Unit *u;
2949
2950 assert(m);
2951 assert(cgroup);
2952
2953 u = hashmap_get(m->cgroup_unit, cgroup);
2954 if (u)
2955 return u;
2956
2957 p = strdupa(cgroup);
2958 for (;;) {
2959 char *e;
2960
2961 e = strrchr(p, '/');
2962 if (!e || e == p)
2963 return hashmap_get(m->cgroup_unit, SPECIAL_ROOT_SLICE);
2964
2965 *e = 0;
2966
2967 u = hashmap_get(m->cgroup_unit, p);
2968 if (u)
2969 return u;
2970 }
2971 }
2972
2973 Unit *manager_get_unit_by_pid_cgroup(Manager *m, pid_t pid) {
2974 _cleanup_free_ char *cgroup = NULL;
2975
2976 assert(m);
2977
2978 if (!pid_is_valid(pid))
2979 return NULL;
2980
2981 if (cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, pid, &cgroup) < 0)
2982 return NULL;
2983
2984 return manager_get_unit_by_cgroup(m, cgroup);
2985 }
2986
2987 Unit *manager_get_unit_by_pid(Manager *m, pid_t pid) {
2988 Unit *u, **array;
2989
2990 assert(m);
2991
2992 /* Note that a process might be owned by multiple units, we return only one here, which is good enough for most
2993 * cases, though not strictly correct. We prefer the one reported by cgroup membership, as that's the most
2994 * relevant one as children of the process will be assigned to that one, too, before all else. */
2995
2996 if (!pid_is_valid(pid))
2997 return NULL;
2998
2999 if (pid == getpid_cached())
3000 return hashmap_get(m->units, SPECIAL_INIT_SCOPE);
3001
3002 u = manager_get_unit_by_pid_cgroup(m, pid);
3003 if (u)
3004 return u;
3005
3006 u = hashmap_get(m->watch_pids, PID_TO_PTR(pid));
3007 if (u)
3008 return u;
3009
3010 array = hashmap_get(m->watch_pids, PID_TO_PTR(-pid));
3011 if (array)
3012 return array[0];
3013
3014 return NULL;
3015 }
3016
3017 int manager_notify_cgroup_empty(Manager *m, const char *cgroup) {
3018 Unit *u;
3019
3020 assert(m);
3021 assert(cgroup);
3022
3023 /* Called on the legacy hierarchy whenever we get an explicit cgroup notification from the cgroup agent process
3024 * or from the --system instance */
3025
3026 log_debug("Got cgroup empty notification for: %s", cgroup);
3027
3028 u = manager_get_unit_by_cgroup(m, cgroup);
3029 if (!u)
3030 return 0;
3031
3032 unit_add_to_cgroup_empty_queue(u);
3033 return 1;
3034 }
3035
3036 int unit_get_memory_current(Unit *u, uint64_t *ret) {
3037 _cleanup_free_ char *v = NULL;
3038 int r;
3039
3040 assert(u);
3041 assert(ret);
3042
3043 if (!UNIT_CGROUP_BOOL(u, memory_accounting))
3044 return -ENODATA;
3045
3046 if (!u->cgroup_path)
3047 return -ENODATA;
3048
3049 /* The root cgroup doesn't expose this information, let's get it from /proc instead */
3050 if (unit_has_host_root_cgroup(u))
3051 return procfs_memory_get_used(ret);
3052
3053 if ((u->cgroup_realized_mask & CGROUP_MASK_MEMORY) == 0)
3054 return -ENODATA;
3055
3056 r = cg_all_unified();
3057 if (r < 0)
3058 return r;
3059 if (r > 0)
3060 r = cg_get_attribute("memory", u->cgroup_path, "memory.current", &v);
3061 else
3062 r = cg_get_attribute("memory", u->cgroup_path, "memory.usage_in_bytes", &v);
3063 if (r == -ENOENT)
3064 return -ENODATA;
3065 if (r < 0)
3066 return r;
3067
3068 return safe_atou64(v, ret);
3069 }
3070
3071 int unit_get_tasks_current(Unit *u, uint64_t *ret) {
3072 _cleanup_free_ char *v = NULL;
3073 int r;
3074
3075 assert(u);
3076 assert(ret);
3077
3078 if (!UNIT_CGROUP_BOOL(u, tasks_accounting))
3079 return -ENODATA;
3080
3081 if (!u->cgroup_path)
3082 return -ENODATA;
3083
3084 /* The root cgroup doesn't expose this information, let's get it from /proc instead */
3085 if (unit_has_host_root_cgroup(u))
3086 return procfs_tasks_get_current(ret);
3087
3088 if ((u->cgroup_realized_mask & CGROUP_MASK_PIDS) == 0)
3089 return -ENODATA;
3090
3091 r = cg_get_attribute("pids", u->cgroup_path, "pids.current", &v);
3092 if (r == -ENOENT)
3093 return -ENODATA;
3094 if (r < 0)
3095 return r;
3096
3097 return safe_atou64(v, ret);
3098 }
3099
3100 static int unit_get_cpu_usage_raw(Unit *u, nsec_t *ret) {
3101 _cleanup_free_ char *v = NULL;
3102 uint64_t ns;
3103 int r;
3104
3105 assert(u);
3106 assert(ret);
3107
3108 if (!u->cgroup_path)
3109 return -ENODATA;
3110
3111 /* The root cgroup doesn't expose this information, let's get it from /proc instead */
3112 if (unit_has_host_root_cgroup(u))
3113 return procfs_cpu_get_usage(ret);
3114
3115 /* Requisite controllers for CPU accounting are not enabled */
3116 if ((get_cpu_accounting_mask() & ~u->cgroup_realized_mask) != 0)
3117 return -ENODATA;
3118
3119 r = cg_all_unified();
3120 if (r < 0)
3121 return r;
3122 if (r > 0) {
3123 _cleanup_free_ char *val = NULL;
3124 uint64_t us;
3125
3126 r = cg_get_keyed_attribute("cpu", u->cgroup_path, "cpu.stat", STRV_MAKE("usage_usec"), &val);
3127 if (IN_SET(r, -ENOENT, -ENXIO))
3128 return -ENODATA;
3129 if (r < 0)
3130 return r;
3131
3132 r = safe_atou64(val, &us);
3133 if (r < 0)
3134 return r;
3135
3136 ns = us * NSEC_PER_USEC;
3137 } else {
3138 r = cg_get_attribute("cpuacct", u->cgroup_path, "cpuacct.usage", &v);
3139 if (r == -ENOENT)
3140 return -ENODATA;
3141 if (r < 0)
3142 return r;
3143
3144 r = safe_atou64(v, &ns);
3145 if (r < 0)
3146 return r;
3147 }
3148
3149 *ret = ns;
3150 return 0;
3151 }
3152
3153 int unit_get_cpu_usage(Unit *u, nsec_t *ret) {
3154 nsec_t ns;
3155 int r;
3156
3157 assert(u);
3158
3159 /* Retrieve the current CPU usage counter. This will subtract the CPU counter taken when the unit was
3160 * started. If the cgroup has been removed already, returns the last cached value. To cache the value, simply
3161 * call this function with a NULL return value. */
3162
3163 if (!UNIT_CGROUP_BOOL(u, cpu_accounting))
3164 return -ENODATA;
3165
3166 r = unit_get_cpu_usage_raw(u, &ns);
3167 if (r == -ENODATA && u->cpu_usage_last != NSEC_INFINITY) {
3168 /* If we can't get the CPU usage anymore (because the cgroup was already removed, for example), use our
3169 * cached value. */
3170
3171 if (ret)
3172 *ret = u->cpu_usage_last;
3173 return 0;
3174 }
3175 if (r < 0)
3176 return r;
3177
3178 if (ns > u->cpu_usage_base)
3179 ns -= u->cpu_usage_base;
3180 else
3181 ns = 0;
3182
3183 u->cpu_usage_last = ns;
3184 if (ret)
3185 *ret = ns;
3186
3187 return 0;
3188 }
3189
3190 int unit_get_ip_accounting(
3191 Unit *u,
3192 CGroupIPAccountingMetric metric,
3193 uint64_t *ret) {
3194
3195 uint64_t value;
3196 int fd, r;
3197
3198 assert(u);
3199 assert(metric >= 0);
3200 assert(metric < _CGROUP_IP_ACCOUNTING_METRIC_MAX);
3201 assert(ret);
3202
3203 if (!UNIT_CGROUP_BOOL(u, ip_accounting))
3204 return -ENODATA;
3205
3206 fd = IN_SET(metric, CGROUP_IP_INGRESS_BYTES, CGROUP_IP_INGRESS_PACKETS) ?
3207 u->ip_accounting_ingress_map_fd :
3208 u->ip_accounting_egress_map_fd;
3209 if (fd < 0)
3210 return -ENODATA;
3211
3212 if (IN_SET(metric, CGROUP_IP_INGRESS_BYTES, CGROUP_IP_EGRESS_BYTES))
3213 r = bpf_firewall_read_accounting(fd, &value, NULL);
3214 else
3215 r = bpf_firewall_read_accounting(fd, NULL, &value);
3216 if (r < 0)
3217 return r;
3218
3219 /* Add in additional metrics from a previous runtime. Note that when reexecing/reloading the daemon we compile
3220 * all BPF programs and maps anew, but serialize the old counters. When deserializing we store them in the
3221 * ip_accounting_extra[] field, and add them in here transparently. */
3222
3223 *ret = value + u->ip_accounting_extra[metric];
3224
3225 return r;
3226 }
3227
3228 int unit_reset_cpu_accounting(Unit *u) {
3229 nsec_t ns;
3230 int r;
3231
3232 assert(u);
3233
3234 u->cpu_usage_last = NSEC_INFINITY;
3235
3236 r = unit_get_cpu_usage_raw(u, &ns);
3237 if (r < 0) {
3238 u->cpu_usage_base = 0;
3239 return r;
3240 }
3241
3242 u->cpu_usage_base = ns;
3243 return 0;
3244 }
3245
3246 int unit_reset_ip_accounting(Unit *u) {
3247 int r = 0, q = 0;
3248
3249 assert(u);
3250
3251 if (u->ip_accounting_ingress_map_fd >= 0)
3252 r = bpf_firewall_reset_accounting(u->ip_accounting_ingress_map_fd);
3253
3254 if (u->ip_accounting_egress_map_fd >= 0)
3255 q = bpf_firewall_reset_accounting(u->ip_accounting_egress_map_fd);
3256
3257 zero(u->ip_accounting_extra);
3258
3259 return r < 0 ? r : q;
3260 }
3261
3262 void unit_invalidate_cgroup(Unit *u, CGroupMask m) {
3263 assert(u);
3264
3265 if (!UNIT_HAS_CGROUP_CONTEXT(u))
3266 return;
3267
3268 if (m == 0)
3269 return;
3270
3271 /* always invalidate compat pairs together */
3272 if (m & (CGROUP_MASK_IO | CGROUP_MASK_BLKIO))
3273 m |= CGROUP_MASK_IO | CGROUP_MASK_BLKIO;
3274
3275 if (m & (CGROUP_MASK_CPU | CGROUP_MASK_CPUACCT))
3276 m |= CGROUP_MASK_CPU | CGROUP_MASK_CPUACCT;
3277
3278 if (FLAGS_SET(u->cgroup_invalidated_mask, m)) /* NOP? */
3279 return;
3280
3281 u->cgroup_invalidated_mask |= m;
3282 unit_add_to_cgroup_realize_queue(u);
3283 }
3284
3285 void unit_invalidate_cgroup_bpf(Unit *u) {
3286 assert(u);
3287
3288 if (!UNIT_HAS_CGROUP_CONTEXT(u))
3289 return;
3290
3291 if (u->cgroup_invalidated_mask & CGROUP_MASK_BPF_FIREWALL) /* NOP? */
3292 return;
3293
3294 u->cgroup_invalidated_mask |= CGROUP_MASK_BPF_FIREWALL;
3295 unit_add_to_cgroup_realize_queue(u);
3296
3297 /* If we are a slice unit, we also need to put compile a new BPF program for all our children, as the IP access
3298 * list of our children includes our own. */
3299 if (u->type == UNIT_SLICE) {
3300 Unit *member;
3301 Iterator i;
3302 void *v;
3303
3304 HASHMAP_FOREACH_KEY(v, member, u->dependencies[UNIT_BEFORE], i) {
3305 if (UNIT_DEREF(member->slice) == u)
3306 unit_invalidate_cgroup_bpf(member);
3307 }
3308 }
3309 }
3310
3311 bool unit_cgroup_delegate(Unit *u) {
3312 CGroupContext *c;
3313
3314 assert(u);
3315
3316 if (!UNIT_VTABLE(u)->can_delegate)
3317 return false;
3318
3319 c = unit_get_cgroup_context(u);
3320 if (!c)
3321 return false;
3322
3323 return c->delegate;
3324 }
3325
3326 void manager_invalidate_startup_units(Manager *m) {
3327 Iterator i;
3328 Unit *u;
3329
3330 assert(m);
3331
3332 SET_FOREACH(u, m->startup_units, i)
3333 unit_invalidate_cgroup(u, CGROUP_MASK_CPU|CGROUP_MASK_IO|CGROUP_MASK_BLKIO);
3334 }
3335
3336 static const char* const cgroup_device_policy_table[_CGROUP_DEVICE_POLICY_MAX] = {
3337 [CGROUP_AUTO] = "auto",
3338 [CGROUP_CLOSED] = "closed",
3339 [CGROUP_STRICT] = "strict",
3340 };
3341
3342 DEFINE_STRING_TABLE_LOOKUP(cgroup_device_policy, CGroupDevicePolicy);
Unnamed repository; edit this file 'description' to name the repository.