1 /* SPDX-License-Identifier: LGPL-2.1+ */
5 #include "alloc-util.h"
9 #include "mount-util.h"
10 #include "nspawn-cgroup.h"
12 #include "string-util.h"
16 static int chown_cgroup_path(const char *path
, uid_t uid_shift
) {
17 _cleanup_close_
int fd
= -1;
20 fd
= open(path
, O_RDONLY
|O_CLOEXEC
|O_DIRECTORY
);
26 "cgroup.clone_children",
31 "cgroup.subtree_control",
35 if (fchownat(fd
, fn
, uid_shift
, uid_shift
, 0) < 0)
36 log_full_errno(errno
== ENOENT
? LOG_DEBUG
: LOG_WARNING
, errno
,
37 "Failed to chown \"%s/%s\", ignoring: %m", path
, fn
);
42 int chown_cgroup(pid_t pid
, CGroupUnified unified_requested
, uid_t uid_shift
) {
43 _cleanup_free_
char *path
= NULL
, *fs
= NULL
;
46 r
= cg_pid_get_path(NULL
, pid
, &path
);
48 return log_error_errno(r
, "Failed to get container cgroup path: %m");
50 r
= cg_get_path(SYSTEMD_CGROUP_CONTROLLER
, path
, NULL
, &fs
);
52 return log_error_errno(r
, "Failed to get file system path for container cgroup: %m");
54 r
= chown_cgroup_path(fs
, uid_shift
);
56 return log_error_errno(r
, "Failed to chown() cgroup %s: %m", fs
);
58 if (unified_requested
== CGROUP_UNIFIED_SYSTEMD
) {
59 _cleanup_free_
char *lfs
= NULL
;
60 /* Always propagate access rights from unified to legacy controller */
62 r
= cg_get_path(SYSTEMD_CGROUP_CONTROLLER_LEGACY
, path
, NULL
, &lfs
);
64 return log_error_errno(r
, "Failed to get file system path for container cgroup: %m");
66 r
= chown_cgroup_path(lfs
, uid_shift
);
68 return log_error_errno(r
, "Failed to chown() cgroup %s: %m", lfs
);
74 int sync_cgroup(pid_t pid
, CGroupUnified unified_requested
, uid_t arg_uid_shift
) {
75 _cleanup_free_
char *cgroup
= NULL
;
76 char tree
[] = "/tmp/unifiedXXXXXX", pid_string
[DECIMAL_STR_MAX(pid
) + 1];
77 bool undo_mount
= false;
79 int r
, unified_controller
;
81 unified_controller
= cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER
);
82 if (unified_controller
< 0)
83 return log_error_errno(unified_controller
, "Failed to determine whether the systemd hierarchy is unified: %m");
84 if ((unified_controller
> 0) == (unified_requested
>= CGROUP_UNIFIED_SYSTEMD
))
87 /* When the host uses the legacy cgroup setup, but the
88 * container shall use the unified hierarchy, let's make sure
89 * we copy the path from the name=systemd hierarchy into the
90 * unified hierarchy. Similar for the reverse situation. */
92 r
= cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER
, pid
, &cgroup
);
94 return log_error_errno(r
, "Failed to get control group of " PID_FMT
": %m", pid
);
96 /* In order to access the unified hierarchy we need to mount it */
98 return log_error_errno(errno
, "Failed to generate temporary mount point for unified hierarchy: %m");
100 if (unified_controller
> 0)
101 r
= mount_verbose(LOG_ERR
, "cgroup", tree
, "cgroup",
102 MS_NOSUID
|MS_NOEXEC
|MS_NODEV
, "none,name=systemd,xattr");
104 r
= mount_verbose(LOG_ERR
, "cgroup", tree
, "cgroup2",
105 MS_NOSUID
|MS_NOEXEC
|MS_NODEV
, NULL
);
111 /* If nspawn dies abruptly the cgroup hierarchy created below
112 * its unit isn't cleaned up. So, let's remove it
113 * https://github.com/systemd/systemd/pull/4223#issuecomment-252519810 */
114 fn
= strjoina(tree
, cgroup
);
115 (void) rm_rf(fn
, REMOVE_ROOT
|REMOVE_ONLY_DIRECTORIES
);
117 fn
= strjoina(tree
, cgroup
, "/cgroup.procs");
118 (void) mkdir_parents(fn
, 0755);
120 sprintf(pid_string
, PID_FMT
, pid
);
121 r
= write_string_file(fn
, pid_string
, 0);
123 log_error_errno(r
, "Failed to move process: %m");
127 fn
= strjoina(tree
, cgroup
);
128 r
= chown_cgroup_path(fn
, arg_uid_shift
);
130 log_error_errno(r
, "Failed to chown() cgroup %s: %m", fn
);
133 (void) umount_verbose(tree
);
139 int create_subcgroup(pid_t pid
, bool keep_unit
, CGroupUnified unified_requested
) {
140 _cleanup_free_
char *cgroup
= NULL
;
141 CGroupMask supported
;
147 /* In the unified hierarchy inner nodes may only contain subgroups, but not processes. Hence, if we running in
148 * the unified hierarchy and the container does the same, and we did not create a scope unit for the container
149 * move us and the container into two separate subcgroups.
151 * Moreover, container payloads such as systemd try to manage the cgroup they run in in full (i.e. including
152 * its attributes), while the host systemd will only delegate cgroups for children of the cgroup created for a
153 * delegation unit, instead of the cgroup itself. This means, if we'd pass on the cgroup allocated from the
154 * host systemd directly to the payload, the host and payload systemd might fight for the cgroup
155 * attributes. Hence, let's insert an intermediary cgroup to cover that case too.
157 * Note that we only bother with the main hierarchy here, not with any secondary ones. On the unified setup
158 * that's fine because there's only one hiearchy anyway and controllers are enabled directly on it. On the
159 * legacy setup, this is fine too, since delegation of controllers is generally not safe there, hence we won't
162 r
= cg_mask_supported(&supported
);
164 return log_error_errno(r
, "Failed to determine supported controllers: %m");
167 r
= cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER
, 0, &cgroup
);
169 r
= cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER
, pid
, &cgroup
);
171 return log_error_errno(r
, "Failed to get our control group: %m");
173 payload
= strjoina(cgroup
, "/payload");
174 r
= cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER
, payload
, pid
);
176 return log_error_errno(r
, "Failed to create %s subcgroup: %m", payload
);
179 const char *supervisor
;
181 supervisor
= strjoina(cgroup
, "/supervisor");
182 r
= cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER
, supervisor
, 0);
184 return log_error_errno(r
, "Failed to create %s subcgroup: %m", supervisor
);
187 /* Try to enable as many controllers as possible for the new payload. */
188 (void) cg_enable_everywhere(supported
, supported
, cgroup
);