src/nspawn/nspawn-cgroup.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2015 Lennart Poettering
   6
   7   systemd is free software; you can redistribute it and/or modify it
   8   under the terms of the GNU Lesser General Public License as published by
   9   the Free Software Foundation; either version 2.1 of the License, or
  10   (at your option) any later version.
  11
  12   systemd is distributed in the hope that it will be useful, but
  13   WITHOUT ANY WARRANTY; without even the implied warranty of
  14   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  15   Lesser General Public License for more details.
  16
  17   You should have received a copy of the GNU Lesser General Public License
  18   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  19 ***/
  20
  21 #include <sys/mount.h>
  22
  23 #include "alloc-util.h"
  24 #include "fd-util.h"
  25 #include "fileio.h"
  26 #include "mkdir.h"
  27 #include "mount-util.h"
  28 #include "nspawn-cgroup.h"
  29 #include "rm-rf.h"
  30 #include "string-util.h"
  31 #include "strv.h"
  32 #include "util.h"
  33
  34 static int chown_cgroup_path(const char *path, uid_t uid_shift) {
  35         _cleanup_close_ int fd = -1;
  36         const char *fn;
  37
  38         fd = open(path, O_RDONLY|O_CLOEXEC|O_DIRECTORY);
  39         if (fd < 0)
  40                 return -errno;
  41
  42         FOREACH_STRING(fn,
  43                        ".",
  44                        "cgroup.clone_children",
  45                        "cgroup.controllers",
  46                        "cgroup.events",
  47                        "cgroup.procs",
  48                        "cgroup.stat",
  49                        "cgroup.subtree_control",
  50                        "cgroup.threads",
  51                        "notify_on_release",
  52                        "tasks")
  53                 if (fchownat(fd, fn, uid_shift, uid_shift, 0) < 0)
  54                         log_full_errno(errno == ENOENT ? LOG_DEBUG :  LOG_WARNING, errno,
  55                                        "Failed to chown \"%s/%s\", ignoring: %m", path, fn);
  56
  57         return 0;
  58 }
  59
  60 int chown_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t uid_shift) {
  61         _cleanup_free_ char *path = NULL, *fs = NULL;
  62         int r;
  63
  64         r = cg_pid_get_path(NULL, pid, &path);
  65         if (r < 0)
  66                 return log_error_errno(r, "Failed to get container cgroup path: %m");
  67
  68         r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, path, NULL, &fs);
  69         if (r < 0)
  70                 return log_error_errno(r, "Failed to get file system path for container cgroup: %m");
  71
  72         r = chown_cgroup_path(fs, uid_shift);
  73         if (r < 0)
  74                 return log_error_errno(r, "Failed to chown() cgroup %s: %m", fs);
  75
  76         if (unified_requested == CGROUP_UNIFIED_SYSTEMD) {
  77                 _cleanup_free_ char *lfs = NULL;
  78                 /* Always propagate access rights from unified to legacy controller */
  79
  80                 r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER_LEGACY, path, NULL, &lfs);
  81                 if (r < 0)
  82                         return log_error_errno(r, "Failed to get file system path for container cgroup: %m");
  83
  84                 r = chown_cgroup_path(lfs, uid_shift);
  85                 if (r < 0)
  86                         return log_error_errno(r, "Failed to chown() cgroup %s: %m", lfs);
  87         }
  88
  89         return 0;
  90 }
  91
  92 int sync_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t arg_uid_shift) {
  93         _cleanup_free_ char *cgroup = NULL;
  94         char tree[] = "/tmp/unifiedXXXXXX", pid_string[DECIMAL_STR_MAX(pid) + 1];
  95         bool undo_mount = false;
  96         const char *fn;
  97         int r, unified_controller;
  98
  99         unified_controller = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
 100         if (unified_controller < 0)
 101                 return log_error_errno(unified_controller, "Failed to determine whether the systemd hierarchy is unified: %m");
 102         if ((unified_controller > 0) == (unified_requested >= CGROUP_UNIFIED_SYSTEMD))
 103                 return 0;
 104
 105         /* When the host uses the legacy cgroup setup, but the
 106          * container shall use the unified hierarchy, let's make sure
 107          * we copy the path from the name=systemd hierarchy into the
 108          * unified hierarchy. Similar for the reverse situation. */
 109
 110         r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, pid, &cgroup);
 111         if (r < 0)
 112                 return log_error_errno(r, "Failed to get control group of " PID_FMT ": %m", pid);
 113
 114         /* In order to access the unified hierarchy we need to mount it */
 115         if (!mkdtemp(tree))
 116                 return log_error_errno(errno, "Failed to generate temporary mount point for unified hierarchy: %m");
 117
 118         if (unified_controller > 0)
 119                 r = mount_verbose(LOG_ERR, "cgroup", tree, "cgroup",
 120                                   MS_NOSUID|MS_NOEXEC|MS_NODEV, "none,name=systemd,xattr");
 121         else
 122                 r = mount_verbose(LOG_ERR, "cgroup", tree, "cgroup2",
 123                                   MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
 124         if (r < 0)
 125                 goto finish;
 126
 127         undo_mount = true;
 128
 129         /* If nspawn dies abruptly the cgroup hierarchy created below
 130          * its unit isn't cleaned up. So, let's remove it
 131          * https://github.com/systemd/systemd/pull/4223#issuecomment-252519810 */
 132         fn = strjoina(tree, cgroup);
 133         (void) rm_rf(fn, REMOVE_ROOT|REMOVE_ONLY_DIRECTORIES);
 134
 135         fn = strjoina(tree, cgroup, "/cgroup.procs");
 136         (void) mkdir_parents(fn, 0755);
 137
 138         sprintf(pid_string, PID_FMT, pid);
 139         r = write_string_file(fn, pid_string, 0);
 140         if (r < 0) {
 141                 log_error_errno(r, "Failed to move process: %m");
 142                 goto finish;
 143         }
 144
 145         fn = strjoina(tree, cgroup);
 146         r = chown_cgroup_path(fn, arg_uid_shift);
 147         if (r < 0)
 148                 log_error_errno(r, "Failed to chown() cgroup %s: %m", fn);
 149 finish:
 150         if (undo_mount)
 151                 (void) umount_verbose(tree);
 152
 153         (void) rmdir(tree);
 154         return r;
 155 }
 156
 157 int create_subcgroup(pid_t pid, CGroupUnified unified_requested) {
 158         _cleanup_free_ char *cgroup = NULL;
 159         const char *child;
 160         int r;
 161         CGroupMask supported;
 162
 163         /* In the unified hierarchy inner nodes may only contain
 164          * subgroups, but not processes. Hence, if we running in the
 165          * unified hierarchy and the container does the same, and we
 166          * did not create a scope unit for the container move us and
 167          * the container into two separate subcgroups. */
 168
 169         if (unified_requested == CGROUP_UNIFIED_NONE)
 170                 return 0;
 171
 172         r = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
 173         if (r < 0)
 174                 return log_error_errno(r, "Failed to determine whether the systemd controller is unified: %m");
 175         if (r == 0)
 176                 return 0;
 177
 178         r = cg_mask_supported(&supported);
 179         if (r < 0)
 180                 return log_error_errno(r, "Failed to determine supported controllers: %m");
 181
 182         r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, 0, &cgroup);
 183         if (r < 0)
 184                 return log_error_errno(r, "Failed to get our control group: %m");
 185
 186         child = strjoina(cgroup, "/payload");
 187         r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, child, pid);
 188         if (r < 0)
 189                 return log_error_errno(r, "Failed to create %s subcgroup: %m", child);
 190
 191         child = strjoina(cgroup, "/supervisor");
 192         r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, child, 0);
 193         if (r < 0)
 194                 return log_error_errno(r, "Failed to create %s subcgroup: %m", child);
 195
 196         /* Try to enable as many controllers as possible for the new payload. */
 197         (void) cg_enable_everywhere(supported, supported, cgroup);
 198         return 0;
 199 }