/* Slurp in a whole file */
static char *read_file(const char *fnam)
{
- FILE *f;
- char *line = NULL, *buf = NULL;
- size_t len = 0, fulllen = 0;
+ __do_free char *line = NULL;
+ __do_fclose FILE *f = NULL;
int linelen;
+ char *buf = NULL;
+ size_t len = 0, fulllen = 0;
f = fopen(fnam, "r");
if (!f)
append_line(&buf, fulllen, line, linelen);
fulllen += linelen;
}
- fclose(f);
- free(line);
return buf;
}
#define __ISOL_CPUS "/sys/devices/system/cpu/isolated"
static bool cg_legacy_filter_and_set_cpus(char *path, bool am_initialized)
{
+ __do_free char *cpulist = NULL, *fpath = NULL, *isolcpus = NULL,
+ *posscpus = NULL;
+ __do_free uint32_t *isolmask = NULL, *possmask = NULL;
int ret;
ssize_t i;
- char *lastslash, *fpath, oldv;
+ char oldv;
+ char *lastslash;
ssize_t maxisol = 0, maxposs = 0;
- char *cpulist = NULL, *isolcpus = NULL, *posscpus = NULL;
- uint32_t *isolmask = NULL, *possmask = NULL;
bool bret = false, flipped_bit = false;
lastslash = strrchr(path, '/');
posscpus = read_file(fpath);
if (!posscpus) {
SYSERROR("Failed to read file \"%s\"", fpath);
- goto on_error;
+ return false;
}
/* Get maximum number of cpus found in possible cpuset. */
maxposs = get_max_cpus(posscpus);
if (maxposs < 0 || maxposs >= INT_MAX - 1)
- goto on_error;
+ return false;
if (!file_exists(__ISOL_CPUS)) {
/* This system doesn't expose isolated cpus. */
DEBUG("The path \""__ISOL_CPUS"\" to read isolated cpus from does not exist");
- cpulist = posscpus;
/* No isolated cpus but we weren't already initialized by
* someone. We should simply copy the parents cpuset.cpus
* values.
*/
if (!am_initialized) {
DEBUG("Copying cpu settings of parent cgroup");
+ cpulist = posscpus;
goto copy_parent;
}
/* No isolated cpus but we were already initialized by someone.
* Nothing more to do for us.
*/
- goto on_success;
+ return true;
}
isolcpus = read_file(__ISOL_CPUS);
if (!isolcpus) {
SYSERROR("Failed to read file \""__ISOL_CPUS"\"");
- goto on_error;
+ return false;
}
if (!isdigit(isolcpus[0])) {
TRACE("No isolated cpus detected");
- cpulist = posscpus;
/* No isolated cpus but we weren't already initialized by
* someone. We should simply copy the parents cpuset.cpus
* values.
*/
if (!am_initialized) {
DEBUG("Copying cpu settings of parent cgroup");
+ cpulist = posscpus;
goto copy_parent;
}
/* No isolated cpus but we were already initialized by someone.
* Nothing more to do for us.
*/
- goto on_success;
+ return true;
}
/* Get maximum number of cpus found in isolated cpuset. */
maxisol = get_max_cpus(isolcpus);
if (maxisol < 0 || maxisol >= INT_MAX - 1)
- goto on_error;
+ return false;
if (maxposs < maxisol)
maxposs = maxisol;
possmask = lxc_cpumask(posscpus, maxposs);
if (!possmask) {
ERROR("Failed to create cpumask for possible cpus");
- goto on_error;
+ return false;
}
isolmask = lxc_cpumask(isolcpus, maxposs);
if (!isolmask) {
ERROR("Failed to create cpumask for isolated cpus");
- goto on_error;
+ return false;
}
for (i = 0; i <= maxposs; i++) {
if (!flipped_bit) {
DEBUG("No isolated cpus present in cpuset");
- goto on_success;
+ return true;
}
DEBUG("Removed isolated cpus from cpuset");
cpulist = lxc_cpumask_to_cpulist(possmask, maxposs);
if (!cpulist) {
ERROR("Failed to create cpu list");
- goto on_error;
+ return false;
}
copy_parent:
*lastslash = oldv;
- free(fpath);
fpath = must_make_path(path, "cpuset.cpus", NULL);
ret = lxc_write_to_file(fpath, cpulist, strlen(cpulist), false, 0666);
+ if (cpulist == posscpus)
+ cpulist = NULL;
if (ret < 0) {
SYSERROR("Failed to write cpu list to \"%s\"", fpath);
- goto on_error;
+ return false;
}
-on_success:
- bret = true;
-
-on_error:
- free(fpath);
-
- free(isolcpus);
- free(isolmask);
-
- if (posscpus != cpulist)
- free(posscpus);
- free(possmask);
-
- free(cpulist);
- return bret;
+ return true;
}
/* Copy contents of parent(@path)/@file to @path/@file */
*lastslash = '\0';
parent_path = must_make_path(path, file, NULL);
len = lxc_read_from_file(parent_path, NULL, 0);
- if (len <= 0)
- goto on_error;
+ if (len <= 0) {
+ SYSERROR("Failed to determine buffer size");
+ return false;
+ }
value = must_realloc(NULL, len + 1);
ret = lxc_read_from_file(parent_path, value, len);
- if (ret != len)
- goto on_error;
+ if (ret != len) {
+ SYSERROR("Failed to read from parent file \"%s\"", parent_path);
+ return false;
+ }
*lastslash = oldv;
child_path = must_make_path(path, file, NULL);
if (ret < 0)
SYSERROR("Failed to write \"%s\" to file \"%s\"", value, child_path);
return ret >= 0;
-
-on_error:
- SYSERROR("Failed to read file \"%s\"", child_path);
- return false;
}
/* Initialize the cpuset hierarchy in first directory of @gname and set
*/
static bool cg_legacy_handle_cpuset_hierarchy(struct hierarchy *h, char *cgname)
{
+ __do_free char *cgpath = NULL, *clonechildrenpath = NULL;
int ret;
char v;
- char *cgpath, *clonechildrenpath, *slash;
+ char *slash;
if (!string_in_list(h->controllers, "cpuset"))
return true;
if (ret < 0) {
if (errno != EEXIST) {
SYSERROR("Failed to create directory \"%s\"", cgpath);
- free(cgpath);
return false;
}
}
- clonechildrenpath =
- must_make_path(cgpath, "cgroup.clone_children", NULL);
+ clonechildrenpath = must_make_path(cgpath, "cgroup.clone_children", NULL);
/* unified hierarchy doesn't have clone_children */
- if (!file_exists(clonechildrenpath)) {
- free(clonechildrenpath);
- free(cgpath);
+ if (!file_exists(clonechildrenpath))
return true;
- }
ret = lxc_read_from_file(clonechildrenpath, &v, 1);
if (ret < 0) {
SYSERROR("Failed to read file \"%s\"", clonechildrenpath);
- free(clonechildrenpath);
- free(cgpath);
return false;
}
/* Make sure any isolated cpus are removed from cpuset.cpus. */
if (!cg_legacy_filter_and_set_cpus(cgpath, v == '1')) {
SYSERROR("Failed to remove isolated cpus");
- free(clonechildrenpath);
- free(cgpath);
return false;
}
/* Already set for us by someone else. */
if (v == '1') {
DEBUG("\"cgroup.clone_children\" was already set to \"1\"");
- free(clonechildrenpath);
- free(cgpath);
return true;
}
/* copy parent's settings */
if (!copy_parent_file(cgpath, "cpuset.mems")) {
SYSERROR("Failed to copy \"cpuset.mems\" settings");
- free(cgpath);
- free(clonechildrenpath);
return false;
}
- free(cgpath);
ret = lxc_write_to_file(clonechildrenpath, "1", 1, false, 0666);
if (ret < 0) {
/* Set clone_children so children inherit our settings */
SYSERROR("Failed to write 1 to \"%s\"", clonechildrenpath);
- free(clonechildrenpath);
return false;
}
- free(clonechildrenpath);
+
return true;
}
* for legacy hierarchies.
*/
int i;
- char *dup, *p2, *tok;
+ char *p2, *tok;
char *p = line, *sep = ",";
char **aret = NULL;
*p2 = '\0';
if (type == CGROUP_SUPER_MAGIC) {
+ __do_free char *dup = NULL;
+
/* strdup() here for v1 hierarchies. Otherwise
* lxc_iterate_parts() will destroy mountpoints such as
* "/sys/fs/cgroup/cpu,cpuacct".
*/
- dup = strdup(p);
+ dup = must_copy_string(p);
if (!dup)
return NULL;
- lxc_iterate_parts(tok, dup, sep) {
+ lxc_iterate_parts (tok, dup, sep)
must_append_controller(klist, nlist, &aret, tok);
- }
-
- free(dup);
}
*p2 = ' ';
static char **cg_unified_get_controllers(const char *file)
{
- char *buf, *tok;
+ __do_free char *buf = NULL;
+ char *tok;
char *sep = " \t\n";
char **aret = NULL;
aret[newentry] = copy;
}
- free(buf);
return aret;
}
new->mountpoint = mountpoint;
new->container_base_path = container_base_path;
new->container_full_path = NULL;
+ new->monitor_full_path = NULL;
new->version = type;
+ new->cgroup2_chown = NULL;
newentry = append_null_to_list((void ***)h);
(*h)[newentry] = new;
*/
static bool controller_in_clist(char *cgline, char *c)
{
- char *tok, *eol, *tmp;
+ __do_free char *tmp = NULL;
+ char *tok, *eol;
size_t len;
eol = strchr(cgline, ':');
memcpy(tmp, cgline, len);
tmp[len] = '\0';
- lxc_iterate_parts(tok, tmp, ",") {
- if (strcmp(tok, c) == 0) {
- free(tmp);
+ lxc_iterate_parts(tok, tmp, ",")
+ if (strcmp(tok, c) == 0)
return true;
- }
- }
- free(tmp);
return false;
}
static int get_existing_subsystems(char ***klist, char ***nlist)
{
- FILE *f;
- char *line = NULL;
+ __do_free char *line = NULL;
+ __do_fclose FILE *f = NULL;
size_t len = 0;
f = fopen("/proc/self/cgroup", "r");
}
}
- free(line);
- fclose(f);
return 0;
}
int ret;
struct generic_userns_exec_data wrap;
+ if (!ops->hierarchies)
+ return;
+
wrap.origuid = 0;
wrap.container_cgroup = ops->container_cgroup;
wrap.hierarchies = ops->hierarchies;
}
}
+__cgfsng_ops static void cgfsng_monitor_destroy(struct cgroup_ops *ops,
+ struct lxc_handler *handler)
+{
+ int len;
+ struct lxc_conf *conf = handler->conf;
+ char pidstr[INTTYPE_TO_STRLEN(pid_t)];
+
+ if (!ops->hierarchies)
+ return;
+
+ len = snprintf(pidstr, sizeof(pidstr), "%d", handler->monitor_pid);
+ if (len < 0 || (size_t)len >= sizeof(pidstr))
+ return;
+
+ for (int i = 0; ops->hierarchies[i]; i++) {
+ __do_free char *pivot_path = NULL;
+ int ret;
+ char *chop;
+ char pivot_cgroup[] = PIVOT_CGROUP;
+ struct hierarchy *h = ops->hierarchies[i];
+
+ if (!h->monitor_full_path)
+ continue;
+
+ if (conf && conf->cgroup_meta.dir)
+ pivot_path = must_make_path(h->mountpoint,
+ h->container_base_path,
+ conf->cgroup_meta.dir,
+ PIVOT_CGROUP,
+ "cgroup.procs", NULL);
+ else
+ pivot_path = must_make_path(h->mountpoint,
+ h->container_base_path,
+ PIVOT_CGROUP,
+ "cgroup.procs", NULL);
+
+ chop = strrchr(pivot_path, '/');
+ if (chop)
+ *chop = '\0';
+
+ /*
+ * Make sure not to pass in the ro string literal PIVOT_CGROUP
+ * here.
+ */
+ if (!cg_legacy_handle_cpuset_hierarchy(h, pivot_cgroup)) {
+ WARN("Failed to handle legacy cpuset controller");
+ continue;
+ }
+
+ ret = mkdir_p(pivot_path, 0755);
+ if (ret < 0 && errno != EEXIST) {
+ SYSWARN("Failed to create cgroup \"%s\"\n", pivot_path);
+ continue;
+ }
+
+ if (chop)
+ *chop = '/';
+
+ /* Move ourselves into the pivot cgroup to delete our own
+ * cgroup.
+ */
+ ret = lxc_write_to_file(pivot_path, pidstr, len, false, 0666);
+ if (ret != 0) {
+ SYSWARN("Failed to move monitor %s to \"%s\"\n", pidstr, pivot_path);
+ continue;
+ }
+
+ ret = recursive_destroy(h->monitor_full_path);
+ if (ret < 0)
+ WARN("Failed to destroy \"%s\"", h->monitor_full_path);
+ }
+}
+
static bool cg_unified_create_cgroup(struct hierarchy *h, char *cgname)
{
+ __do_free char *add_controllers = NULL, *cgroup = NULL;
size_t i, parts_len;
char **it;
size_t full_len = 0;
- char *add_controllers = NULL, *cgroup = NULL;
char **parts = NULL;
bool bret = false;
cgroup = must_make_path(h->mountpoint, h->container_base_path, NULL);
for (i = 0; i < parts_len; i++) {
int ret;
- char *target;
+ __do_free char *target = NULL;
cgroup = must_append_path(cgroup, parts[i], NULL);
target = must_make_path(cgroup, "cgroup.subtree_control", NULL);
ret = lxc_write_to_file(target, add_controllers, full_len, false, 0666);
- free(target);
if (ret < 0) {
SYSERROR("Could not enable \"%s\" controllers in the "
"unified cgroup \"%s\"", add_controllers, cgroup);
on_error:
lxc_free_array((void **)parts, free);
- free(add_controllers);
- free(cgroup);
return bret;
}
orig_len = strlen(dir);
do {
+ __do_free char *makeme;
int ret;
size_t cur_len;
- char *makeme;
dir = tmp + strspn(tmp, "/");
tmp = dir + strcspn(dir, "/");
if (ret < 0) {
if ((errno != EEXIST) || (orig_len == cur_len)) {
SYSERROR("Failed to create directory \"%s\"", makeme);
- free(makeme);
return -1;
}
}
- free(makeme);
-
} while (tmp != dir);
return 0;
}
-static bool create_path_for_hierarchy(struct hierarchy *h, char *cgname)
+static bool monitor_create_path_for_hierarchy(struct hierarchy *h, char *cgname)
+{
+ int ret;
+
+ if (!cg_legacy_handle_cpuset_hierarchy(h, cgname)) {
+ ERROR("Failed to handle legacy cpuset controller");
+ return false;
+ }
+
+ h->monitor_full_path = must_make_path(h->mountpoint, h->container_base_path, cgname, NULL);
+ ret = mkdir_eexist_on_last(h->monitor_full_path, 0755);
+ if (ret < 0) {
+ ERROR("Failed to create cgroup \"%s\"", h->monitor_full_path);
+ return false;
+ }
+
+ return cg_unified_create_cgroup(h, cgname);
+}
+
+static bool container_create_path_for_hierarchy(struct hierarchy *h, char *cgname)
{
int ret;
return cg_unified_create_cgroup(h, cgname);
}
-static void remove_path_for_hierarchy(struct hierarchy *h, char *cgname)
+static void remove_path_for_hierarchy(struct hierarchy *h, char *cgname, bool monitor)
{
int ret;
+ char *full_path;
+
+ if (monitor)
+ full_path = h->monitor_full_path;
+ else
+ full_path = h->container_full_path;
- ret = rmdir(h->container_full_path);
+ ret = rmdir(full_path);
if (ret < 0)
- SYSERROR("Failed to rmdir(\"%s\") from failed creation attempt", h->container_full_path);
+ SYSERROR("Failed to rmdir(\"%s\") from failed creation attempt", full_path);
+
+ free(full_path);
+
+ if (monitor)
+ h->monitor_full_path = NULL;
+ else
+ h->container_full_path = NULL;
+}
- free(h->container_full_path);
- h->container_full_path = NULL;
+__cgfsng_ops static inline bool cgfsng_monitor_create(struct cgroup_ops *ops,
+ struct lxc_handler *handler)
+{
+ __do_free char *monitor_cgroup = NULL;
+ char *offset, *tmp;
+ int i, idx = 0;
+ size_t len;
+ struct lxc_conf *conf = handler->conf;
+
+ if (!conf)
+ return false;
+
+ if (!ops->hierarchies)
+ return true;
+
+ if (conf->cgroup_meta.dir)
+ tmp = lxc_string_join("/",
+ (const char *[]){conf->cgroup_meta.dir,
+ ops->monitor_pattern,
+ handler->name, NULL},
+ false);
+ else
+ tmp = must_make_path(ops->monitor_pattern, handler->name, NULL);
+ if (!tmp)
+ return false;
+
+ len = strlen(tmp) + 5; /* leave room for -NNN\0 */
+ monitor_cgroup = must_realloc(tmp, len);
+ offset = monitor_cgroup + len - 5;
+ *offset = 0;
+
+ do {
+ if (idx) {
+ int ret = snprintf(offset, 5, "-%d", idx);
+ if (ret < 0 || (size_t)ret >= 5)
+ return false;
+ }
+
+ for (i = 0; ops->hierarchies[i]; i++) {
+ if (!monitor_create_path_for_hierarchy(ops->hierarchies[i],
+ monitor_cgroup)) {
+ ERROR("Failed to create cgroup \"%s\"",
+ ops->hierarchies[i]->monitor_full_path);
+ for (int j = 0; j < i; j++)
+ remove_path_for_hierarchy(ops->hierarchies[j],
+ monitor_cgroup,
+ true);
+
+ idx++;
+ break;
+ }
+ }
+ } while (ops->hierarchies[i] && idx > 0 && idx < 1000);
+
+ if (idx == 1000)
+ return false;
+
+ INFO("The monitor process uses \"%s\" as cgroup", monitor_cgroup);
+ return true;
}
/* Try to create the same cgroup in all hierarchies. Start with cgroup_pattern;
* next cgroup_pattern-1, -2, ..., -999.
*/
-__cgfsng_ops static bool cgfsng_payload_create(struct cgroup_ops *ops,
- struct lxc_handler *handler)
+__cgfsng_ops static inline bool cgfsng_payload_create(struct cgroup_ops *ops,
+ struct lxc_handler *handler)
{
+ __do_free char *container_cgroup = NULL, *tmp = NULL;
int i;
size_t len;
- char *container_cgroup, *offset, *tmp;
+ char *offset;
int idx = 0;
struct lxc_conf *conf = handler->conf;
- if (ops->container_cgroup) {
- WARN("cgfsng_create called a second time: %s", ops->container_cgroup);
+ if (ops->container_cgroup)
return false;
- }
if (!conf)
return false;
+ if (!ops->hierarchies)
+ return true;
+
if (conf->cgroup_meta.dir)
tmp = lxc_string_join("/", (const char *[]){conf->cgroup_meta.dir, handler->name, NULL}, false);
else
len = strlen(tmp) + 5; /* leave room for -NNN\0 */
container_cgroup = must_realloc(NULL, len);
(void)strlcpy(container_cgroup, tmp, len);
- free(tmp);
offset = container_cgroup + len - 5;
-again:
- if (idx == 1000) {
- ERROR("Too many conflicting cgroup names");
- goto out_free;
- }
-
- if (idx) {
- int ret;
-
- ret = snprintf(offset, 5, "-%d", idx);
- if (ret < 0 || (size_t)ret >= 5) {
- FILE *f = fopen("/dev/null", "w");
- if (f) {
- fprintf(f, "Workaround for GCC7 bug: "
- "https://gcc.gnu.org/bugzilla/"
- "show_bug.cgi?id=78969");
- fclose(f);
- }
+ do {
+ if (idx) {
+ int ret = snprintf(offset, 5, "-%d", idx);
+ if (ret < 0 || (size_t)ret >= 5)
+ return false;
}
- }
- for (i = 0; ops->hierarchies[i]; i++) {
- if (!create_path_for_hierarchy(ops->hierarchies[i], container_cgroup)) {
- int j;
- ERROR("Failed to create cgroup \"%s\"", ops->hierarchies[i]->container_full_path);
- for (j = 0; j < i; j++)
- remove_path_for_hierarchy(ops->hierarchies[j], container_cgroup);
- idx++;
- goto again;
+ for (i = 0; ops->hierarchies[i]; i++) {
+ if (!container_create_path_for_hierarchy(ops->hierarchies[i],
+ container_cgroup)) {
+ ERROR("Failed to create cgroup \"%s\"",
+ ops->hierarchies[i]->container_full_path);
+ for (int j = 0; j < i; j++)
+ remove_path_for_hierarchy(ops->hierarchies[j],
+ container_cgroup,
+ false);
+ idx++;
+ break;
+ }
}
- }
+ } while (ops->hierarchies[i] && idx > 0 && idx < 1000);
- ops->container_cgroup = container_cgroup;
+ if (idx == 1000)
+ return false;
+ INFO("The container process uses \"%s\" as cgroup", container_cgroup);
+ ops->container_cgroup = move_ptr(container_cgroup);
return true;
-
-out_free:
- free(container_cgroup);
-
- return false;
}
-__cgfsng_ops static bool cgfsng_payload_enter(struct cgroup_ops *ops, pid_t pid)
+__cgfsng_ops static bool __do_cgroup_enter(struct cgroup_ops *ops, pid_t pid,
+ bool monitor)
{
int len;
char pidstr[INTTYPE_TO_STRLEN(pid_t)];
+ if (!ops->hierarchies)
+ return true;
+
len = snprintf(pidstr, sizeof(pidstr), "%d", pid);
if (len < 0 || (size_t)len >= sizeof(pidstr))
return false;
for (int i = 0; ops->hierarchies[i]; i++) {
int ret;
- char *fullpath;
+ __do_free char *path = NULL;
- fullpath = must_make_path(ops->hierarchies[i]->container_full_path,
- "cgroup.procs", NULL);
- ret = lxc_write_to_file(fullpath, pidstr, len, false, 0666);
+ if (monitor)
+ path = must_make_path(ops->hierarchies[i]->monitor_full_path,
+ "cgroup.procs", NULL);
+ else
+ path = must_make_path(ops->hierarchies[i]->container_full_path,
+ "cgroup.procs", NULL);
+ ret = lxc_write_to_file(path, pidstr, len, false, 0666);
if (ret != 0) {
- SYSERROR("Failed to enter cgroup \"%s\"", fullpath);
- free(fullpath);
+ SYSERROR("Failed to enter cgroup \"%s\"", path);
return false;
}
- free(fullpath);
}
return true;
}
+__cgfsng_ops static bool cgfsng_monitor_enter(struct cgroup_ops *ops, pid_t pid)
+{
+ return __do_cgroup_enter(ops, pid, true);
+}
+
+static bool cgfsng_payload_enter(struct cgroup_ops *ops, pid_t pid)
+{
+ return __do_cgroup_enter(ops, pid, false);
+}
+
static int chowmod(char *path, uid_t chown_uid, gid_t chown_gid,
mode_t chmod_mode)
{
destuid = 0;
for (i = 0; arg->hierarchies[i]; i++) {
- char *fullpath;
+ __do_free char *fullpath = NULL;
char *path = arg->hierarchies[i]->container_full_path;
ret = chowmod(path, destuid, nsgid, 0775);
if (arg->hierarchies[i]->version == CGROUP_SUPER_MAGIC) {
fullpath = must_make_path(path, "tasks", NULL);
(void)chowmod(fullpath, destuid, nsgid, 0664);
- free(fullpath);
}
fullpath = must_make_path(path, "cgroup.procs", NULL);
(void)chowmod(fullpath, destuid, nsgid, 0664);
- free(fullpath);
if (arg->hierarchies[i]->version != CGROUP2_SUPER_MAGIC)
continue;
- fullpath = must_make_path(path, "cgroup.subtree_control", NULL);
- (void)chowmod(fullpath, destuid, nsgid, 0664);
- free(fullpath);
-
- fullpath = must_make_path(path, "cgroup.threads", NULL);
- (void)chowmod(fullpath, destuid, nsgid, 0664);
- free(fullpath);
+ for (char **p = arg->hierarchies[i]->cgroup2_chown; p && *p; p++) {
+ fullpath = must_make_path(path, *p, NULL);
+ (void)chowmod(fullpath, destuid, nsgid, 0664);
+ }
}
return 0;
if (lxc_list_empty(&conf->id_map))
return true;
+ if (!ops->hierarchies)
+ return true;
+
wrap.origuid = geteuid();
wrap.path = NULL;
wrap.hierarchies = ops->hierarchies;
char *controllerpath, char *cgpath,
const char *container_cgroup)
{
+ __do_free char *sourcepath = NULL;
int ret, remount_flags;
- char *sourcepath;
int flags = MS_BIND;
if (type == LXC_AUTO_CGROUP_RO || type == LXC_AUTO_CGROUP_MIXED) {
ret = mount(sourcepath, cgpath, "cgroup", flags, NULL);
if (ret < 0) {
SYSERROR("Failed to mount \"%s\" onto \"%s\"", h->controllers[0], cgpath);
- free(sourcepath);
return -1;
}
INFO("Mounted \"%s\" onto \"%s\"", h->controllers[0], cgpath);
ret = mount(sourcepath, cgpath, "cgroup", remount_flags, NULL);
if (ret < 0) {
SYSERROR("Failed to remount \"%s\" ro", cgpath);
- free(sourcepath);
return -1;
}
INFO("Remounted %s read-only", cgpath);
}
- free(sourcepath);
INFO("Completed second stage cgroup automounts for \"%s\"", cgpath);
return 0;
}
const char *controllerpath)
{
int ret;
- char *controllers = NULL;
+ __do_free char *controllers = NULL;
char *fstype = "cgroup2";
unsigned long flags = 0;
}
ret = mount("cgroup", controllerpath, fstype, flags, controllers);
- free(controllers);
if (ret < 0) {
SYSERROR("Failed to mount \"%s\" with cgroup filesystem type %s", controllerpath, fstype);
return -1;
struct lxc_handler *handler,
const char *root, int type)
{
+ __do_free char *tmpfspath = NULL;
int i, ret;
- char *tmpfspath = NULL;
bool has_cgns = false, retval = false, wants_force_mount = false;
+ if (!ops->hierarchies)
+ return true;
+
if ((type & LXC_AUTO_CGROUP_MASK) == 0)
return true;
goto on_error;
for (i = 0; ops->hierarchies[i]; i++) {
- char *controllerpath, *path2;
+ __do_free char *controllerpath = NULL, *path2 = NULL;
struct hierarchy *h = ops->hierarchies[i];
char *controller = strrchr(h->mountpoint, '/');
controller++;
controllerpath = must_make_path(tmpfspath, controller, NULL);
- if (dir_exists(controllerpath)) {
- free(controllerpath);
+ if (dir_exists(controllerpath))
continue;
- }
ret = mkdir(controllerpath, 0755);
if (ret < 0) {
SYSERROR("Error creating cgroup path: %s", controllerpath);
- free(controllerpath);
goto on_error;
}
* need to mount the cgroups manually.
*/
ret = cg_mount_in_cgroup_namespace(type, h, controllerpath);
- free(controllerpath);
if (ret < 0)
goto on_error;
}
ret = cg_mount_cgroup_full(type, h, controllerpath);
- if (ret < 0) {
- free(controllerpath);
+ if (ret < 0)
goto on_error;
- }
- if (!cg_mount_needs_subdirs(type)) {
- free(controllerpath);
+ if (!cg_mount_needs_subdirs(type))
continue;
- }
path2 = must_make_path(controllerpath, h->container_base_path,
ops->container_cgroup, NULL);
ret = mkdir_p(path2, 0755);
- if (ret < 0) {
- free(controllerpath);
- free(path2);
+ if (ret < 0)
goto on_error;
- }
ret = cg_legacy_mount_controllers(type, h, controllerpath,
path2, ops->container_cgroup);
- free(controllerpath);
- free(path2);
if (ret < 0)
goto on_error;
}
retval = true;
on_error:
- free(tmpfspath);
return retval;
}
static int recursive_count_nrtasks(char *dirname)
{
+ __do_free char *path = NULL;
+ __do_closedir DIR *dir = NULL;
struct dirent *direntp;
- DIR *dir;
int count = 0, ret;
- char *path;
dir = opendir(dirname);
if (!dir)
path = must_make_path(dirname, direntp->d_name, NULL);
if (lstat(path, &mystat))
- goto next;
+ continue;
if (!S_ISDIR(mystat.st_mode))
- goto next;
+ continue;
count += recursive_count_nrtasks(path);
- next:
- free(path);
}
path = must_make_path(dirname, "cgroup.procs", NULL);
ret = lxc_count_file_lines(path);
if (ret != -1)
count += ret;
- free(path);
-
- (void)closedir(dir);
return count;
}
__cgfsng_ops static int cgfsng_nrtasks(struct cgroup_ops *ops)
{
+ __do_free char *path = NULL;
int count;
- char *path;
if (!ops->container_cgroup || !ops->hierarchies)
return -1;
path = must_make_path(ops->hierarchies[0]->container_full_path, NULL);
count = recursive_count_nrtasks(path);
- free(path);
return count;
}
/* Only root needs to escape to the cgroup of its init. */
-__cgfsng_ops static bool cgfsng_escape(const struct cgroup_ops *ops)
+__cgfsng_ops static bool cgfsng_escape(const struct cgroup_ops *ops,
+ struct lxc_conf *conf)
{
int i;
- if (geteuid())
+ if (geteuid() || !ops->hierarchies)
return true;
for (i = 0; ops->hierarchies[i]; i++) {
int ret;
- char *fullpath;
+ __do_free char *fullpath = NULL;
fullpath = must_make_path(ops->hierarchies[i]->mountpoint,
ops->hierarchies[i]->container_base_path,
ret = lxc_write_to_file(fullpath, "0", 2, false, 0666);
if (ret != 0) {
SYSERROR("Failed to escape to cgroup \"%s\"", fullpath);
- free(fullpath);
return false;
}
- free(fullpath);
}
return true;
__cgfsng_ops static int cgfsng_num_hierarchies(struct cgroup_ops *ops)
{
- int i;
+ int i = 0;
- for (i = 0; ops->hierarchies[i]; i++)
+ if (!ops->hierarchies)
+ return 0;
+
+ for (; ops->hierarchies[i]; i++)
;
return i;
{
int i;
+ if (!ops->hierarchies)
+ return false;
+
/* sanity check n */
for (i = 0; i < n; i++)
if (!ops->hierarchies[i])
__cgfsng_ops static bool cgfsng_unfreeze(struct cgroup_ops *ops)
{
int ret;
- char *fullpath;
+ __do_free char *fullpath = NULL;
struct hierarchy *h;
h = get_hierarchy(ops, "freezer");
fullpath = must_make_path(h->container_full_path, "freezer.state", NULL);
ret = lxc_write_to_file(fullpath, THAWED, THAWED_LEN, false, 0666);
- free(fullpath);
if (ret < 0)
return false;
const char *lxcpath, const char *pidstr,
size_t pidstr_len, const char *controller)
{
+ __do_free char *base_path = NULL, *container_cgroup = NULL,
+ *full_path = NULL;
int ret;
size_t len;
int fret = -1, idx = 0;
- char *base_path = NULL, *container_cgroup = NULL, *full_path = NULL;
container_cgroup = lxc_cmd_get_cgroup_path(name, lxcpath, controller);
/* not running */
if (ret == 0)
goto on_success;
- free(full_path);
-
len = strlen(base_path) + STRLITERALLEN("/lxc-1000") +
STRLITERALLEN("/cgroup-procs");
full_path = must_realloc(NULL, len + 1);
fret = 0;
on_error:
- free(base_path);
- free(container_cgroup);
- free(full_path);
-
return fret;
}
int i, len, ret;
char pidstr[INTTYPE_TO_STRLEN(pid_t)];
+ if (!ops->hierarchies)
+ return true;
+
len = snprintf(pidstr, sizeof(pidstr), "%d", pid);
if (len < 0 || (size_t)len >= sizeof(pidstr))
return false;
for (i = 0; ops->hierarchies[i]; i++) {
- char *path;
+ __do_free char *path = NULL;
char *fullpath = NULL;
struct hierarchy *h = ops->hierarchies[i];
continue;
fullpath = build_full_cgpath_from_monitorpath(h, path, "cgroup.procs");
- free(path);
ret = lxc_write_to_file(fullpath, pidstr, len, false, 0666);
if (ret < 0) {
SYSERROR("Failed to attach %d to %s", (int)pid, fullpath);
- free(fullpath);
return false;
}
- free(fullpath);
}
return true;
char *value, size_t len, const char *name,
const char *lxcpath)
{
- __do_free char *controller;
- char *p, *path;
+ __do_free char *path = NULL;
+ __do_free char *controller = NULL;
+ char *p;
struct hierarchy *h;
int ret = -1;
h = get_hierarchy(ops, controller);
if (h) {
- char *fullpath;
+ __do_free char *fullpath = NULL;
fullpath = build_full_cgpath_from_monitorpath(h, path, filename);
ret = lxc_read_from_file(fullpath, value, len);
- free(fullpath);
}
- free(path);
return ret;
}
const char *filename, const char *value,
const char *name, const char *lxcpath)
{
- __do_free char *controller;
- char *p, *path;
+ __do_free char *path = NULL;
+ __do_free char *controller = NULL;
+ char *p;
struct hierarchy *h;
int ret = -1;
h = get_hierarchy(ops, controller);
if (h) {
- char *fullpath;
+ __do_free char *fullpath = NULL;
fullpath = build_full_cgpath_from_monitorpath(h, path, filename);
ret = lxc_write_to_file(fullpath, value, strlen(value), false, 0666);
- free(fullpath);
}
- free(path);
return ret;
}
*/
static int convert_devpath(const char *invalue, char *dest)
{
+ __do_free char *path = NULL;
int n_parts;
- char *p, *path, type;
+ char *p, type;
unsigned long minor, major;
struct stat sb;
int ret = -EINVAL;
ret = 0;
out:
- free(path);
return ret;
}
static int cg_legacy_set_data(struct cgroup_ops *ops, const char *filename,
const char *value)
{
- __do_free char *controller;
- char *fullpath, *p;
+ __do_free char *controller = NULL;
+ __do_free char *fullpath = NULL;
+ char *p;
/* "b|c <2^64-1>:<2^64-1> r|w|m" = 47 chars max */
char converted_value[50];
struct hierarchy *h;
fullpath = must_make_path(h->container_full_path, filename, NULL);
ret = lxc_write_to_file(fullpath, value, strlen(value), false, 0666);
- free(fullpath);
return ret;
}
struct lxc_list *cgroup_settings,
bool do_devices)
{
- struct lxc_list *iterator, *next, *sorted_cgroup_settings;
+ __do_free struct lxc_list *sorted_cgroup_settings = NULL;
+ struct lxc_list *iterator, *next;
struct lxc_cgroup *cg;
bool ret = false;
if (lxc_list_empty(cgroup_settings))
return true;
+ if (!ops->hierarchies)
+ return false;
+
sorted_cgroup_settings = sort_cgroup_settings(cgroup_settings);
if (!sorted_cgroup_settings)
return false;
lxc_list_del(iterator);
free(iterator);
}
- free(sorted_cgroup_settings);
+
return ret;
}
return false;
lxc_list_for_each(iterator, cgroup_settings) {
+ __do_free char *fullpath = NULL;
int ret;
- char *fullpath;
struct lxc_cgroup *cg = iterator->elem;
fullpath = must_make_path(h->container_full_path, cg->subsystem, NULL);
ret = lxc_write_to_file(fullpath, cg->value, strlen(cg->value), false, 0666);
- free(fullpath);
if (ret < 0) {
SYSERROR("Failed to set \"%s\" to \"%s\"",
cg->subsystem, cg->value);
return true;
}
+static void cg_unified_delegate(char ***delegate)
+{
+ __do_free char *tmp = NULL;
+ int idx;
+ char *standard[] = {"cgroup.subtree_control", "cgroup.threads", NULL};
+
+ tmp = read_file("/sys/kernel/cgroup/delegate");
+ if (!tmp) {
+ for (char **p = standard; p && *p; p++) {
+ idx = append_null_to_list((void ***)delegate);
+ (*delegate)[idx] = must_copy_string(*p);
+ }
+ } else {
+ char *token;
+ lxc_iterate_parts (token, tmp, " \t\n") {
+ /*
+ * We always need to chown this for both cgroup and
+ * cgroup2.
+ */
+ if (strcmp(token, "cgroup.procs") == 0)
+ continue;
+
+ idx = append_null_to_list((void ***)delegate);
+ (*delegate)[idx] = must_copy_string(token);
+ }
+ }
+}
+
/* At startup, parse_hierarchies finds all the info we need about cgroup
* mountpoints and current cgroups, and stores it in @d.
*/
-static bool cg_hybrid_init(struct cgroup_ops *ops)
+static bool cg_hybrid_init(struct cgroup_ops *ops, bool relative,
+ bool unprivileged)
{
+ __do_free char *basecginfo = NULL;
+ __do_free char *line = NULL;
+ __do_fclose FILE *f = NULL;
int ret;
- char *basecginfo;
- bool will_escape;
- FILE *f;
size_t len = 0;
- char *line = NULL;
char **klist = NULL, **nlist = NULL;
/* Root spawned containers escape the current cgroup, so use init's
* cgroups as our base in that case.
*/
- will_escape = (geteuid() == 0);
- if (will_escape)
+ if (!relative && (geteuid() == 0))
basecginfo = read_file("/proc/1/cgroup");
else
basecginfo = read_file("/proc/self/cgroup");
ret = get_existing_subsystems(&klist, &nlist);
if (ret < 0) {
ERROR("Failed to retrieve available legacy cgroup controllers");
- free(basecginfo);
return false;
}
f = fopen("/proc/self/mountinfo", "r");
if (!f) {
ERROR("Failed to open \"/proc/self/mountinfo\"");
- free(basecginfo);
return false;
}
goto next;
new = add_hierarchy(&ops->hierarchies, controller_list, mountpoint, base_cgroup, type);
- if (type == CGROUP2_SUPER_MAGIC && !ops->unified)
+ if (type == CGROUP2_SUPER_MAGIC && !ops->unified) {
+ if (unprivileged)
+ cg_unified_delegate(&new->cgroup2_chown);
ops->unified = new;
+ }
continue;
free_string_list(klist);
free_string_list(nlist);
- free(basecginfo);
-
- fclose(f);
- free(line);
-
TRACE("Writable cgroup hierarchies:");
lxc_cgfsng_print_hierarchies(ops);
}
/* Get current cgroup from /proc/self/cgroup for the cgroupfs v2 hierarchy. */
-static char *cg_unified_get_current_cgroup(void)
+static char *cg_unified_get_current_cgroup(bool relative)
{
- char *basecginfo, *base_cgroup;
- bool will_escape;
+ __do_free char *basecginfo = NULL;
+ char *base_cgroup;
char *copy = NULL;
- will_escape = (geteuid() == 0);
- if (will_escape)
+ if (!relative && (geteuid() == 0))
basecginfo = read_file("/proc/1/cgroup");
else
basecginfo = read_file("/proc/self/cgroup");
goto cleanup_on_err;
cleanup_on_err:
- free(basecginfo);
if (copy)
trim(copy);
return copy;
}
-static int cg_unified_init(struct cgroup_ops *ops)
+static int cg_unified_init(struct cgroup_ops *ops, bool relative,
+ bool unprivileged)
{
__do_free char *subtree_path = NULL;
int ret;
char *mountpoint;
char **delegatable;
+ struct hierarchy *new;
char *base_cgroup = NULL;
ret = cg_is_pure_unified();
if (ret != CGROUP2_SUPER_MAGIC)
return 0;
- base_cgroup = cg_unified_get_current_cgroup();
+ base_cgroup = cg_unified_get_current_cgroup(relative);
if (!base_cgroup)
return -EINVAL;
prune_init_scope(base_cgroup);
* controllers per container.
*/
+ new = add_hierarchy(&ops->hierarchies, delegatable, mountpoint, base_cgroup, CGROUP2_SUPER_MAGIC);
+ if (!unprivileged)
+ cg_unified_delegate(&new->cgroup2_chown);
+
ops->cgroup_layout = CGROUP_LAYOUT_UNIFIED;
- ops->unified = add_hierarchy(&ops->hierarchies, delegatable, mountpoint,
- base_cgroup, CGROUP2_SUPER_MAGIC);
+ ops->unified = new;
return CGROUP2_SUPER_MAGIC;
}
-static bool cg_init(struct cgroup_ops *ops)
+static bool cg_init(struct cgroup_ops *ops, struct lxc_conf *conf)
{
int ret;
const char *tmp;
+ bool relative = false;
tmp = lxc_global_config_value("lxc.cgroup.use");
if (tmp) {
- char *chop, *cur, *pin;
+ __do_free char *pin = NULL;
+ char *chop, *cur;
pin = must_copy_string(tmp);
chop = pin;
- lxc_iterate_parts(cur, chop, ",") {
+ lxc_iterate_parts(cur, chop, ",")
must_append_string(&ops->cgroup_use, cur);
- }
-
- free(pin);
}
- ret = cg_unified_init(ops);
+ ret = cg_unified_init(ops, relative, !lxc_list_empty(&conf->id_map));
if (ret < 0)
return false;
if (ret == CGROUP2_SUPER_MAGIC)
return true;
- return cg_hybrid_init(ops);
+ return cg_hybrid_init(ops, relative, !lxc_list_empty(&conf->id_map));
}
__cgfsng_ops static bool cgfsng_data_init(struct cgroup_ops *ops)
return false;
}
ops->cgroup_pattern = must_copy_string(cgroup_pattern);
+ ops->monitor_pattern = MONITOR_CGROUP;
return true;
}
-struct cgroup_ops *cgfsng_ops_init(void)
+struct cgroup_ops *cgfsng_ops_init(struct lxc_conf *conf)
{
struct cgroup_ops *cgfsng_ops;
memset(cgfsng_ops, 0, sizeof(struct cgroup_ops));
cgfsng_ops->cgroup_layout = CGROUP_LAYOUT_UNKNOWN;
- if (!cg_init(cgfsng_ops)) {
+ if (!cg_init(cgfsng_ops, conf)) {
free(cgfsng_ops);
return NULL;
}
cgfsng_ops->data_init = cgfsng_data_init;
- cgfsng_ops->destroy = cgfsng_payload_destroy;
- cgfsng_ops->destroy = cgfsng_payload_destroy;
+ cgfsng_ops->payload_destroy = cgfsng_payload_destroy;
+ cgfsng_ops->monitor_destroy = cgfsng_monitor_destroy;
+ cgfsng_ops->monitor_create = cgfsng_monitor_create;
+ cgfsng_ops->monitor_enter = cgfsng_monitor_enter;
cgfsng_ops->payload_create = cgfsng_payload_create;
cgfsng_ops->payload_enter = cgfsng_payload_enter;
cgfsng_ops->escape = cgfsng_escape;
projects / thirdparty / lxc.git / commitdiff
