src/nspawn/nspawn-cgroup.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <sys/mount.h>
   4
   5 #include "alloc-util.h"
   6 #include "fd-util.h"
   7 #include "fileio.h"
   8 #include "mkdir.h"
   9 #include "mount-util.h"
  10 #include "nspawn-cgroup.h"
  11 #include "rm-rf.h"
  12 #include "string-util.h"
  13 #include "strv.h"
  14 #include "util.h"
  15
  16 static int chown_cgroup_path(const char *path, uid_t uid_shift) {
  17         _cleanup_close_ int fd = -1;
  18         const char *fn;
  19
  20         fd = open(path, O_RDONLY|O_CLOEXEC|O_DIRECTORY);
  21         if (fd < 0)
  22                 return -errno;
  23
  24         FOREACH_STRING(fn,
  25                        ".",
  26                        "cgroup.clone_children",
  27                        "cgroup.controllers",
  28                        "cgroup.events",
  29                        "cgroup.procs",
  30                        "cgroup.stat",
  31                        "cgroup.subtree_control",
  32                        "cgroup.threads",
  33                        "notify_on_release",
  34                        "tasks")
  35                 if (fchownat(fd, fn, uid_shift, uid_shift, 0) < 0)
  36                         log_full_errno(errno == ENOENT ? LOG_DEBUG :  LOG_WARNING, errno,
  37                                        "Failed to chown \"%s/%s\", ignoring: %m", path, fn);
  38
  39         return 0;
  40 }
  41
  42 int chown_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t uid_shift) {
  43         _cleanup_free_ char *path = NULL, *fs = NULL;
  44         int r;
  45
  46         r = cg_pid_get_path(NULL, pid, &path);
  47         if (r < 0)
  48                 return log_error_errno(r, "Failed to get container cgroup path: %m");
  49
  50         r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, path, NULL, &fs);
  51         if (r < 0)
  52                 return log_error_errno(r, "Failed to get file system path for container cgroup: %m");
  53
  54         r = chown_cgroup_path(fs, uid_shift);
  55         if (r < 0)
  56                 return log_error_errno(r, "Failed to chown() cgroup %s: %m", fs);
  57
  58         if (unified_requested == CGROUP_UNIFIED_SYSTEMD) {
  59                 _cleanup_free_ char *lfs = NULL;
  60                 /* Always propagate access rights from unified to legacy controller */
  61
  62                 r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER_LEGACY, path, NULL, &lfs);
  63                 if (r < 0)
  64                         return log_error_errno(r, "Failed to get file system path for container cgroup: %m");
  65
  66                 r = chown_cgroup_path(lfs, uid_shift);
  67                 if (r < 0)
  68                         return log_error_errno(r, "Failed to chown() cgroup %s: %m", lfs);
  69         }
  70
  71         return 0;
  72 }
  73
  74 int sync_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t arg_uid_shift) {
  75         _cleanup_free_ char *cgroup = NULL;
  76         char tree[] = "/tmp/unifiedXXXXXX", pid_string[DECIMAL_STR_MAX(pid) + 1];
  77         bool undo_mount = false;
  78         const char *fn;
  79         int r, unified_controller;
  80
  81         unified_controller = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
  82         if (unified_controller < 0)
  83                 return log_error_errno(unified_controller, "Failed to determine whether the systemd hierarchy is unified: %m");
  84         if ((unified_controller > 0) == (unified_requested >= CGROUP_UNIFIED_SYSTEMD))
  85                 return 0;
  86
  87         /* When the host uses the legacy cgroup setup, but the
  88          * container shall use the unified hierarchy, let's make sure
  89          * we copy the path from the name=systemd hierarchy into the
  90          * unified hierarchy. Similar for the reverse situation. */
  91
  92         r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, pid, &cgroup);
  93         if (r < 0)
  94                 return log_error_errno(r, "Failed to get control group of " PID_FMT ": %m", pid);
  95
  96         /* In order to access the unified hierarchy we need to mount it */
  97         if (!mkdtemp(tree))
  98                 return log_error_errno(errno, "Failed to generate temporary mount point for unified hierarchy: %m");
  99
 100         if (unified_controller > 0)
 101                 r = mount_verbose(LOG_ERR, "cgroup", tree, "cgroup",
 102                                   MS_NOSUID|MS_NOEXEC|MS_NODEV, "none,name=systemd,xattr");
 103         else
 104                 r = mount_verbose(LOG_ERR, "cgroup", tree, "cgroup2",
 105                                   MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
 106         if (r < 0)
 107                 goto finish;
 108
 109         undo_mount = true;
 110
 111         /* If nspawn dies abruptly the cgroup hierarchy created below
 112          * its unit isn't cleaned up. So, let's remove it
 113          * https://github.com/systemd/systemd/pull/4223#issuecomment-252519810 */
 114         fn = strjoina(tree, cgroup);
 115         (void) rm_rf(fn, REMOVE_ROOT|REMOVE_ONLY_DIRECTORIES);
 116
 117         fn = strjoina(tree, cgroup, "/cgroup.procs");
 118         (void) mkdir_parents(fn, 0755);
 119
 120         sprintf(pid_string, PID_FMT, pid);
 121         r = write_string_file(fn, pid_string, 0);
 122         if (r < 0) {
 123                 log_error_errno(r, "Failed to move process: %m");
 124                 goto finish;
 125         }
 126
 127         fn = strjoina(tree, cgroup);
 128         r = chown_cgroup_path(fn, arg_uid_shift);
 129         if (r < 0)
 130                 log_error_errno(r, "Failed to chown() cgroup %s: %m", fn);
 131 finish:
 132         if (undo_mount)
 133                 (void) umount_verbose(tree);
 134
 135         (void) rmdir(tree);
 136         return r;
 137 }
 138
 139 int create_subcgroup(pid_t pid, bool keep_unit, CGroupUnified unified_requested) {
 140         _cleanup_free_ char *cgroup = NULL;
 141         CGroupMask supported;
 142         const char *payload;
 143         int r;
 144
 145         assert(pid > 1);
 146
 147         /* In the unified hierarchy inner nodes may only contain subgroups, but not processes. Hence, if we running in
 148          * the unified hierarchy and the container does the same, and we did not create a scope unit for the container
 149          * move us and the container into two separate subcgroups.
 150          *
 151          * Moreover, container payloads such as systemd try to manage the cgroup they run in in full (i.e. including
 152          * its attributes), while the host systemd will only delegate cgroups for children of the cgroup created for a
 153          * delegation unit, instead of the cgroup itself. This means, if we'd pass on the cgroup allocated from the
 154          * host systemd directly to the payload, the host and payload systemd might fight for the cgroup
 155          * attributes. Hence, let's insert an intermediary cgroup to cover that case too.
 156          *
 157          * Note that we only bother with the main hierarchy here, not with any secondary ones. On the unified setup
 158          * that's fine because there's only one hiearchy anyway and controllers are enabled directly on it. On the
 159          * legacy setup, this is fine too, since delegation of controllers is generally not safe there, hence we won't
 160          * do it. */
 161
 162         r = cg_mask_supported(&supported);
 163         if (r < 0)
 164                 return log_error_errno(r, "Failed to determine supported controllers: %m");
 165
 166         if (keep_unit)
 167                 r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, 0, &cgroup);
 168         else
 169                 r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, pid, &cgroup);
 170         if (r < 0)
 171                 return log_error_errno(r, "Failed to get our control group: %m");
 172
 173         payload = strjoina(cgroup, "/payload");
 174         r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, payload, pid);
 175         if (r < 0)
 176                 return log_error_errno(r, "Failed to create %s subcgroup: %m", payload);
 177
 178         if (keep_unit) {
 179                 const char *supervisor;
 180
 181                 supervisor = strjoina(cgroup, "/supervisor");
 182                 r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, supervisor, 0);
 183                 if (r < 0)
 184                         return log_error_errno(r, "Failed to create %s subcgroup: %m", supervisor);
 185         }
 186
 187         /* Try to enable as many controllers as possible for the new payload. */
 188         (void) cg_enable_everywhere(supported, supported, cgroup);
 189         return 0;
 190 }