src/nspawn/nspawn-cgroup.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2015 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <sys/mount.h>
  21
  22 #include "alloc-util.h"
  23 #include "fd-util.h"
  24 #include "fileio.h"
  25 #include "mkdir.h"
  26 #include "mount-util.h"
  27 #include "nspawn-cgroup.h"
  28 #include "rm-rf.h"
  29 #include "string-util.h"
  30 #include "strv.h"
  31 #include "util.h"
  32
  33 static int chown_cgroup_path(const char *path, uid_t uid_shift) {
  34         _cleanup_close_ int fd = -1;
  35         const char *fn;
  36
  37         fd = open(path, O_RDONLY|O_CLOEXEC|O_DIRECTORY);
  38         if (fd < 0)
  39                 return -errno;
  40
  41         FOREACH_STRING(fn,
  42                        ".",
  43                        "tasks",
  44                        "notify_on_release",
  45                        "cgroup.procs",
  46                        "cgroup.events",
  47                        "cgroup.clone_children",
  48                        "cgroup.controllers",
  49                        "cgroup.subtree_control")
  50                 if (fchownat(fd, fn, uid_shift, uid_shift, 0) < 0)
  51                         log_full_errno(errno == ENOENT ? LOG_DEBUG :  LOG_WARNING, errno,
  52                                        "Failed to chown() cgroup file %s, ignoring: %m", fn);
  53
  54         return 0;
  55 }
  56
  57 int chown_cgroup(pid_t pid, uid_t uid_shift) {
  58         _cleanup_free_ char *path = NULL, *fs = NULL;
  59         int r;
  60
  61         r = cg_pid_get_path(NULL, pid, &path);
  62         if (r < 0)
  63                 return log_error_errno(r, "Failed to get container cgroup path: %m");
  64
  65         r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, path, NULL, &fs);
  66         if (r < 0)
  67                 return log_error_errno(r, "Failed to get file system path for container cgroup: %m");
  68
  69         r = chown_cgroup_path(fs, uid_shift);
  70         if (r < 0)
  71                 return log_error_errno(r, "Failed to chown() cgroup %s: %m", fs);
  72
  73         return 0;
  74 }
  75
  76 int sync_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t arg_uid_shift) {
  77         _cleanup_free_ char *cgroup = NULL;
  78         char tree[] = "/tmp/unifiedXXXXXX", pid_string[DECIMAL_STR_MAX(pid) + 1];
  79         bool undo_mount = false;
  80         const char *fn;
  81         int r;
  82
  83         if (cg_unified(SYSTEMD_CGROUP_CONTROLLER) == (unified_requested >= CGROUP_UNIFIED_SYSTEMD))
  84                 return 0;
  85
  86         /* When the host uses the legacy cgroup setup, but the
  87          * container shall use the unified hierarchy, let's make sure
  88          * we copy the path from the name=systemd hierarchy into the
  89          * unified hierarchy. Similar for the reverse situation. */
  90
  91         r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, pid, &cgroup);
  92         if (r < 0)
  93                 return log_error_errno(r, "Failed to get control group of " PID_FMT ": %m", pid);
  94
  95         /* In order to access the unified hierarchy we need to mount it */
  96         if (!mkdtemp(tree))
  97                 return log_error_errno(errno, "Failed to generate temporary mount point for unified hierarchy: %m");
  98
  99         if (cg_unified(SYSTEMD_CGROUP_CONTROLLER))
 100                 r = mount_verbose(LOG_ERR, "cgroup", tree, "cgroup",
 101                                   MS_NOSUID|MS_NOEXEC|MS_NODEV, "none,name=systemd,xattr");
 102         else
 103                 r = mount_verbose(LOG_ERR, "cgroup", tree, "cgroup2",
 104                                   MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
 105         if (r < 0)
 106                 goto finish;
 107
 108         undo_mount = true;
 109
 110         /* If nspawn dies abruptly the cgroup hierarchy created below
 111          * its unit isn't cleaned up. So, let's remove it
 112          * https://github.com/systemd/systemd/pull/4223#issuecomment-252519810 */
 113         fn = strjoina(tree, cgroup);
 114         (void) rm_rf(fn, REMOVE_ROOT|REMOVE_ONLY_DIRECTORIES);
 115
 116         fn = strjoina(tree, cgroup, "/cgroup.procs");
 117         (void) mkdir_parents(fn, 0755);
 118
 119         sprintf(pid_string, PID_FMT, pid);
 120         r = write_string_file(fn, pid_string, 0);
 121         if (r < 0) {
 122                 log_error_errno(r, "Failed to move process: %m");
 123                 goto finish;
 124         }
 125
 126         fn = strjoina(tree, cgroup);
 127         r = chown_cgroup_path(fn, arg_uid_shift);
 128         if (r < 0)
 129                 log_error_errno(r, "Failed to chown() cgroup %s: %m", fn);
 130 finish:
 131         if (undo_mount)
 132                 (void) umount_verbose(tree);
 133
 134         (void) rmdir(tree);
 135         return r;
 136 }
 137
 138 int create_subcgroup(pid_t pid, CGroupUnified unified_requested) {
 139         _cleanup_free_ char *cgroup = NULL;
 140         const char *child;
 141         int r;
 142         CGroupMask supported;
 143
 144         /* In the unified hierarchy inner nodes may only contain
 145          * subgroups, but not processes. Hence, if we running in the
 146          * unified hierarchy and the container does the same, and we
 147          * did not create a scope unit for the container move us and
 148          * the container into two separate subcgroups. */
 149
 150         if (unified_requested == CGROUP_UNIFIED_NONE)
 151                 return 0;
 152
 153         if (!cg_unified(SYSTEMD_CGROUP_CONTROLLER))
 154                 return 0;
 155
 156         r = cg_mask_supported(&supported);
 157         if (r < 0)
 158                 return log_error_errno(r, "Failed to determine supported controllers: %m");
 159
 160         r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, 0, &cgroup);
 161         if (r < 0)
 162                 return log_error_errno(r, "Failed to get our control group: %m");
 163
 164         child = strjoina(cgroup, "/payload");
 165         r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, child, pid);
 166         if (r < 0)
 167                 return log_error_errno(r, "Failed to create %s subcgroup: %m", child);
 168
 169         child = strjoina(cgroup, "/supervisor");
 170         r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, child, 0);
 171         if (r < 0)
 172                 return log_error_errno(r, "Failed to create %s subcgroup: %m", child);
 173
 174         /* Try to enable as many controllers as possible for the new payload. */
 175         (void) cg_enable_everywhere(supported, supported, cgroup);
 176         return 0;
 177 }