treewide: use log_*_errno whenever %m is in the format string

[thirdparty/systemd.git] / src / core / cgroup.c

diff --git a/src/core/cgroup.c b/src/core/cgroup.c
index e604c3cbc694e7254a56fb5fb5389345502f2101..382e6a6ccc6fd7d3408bd58743bb34191f181386 100644 (file)
--- a/src/core/cgroup.c
+++ b/src/core/cgroup.c
@@ -105,7 +105,8 @@ void cgroup_context_dump(CGroupContext *c, FILE* f, const char *prefix) {
                 "%sBlockIOWeight=%lu\n"
                 "%sStartupBlockIOWeight=%lu\n"
                 "%sMemoryLimit=%" PRIu64 "\n"
-                "%sDevicePolicy=%s\n",
+                "%sDevicePolicy=%s\n"
+                "%sDelegate=%s\n",
                 prefix, yes_no(c->cpu_accounting),
                 prefix, yes_no(c->blockio_accounting),
                 prefix, yes_no(c->memory_accounting),
@@ -115,7 +116,8 @@ void cgroup_context_dump(CGroupContext *c, FILE* f, const char *prefix) {
                 prefix, c->blockio_weight,
                 prefix, c->startup_blockio_weight,
                 prefix, c->memory_limit,
-                prefix, cgroup_device_policy_to_string(c->device_policy));
+                prefix, cgroup_device_policy_to_string(c->device_policy),
+                prefix, yes_no(c->delegate));
 
         LIST_FOREACH(device_allow, a, c->device_allow)
                 fprintf(f,
@@ -152,7 +154,7 @@ static int lookup_blkio_device(const char *p, dev_t *dev) {
 
         r = stat(p, &st);
         if (r < 0) {
-                log_warning("Couldn't stat device %s: %m", p);
+                log_warning_errno(errno, "Couldn't stat device %s: %m", p);
                 return -errno;
         }
 
@@ -217,7 +219,7 @@ static int whitelist_major(const char *path, const char *name, char type, const
 
         f = fopen("/proc/devices", "re");
         if (!f) {
-                log_warning("Cannot open /proc/devices to resolve %s (%c): %m", name, type);
+                log_warning_errno(errno, "Cannot open /proc/devices to resolve %s (%c): %m", name, type);
                 return -errno;
         }
 
@@ -278,7 +280,7 @@ static int whitelist_major(const char *path, const char *name, char type, const
         return 0;
 
 fail:
-        log_warning("Failed to read /proc/devices: %m");
+        log_warning_errno(errno, "Failed to read /proc/devices: %m");
         return -errno;
 }
 
@@ -461,7 +463,8 @@ CGroupControllerMask cgroup_context_get_mask(CGroupContext *c) {
             c->memory_limit != (uint64_t) -1)
                 mask |= CGROUP_MEMORY;
 
-        if (c->device_allow || c->device_policy != CGROUP_AUTO)
+        if (c->device_allow ||
+            c->device_policy != CGROUP_AUTO)
                 mask |= CGROUP_DEVICE;
 
         return mask;
@@ -474,6 +477,19 @@ CGroupControllerMask unit_get_cgroup_mask(Unit *u) {
         if (!c)
                 return 0;
 
+        /* If delegation is turned on, then turn on all cgroups,
+         * unless the process we fork into it is known to drop
+         * privileges anyway, and shouldn't get access to the
+         * controllers anyway. */
+
+        if (c->delegate) {
+                ExecContext *e;
+
+                e = unit_get_exec_context(u);
+                if (!e || exec_context_maintains_privileges(e))
+                        return _CGROUP_CONTROLLER_MASK_ALL;
+        }
+
         return cgroup_context_get_mask(c);
 }
 
@@ -614,10 +630,8 @@ static int unit_create_cgroups(Unit *u, CGroupControllerMask mask) {
 
         /* First, create our own group */
         r = cg_create_everywhere(u->manager->cgroup_supported, mask, u->cgroup_path);
-        if (r < 0) {
-                log_error("Failed to create cgroup %s: %s", u->cgroup_path, strerror(-r));
-                return r;
-        }
+        if (r < 0)
+                return log_error_errno(r, "Failed to create cgroup %s: %m", u->cgroup_path);
 
         /* Keep track that this is now realized */
         u->cgroup_realized = true;
@@ -626,7 +640,7 @@ static int unit_create_cgroups(Unit *u, CGroupControllerMask mask) {
         /* Then, possibly move things over */
         r = cg_migrate_everywhere(u->manager->cgroup_supported, u->cgroup_path, u->cgroup_path, migrate_callback, u);
         if (r < 0)
-                log_warning("Failed to migrate cgroup from to %s: %s", u->cgroup_path, strerror(-r));
+                log_warning_errno(r, "Failed to migrate cgroup from to %s: %m", u->cgroup_path);
 
         return 0;
 }
@@ -699,7 +713,7 @@ unsigned manager_dispatch_cgroup_queue(Manager *m) {
 
                 r = unit_realize_cgroup_now(i, state);
                 if (r < 0)
-                        log_warning("Failed to realize cgroups for queued unit %s: %s", i->id, strerror(-r));
+                        log_warning_errno(r, "Failed to realize cgroups for queued unit %s: %m", i->id);
 
                 n++;
         }
@@ -782,7 +796,7 @@ void unit_destroy_cgroup(Unit *u) {
 
         r = cg_trim_everywhere(u->manager->cgroup_supported, u->cgroup_path, !unit_has_name(u, SPECIAL_ROOT_SLICE));
         if (r < 0)
-                log_debug("Failed to destroy cgroup %s: %s", u->cgroup_path, strerror(-r));
+                log_debug_errno(r, "Failed to destroy cgroup %s: %m", u->cgroup_path);
 
         hashmap_remove(u->manager->cgroup_unit, u->cgroup_path);
 
@@ -841,10 +855,8 @@ int manager_setup_cgroup(Manager *m) {
         m->cgroup_root = NULL;
 
         r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, 0, &m->cgroup_root);
-        if (r < 0) {
-                log_error("Cannot determine cgroup we are running in: %s", strerror(-r));
-                return r;
-        }
+        if (r < 0)
+                return log_error_errno(r, "Cannot determine cgroup we are running in: %m");
 
         /* LEGACY: Already in /system.slice? If so, let's cut this
          * off. This is to support live upgrades from older systemd
@@ -867,10 +879,8 @@ int manager_setup_cgroup(Manager *m) {
 
         /* 2. Show data */
         r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, m->cgroup_root, NULL, &path);
-        if (r < 0) {
-                log_error("Cannot find cgroup mount point: %s", strerror(-r));
-                return r;
-        }
+        if (r < 0)
+                return log_error_errno(r, "Cannot find cgroup mount point: %m");
 
         log_debug("Using cgroup controller " SYSTEMD_CGROUP_CONTROLLER ". File system hierarchy is at %s.", path);
         if (!m->test_run) {
@@ -879,7 +889,7 @@ int manager_setup_cgroup(Manager *m) {
                 if (m->running_as == SYSTEMD_SYSTEM) {
                         r = cg_install_release_agent(SYSTEMD_CGROUP_CONTROLLER, SYSTEMD_CGROUP_AGENT_PATH);
                         if (r < 0)
-                                log_warning("Failed to install release agent, ignoring: %s", strerror(-r));
+                                log_warning_errno(r, "Failed to install release agent, ignoring: %m");
                         else if (r > 0)
                                 log_debug("Installed release agent.");
                         else
@@ -888,17 +898,15 @@ int manager_setup_cgroup(Manager *m) {
 
                 /* 4. Make sure we are in the root cgroup */
                 r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, m->cgroup_root, 0);
-                if (r < 0) {
-                        log_error("Failed to create root cgroup hierarchy: %s", strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_error_errno(r, "Failed to create root cgroup hierarchy: %m");
 
                 /* 5. And pin it, so that it cannot be unmounted */
                 safe_close(m->pin_cgroupfs_fd);
 
                 m->pin_cgroupfs_fd = open(path, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY|O_NONBLOCK);
                 if (m->pin_cgroupfs_fd < 0) {
-                        log_error("Failed to open pin file: %m");
+                        log_error_errno(errno, "Failed to open pin file: %m");
                         return -errno;
                 }