With cgroup_config_set_default() can an application set default permissions
of groups and files created by cgroup_config_load_config(). See the
documentation of the function.
Jan Safranek [Wed, 30 Nov 2011 14:42:29 +0000 (15:42 +0100)]
tools: Added parse_mode() and parse_uid_gid() to tools_common.c.
The parse_mode() function will be used by cgconfigparser, so move it there.
In addition, the cgconfigparser will need uid:gid parsing routines from
cgcreate.c, so move it to common code as well.
Signed-off-by: Jan Safranek <jsafrane@redhat.com> Acked-by: Dhaval Giani <dhaval.giani@gmail.com>
Jan Safranek [Wed, 30 Nov 2011 14:42:08 +0000 (15:42 +0100)]
cgconfigparser: Allow SUID and SGID permissions in 'fperm' and 'dperm' options.
libcgroup should allow SUID, SGID or sticky bit to be set either in
cgconfig.conf file or in API calls. Especially the sticky bit can be useful for
cooperation with systemd.
Jan Safranek [Wed, 30 Nov 2011 14:42:01 +0000 (15:42 +0100)]
cgconfigparser: Add 'default' section.
'default' section in cgconfig.conf file describes default owner and
permissions of group's control and task files. Using the 'default' section,
the common permissions can be specified only once per config file instead
of defining it separately for each group.
Signed-off-by: Jan Safranek <jsafrane@redhat.com> Acked-by: Dhaval Giani <dhaval.giani@gmail.com>
Jan Safranek [Wed, 30 Nov 2011 14:41:53 +0000 (15:41 +0100)]
libcgroup: Define NO_UID_GID.
Group control or task file owner should have UID/GID set to NO_UID_GID to
distinguish permissions which were set in config file from undefined
values. In the end, NO_UID_GID is transtated to UID/GID 0, so users
won't see any difference.
This will allow subsequent patches to set default owners of files/directories if
the group definition itself did not contain perm {} section.
Jan Safranek [Thu, 3 Nov 2011 09:50:11 +0000 (10:50 +0100)]
tests: Added cgconfig tests
There are two tests:
- cgclear_config_one - tests cgclear with one config file, incl. several error
cases
- cgclear_config_multi - tests cgclear with multiple config files, not so
many error cases here
Jan Safranek [Fri, 23 Sep 2011 11:53:33 +0000 (13:53 +0200)]
cgclear: delete cgroups from config file
cgclear should be able to 'uload' cgroups (and mounts) as specified in
given config file - as exact opposite of cgconfigparser.
This patch adds new options '-c <config_file>' and '-C <directory with config
files> just for this purpose. These options can be specified multiple times.
Jan Safranek [Fri, 23 Sep 2011 11:53:13 +0000 (13:53 +0200)]
libcgroup: free global config_cgroup_table
To be able to call the cgroup_parse_config() several times without memory
leaks, its callers should free the memory it allocates when they don't need
it.
Jan Safranek [Fri, 23 Sep 2011 11:53:06 +0000 (13:53 +0200)]
libcgroup: allow parsing to be called several times
cgroup_parse_config() should properly initialize its global variables, so
it can be called several times safely, i.e. several config files can be
parsed in sequence. The call to cgroup_parse_config() *rewrites* previous
result, it does not *add* new groups/mounts to global tables.
Jan Safranek [Fri, 23 Sep 2011 11:52:59 +0000 (13:52 +0200)]
libcgroup: the library can be re-initialize by cgroup_init()
cgroup_init() can be called several times in sequence. New call completelly
rewrites old data, i.e. things that were unmounted between two
cgroup_init() calls disappear and new mount points show up.
Jan Safranek [Fri, 23 Sep 2011 11:52:46 +0000 (13:52 +0200)]
libcgroup: added new flag to cgroup_delete_cgroup_ext to delete only empty groups
New flag CGFLAG_DELETE_EMPTY_ONLY tells cgroup_delete_cgroup_ext that the
group being deleted must be empty, i.e. have no subgroups and no tasks
inside.
Jan Safranek [Tue, 27 Sep 2011 06:50:09 +0000 (08:50 +0200)]
libcgroup: ignore 'tasks' file when changing permission of control files
When cgroup_create_cgroup() is called with different control_fperm and
task_fperm, libcgroup first changes permissions of *all* files to match
the control_fperm, which includes the also the tasks file and it might
loose some permission bits. The tasks file is then modulated by
control_fperm, but because umask-style of control_fperm, it might get
lower permissions that users would expect.
Therefore 'tasks' file must be skipped when using control_fperm.
Changelog since v1:
- use list of ignored files, cg_chmod_recursive_controller is called from
cg_chmod_recursive, which should chmod all files, incl. 'tasks'.
Changelog since v2:
- renamed the list with ignored files.
Signed-off-by: Jan Safranek <jsafrane@redhat.com> Reviewed-by: Michal Hocko <mhocko@suse.cz>
fts_read can return NULL in two cases. Either when we have visited all
files in the hierarchy (when errno is set to 0) or when an error
occured. We shouldn't set an error code in the first case obviously.
Changelog since v1:
- updated log message
Signed-off-by: Jan Safranek <jsafrane@redhat.com> Reviewed-by: Michal Hocko <mhocko@suse.cz>
Jan Safranek [Mon, 22 Aug 2011 08:48:58 +0000 (10:48 +0200)]
cgrulesengd: Fixed processing of symlinked executables.
when an executable is symlinked and the symlink is executed,
/proc/PID/status contains name of the symlink, while /proc/PID/exe points
to the real executable name. cgrulesengd considered this case as error and
did not trigger any rule for this exec().
With this patch, cgrulesengd uses name of /proc/PID/exe as the executable
in this case.
Jan Safranek [Wed, 24 Aug 2011 09:41:26 +0000 (11:41 +0200)]
lssubsys: Fixed file descriptor leak on error enumerating controllers.
Close the iterator when cgroup_get_all_controller_next fails. I've
rewritten the loop to have one error check for both
cgroup_get_all_controller_begin and cgroup_get_all_controller_end.
Jan Safranek [Wed, 24 Aug 2011 09:40:13 +0000 (11:40 +0200)]
cgconfigparser: Made YY_FATAL_ERROR really fatal when parsing cgconfig.conf
The error macro should stop all processing, otherwise some NULL pointers might
get dereferenced (e.g. lex.c:1323). It uses setjmp/longjmp to return from
depths of the bison/lex routines. As obvious consequence, all memory allocated
in the parsers is lost and is never freed. Still, it should be better than
exit() I proposed before.
Peter Schiffer [Wed, 13 Jul 2011 12:50:41 +0000 (14:50 +0200)]
Fixed few findings from Coverity scan
In function cgroup_parse_rules() added missing check for getpwuid() result.
In cgroup_get_procs() added missing fclose() on file descriptor.
In load_list() added missing fclose() on file descriptor.
Signed-off-by: Peter Schiffer <pschiffe@redhat.com> Signed-off-by: Jan Safranek <jsafrane@redhat.com>
There is no general rule on which permissions make sense for files in
different subsystems. Nevertheless the kernel creates those files with
the maximum allowed permissions for owner so we should use its part as
an umask for group and others permissions as well.
This means that if we specify 777 for file_mode we will end up having
same permissions as owner what ever they are.
The primary intelligence is implemented in cg_chmod_path function which
takes an argument which says whether user permissions should be used
as a template.
This patch adds and exports cgroup_set_permissions which sets
permissions for control and task files into the cgroup descriptor
and cgroup_create_cgroup does the rest.
Example:
/etc/cgconfig.conf:
mount {
cpu = /cgroup/cpuctl/;
}
Michal Hocko [Wed, 15 Jun 2011 15:23:47 +0000 (17:23 +0200)]
cgconfig: enable setting file permissions
We cannot setup file or directory permissions in (/etc/cgconfig.conf)
configuration file while we can do this with available tools.
This patch adds new two options fperm, dperm.
Task section supports only fperm, because there are no directories
involved while admin section supports both of them.
$ tools/cgconfigparser -l /etc/cgconfig.conf
$ ls -la /dev/cpuctl/devel/
total 0
drwxrwxr-x 2 root cgroup 0 May 13 15:22 .
drwxr-xr-x 3 root root 0 May 13 15:22 ..
-rw-r--r-- 1 root cgroup 0 May 13 15:22 cgroup.clone_children
--w--w--w- 1 root cgroup 0 May 13 15:22 cgroup.event_control
-r--r--r-- 1 root cgroup 0 May 13 15:22 cgroup.procs
-rw-r--r-- 1 root cgroup 0 May 13 15:22 cpu.rt_period_us
-rw-r--r-- 1 root cgroup 0 May 13 15:22 cpu.rt_runtime_us
-rw-r--r-- 1 root cgroup 0 May 13 15:22 cpu.shares
-rw-r--r-- 1 root cgroup 0 May 13 15:22 notify_on_release
-rw-rw---- 1 root cgroup 0 May 13 15:22 tasks
This patch enhances parser callbacks to initialize cgroup->task_fperm
and cgroup->control_[fd]perm and forces chmod at general
cgroup_create_cgroup level. This is safe because everybody who uses
cgroup has those values initialized to -1 unless they are set and then
they should be used.
Signed-off-by: Michal Hocko <mhocko@suse.cz> Signed-off-by: Jan Safranek <jsafrane@redhat.com>
Michal Hocko [Wed, 15 Jun 2011 15:23:39 +0000 (17:23 +0200)]
Add file and directory permissions into cgroup
Let's add file permission for tasks and file and directory permissions
for control files into cgroup so that we can add them into configuration
files.
Permissions are initialized to NO_PERMS (unsigned -1 which doesn't
represent any valid permissions) to reflect that no value is set. Let's
also add a common initialization functions for both cgroup table and
single cgroup.
Signed-off-by: Michal Hocko <mhocko@suse.cz> Signed-off-by: Jan Safranek <jsafrane@redhat.com>
cg_build_path: use max FILENAME_MAX characters for array in 2nd parameter
The function cg_build_path is internal now. All calls of it (there is one
exception - cgroup_fill_cgc function which uses FILENAME_MAX+1, fixed now too)
have the limited second parameter buffer to FILENAME_MAX.
cg_build_path copy to this buffer, but thhere was no limitation of the size of coppied buffer.
This is fixed in the patch.
Signed-off-by: Ivana Hutarova Varekova <varekova@redhat.com> Signed-off-by: Jan Safranek <jsafrane@redhat.com>
Jan Safranek [Wed, 1 Jun 2011 09:10:51 +0000 (11:10 +0200)]
Fixed cg_chmod_recursive
The function changes permissions only in the first hierarchy, but it should
change it in all of them.
Reproducer:
1) have cpuacct and freezer mounted separately, i.e.:
$ lssubsys -m
cpuacct /sys/fs/cgroup/cpuacct
freezer /sys/fs/cgroup/freezer
2) create a group with specific permissions:
$ cgcreate -f 700 -g freezer,cpuacct:/test
Result:
$ ls -la /sys/fs/cgroup/freezer/test/
-rwx------. 1 jsafrane jsafrane 0 May 31 09:16 cgroup.clone_children
-rwx------. 1 jsafrane jsafrane 0 May 31 09:16 cgroup.event_control
(-> first controller is fine)
$ ls -la /sys/fs/cgroup/cpuacct/test/
-rw-r--r--. 1 jsafrane jsafrane 0 May 31 09:16 cgroup.clone_children
--w--w--w-. 1 jsafrane jsafrane 0 May 31 09:16 cgroup.event_control
(-> second controller is wrong, it should be -rwx------)
Changelog:
- v2: fixed return code of cg_chmod_recursive_controller when fts_read fails
- v3: fixed error code when malloc fails
Signed-off-by: Jan Safranek <jsafrane@redhat.com> Acked-By: Ivana Hutarova Varekova<varekova@redhat.com>
Dhaval Giani [Fri, 27 May 2011 06:36:19 +0000 (08:36 +0200)]
cgconfig: Do not touch subsystems not mounted by cgconfig
cgconfig: Do not touch subsystems not mounted by cgconfig
In its failure path, cgconfig should only touch the subsystems
it had something to do with. Currently, it unmounts all the
subsystems in the config file. Correct this.
Signed-off-by: Dhaval Giani <dhaval.giani@gmail.com> Signed-off-by: Jan Safranek <jsafrane@redhat.com> Acked-By: Ivana Hutarova Varekova <varekova@redhat.com>
Jan Safranek [Fri, 20 May 2011 13:52:58 +0000 (15:52 +0200)]
Fixed cgconfigparser to allow configs with no 'mount' section
cgconfig service fails when something else mounts cgroup hierarchies during
boot (e.g. systemd). Therefore we should allow cgconfig.conf to have no
'mount' section -> it's up to admin to ensure that controllers are mounted as
needed.
Because 'group' section is already optional, with this patch cgconfigparser
will accept empty configuration file. This is probably the best default
config for distros with systemd.
Changelog:
- fixed case with empty config file and no mounted controllers
- reworked the if conditions to be more clear
pathtest(.sh) is ot run in the current makefile and it does not work
properly, so there is no reason to add it there. This path removes
pathtest from git.
Signed-off-by: Ivana Hutarova Varekova <varekova@redhat.com> Signed-off-by: Jan Safranek <jsafrane@redhat.com>
new version:
$ cgget -h
Usage: cgget [-nv] [-r <name>] [-g <controller>] [-a] <path> ...
or: cgget [-nv] [-r <name>] -g <controller>:<path> ...
Print parameter(s) of given group(s).
-a, --all Print info about all relevant controllers
-g <controller> Controller which info should be displaied
-g <controller>:<path> Control group whih info should be displaied
-h, --help Display this help
-n Do not print headers
-r, --variable <name> Define parameter to display
-v, --values-only Print only values, not parameter names
Signed-off-by: Ivana Hutarova Varekova <varekova@redhat.com> Signed-off-by: Jan Safranek <jsafrane@redhat.com>
cgget: add the possibility to use -g <controllers>:<path>
Most of the tools use <controllers>:<path> together with -g option,
this patch adds this version of usage of -g option to cgget tool
Older have the possibility to use -g in form -g <controller> <path>.
fix several problems in lssubsys output
* not consistent output with and without -i option
* without this option lssubsys ignore multiple hierarchies on one mount
point
* lssubsys -i without -a does not show the hierarchy number
Jan Safranek [Wed, 6 Apr 2011 06:37:52 +0000 (08:37 +0200)]
Added tests for herarcheis mounted several times.
Two new tests:
- Test cgsnapshot, cgconfigparser and lssubsys with hierarchies mounted
several times.
- Test all the above with *named* hierarchies mounted several times +
also with named hierarchy with ordinary controllers.
Signed-off-by: Jan Safranek <jsafrane@redhat.com> Acked-by: Ivana Hutarova Varekova<varekova@redhat.com>
Jan Safranek [Wed, 6 Apr 2011 06:37:45 +0000 (08:37 +0200)]
Added support for named hierarchies to cgconfigparser.
Add the missing parts to make cgconfigparser able to mount named
hierarchies. It must add 'none' option to mount opts for mount without real
controller and with 'name=xxx' only, the rest (surprisingly) works out of the
box, only quoting needs special care.
Following cgconfig.conf is usable with the patch:
mount {
"name=test" = /cgroup/test;
"name=testwithcpu" = /cgroup/cpu;
cpu = /cgroup/cpu;
}
group foo {
"name=test" { }
"name=testwithcpu" { }
cpu { cpu.shares = 1024; }
}
Jan Safranek [Wed, 6 Apr 2011 06:37:38 +0000 (08:37 +0200)]
Enhanced cgsnapshot to print named hierarchies.
cgsnapshot should show named hierarchies in 'mount' section. It already shows
their groups in 'group' sections and the output should be consistent.
And take care of quotes in the output, '=' is not valid character in controller
name unless it is in double quotes.
Example:
$ mount -t cgroup -o none,name=hello none /cgroup/named
$ mount -t cgroup -o cpuacct,name=cputest none /cgroup/cpuacct
$ cgsnapshot
Jan Safranek [Wed, 6 Apr 2011 06:37:25 +0000 (08:37 +0200)]
Added -M option to lssubsys to show multiple mount points of hierarchies.
Now libcgroup is aware of hierarchies and all its mount points, let's
extend lssubsys to show them. The patch also renames few variables to be
descriptive, 'name' is not name of controller, it's list of controllers.
Now (and also with the patch, '-m' works the same):
$ lssubsys -m
cpuset,cpuacct /cgroup/cpu
memory /cgroup/memory
With the patch:
$ lssubsys -M
cpuset,cpuacct /cgroup/cpu
cpuset,cpuacct /cgroup/cpu2
memory /cgroup/memory
Signed-off-by: Jan Safranek <jsafrane@redhat.com> Acked-by: Ivana Hutarova Varekova<varekova@redhat.com>
Jan Safranek [Wed, 6 Apr 2011 06:37:11 +0000 (08:37 +0200)]
Added iterators to go through all mount points of a hierarchy.
Add new iterators, which return all mount points of given hierarchy. The order
of the mount points is the same as in /proc/mounts, The first returned mount
point is the same as cgroup_get_subsys_mount_point().
Signed-off-by: Jan Safranek <jsafrane@redhat.com> Acked-by: Ivana Hutarova Varekova<varekova@redhat.com>
Jan Safranek [Wed, 6 Apr 2011 06:37:04 +0000 (08:37 +0200)]
Fixed libcgroup to be aware of hierarchies mounted multiple times.
Current libcgroup design handles each hierarchy only once. If a hierarchy
is mounted twice or more times, only the first mount point is taken into
account and the others are 'invisible' to libcgroup.
This causes cgsnapshot and lssubsys to show only one mount point for a
hierarchy and especially in case of cgsnapshot it's not what user expects.
The patch below adds a list of all mount points to cg_mount_table_s structure.
Signed-off-by: Jan Safranek <jsafrane@redhat.com> Acked-by: Ivana Hutarova Varekova<varekova@redhat.com>
Jan Safranek [Wed, 6 Apr 2011 06:36:58 +0000 (08:36 +0200)]
Fixed parsing of mount options
hasmntopt() returns start of the matching string, i.e. when looking for
'cpuacct' option it can return 'cpuacct,cpuset' if these two are mounted
together. So, don't use result of this function, use internal table of
controllers instead when checking for duplicates.
Signed-off-by: Jan Safranek <jsafrane@redhat.com> Acked-by: Ivana Hutarova Varekova<varekova@redhat.com>
projects / thirdparty / libcgroup.git / log
