cgroups: handle lxc.cgroup.use global parameter

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: fix cg_legacy_freeze() return type

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

file_utils: tweak lxc_write_openat()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: improve utility controller handling

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/cgroup2_chown/delegate/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: move cgroup2 parameters into substruct

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/container_limit_path/path_lim/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/container_full_path/path_con/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/cgfd_limit/dfd_lim/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/cgfd_mon/dfd_mon/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/cgfd_con/dfd_con/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/mountpoint/at_mnt/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/container_base_path/at_base/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: rename cgroupfs mount fd

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: simplify and fix mounting on non-cgroup namespace aware kernels

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: introduce cgroup hierarchy type

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: remove unused helpers

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/add_hierarchy()/cgroup_hierarchy_add()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: split delegation checks into separate helpers

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: simplify string list handling

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: rework cgroup initialization

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: split out unified cgroup helpers

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

memory_utils: adapt to new pointer error macros

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

macro: add pointer error encoding support

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

compiler: add likely() and unlikely() support

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/basecginfo/cgroup_info/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: simplify current cgroup retrieval on pure unified cgroup layouts

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: tweak return values

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: tweak lxc.cgroup.use handling in __cgroup_init()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: s/must_copy_string()/strdup()/g

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: avoid additional variable for single access

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: fix prune_init_scope()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

string_utils: move lxc_iterate_parts()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3684 from brauner/2021-02-18/fixes_2

bpf: device cgroup improvements

Merge pull request #3687 from brauner/2021-02-19/fixes

lsm: fixes

doc: tweak cgroup headline

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

doc: epxlain eBPF-based device controller semantics

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

doc: add missing ".[controller file] suffix to lxc.cgroup{2}. key explanations

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: update device cgroup semantics

LXC has supported the bpf device controlller for a while now. A bpf device
program can be attached to the container's cgroup if this is a pure cgroup2
host.

The format for specifying device rules for the cgroup2 bpf device controller is
the same as for the legacy cgroup device controller; only the configuration key
prefix has to change. Specifically, device rules for the legacy cgroup device
controller are specified by via lxc.cgroup.devices.{allow,deny} whereas for the
cgroup2 bpf device controller lxc.cgroup2.devices.{allow,deny} must be used.

The following semantics apply:
1. The device rule "lxc.cgroup2.devices.deny = a" will cause LXC to instruct
   the kernel to block access to all devices by default. To grant access to
   devices "allow device rules" must be added via the
   "lxc.cgroup2.devices.allow" key. This is referred to as a "allowlist" device
   program.
2. The device rule "lxc.cgroup2.devices.allow = a" will cause LXC to instruct
   the kernel to allow access to all devices by default. To deny access to
   devices "deny device rules" must be added via "lxc.cgroup2.devices.deny"
   key. This is referred to as a "denylist" device program.
3. Specifying a rule as explained in 1. or 2. will cause all previous rules to
   be cleared, i.e. the device list will be reset.

For example the set of rules:

lxc.cgroup2.devices.deny = a
lxc.cgroup2.devices.allow = c *:* m
lxc.cgroup2.devices.allow = b *:* m
lxc.cgroup2.devices.allow = c 1:3 rwm

implements a "allowlist" device program, i.e. the kernel will block access to
all devices not specifically allowed in this list. This particular program
states that all character and block devices might be created but only /dev/null
might be read or written.

If we to switch to the set of rules to:

lxc.cgroup2.devices.allow = a
lxc.cgroup2.devices.deny = c *:* m
lxc.cgroup2.devices.deny = b *:* m
lxc.cgroup2.devices.deny = c 1:3 rwm

then LXC would instruct the kernel to implement a "denylist", i.e. the kernel
will allow access to all devices not specifically denied in this list. This
particular program states that no character devices or block devices might be
created and that /dev/null is not allow allowed to be read, written, or
created.

Consider the same program but followed by a rule as explained in 1. or 2.:

lxc.cgroup2.devices.allow = a
lxc.cgroup2.devices.deny = c *:* m
lxc.cgroup2.devices.deny = b *:* m
lxc.cgroup2.devices.deny = c 1:3 rwm
lxc.cgroup2.devices.allow = a

The last line will cause LXC to reset the device list without changing the type
of device program.

lxc.cgroup2.devices.allow = a
lxc.cgroup2.devices.deny = c *:* m
lxc.cgroup2.devices.deny = b *:* m
lxc.cgroup2.devices.deny = c 1:3 rwm
lxc.cgroup2.devices.deny = a

The last line will cause LXC to reset the device list and switch from a
"allowlist" program to a "denylist" program.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: tweak bpf_device_cgroup_prepare()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: expose lxc_clear_cgroup2_devices()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: improve lxc_clear_cgroups()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: fix typos

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: comment bpf_cgroup_devices_update()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: only update bpf device program if really needed

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: make device cgroup handling smarter and simpler

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: ensure no garbage is returned

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lsm: twek apparmor_process_label_get()

Fixes: Coverity 1473189
Fixes: Coverity 1473190
Fixes: 47f4914d88df ("apparmor: prefer /proc/.../attr/apparmor/current over legacy interface")
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

file_utils: allow fd_to_buf() to fail for real

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3686 from cyphar/apparmor-attr-subdir

apparmor: prefer /proc/.../attr/apparmor/current over legacy interface

apparmor: prefer /proc/.../attr/apparmor/current over legacy interface

It turns out that since Linux 5.1 there are now per-LSM subdirectories
for major LSMs, which users are recommended to use over the "legacy"
top-level /proc/$pid/attr/... files[1]:

> Process attributes associated with “major” security modules should be
> accessed and maintained using the special files in /proc/.../attr. A
> security module may maintain a module specific subdirectory there,
> named after the module. /proc/.../attr/smack is provided by the Smack
> security module and contains all its special files. The files directly
> in /proc/.../attr remain as legacy interfaces for modules that provide
> subdirectories.

AppArmor has had such a directory since Linux 5.8[2], and it turns out
that with certain CONFIG_LSM configurations you can end up with AppArmor
files not being accessible from the legacy interface. Arch Linux
recently added BPF as one of the enabled LSM in their configuration, and
this broke runc[3] and LXC.

The solution is to first try to use /proc/$pid/attr/apparmor/current and
fall back to /proc/$pid/attr/current if the former is not available.

[1]: https://www.kernel.org/doc/html/latest/admin-guide/LSM/index.html
[2]: Linux 5.8 ; commit 6413f852ce08 ("apparmor: add proc subdir to attrs")
[3]: https://github.com/opencontainers/runc/issues/2801

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>

apparmor: clean up apparmor_process_label_get

Rather than open-coding file reading and retry semantics and
implementing the path generation logic separately to
apparmor_process_label_fd_get, refactor the logic so that it looks
closer to the pidfd version.

This will make it easier to implement the two-step handling for
/proc/self/attr/apparmor/current and makes this code slightly less
confusing.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>

Merge pull request #3681 from brauner/2021-02-18/cgroups

cgroups: fixes & bpf rework

Merge pull request #3682 from brauner/2021-02-18/fixes

console: fixes

conf: don't log garbage

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

start: fix non-daemonized and application containers

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: use saner mode for console

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: simplify bpf (device) program freeing

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: make bpf_program_cgroup_attach() static

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: prevent double-close

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: use close_equal() and free_equal()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

memory_utils: add close_equal() and free_equal()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

lxccontainer: fix reboot logging

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: rework live device cgroup update

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

compiler: fix fallthrough attribute

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: fix return values in bpf_program_cgroup_attach()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: let bpf_list_add_device() take the device list directly

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: add and use bpf_cgroup_devices_attach() helper

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: remove compile-time bpf support detection

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: vendor bpf headers

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: handling missing defines

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: rework bpf_program_cgroup_detach()

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: rework bpf devices BPF_F_REPLACE codepath

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: don't close invalid fd, simply swap

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: use __u32 not uint32_t

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

macro: add swap helper

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: replace bpf program on update

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

commands: improve bpf device program management

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: improve bpf device program management

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: add helpers for better bpf device program management

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: improve bpf device program handling

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: make device cgroups semantics clearer

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: enable helpers to let caller replace existing bpf programs

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: align struct initialization

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: use return macros

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: introduce lxc_bpf_devices_rule_t type

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

bpf: use cgroup fd directly instead of paths

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: kill monitor_full_path

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: free correct path

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

utils: fix print_r() debugging helper

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: fix error values

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: don't overwrite type

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: make it extremely obvious that we're transitioning from a flag to a type

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Merge pull request #3680 from brauner/2021-02-17/cgroups_2

cgroups: fourth batch of cgroup fixes

cgroups: create controller directories if missing

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: use non-flag based checking now that we switched all codepaths over

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

conf: use brackets to clarify check semantics

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: validate that only a single cgroup mount type is set

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: prevent cgroup mount type overwrite

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

cgroups: ensure that cgroup_root is initialized in legacy codepaths

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>