From 7696c1f9d1aed98a54bf7acd4c48799c395cdc64 Mon Sep 17 00:00:00 2001 From: Ruben Jenster Date: Fri, 23 Oct 2020 11:33:38 +0200 Subject: [PATCH] Introduce lxc.cgroup.dir.monitor.pivot On termination lxc may fail to remove either lxc.cgroup.dir or lxc.cgroup.dir.monitor, because the monitor process may still be a member of either of these cgroups. The pivot cgroup should not be a member (subpath) of any other container cgroup (dir). because only empty cgroups can be removed. Signed-off-by: Ruben Jenster --- doc/lxc.container.conf.sgml.in | 12 ++++++++++++ src/lxc/cgroups/cgfsng.c | 5 ++++- src/lxc/conf.h | 1 + src/lxc/confile.c | 36 ++++++++++++++++++++++++++++++++++ 4 files changed, 53 insertions(+), 1 deletion(-) diff --git a/doc/lxc.container.conf.sgml.in b/doc/lxc.container.conf.sgml.in index ba25b3413..ac724cebe 100644 --- a/doc/lxc.container.conf.sgml.in +++ b/doc/lxc.container.conf.sgml.in @@ -1604,6 +1604,18 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + + + + + + + On container termination the PID of the monitor process is attached to this cgroup. + This path should not be a subpath of any other configured cgroup dir to ensure + proper removal of other cgroup paths on container termination. + + + diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c index f508c63d3..a699a4445 100644 --- a/src/lxc/cgroups/cgfsng.c +++ b/src/lxc/cgroups/cgfsng.c @@ -1093,7 +1093,10 @@ __cgfsng_ops static void cgfsng_monitor_destroy(struct cgroup_ops *ops, goto try_lxc_rm_rf; } - if (conf && conf->cgroup_meta.monitor_dir) + if (conf && conf->cgroup_meta.monitor_pivot_dir) + pivot_path = must_make_path(h->mountpoint, h->container_base_path, + conf->cgroup_meta.monitor_pivot_dir, CGROUP_PIVOT, NULL); + else if (conf && conf->cgroup_meta.monitor_dir) pivot_path = must_make_path(h->mountpoint, h->container_base_path, conf->cgroup_meta.monitor_dir, CGROUP_PIVOT, NULL); else if (conf && conf->cgroup_meta.dir) diff --git a/src/lxc/conf.h b/src/lxc/conf.h index ba06d42dc..907cbdfa5 100644 --- a/src/lxc/conf.h +++ b/src/lxc/conf.h @@ -61,6 +61,7 @@ struct lxc_cgroup { char *controllers; char *dir; char *monitor_dir; + char *monitor_pivot_dir; char *container_dir; char *namespace_dir; bool relative; diff --git a/src/lxc/confile.c b/src/lxc/confile.c index 75587d0ac..205b98013 100644 --- a/src/lxc/confile.c +++ b/src/lxc/confile.c @@ -73,6 +73,7 @@ lxc_config_define(cgroup_controller); lxc_config_define(cgroup2_controller); lxc_config_define(cgroup_dir); lxc_config_define(cgroup_monitor_dir); +lxc_config_define(cgroup_monitor_pivot_dir); lxc_config_define(cgroup_container_dir); lxc_config_define(cgroup_container_inner_dir); lxc_config_define(cgroup_relative); @@ -178,6 +179,7 @@ static struct lxc_config_t config_jump_table[] = { { "lxc.cap.drop", set_config_cap_drop, get_config_cap_drop, clr_config_cap_drop, }, { "lxc.cap.keep", set_config_cap_keep, get_config_cap_keep, clr_config_cap_keep, }, { "lxc.cgroup2", set_config_cgroup2_controller, get_config_cgroup2_controller, clr_config_cgroup2_controller, }, + { "lxc.cgroup.dir.monitor.pivot", set_config_cgroup_monitor_pivot_dir, get_config_cgroup_monitor_pivot_dir, clr_config_cgroup_monitor_pivot_dir, }, { "lxc.cgroup.dir.monitor", set_config_cgroup_monitor_dir, get_config_cgroup_monitor_dir, clr_config_cgroup_monitor_dir, }, { "lxc.cgroup.dir.container.inner", set_config_cgroup_container_inner_dir, get_config_cgroup_container_inner_dir, clr_config_cgroup_container_inner_dir, }, { "lxc.cgroup.dir.container", set_config_cgroup_container_dir, get_config_cgroup_container_dir, clr_config_cgroup_container_dir, }, @@ -1814,6 +1816,16 @@ static int set_config_cgroup_monitor_dir(const char *key, const char *value, value); } +static int set_config_cgroup_monitor_pivot_dir(const char *key, const char *value, + struct lxc_conf *lxc_conf, void *data) +{ + if (lxc_config_value_empty(value)) + return clr_config_cgroup_monitor_pivot_dir(key, lxc_conf, NULL); + + return set_config_string_item(&lxc_conf->cgroup_meta.monitor_pivot_dir, + value); +} + static int set_config_cgroup_container_dir(const char *key, const char *value, struct lxc_conf *lxc_conf, void *data) @@ -3858,6 +3870,22 @@ static int get_config_cgroup_monitor_dir(const char *key, char *retv, int inlen, return fulllen; } +static int get_config_cgroup_monitor_pivot_dir(const char *key, char *retv, int inlen, + struct lxc_conf *lxc_conf, void *data) +{ + int len; + int fulllen = 0; + + if (!retv) + inlen = 0; + else + memset(retv, 0, inlen); + + strprint(retv, inlen, "%s", lxc_conf->cgroup_meta.monitor_pivot_dir); + + return fulllen; +} + static int get_config_cgroup_container_dir(const char *key, char *retv, int inlen, struct lxc_conf *lxc_conf, @@ -4756,6 +4784,14 @@ static int clr_config_cgroup_monitor_dir(const char *key, return 0; } +static int clr_config_cgroup_monitor_pivot_dir(const char *key, + struct lxc_conf *lxc_conf, + void *data) +{ + free_disarm(lxc_conf->cgroup_meta.monitor_pivot_dir); + return 0; +} + static int clr_config_cgroup_container_dir(const char *key, struct lxc_conf *lxc_conf, void *data) -- 2.47.2