morgan/systemd
1
0
Fork 0
mirror of https://github.com/morgan9e/systemd synced 2026-04-14 00:14:32 +09:00
Code Issues Packages Projects Releases Wiki Activity

nspawn: drop cgv1 handling; core: drop cgroup agent (#36764)

Browse Source
This commit is contained in:
Yu Watanabe
2025-04-05 17:57:18 +09:00
committed by GitHub
parent 668d915a4b 1b781af6ee
commit e4e40936f3
32 changed files with 154 additions and 1427 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
NEWS
View File

@@ -4,6 +4,14 @@ CHANGES WITH 258 in spe:
Incompatible changes:
* Support for cgroup v1 ('legacy' and 'hybrid' hierarchies) has been
removed. cgroup v2 ('unified' hierarchy) will always be mounted
during system bootup and systemd-nspawn container initialization.
* The minimum kernel baseline version has been bumped to v5.4
(released in 2019), with the recommended version now going up to
v5.7. Consult the README file for a list of required kernel APIs.
* The default access mode of tty/pts device nodes has been changed to
0600, which was 0620 in the older releases, due to general security
concerns about terminals being written to by other users. To restore
@@ -65,15 +73,6 @@ CHANGES WITH 258 in spe:
migrated between cgroups. It is likely to be fully removed in a
future release (reach out if you have use cases).
* The recommended kernel baseline version has been bumped to v5.4
(released in 2019). Expect limited testing on older kernel versions,
where "old-kernel" taint flag would also be set. Support for them
will be phased out in a future release in 2025, i.e. we expect to bump
the minimum baseline to v5.4 then too.
* The complete removal of support for cgroup v1 ('legacy' and 'hybrid'
hierarchies) is scheduled for v258.
* Support for System V service scripts is deprecated and will be
removed in v258. Please make sure to update your software
*now* to include a native systemd unit file instead of a legacy

3
docs/ENVIRONMENT.md
View File

@@ -150,9 +150,6 @@ All tools:
`systemd-nspawn`:
* `$SYSTEMD_NSPAWN_UNIFIED_HIERARCHY=1` — if set, force `systemd-nspawn` into
unified cgroup hierarchy mode.
* `$SYSTEMD_NSPAWN_API_VFS_WRITABLE=1` — if set, make `/sys/`, `/proc/sys/`,
and friends writable in the container. If set to "network", leave only
`/proc/sys/net/` writable.

2
meson.build
View File

@@ -271,7 +271,6 @@ conf.set_quoted('SYSTEMCTL_BINARY_PATH', bindir / 'systemct
conf.set_quoted('SYSTEMD_BINARY_PATH', libexecdir / 'systemd')
conf.set_quoted('SYSTEMD_EXECUTOR_BINARY_PATH', libexecdir / 'systemd-executor')
conf.set_quoted('SYSTEMD_CATALOG_DIR', catalogdir)
conf.set_quoted('SYSTEMD_CGROUPS_AGENT_PATH', libexecdir / 'systemd-cgroups-agent')
conf.set_quoted('SYSTEMD_CRYPTSETUP_PATH', bindir / 'systemd-cryptsetup')
conf.set_quoted('SYSTEMD_EXPORT_PATH', libexecdir / 'systemd-export')
conf.set_quoted('SYSTEMD_FSCK_PATH', libexecdir / 'systemd-fsck')
@@ -2305,7 +2304,6 @@ subdir('src/boot')
subdir('src/bootctl')
subdir('src/busctl')
subdir('src/cgls')
subdir('src/cgroups-agent')
subdir('src/cgtop')
subdir('src/coredump')
subdir('src/creds')

2
mkosi/mkosi.conf.d/debian-ubuntu/mkosi.conf.d/pkgenv.conf
View File

@@ -9,5 +9,5 @@ Environment=
GIT_URL=https://salsa.debian.org/systemd-team/systemd.git
GIT_SUBDIR=debian
GIT_BRANCH=debian/master
GIT_COMMIT=d8c7f8f7f461b1edc3bf5040509e697ea574c990
GIT_COMMIT=46432631232015b78071f84e5a3fb944621c83f7
PKG_SUBDIR=debian

4
mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.build.chroot
View File

@@ -18,8 +18,10 @@ TS="${SOURCE_DATE_EPOCH:-$(date +%s)}"
# The openSUSE filelists hardcode the manpage compression extension. This causes rpmbuild errors since we
# disable manpage compression as the files cannot be found. Fix the issue by removing the compression
# extension.
#
# TODO: remove manual cgroups-agent patch when the upstream spec is updated
while read -r filelist; do
sed 's/\.gz$//' "$filelist" >"/tmp/$(basename "$filelist")"
sed 's/\.gz$//; /systemd-cgroups-agent/d' "$filelist" >"/tmp/$(basename "$filelist")"
mount --bind "/tmp/$(basename "$filelist")" "$filelist"
done < <(find "pkg/$PKG_SUBDIR${GIT_SUBDIR:+/$GIT_SUBDIR}" -name "files.*")

57
src/basic/cgroup-util.c
View File

@@ -1028,10 +1028,6 @@ int cg_get_root_path(char **ret_path) {
return r;
e = endswith(p, "/" SPECIAL_INIT_SCOPE);
if (!e)
e = endswith(p, "/" SPECIAL_SYSTEM_SLICE); /* legacy */
if (!e)
e = endswith(p, "/system"); /* even more legacy */
if (e)
*e = 0;
@@ -2078,59 +2074,6 @@ int cg_mask_supported(CGroupMask *ret) {
return cg_mask_supported_subtree(root, ret);
}
int cg_kernel_controllers(Set **ret) {
_cleanup_set_free_ Set *controllers = NULL;
_cleanup_fclose_ FILE *f = NULL;
int r;
assert(ret);
/* Determines the full list of kernel-known controllers. Might include controllers we don't actually support
* and controllers that aren't currently accessible (because not mounted). This does not include "name="
* pseudo-controllers. */
r = fopen_unlocked("/proc/cgroups", "re", &f);
if (r == -ENOENT) {
*ret = NULL;
return 0;
}
if (r < 0)
return r;
/* Ignore the header line */
(void) read_line(f, SIZE_MAX, NULL);
for (;;) {
_cleanup_free_ char *controller = NULL;
int enabled = 0;
if (fscanf(f, "%ms %*i %*i %i", &controller, &enabled) != 2) {
if (ferror(f))
return -errno;
if (feof(f))
break;
return -EBADMSG;
}
if (!enabled)
continue;
if (!cg_controller_is_valid(controller))
return -EBADMSG;
r = set_ensure_consume(&controllers, &string_hash_ops_free, TAKE_PTR(controller));
if (r < 0)
return r;
}
*ret = TAKE_PTR(controllers);
return 0;
}
/* The hybrid mode was initially implemented in v232 and simply mounted cgroup2 on
* /sys/fs/cgroup/systemd. This unfortunately broke other tools (such as docker) which expected the v1
* "name=systemd" hierarchy on /sys/fs/cgroup/systemd. From v233 and on, the hybrid mode mounts v2 on

2
src/basic/cgroup-util.h
View File

@@ -311,8 +311,6 @@ int cg_mask_supported_subtree(const char *root, CGroupMask *ret);
int cg_mask_from_string(const char *s, CGroupMask *ret);
int cg_mask_to_string(CGroupMask mask, char **ret);
int cg_kernel_controllers(Set **controllers);
bool cg_ns_supported(void);
bool cg_freezer_supported(void);
bool cg_kill_supported(void);

42
src/basic/procfs-util.c
View File

@@ -62,13 +62,13 @@ int procfs_tasks_set_limit(uint64_t limit) {
/* As pid_max is about the numeric pid_t range we'll bump it if necessary, but only ever increase it, never
* decrease it, as threads-max is the much more relevant sysctl. */
if (limit > pid_max-1) {
sprintf(buffer, "%" PRIu64, limit+1); /* Add one, since PID 0 is not a valid PID */
xsprintf(buffer, "%" PRIu64, limit+1); /* Add one, since PID 0 is not a valid PID */
r = write_string_file("/proc/sys/kernel/pid_max", buffer, WRITE_STRING_FILE_DISABLE_BUFFER);
if (r < 0)
return r;
}
sprintf(buffer, "%" PRIu64, limit);
xsprintf(buffer, "%" PRIu64, limit);
r = write_string_file("/proc/sys/kernel/threads-max", buffer, WRITE_STRING_FILE_DISABLE_BUFFER);
if (r < 0) {
uint64_t threads_max;
@@ -175,46 +175,34 @@ int procfs_cpu_get_usage(nsec_t *ret) {
return 0;
}
int convert_meminfo_value_to_uint64_bytes(const char *word, uint64_t *ret) {
int convert_meminfo_value_to_uint64_bytes(const char *s, uint64_t *ret) {
_cleanup_free_ char *w = NULL;
char *digits, *e;
uint64_t v;
size_t n;
int r;
assert(word);
assert(s);
assert(ret);
w = strdup(word);
if (!w)
return -ENOMEM;
/* Determine length of numeric value */
n = strspn(w, WHITESPACE);
digits = w + n;
n = strspn(digits, DIGITS);
if (n == 0)
return -EINVAL;
e = digits + n;
/* Ensure the line ends in " kB" */
n = strspn(e, WHITESPACE);
if (n == 0)
return -EINVAL;
if (!streq(e + n, "kB"))
r = extract_first_word(&s, &w, /* separators = */ NULL, /* flags = */ 0);
if (r < 0)
return r;
if (r == 0)
return -EINVAL;
*e = 0;
r = safe_atou64(digits, &v);
/* Ensure the line ends in "kB" */
if (!streq(s, "kB"))
return -EINVAL;
r = safe_atou64(w, &v);
if (r < 0)
return r;
if (v == UINT64_MAX)
return -EINVAL;
if (v > UINT64_MAX/1024)
if (!MUL_ASSIGN_SAFE(&v, U64_KB))
return -EOVERFLOW;
*ret = v * 1024U;
*ret = v;
return 0;
}

54
src/cgroups-agent/cgroups-agent.c
View File

@@ -1,54 +0,0 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include <stdlib.h>
#include "fd-util.h"
#include "log.h"
#include "socket-util.h"
int main(int argc, char *argv[]) {
static const union sockaddr_union sa = {
.un.sun_family = AF_UNIX,
.un.sun_path = "/run/systemd/cgroups-agent",
};
_cleanup_close_ int fd = -EBADF;
ssize_t n;
size_t l;
int r;
r = make_null_stdio();
if (r < 0) {
log_error_errno(r, "Failed to connect stdin/stdout/stderr with /dev/null: %m");
return EXIT_FAILURE;
}
if (argc != 2) {
log_error("Incorrect number of arguments.");
return EXIT_FAILURE;
}
log_setup();
fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0);
if (fd < 0) {
log_debug_errno(errno, "Failed to allocate socket: %m");
return EXIT_FAILURE;
}
l = strlen(argv[1]);
n = sendto(fd, argv[1], l, 0, &sa.sa, SOCKADDR_UN_LEN(sa.un));
if (n < 0) {
log_debug_errno(errno, "Failed to send cgroups agent message: %m");
return EXIT_FAILURE;
}
if ((size_t) n != l) {
log_debug("Datagram size mismatch");
return EXIT_FAILURE;
}
return EXIT_SUCCESS;
}

8
src/cgroups-agent/meson.build
View File

@@ -1,8 +0,0 @@
# SPDX-License-Identifier: LGPL-2.1-or-later
executables += [
libexec_template + {
'name' : 'systemd-cgroups-agent',
'sources' : files('cgroups-agent.c'),
},
]

167
src/core/cgroup.c
View File

@@ -4256,11 +4256,7 @@ static int cg_bpf_mask_supported(CGroupMask *ret) {
}
int manager_setup_cgroup(Manager *m) {
_cleanup_free_ char *path = NULL;
const char *scope_path;
int r, all_unified;
CGroupMask mask;
char *e;
int r;
assert(m);
@@ -4271,17 +4267,7 @@ int manager_setup_cgroup(Manager *m) {
return log_error_errno(r, "Cannot determine cgroup we are running in: %m");
/* Chop off the init scope, if we are already located in it */
e = endswith(m->cgroup_root, "/" SPECIAL_INIT_SCOPE);
/* LEGACY: Also chop off the system slice if we are in
* it. This is to support live upgrades from older systemd
* versions where PID 1 was moved there. Also see
* cg_get_root_path(). */
if (!e && MANAGER_IS_SYSTEM(m)) {
e = endswith(m->cgroup_root, "/" SPECIAL_SYSTEM_SLICE);
if (!e)
e = endswith(m->cgroup_root, "/system"); /* even more legacy */
}
char *e = endswith(m->cgroup_root, "/" SPECIAL_INIT_SCOPE);
if (e)
*e = 0;
@@ -4289,29 +4275,11 @@ int manager_setup_cgroup(Manager *m) {
* easily prepend it everywhere. */
delete_trailing_chars(m->cgroup_root, "/");
/* 2. Show data */
r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, m->cgroup_root, NULL, &path);
if (r < 0)
return log_error_errno(r, "Cannot find cgroup mount point: %m");
r = cg_unified();
if (r < 0)
return log_error_errno(r, "Couldn't determine if we are running in the unified hierarchy: %m");
all_unified = cg_all_unified();
if (all_unified < 0)
return log_error_errno(all_unified, "Couldn't determine whether we are in all unified mode: %m");
if (all_unified > 0)
log_debug("Unified cgroup hierarchy is located at %s.", path);
else {
r = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
if (r < 0)
return log_error_errno(r, "Failed to determine whether systemd's own controller is in unified mode: %m");
if (r > 0)
log_debug("Unified cgroup hierarchy is located at %s. Controllers are on legacy hierarchies.", path);
else
log_debug("Using cgroup controller " SYSTEMD_CGROUP_CONTROLLER_LEGACY ". File system hierarchy is at %s.", path);
}
/* 2. Pin the cgroupfs mount, so that it cannot be unmounted */
safe_close(m->pin_cgroupfs_fd);
m->pin_cgroupfs_fd = open("/sys/fs/cgroup", O_PATH|O_CLOEXEC|O_DIRECTORY);
if (m->pin_cgroupfs_fd < 0)
return log_error_errno(errno, "Failed to pin cgroup hierarchy: %m");
/* 3. Allocate cgroup empty defer event source */
m->cgroup_empty_event_source = sd_event_source_disable_unref(m->cgroup_empty_event_source);
@@ -4332,79 +4300,52 @@ int manager_setup_cgroup(Manager *m) {
(void) sd_event_source_set_description(m->cgroup_empty_event_source, "cgroup-empty");
/* 4. Install notifier inotify object, or agent */
if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0) {
/* 4. Install cgroup empty event notifier inotify object */
m->cgroup_inotify_event_source = sd_event_source_disable_unref(m->cgroup_inotify_event_source);
safe_close(m->cgroup_inotify_fd);
/* In the unified hierarchy we can get cgroup empty notifications via inotify. */
m->cgroup_inotify_fd = inotify_init1(IN_NONBLOCK|IN_CLOEXEC);
if (m->cgroup_inotify_fd < 0)
return log_error_errno(errno, "Failed to create control group inotify object: %m");
m->cgroup_inotify_event_source = sd_event_source_disable_unref(m->cgroup_inotify_event_source);
safe_close(m->cgroup_inotify_fd);
r = sd_event_add_io(m->event, &m->cgroup_inotify_event_source, m->cgroup_inotify_fd, EPOLLIN, on_cgroup_inotify_event, m);
if (r < 0)
return log_error_errno(r, "Failed to watch control group inotify object: %m");
m->cgroup_inotify_fd = inotify_init1(IN_NONBLOCK|IN_CLOEXEC);
if (m->cgroup_inotify_fd < 0)
return log_error_errno(errno, "Failed to create control group inotify object: %m");
/* Process cgroup empty notifications early. Note that when this event is dispatched it'll
* just add the unit to a cgroup empty queue, hence let's run earlier than that. Also see
* handling of cgroup agent notifications, for the classic cgroup hierarchy support. */
r = sd_event_source_set_priority(m->cgroup_inotify_event_source, EVENT_PRIORITY_CGROUP_INOTIFY);
if (r < 0)
return log_error_errno(r, "Failed to set priority of inotify event source: %m");
r = sd_event_add_io(m->event, &m->cgroup_inotify_event_source, m->cgroup_inotify_fd, EPOLLIN, on_cgroup_inotify_event, m);
if (r < 0)
return log_error_errno(r, "Failed to watch control group inotify object: %m");
/* Process cgroup empty notifications early. Note that when this event is dispatched it'll
* just add the unit to a cgroup empty queue, hence let's run earlier than that. Also see
* handling of cgroup agent notifications, for the classic cgroup hierarchy support. */
r = sd_event_source_set_priority(m->cgroup_inotify_event_source, EVENT_PRIORITY_CGROUP_INOTIFY);
if (r < 0)
return log_error_errno(r, "Failed to set priority of inotify event source: %m");
(void) sd_event_source_set_description(m->cgroup_inotify_event_source, "cgroup-inotify");
} else if (MANAGER_IS_SYSTEM(m) && manager_owns_host_root_cgroup(m) && !MANAGER_IS_TEST_RUN(m)) {
/* On the legacy hierarchy we only get notifications via cgroup agents. (Which isn't really reliable,
* since it does not generate events when control groups with children run empty. */
r = cg_install_release_agent(SYSTEMD_CGROUP_CONTROLLER, SYSTEMD_CGROUPS_AGENT_PATH);
if (r < 0)
log_warning_errno(r, "Failed to install release agent, ignoring: %m");
else if (r > 0)
log_debug("Installed release agent.");
else if (r == 0)
log_debug("Release agent already installed.");
}
(void) sd_event_source_set_description(m->cgroup_inotify_event_source, "cgroup-inotify");
/* 5. Make sure we are in the special "init.scope" unit in the root slice. */
scope_path = strjoina(m->cgroup_root, "/" SPECIAL_INIT_SCOPE);
r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, scope_path, 0);
const char *scope_path = strjoina(m->cgroup_root, "/" SPECIAL_INIT_SCOPE);
r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, scope_path, /* pid = */ 0);
if (r >= 0) {
/* Also, move all other userspace processes remaining in the root cgroup into that scope. */
r = cg_migrate(SYSTEMD_CGROUP_CONTROLLER, m->cgroup_root, SYSTEMD_CGROUP_CONTROLLER, scope_path, 0);
if (r < 0)
log_warning_errno(r, "Couldn't move remaining userspace processes, ignoring: %m");
/* 6. And pin it, so that it cannot be unmounted */
safe_close(m->pin_cgroupfs_fd);
m->pin_cgroupfs_fd = open(path, O_PATH|O_CLOEXEC|O_DIRECTORY);
if (m->pin_cgroupfs_fd < 0)
return log_error_errno(errno, "Failed to open pin file: %m");
} else if (!MANAGER_IS_TEST_RUN(m))
return log_error_errno(r, "Failed to create %s control group: %m", scope_path);
/* 7. Always enable hierarchical support if it exists... */
if (!all_unified && !MANAGER_IS_TEST_RUN(m))
(void) cg_set_attribute("memory", "/", "memory.use_hierarchy", "1");
/* 8. Figure out which controllers are supported */
/* 6. Figure out which controllers are supported */
r = cg_mask_supported_subtree(m->cgroup_root, &m->cgroup_supported);
if (r < 0)
return log_error_errno(r, "Failed to determine supported controllers: %m");
/* 9. Figure out which bpf-based pseudo-controllers are supported */
/* 7. Figure out which bpf-based pseudo-controllers are supported */
CGroupMask mask;
r = cg_bpf_mask_supported(&mask);
if (r < 0)
return log_error_errno(r, "Failed to determine supported bpf-based pseudo-controllers: %m");
m->cgroup_supported |= mask;
/* 10. Log which controllers are supported */
/* 8. Log which controllers are supported */
for (CGroupController c = 0; c < _CGROUP_CONTROLLER_MAX; c++)
log_debug("Controller '%s' supported: %s", cgroup_controller_to_string(c),
yes_no(m->cgroup_supported & CGROUP_CONTROLLER_TO_MASK(c)));
@@ -4560,11 +4501,7 @@ int unit_get_memory_available(Unit *u, uint64_t *ret) {
if (!unit_context)
return -ENODATA;
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt || !crt->cgroup_path)
continue;
(void) unit_get_memory_current(u, &current);
(void) unit_get_memory_accounting(u, CGROUP_MEMORY_CURRENT, &current);
/* in case of error, previous current propagates as lower bound */
if (unit_has_name(u, SPECIAL_ROOT_SLICE))
@@ -4582,38 +4519,10 @@ int unit_get_memory_available(Unit *u, uint64_t *ret) {
return 0;
}
int unit_get_memory_current(Unit *u, uint64_t *ret) {
int r;
// FIXME: Merge this into unit_get_memory_accounting after support for cgroup v1 is dropped
assert(u);
assert(ret);
if (!UNIT_CGROUP_BOOL(u, memory_accounting))
return -ENODATA;
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt || !crt->cgroup_path)
return -ENODATA;
/* The root cgroup doesn't expose this information, let's get it from /proc instead */
if (unit_has_host_root_cgroup(u))
return procfs_memory_get_used(ret);
if ((crt->cgroup_realized_mask & CGROUP_MASK_MEMORY) == 0)
return -ENODATA;
r = cg_all_unified();
if (r < 0)
return r;
return cg_get_attribute_as_uint64("memory", crt->cgroup_path, r > 0 ? "memory.current" : "memory.usage_in_bytes", ret);
}
int unit_get_memory_accounting(Unit *u, CGroupMemoryAccountingMetric metric, uint64_t *ret) {
static const char* const attributes_table[_CGROUP_MEMORY_ACCOUNTING_METRIC_MAX] = {
[CGROUP_MEMORY_CURRENT] = "memory.current",
[CGROUP_MEMORY_PEAK] = "memory.peak",
[CGROUP_MEMORY_SWAP_CURRENT] = "memory.swap.current",
[CGROUP_MEMORY_SWAP_PEAK] = "memory.swap.peak",
@@ -4632,8 +4541,13 @@ int unit_get_memory_accounting(Unit *u, CGroupMemoryAccountingMetric metric, uin
return -ENODATA;
/* The root cgroup doesn't expose this information. */
if (unit_has_host_root_cgroup(u))
if (unit_has_host_root_cgroup(u)) {
/* System-wide memory usage can be acquired from /proc/ */
if (metric == CGROUP_MEMORY_CURRENT)
return procfs_memory_get_used(ret);
return -ENODATA;
}
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt)
@@ -4645,12 +4559,6 @@ int unit_get_memory_accounting(Unit *u, CGroupMemoryAccountingMetric metric, uin
if (!FLAGS_SET(crt->cgroup_realized_mask, CGROUP_MASK_MEMORY))
return -ENODATA;
r = cg_all_unified();
if (r < 0)
return r;
if (r == 0)
return -ENODATA;
r = cg_get_attribute_as_uint64("memory", crt->cgroup_path, attributes_table[metric], &bytes);
if (r < 0 && r != -ENODATA)
return r;
@@ -5745,6 +5653,7 @@ static const char* const cgroup_io_accounting_metric_table[_CGROUP_IO_ACCOUNTING
DEFINE_STRING_TABLE_LOOKUP(cgroup_io_accounting_metric, CGroupIOAccountingMetric);
static const char* const cgroup_memory_accounting_metric_table[_CGROUP_MEMORY_ACCOUNTING_METRIC_MAX] = {
[CGROUP_MEMORY_CURRENT] = "MemoryCurrent",
[CGROUP_MEMORY_PEAK] = "MemoryPeak",
[CGROUP_MEMORY_SWAP_CURRENT] = "MemorySwapCurrent",
[CGROUP_MEMORY_SWAP_PEAK] = "MemorySwapPeak",

2
src/core/cgroup.h
View File

@@ -280,6 +280,7 @@ typedef enum CGroupMemoryAccountingMetric {
_CGROUP_MEMORY_ACCOUNTING_METRIC_CACHED_LAST = CGROUP_MEMORY_SWAP_PEAK,
/* These attributes are transient, so no need for caching. */
CGROUP_MEMORY_CURRENT,
CGROUP_MEMORY_SWAP_CURRENT,
CGROUP_MEMORY_ZSWAP_CURRENT,
@@ -478,7 +479,6 @@ int unit_watch_all_pids(Unit *u);
int unit_synthesize_cgroup_empty_event(Unit *u);
int unit_get_memory_available(Unit *u, uint64_t *ret);
int unit_get_memory_current(Unit *u, uint64_t *ret);
int unit_get_memory_accounting(Unit *u, CGroupMemoryAccountingMetric metric, uint64_t *ret);
int unit_get_tasks_current(Unit *u, uint64_t *ret);
int unit_get_cpu_usage(Unit *u, nsec_t *ret);

25
src/core/dbus-unit.c
View File

@@ -1052,29 +1052,6 @@ static int property_get_slice(
return sd_bus_message_append(reply, "s", unit_slice_name(u));
}
static int property_get_current_memory(
sd_bus *bus,
const char *path,
const char *interface,
const char *property,
sd_bus_message *reply,
void *userdata,
sd_bus_error *error) {
uint64_t sz = UINT64_MAX;
Unit *u = ASSERT_PTR(userdata);
int r;
assert(bus);
assert(reply);
r = unit_get_memory_current(u, &sz);
if (r < 0 && r != -ENODATA)
log_unit_warning_errno(u, r, "Failed to get current memory usage from cgroup: %m");
return sd_bus_message_append(reply, "t", sz);
}
static int property_get_available_memory(
sd_bus *bus,
const char *path,
@@ -1652,7 +1629,7 @@ const sd_bus_vtable bus_unit_cgroup_vtable[] = {
SD_BUS_PROPERTY("Slice", "s", property_get_slice, 0, 0),
SD_BUS_PROPERTY("ControlGroup", "s", property_get_cgroup, 0, 0),
SD_BUS_PROPERTY("ControlGroupId", "t", property_get_cgroup_id, 0, 0),
SD_BUS_PROPERTY("MemoryCurrent", "t", property_get_current_memory, 0, 0),
SD_BUS_PROPERTY("MemoryCurrent", "t", property_get_memory_accounting, 0, 0),
SD_BUS_PROPERTY("MemoryPeak", "t", property_get_memory_accounting, 0, 0),
SD_BUS_PROPERTY("MemorySwapCurrent", "t", property_get_memory_accounting, 0, 0),
SD_BUS_PROPERTY("MemorySwapPeak", "t", property_get_memory_accounting, 0, 0),

83
src/core/dbus.c
View File

@@ -69,61 +69,6 @@ void bus_send_pending_reload_message(Manager *m) {
return;
}
int bus_forward_agent_released(Manager *m, const char *path) {
int r;
assert(m);
assert(path);
if (!MANAGER_IS_SYSTEM(m))
return 0;
if (!m->system_bus)
return 0;
/* If we are running a system instance we forward the agent message on the system bus, so that the user
* instances get notified about this, too */
r = sd_bus_emit_signal(m->system_bus,
"/org/freedesktop/systemd1/agent",
"org.freedesktop.systemd1.Agent",
"Released",
"s", path);
if (r < 0)
return log_debug_errno(r, "Failed to propagate agent release message: %m");
return 1;
}
static int signal_agent_released(sd_bus_message *message, void *userdata, sd_bus_error *error) {
_cleanup_(sd_bus_creds_unrefp) sd_bus_creds *creds = NULL;
Manager *m = ASSERT_PTR(userdata);
const char *cgroup;
uid_t sender_uid;
int r;
assert(message);
/* only accept org.freedesktop.systemd1.Agent from UID=0 */
r = sd_bus_query_sender_creds(message, SD_BUS_CREDS_EUID, &creds);
if (r < 0)
return r;
r = sd_bus_creds_get_euid(creds, &sender_uid);
if (r < 0 || sender_uid != 0)
return 0;
/* parse 'cgroup-empty' notification */
r = sd_bus_message_read(message, "s", &cgroup);
if (r < 0) {
bus_log_parse_error(r);
return 0;
}
manager_notify_cgroup_empty(m, cgroup);
return 0;
}
static int signal_disconnected(sd_bus_message *message, void *userdata, sd_bus_error *error) {
Manager *m = ASSERT_PTR(userdata);
sd_bus *bus;
@@ -890,30 +835,6 @@ int bus_init_api(Manager *m) {
return 0;
}
static void bus_setup_system(Manager *m, sd_bus *bus) {
int r;
assert(m);
assert(bus);
/* if we are a user instance we get the Released message via the system bus */
if (MANAGER_IS_USER(m)) {
r = sd_bus_match_signal_async(
bus,
NULL,
NULL,
"/org/freedesktop/systemd1/agent",
"org.freedesktop.systemd1.Agent",
"Released",
signal_agent_released, NULL, m);
if (r < 0)
log_warning_errno(r, "Failed to request Released match on system bus: %m");
}
log_debug("Successfully connected to system bus.");
return;
}
int bus_init_system(Manager *m) {
_cleanup_(sd_bus_close_unrefp) sd_bus *bus = NULL;
int r;
@@ -938,10 +859,10 @@ int bus_init_system(Manager *m) {
return r;
}
bus_setup_system(m, bus);
m->system_bus = TAKE_PTR(bus);
log_debug("Successfully connected to system bus.");
return 0;
}

2
src/core/dbus.h
View File

@@ -22,8 +22,6 @@ void bus_track_serialize(sd_bus_track *t, FILE *f, const char *prefix);
int bus_foreach_bus(Manager *m, sd_bus_track *subscribed2, int (*send_message)(sd_bus *bus, void *userdata), void *userdata);
int bus_forward_agent_released(Manager *m, const char *path);
uint64_t manager_bus_n_queued_write(Manager *m);
void dump_bus_properties(FILE *f);

5
src/core/main.c
View File

@@ -1723,11 +1723,6 @@ static int become_shutdown(int objective, int retval) {
if (arg_watchdog_device)
(void) strv_extendf(&env_block, "WATCHDOG_DEVICE=%s", arg_watchdog_device);
/* Avoid the creation of new processes forked by the kernel; at this
* point, we will not listen to the signals anyway */
if (detect_container() <= 0)
(void) cg_uninstall_release_agent(SYSTEMD_CGROUP_CONTROLLER);
(void) write_boot_or_shutdown_osc("shutdown");
execve(SYSTEMD_SHUTDOWN_BINARY_PATH, (char **) command_line, env_block);

17
src/core/manager-serialize.c
View File

@@ -137,12 +137,6 @@ int manager_serialize(
(void) serialize_item(f, "notify-socket", m->notify_socket);
}
if (m->cgroups_agent_fd >= 0) {
r = serialize_fd(f, fds, "cgroups-agent-fd", m->cgroups_agent_fd);
if (r < 0)
return r;
}
if (m->user_lookup_fds[0] >= 0) {
r = serialize_fd_many(f, fds, "user-lookup", m->user_lookup_fds, 2);
if (r < 0)
@@ -453,15 +447,6 @@ int manager_deserialize(Manager *m, FILE *f, FDSet *fds) {
if (r < 0)
return r;
} else if ((val = startswith(l, "cgroups-agent-fd="))) {
int fd;
fd = deserialize_fd(fds, val);
if (fd >= 0) {
m->cgroups_agent_event_source = sd_event_source_disable_unref(m->cgroups_agent_event_source);
close_and_replace(m->cgroups_agent_fd, fd);
}
} else if ((val = startswith(l, "user-lookup="))) {
m->user_lookup_event_source = sd_event_source_disable_unref(m->user_lookup_event_source);
@@ -550,7 +535,7 @@ int manager_deserialize(Manager *m, FILE *f, FDSet *fds) {
if (q < _MANAGER_TIMESTAMP_MAX) /* found it */
(void) deserialize_dual_timestamp(val, m->timestamps + q);
else if (!STARTSWITH_SET(l, "kdbus-fd=", "honor-device-enumeration=", "ready-sent=")) /* ignore deprecated values */
else if (!STARTSWITH_SET(l, "kdbus-fd=", "honor-device-enumeration=", "ready-sent=", "cgroups-agent-fd=")) /* ignore deprecated values */
log_notice("Unknown serialization item '%s', ignoring.", l);
}
}

113
src/core/manager.c
View File

@@ -122,7 +122,6 @@
#define DEFAULT_TASKS_MAX ((CGroupTasksMax) { 15U, 100U }) /* 15% */
static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata);
static int manager_dispatch_cgroups_agent_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata);
static int manager_dispatch_signal_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata);
static int manager_dispatch_time_change_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata);
static int manager_dispatch_idle_pipe_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata);
@@ -912,7 +911,6 @@ int manager_new(RuntimeScope runtime_scope, ManagerTestRunFlags test_run_flags,
.show_status_overridden = _SHOW_STATUS_INVALID,
.notify_fd = -EBADF,
.cgroups_agent_fd = -EBADF,
.signal_fd = -EBADF,
.user_lookup_fds = EBADF_PAIR,
.handoff_timestamp_fds = EBADF_PAIR,
@@ -1131,80 +1129,6 @@ static int manager_setup_notify(Manager *m) {
return 0;
}
static int manager_setup_cgroups_agent(Manager *m) {
static const union sockaddr_union sa = {
.un.sun_family = AF_UNIX,
.un.sun_path = "/run/systemd/cgroups-agent",
};
int r;
/* This creates a listening socket we receive cgroups agent messages on. We do not use D-Bus for delivering
* these messages from the cgroups agent binary to PID 1, as the cgroups agent binary is very short-living, and
* each instance of it needs a new D-Bus connection. Since D-Bus connections are SOCK_STREAM/AF_UNIX, on
* overloaded systems the backlog of the D-Bus socket becomes relevant, as not more than the configured number
* of D-Bus connections may be queued until the kernel will start dropping further incoming connections,
* possibly resulting in lost cgroups agent messages. To avoid this, we'll use a private SOCK_DGRAM/AF_UNIX
* socket, where no backlog is relevant as communication may take place without an actual connect() cycle, and
* we thus won't lose messages.
*
* Note that PID 1 will forward the agent message to system bus, so that the user systemd instance may listen
* to it. The system instance hence listens on this special socket, but the user instances listen on the system
* bus for these messages. */
if (MANAGER_IS_TEST_RUN(m))
return 0;
if (!MANAGER_IS_SYSTEM(m))
return 0;
r = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
if (r < 0)
return log_error_errno(r, "Failed to determine whether unified cgroups hierarchy is used: %m");
if (r > 0) /* We don't need this anymore on the unified hierarchy */
return 0;
if (m->cgroups_agent_fd < 0) {
_cleanup_close_ int fd = -EBADF;
/* First free all secondary fields */
m->cgroups_agent_event_source = sd_event_source_disable_unref(m->cgroups_agent_event_source);
fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
if (fd < 0)
return log_error_errno(errno, "Failed to allocate cgroups agent socket: %m");
(void) fd_increase_rxbuf(fd, MANAGER_SOCKET_RCVBUF_SIZE);
(void) sockaddr_un_unlink(&sa.un);
/* Only allow root to connect to this socket */
WITH_UMASK(0077)
r = bind(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
if (r < 0)
return log_error_errno(errno, "bind(%s) failed: %m", sa.un.sun_path);
m->cgroups_agent_fd = TAKE_FD(fd);
}
if (!m->cgroups_agent_event_source) {
r = sd_event_add_io(m->event, &m->cgroups_agent_event_source, m->cgroups_agent_fd, EPOLLIN, manager_dispatch_cgroups_agent_fd, m);
if (r < 0)
return log_error_errno(r, "Failed to allocate cgroups agent event source: %m");
/* Process cgroups notifications early. Note that when the agent notification is received
* we'll just enqueue the unit in the cgroup empty queue, hence pick a high priority than
* that. Also see handling of cgroup inotify for the unified cgroup stuff. */
r = sd_event_source_set_priority(m->cgroups_agent_event_source, EVENT_PRIORITY_CGROUP_AGENT);
if (r < 0)
return log_error_errno(r, "Failed to set priority of cgroups agent event source: %m");
(void) sd_event_source_set_description(m->cgroups_agent_event_source, "manager-cgroups-agent");
}
return 0;
}
static int manager_setup_user_lookup_fd(Manager *m) {
int r;
@@ -1758,7 +1682,6 @@ Manager* manager_free(Manager *m) {
sd_event_source_unref(m->signal_event_source);
sd_event_source_unref(m->sigchld_event_source);
sd_event_source_unref(m->notify_event_source);
sd_event_source_unref(m->cgroups_agent_event_source);
sd_event_source_unref(m->time_change_event_source);
sd_event_source_unref(m->timezone_change_event_source);
sd_event_source_unref(m->jobs_in_progress_event_source);
@@ -1770,7 +1693,6 @@ Manager* manager_free(Manager *m) {
safe_close(m->signal_fd);
safe_close(m->notify_fd);
safe_close(m->cgroups_agent_fd);
safe_close_pair(m->user_lookup_fds);
safe_close_pair(m->handoff_timestamp_fds);
safe_close_pair(m->pidref_transport_fds);
@@ -2133,11 +2055,6 @@ int manager_startup(Manager *m, FILE *serialization, FDSet *fds, const char *roo
/* No sense to continue without notifications, our children would fail anyway. */
return r;
r = manager_setup_cgroups_agent(m);
if (r < 0)
/* Likewise, no sense to continue without empty cgroup notifications. */
return r;
r = manager_setup_user_lookup_fd(m);
if (r < 0)
/* This shouldn't fail, except if things are really broken. */
@@ -2677,35 +2594,6 @@ static unsigned manager_dispatch_dbus_queue(Manager *m) {
return n;
}
static int manager_dispatch_cgroups_agent_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
Manager *m = userdata;
char buf[PATH_MAX];
ssize_t n;
n = recv(fd, buf, sizeof(buf), 0);
if (n < 0)
return log_error_errno(errno, "Failed to read cgroups agent message: %m");
if (n == 0) {
log_error("Got zero-length cgroups agent message, ignoring.");
return 0;
}
if ((size_t) n >= sizeof(buf)) {
log_error("Got overly long cgroups agent message, ignoring.");
return 0;
}
if (memchr(buf, 0, n)) {
log_error("Got cgroups agent message with embedded NUL byte, ignoring.");
return 0;
}
buf[n] = 0;
manager_notify_cgroup_empty(m, buf);
(void) bus_forward_agent_released(m, buf);
return 0;
}
static bool manager_process_barrier_fd(char * const *tags, FDSet *fds) {
/* nothing else must be sent when using BARRIER=1 */
@@ -3709,7 +3597,6 @@ int manager_reload(Manager *m) {
/* Re-register notify_fd as event source, and set up other sockets/communication channels we might need */
(void) manager_setup_notify(m);
(void) manager_setup_cgroups_agent(m);
(void) manager_setup_user_lookup_fd(m);
(void) manager_setup_handoff_timestamp_fd(m);
(void) manager_setup_pidref_transport_fd(m);

6
src/core/manager.h
View File

@@ -269,9 +269,6 @@ struct Manager {
int notify_fd;
sd_event_source *notify_event_source;
int cgroups_agent_fd;
sd_event_source *cgroups_agent_event_source;
int signal_fd;
sd_event_source *signal_event_source;
@@ -685,8 +682,7 @@ enum {
EVENT_PRIORITY_USER_LOOKUP = SD_EVENT_PRIORITY_NORMAL-12,
EVENT_PRIORITY_MOUNT_TABLE = SD_EVENT_PRIORITY_NORMAL-11,
EVENT_PRIORITY_SWAP_TABLE = SD_EVENT_PRIORITY_NORMAL-11,
EVENT_PRIORITY_CGROUP_AGENT = SD_EVENT_PRIORITY_NORMAL-10, /* cgroupv1 */
EVENT_PRIORITY_CGROUP_INOTIFY = SD_EVENT_PRIORITY_NORMAL-10, /* cgroupv2 */
EVENT_PRIORITY_CGROUP_INOTIFY = SD_EVENT_PRIORITY_NORMAL-10,
EVENT_PRIORITY_CGROUP_OOM = SD_EVENT_PRIORITY_NORMAL-9,
EVENT_PRIORITY_PIDREF = SD_EVENT_PRIORITY_NORMAL-8,
EVENT_PRIORITY_HANDOFF_TIMESTAMP = SD_EVENT_PRIORITY_NORMAL-7,

8
src/nspawn/meson.build
View File

@@ -16,7 +16,6 @@ libnspawn_core_sources = files(
'nspawn-settings.c',
'nspawn-setuid.c',
'nspawn-stub-pid1.c',
'nspawn-util.c',
)
nspawn_gperf_c = custom_target(
@@ -62,18 +61,11 @@ executables += [
},
nspawn_test_template + {
'sources' : files('test-nspawn-tables.c'),
'conditions' : ['ENABLE_NSPAWN'],
},
nspawn_test_template + {
'sources' : files('test-nspawn-util.c'),
'conditions' : ['ENABLE_NSPAWN'],
},
nspawn_fuzz_template + {
'sources' : files('fuzz-nspawn-settings.c'),
'conditions' : ['ENABLE_NSPAWN'],
},
nspawn_fuzz_template + {
'sources' : files('fuzz-nspawn-oci.c'),
'conditions' : ['ENABLE_NSPAWN'],
},
]

514
src/nspawn/nspawn-cgroup.c
View File

@@ -5,32 +5,28 @@
#include "alloc-util.h"
#include "cgroup-setup.h"
#include "fd-util.h"
#include "fileio.h"
#include "format-util.h"
#include "fs-util.h"
#include "mkdir.h"
#include "mount-setup.h"
#include "mount-util.h"
#include "mountpoint-util.h"
#include "nspawn-cgroup.h"
#include "nspawn-mount.h"
#include "nsresource.h"
#include "path-util.h"
#include "rm-rf.h"
#include "string-util.h"
#include "strv.h"
#include "tmpfile-util.h"
#include "user-util.h"
static int chown_cgroup_path(const char *path, uid_t uid_shift) {
_cleanup_close_ int fd = -EBADF;
fd = open(path, O_RDONLY|O_CLOEXEC|O_DIRECTORY);
assert(path);
fd = open(path, O_PATH|O_CLOEXEC|O_DIRECTORY);
if (fd < 0)
return -errno;
FOREACH_STRING(fn,
".",
"cgroup.clone_children",
"cgroup.controllers",
"cgroup.events",
"cgroup.procs",
@@ -38,95 +34,27 @@ static int chown_cgroup_path(const char *path, uid_t uid_shift) {
"cgroup.subtree_control",
"cgroup.threads",
"memory.oom.group",
"memory.reclaim",
"notify_on_release",
"tasks")
"memory.reclaim")
if (fchownat(fd, fn, uid_shift, uid_shift, 0) < 0)
log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno,
log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno,
"Failed to chown \"%s/%s\", ignoring: %m", path, fn);
return 0;
}
int sync_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t uid_shift) {
_cleanup_(rmdir_and_freep) char *tree = NULL;
_cleanup_free_ char *cgroup = NULL;
char pid_string[DECIMAL_STR_MAX(pid) + 1];
bool undo_mount = false;
const char *fn;
int r, unified_controller;
unified_controller = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
if (unified_controller < 0)
return log_error_errno(unified_controller, "Failed to determine whether the systemd hierarchy is unified: %m");
if ((unified_controller > 0) == (unified_requested >= CGROUP_UNIFIED_SYSTEMD))
return 0;
/* When the host uses the legacy cgroup setup, but the
* container shall use the unified hierarchy, let's make sure
* we copy the path from the name=systemd hierarchy into the
* unified hierarchy. Similar for the reverse situation. */
r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, pid, &cgroup);
if (r < 0)
return log_error_errno(r, "Failed to get control group of " PID_FMT ": %m", pid);
/* In order to access the unified hierarchy we need to mount it */
r = mkdtemp_malloc("/tmp/unifiedXXXXXX", &tree);
if (r < 0)
return log_error_errno(r, "Failed to generate temporary mount point for unified hierarchy: %m");
if (unified_controller > 0)
r = mount_nofollow_verbose(LOG_ERR, "cgroup", tree, "cgroup",
MS_NOSUID|MS_NOEXEC|MS_NODEV, "none,name=systemd,xattr");
else
r = mount_nofollow_verbose(LOG_ERR, "cgroup", tree, "cgroup2",
MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
if (r < 0)
goto finish;
undo_mount = true;
/* If nspawn dies abruptly the cgroup hierarchy created below
* its unit isn't cleaned up. So, let's remove it
* https://github.com/systemd/systemd/pull/4223#issuecomment-252519810 */
fn = strjoina(tree, cgroup);
(void) rm_rf(fn, REMOVE_ROOT|REMOVE_ONLY_DIRECTORIES);
fn = strjoina(tree, cgroup, "/cgroup.procs");
sprintf(pid_string, PID_FMT, pid);
r = write_string_file(fn, pid_string, WRITE_STRING_FILE_DISABLE_BUFFER|WRITE_STRING_FILE_MKDIR_0755);
if (r < 0) {
log_error_errno(r, "Failed to move process: %m");
goto finish;
}
fn = strjoina(tree, cgroup);
r = chown_cgroup_path(fn, uid_shift);
if (r < 0)
log_error_errno(r, "Failed to chown() cgroup %s: %m", fn);
finish:
if (undo_mount)
(void) umount_verbose(LOG_ERR, tree, UMOUNT_NOFOLLOW);
return r;
}
int create_subcgroup(
pid_t pid,
bool keep_unit,
CGroupUnified unified_requested,
uid_t uid_shift,
int userns_fd,
UserNamespaceMode userns_mode) {
_cleanup_free_ char *cgroup = NULL, *payload = NULL;
CGroupMask supported;
char *e;
int r;
assert(pid > 1);
assert((userns_fd >= 0) == (userns_mode == USER_NAMESPACE_MANAGED));
/* In the unified hierarchy inner nodes may only contain subgroups, but not processes. Hence, if we running in
* the unified hierarchy and the container does the same, and we did not create a scope unit for the container
@@ -136,12 +64,7 @@ int create_subcgroup(
* its attributes), while the host systemd will only delegate cgroups for children of the cgroup created for a
* delegation unit, instead of the cgroup itself. This means, if we'd pass on the cgroup allocated from the
* host systemd directly to the payload, the host and payload systemd might fight for the cgroup
* attributes. Hence, let's insert an intermediary cgroup to cover that case too.
*
* Note that we only bother with the main hierarchy here, not with any secondary ones. On the unified setup
* that's fine because there's only one hierarchy anyway and controllers are enabled directly on it. On the
* legacy setup, this is fine too, since delegation of controllers is generally not safe there, hence we won't
* do it. */
* attributes. Hence, let's insert an intermediary cgroup to cover that case too. */
r = cg_mask_supported(&supported);
if (r < 0)
@@ -155,7 +78,7 @@ int create_subcgroup(
return log_error_errno(r, "Failed to get our control group: %m");
/* If the service manager already placed us in the supervisor cgroup, let's handle that. */
e = endswith(cgroup, "/supervisor");
char *e = endswith(cgroup, "/supervisor");
if (e)
*e = 0; /* chop off, we want the main path delegated to us */
@@ -170,17 +93,7 @@ int create_subcgroup(
if (r < 0)
return log_error_errno(r, "Failed to create %s subcgroup: %m", payload);
if (userns_mode != USER_NAMESPACE_MANAGED) {
_cleanup_free_ char *fs = NULL;
r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, payload, NULL, &fs);
if (r < 0)
return log_error_errno(r, "Failed to get file system path for container cgroup: %m");
r = chown_cgroup_path(fs, uid_shift);
if (r < 0)
return log_error_errno(r, "Failed to chown() cgroup %s: %m", fs);
} else if (userns_fd >= 0) {
if (userns_mode == USER_NAMESPACE_MANAGED) {
_cleanup_close_ int cgroup_fd = -EBADF;
cgroup_fd = cg_path_open(SYSTEMD_CGROUP_CONTROLLER, payload);
@@ -194,19 +107,15 @@ int create_subcgroup(
r = nsresource_add_cgroup(userns_fd, cgroup_fd);
if (r < 0)
return log_error_errno(r, "Failed to add cgroup %s to userns: %m", payload);
}
if (unified_requested == CGROUP_UNIFIED_SYSTEMD || (unified_requested == CGROUP_UNIFIED_NONE && cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0)) {
_cleanup_free_ char *lfs = NULL;
/* Always propagate access rights from unified to legacy controller */
r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER_LEGACY, payload, NULL, &lfs);
} else {
_cleanup_free_ char *fs = NULL;
r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, payload, NULL, &fs);
if (r < 0)
return log_error_errno(r, "Failed to get file system path for container cgroup: %m");
r = chown_cgroup_path(lfs, uid_shift);
r = chown_cgroup_path(fs, uid_shift);
if (r < 0)
return log_error_errno(r, "Failed to chown() cgroup %s: %m", lfs);
return log_error_errno(r, "Failed to chown() cgroup %s: %m", fs);
}
if (keep_unit) {
@@ -225,325 +134,10 @@ int create_subcgroup(
return 0;
}
/* Retrieve existing subsystems. This function is called in a new cgroup
* namespace.
*/
static int get_process_controllers(Set **ret) {
_cleanup_set_free_ Set *controllers = NULL;
_cleanup_fclose_ FILE *f = NULL;
int r;
assert(ret);
f = fopen("/proc/self/cgroup", "re");
if (!f)
return errno == ENOENT ? -ESRCH : -errno;
for (;;) {
_cleanup_free_ char *line = NULL;
char *e, *l;
r = read_line(f, LONG_LINE_MAX, &line);
if (r < 0)
return r;
if (r == 0)
break;
l = strchr(line, ':');
if (!l)
continue;
l++;
e = strchr(l, ':');
if (!e)
continue;
*e = 0;
if (STR_IN_SET(l, "", "name=systemd", "name=unified"))
continue;
r = set_put_strdup(&controllers, l);
if (r < 0)
return r;
}
*ret = TAKE_PTR(controllers);
return 0;
}
static int mount_legacy_cgroup_hierarchy(
const char *dest,
const char *controller,
const char *hierarchy,
bool read_only) {
const char *to, *fstype, *opts;
int r;
to = strjoina(strempty(dest), "/sys/fs/cgroup/", hierarchy);
r = path_is_mount_point_full(to, dest, /* flags = */ 0);
if (r < 0 && r != -ENOENT)
return log_error_errno(r, "Failed to determine if %s is mounted already: %m", to);
if (r > 0)
return 0;
(void) mkdir_p(to, 0755);
/* The superblock mount options of the mount point need to be
* identical to the hosts', and hence writable... */
if (streq(controller, SYSTEMD_CGROUP_CONTROLLER_HYBRID)) {
fstype = "cgroup2";
opts = NULL;
} else if (streq(controller, SYSTEMD_CGROUP_CONTROLLER_LEGACY)) {
fstype = "cgroup";
opts = "none,name=systemd,xattr";
} else {
fstype = "cgroup";
opts = controller;
}
r = mount_nofollow_verbose(LOG_ERR, "cgroup", to, fstype, MS_NOSUID|MS_NOEXEC|MS_NODEV, opts);
if (r < 0)
return r;
/* ... hence let's only make the bind mount read-only, not the superblock. */
if (read_only) {
r = mount_nofollow_verbose(LOG_ERR, NULL, to, NULL,
MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, NULL);
if (r < 0)
return r;
}
return 1;
}
/* Mount a legacy cgroup hierarchy when cgroup namespaces are supported. */
static int mount_legacy_cgns_supported(
const char *dest,
CGroupUnified unified_requested,
bool userns,
uid_t uid_shift,
uid_t uid_range,
const char *selinux_apifs_context) {
_cleanup_set_free_ Set *controllers = NULL;
const char *cgroup_root = "/sys/fs/cgroup", *c;
int r;
(void) mkdir_p(cgroup_root, 0755);
/* Mount a tmpfs to /sys/fs/cgroup if it's not mounted there yet. */
r = path_is_mount_point_full(cgroup_root, dest, AT_SYMLINK_FOLLOW);
if (r < 0)
return log_error_errno(r, "Failed to determine if /sys/fs/cgroup is already mounted: %m");
if (r == 0) {
_cleanup_free_ char *options = NULL;
/* When cgroup namespaces are enabled and user namespaces are
* used then the mount of the cgroupfs is done *inside* the new
* user namespace. We're root in the new user namespace and the
* kernel will happily translate our uid/gid to the correct
* uid/gid as seen from e.g. /proc/1/mountinfo. So we simply
* pass uid 0 and not uid_shift to tmpfs_patch_options().
*/
r = tmpfs_patch_options("mode=0755" TMPFS_LIMITS_SYS_FS_CGROUP, 0, selinux_apifs_context, &options);
if (r < 0)
return log_oom();
r = mount_nofollow_verbose(LOG_ERR, "tmpfs", cgroup_root, "tmpfs",
MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME, options);
if (r < 0)
return r;
}
r = cg_all_unified();
if (r < 0)
return r;
if (r > 0)
goto skip_controllers;
r = get_process_controllers(&controllers);
if (r < 0)
return log_error_errno(r, "Failed to determine cgroup controllers: %m");
for (;;) {
_cleanup_free_ const char *controller = NULL;
controller = set_steal_first(controllers);
if (!controller)
break;
r = mount_legacy_cgroup_hierarchy("", controller, controller, !userns);
if (r < 0)
return r;
/* When multiple hierarchies are co-mounted, make their
* constituting individual hierarchies a symlink to the
* co-mount.
*/
c = controller;
for (;;) {
_cleanup_free_ char *target = NULL, *tok = NULL;
r = extract_first_word(&c, &tok, ",", 0);
if (r < 0)
return log_error_errno(r, "Failed to extract co-mounted cgroup controller: %m");
if (r == 0)
break;
if (streq(controller, tok))
break;
target = path_join("/sys/fs/cgroup/", tok);
if (!target)
return log_oom();
r = symlink_idempotent(controller, target, false);
if (r == -EINVAL)
return log_error_errno(r, "Invalid existing symlink for combined hierarchy: %m");
if (r < 0)
return log_error_errno(r, "Failed to create symlink for combined hierarchy: %m");
}
}
skip_controllers:
if (unified_requested >= CGROUP_UNIFIED_SYSTEMD) {
r = mount_legacy_cgroup_hierarchy("", SYSTEMD_CGROUP_CONTROLLER_HYBRID, "unified", false);
if (r < 0)
return r;
}
r = mount_legacy_cgroup_hierarchy("", SYSTEMD_CGROUP_CONTROLLER_LEGACY, "systemd", false);
if (r < 0)
return r;
if (!userns)
return mount_nofollow_verbose(LOG_ERR, NULL, cgroup_root, NULL,
MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY,
"mode=0755");
return 0;
}
/* Mount legacy cgroup hierarchy when cgroup namespaces are unsupported. */
static int mount_legacy_cgns_unsupported(
const char *dest,
CGroupUnified unified_requested,
bool userns,
uid_t uid_shift,
uid_t uid_range,
const char *selinux_apifs_context) {
_cleanup_set_free_ Set *controllers = NULL;
const char *cgroup_root;
int r;
cgroup_root = prefix_roota(dest, "/sys/fs/cgroup");
(void) mkdir_p(cgroup_root, 0755);
/* Mount a tmpfs to /sys/fs/cgroup if it's not mounted there yet. */
r = path_is_mount_point_full(cgroup_root, dest, AT_SYMLINK_FOLLOW);
if (r < 0)
return log_error_errno(r, "Failed to determine if /sys/fs/cgroup is already mounted: %m");
if (r == 0) {
_cleanup_free_ char *options = NULL;
r = tmpfs_patch_options("mode=0755" TMPFS_LIMITS_SYS_FS_CGROUP,
uid_shift == 0 ? UID_INVALID : uid_shift,
selinux_apifs_context,
&options);
if (r < 0)
return log_oom();
r = mount_nofollow_verbose(LOG_ERR, "tmpfs", cgroup_root, "tmpfs",
MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME, options);
if (r < 0)
return r;
}
r = cg_all_unified();
if (r < 0)
return r;
if (r > 0)
goto skip_controllers;
r = cg_kernel_controllers(&controllers);
if (r < 0)
return log_error_errno(r, "Failed to determine cgroup controllers: %m");
for (;;) {
_cleanup_free_ char *controller = NULL, *origin = NULL, *combined = NULL;
controller = set_steal_first(controllers);
if (!controller)
break;
origin = path_join("/sys/fs/cgroup/", controller);
if (!origin)
return log_oom();
r = readlink_malloc(origin, &combined);
if (r == -EINVAL) {
/* Not a symbolic link, but directly a single cgroup hierarchy */
r = mount_legacy_cgroup_hierarchy(dest, controller, controller, true);
if (r < 0)
return r;
} else if (r < 0)
return log_error_errno(r, "Failed to read link %s: %m", origin);
else {
_cleanup_free_ char *target = NULL;
target = path_join(dest, origin);
if (!target)
return log_oom();
/* A symbolic link, a combination of controllers in one hierarchy */
if (!filename_is_valid(combined)) {
log_warning("Ignoring invalid combined hierarchy %s.", combined);
continue;
}
r = mount_legacy_cgroup_hierarchy(dest, combined, combined, true);
if (r < 0)
return r;
r = symlink_idempotent(combined, target, false);
if (r == -EINVAL)
return log_error_errno(r, "Invalid existing symlink for combined hierarchy: %m");
if (r < 0)
return log_error_errno(r, "Failed to create symlink for combined hierarchy: %m");
}
}
skip_controllers:
if (unified_requested >= CGROUP_UNIFIED_SYSTEMD) {
r = mount_legacy_cgroup_hierarchy(dest, SYSTEMD_CGROUP_CONTROLLER_HYBRID, "unified", false);
if (r < 0)
return r;
}
r = mount_legacy_cgroup_hierarchy(dest, SYSTEMD_CGROUP_CONTROLLER_LEGACY, "systemd", false);
if (r < 0)
return r;
return mount_nofollow_verbose(LOG_ERR, NULL, cgroup_root, NULL,
MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY,
"mode=0755");
}
static int mount_unified_cgroups(const char *dest) {
int mount_cgroups(const char *dest, bool accept_existing) {
const char *p;
int r;
assert(dest);
p = prefix_roota(dest, "/sys/fs/cgroup");
(void) mkdir_p(p, 0755);
@@ -552,8 +146,10 @@ static int mount_unified_cgroups(const char *dest) {
if (r < 0)
return log_error_errno(r, "Failed to determine if %s is mounted already: %m", p);
if (r > 0) {
p = prefix_roota(dest, "/sys/fs/cgroup/cgroup.procs");
if (access(p, F_OK) >= 0)
if (!accept_existing)
return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Refusing existing cgroupfs mount: %s", p);
if (access(strjoina(p, "/cgroup.procs"), F_OK) >= 0)
return 0;
if (errno != ENOENT)
return log_error_errno(errno, "Failed to determine if mount point %s contains the unified cgroup hierarchy: %m", p);
@@ -562,51 +158,14 @@ static int mount_unified_cgroups(const char *dest) {
"%s is already mounted but not a unified cgroup hierarchy. Refusing.", p);
}
return mount_nofollow_verbose(LOG_ERR, "cgroup", p, "cgroup2", MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL);
return mount_cgroupfs(p);
}
int mount_cgroups(
const char *dest,
CGroupUnified unified_requested,
bool userns,
uid_t uid_shift,
uid_t uid_range,
const char *selinux_apifs_context,
bool use_cgns) {
if (unified_requested >= CGROUP_UNIFIED_ALL)
return mount_unified_cgroups(dest);
if (use_cgns)
return mount_legacy_cgns_supported(dest, unified_requested, userns, uid_shift, uid_range, selinux_apifs_context);
return mount_legacy_cgns_unsupported(dest, unified_requested, userns, uid_shift, uid_range, selinux_apifs_context);
}
static int mount_systemd_cgroup_writable_one(const char *root, const char *own) {
int r;
assert(root);
assert(own);
/* Make our own cgroup a (writable) bind mount */
r = mount_nofollow_verbose(LOG_ERR, own, own, NULL, MS_BIND, NULL);
if (r < 0)
return r;
/* And then remount the systemd cgroup root read-only */
return mount_nofollow_verbose(LOG_ERR, NULL, root, NULL,
MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, NULL);
}
int mount_systemd_cgroup_writable(
const char *dest,
CGroupUnified unified_requested) {
int bind_mount_cgroup_hierarchy(void) {
_cleanup_free_ char *own_cgroup_path = NULL;
const char *root, *own;
int r;
assert(dest);
/* NB: This must be called from the inner child, with /sys/fs/cgroup/ being a bind mount in mountns! */
r = cg_pid_get_path(NULL, 0, &own_cgroup_path);
if (r < 0)
@@ -616,25 +175,14 @@ int mount_systemd_cgroup_writable(
if (path_equal(own_cgroup_path, "/"))
return 0;
if (unified_requested >= CGROUP_UNIFIED_ALL) {
const char *p = strjoina("/sys/fs/cgroup", own_cgroup_path);
root = prefix_roota(dest, "/sys/fs/cgroup");
own = strjoina(root, own_cgroup_path);
/* Make our own cgroup a (writable) bind mount */
r = mount_nofollow_verbose(LOG_ERR, p, p, NULL, MS_BIND, NULL);
if (r < 0)
return r;
} else {
if (unified_requested >= CGROUP_UNIFIED_SYSTEMD) {
root = prefix_roota(dest, "/sys/fs/cgroup/unified");
own = strjoina(root, own_cgroup_path);
r = mount_systemd_cgroup_writable_one(root, own);
if (r < 0)
return r;
}
root = prefix_roota(dest, "/sys/fs/cgroup/systemd");
own = strjoina(root, own_cgroup_path);
}
return mount_systemd_cgroup_writable_one(root, own);
/* And then remount the systemd cgroup root read-only */
return mount_nofollow_verbose(LOG_ERR, NULL, "/sys/fs/cgroup", NULL,
MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, NULL);
}

13
src/nspawn/nspawn-cgroup.h
View File

@@ -4,11 +4,14 @@
#include <stdbool.h>
#include <sys/types.h>
#include "cgroup-util.h"
#include "nspawn-settings.h"
int sync_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t uid_shift);
int create_subcgroup(pid_t pid, bool keep_unit, CGroupUnified unified_requested, uid_t uid_shift, int userns_fd, UserNamespaceMode userns_mode);
int create_subcgroup(
pid_t pid,
bool keep_unit,
uid_t uid_shift,
int userns_fd,
UserNamespaceMode userns_mode);
int mount_cgroups(const char *dest, CGroupUnified unified_requested, bool userns, uid_t uid_shift, uid_t uid_range, const char *selinux_apifs_context, bool use_cgns);
int mount_systemd_cgroup_writable(const char *dest, CGroupUnified unified_requested);
int mount_cgroups(const char *dest, bool accept_existing);
int bind_mount_cgroup_hierarchy(void);

1
src/nspawn/nspawn-mount.h
View File

@@ -3,7 +3,6 @@
#include <stdbool.h>
#include "cgroup-util.h"
#include "volatile-util.h"
typedef enum MountSettingsMask {

79
src/nspawn/nspawn-util.c
View File

@@ -1,79 +0,0 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include "alloc-util.h"
#include "glob-util.h"
#include "log.h"
#include "nspawn-util.h"
#include "parse-util.h"
#include "path-util.h"
#include "string-util.h"
int systemd_installation_has_version(const char *root, const char *minimal_version) {
bool found = false;
int r;
/* Try to guess if systemd installation is later than the specified version. This
* is hacky and likely to yield false negatives, particularly if the installation
* is non-standard. False positives should be relatively rare.
*/
FOREACH_STRING(pattern,
/* /lib works for systems without usr-merge, and for systems with a sane
* usr-merge, where /lib is a symlink to /usr/lib. /usr/lib is necessary
* for Gentoo which does a merge without making /lib a symlink.
* Also support multiarch paths von Debian/Ubuntu; *-linux-* is a small
* optimization based on the naming scheme of existing multiarch tuples.
*/
"/lib/systemd/libsystemd-shared-*.so",
"/lib64/systemd/libsystemd-shared-*.so",
"/usr/lib/*-linux-*/systemd/libsystemd-shared-*.so",
"/usr/lib/systemd/libsystemd-shared-*.so",
"/usr/lib64/systemd/libsystemd-shared-*.so") {
_cleanup_strv_free_ char **names = NULL;
_cleanup_free_ char *path = NULL;
char *c;
path = path_join(root, pattern);
if (!path)
return -ENOMEM;
r = glob_extend(&names, path, 0);
if (r == -ENOENT)
continue;
if (r < 0)
return r;
assert_se(c = endswith(path, "*.so"));
*c = '\0'; /* truncate the glob part */
STRV_FOREACH(name, names) {
_cleanup_free_ char *bn = NULL;
/* This is most likely to run only once, hence let's not optimize anything. */
char *t, *t2;
if (path_extract_filename(*name, &bn) < 0)
continue;
t = startswith(bn, "libsystemd-shared-");
if (!t)
continue;
t2 = endswith(t, ".so");
if (!t2)
continue;
*t2 = '\0';
found = true;
r = strverscmp_improved(t, minimal_version);
log_debug("Found libsystemd shared at \"%s.so\", version %s (%s).",
*name, t,
r >= 0 ? "OK" : "too old");
if (r >= 0)
return true;
}
}
return !found ? -ENOENT : false;
}

4
src/nspawn/nspawn-util.h
View File

@@ -1,4 +0,0 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#pragma once
int systemd_installation_has_version(const char *root, const char *minimal_version);

174
src/nspawn/nspawn.c
View File

@@ -32,6 +32,7 @@
#include "bus-util.h"
#include "cap-list.h"
#include "capability-util.h"
#include "cgroup-setup.h"
#include "cgroup-util.h"
#include "chase.h"
#include "chattr-util.h"
@@ -77,7 +78,6 @@
#include "nspawn-settings.h"
#include "nspawn-setuid.h"
#include "nspawn-stub-pid1.h"
#include "nspawn-util.h"
#include "nspawn.h"
#include "nsresource.h"
#include "nulstr-util.h"
@@ -201,7 +201,6 @@ static UserNamespaceMode arg_userns_mode; /* initialized depending on arg_privil
static uid_t arg_uid_shift = UID_INVALID, arg_uid_range = 0x10000U;
static UserNamespaceOwnership arg_userns_ownership = _USER_NAMESPACE_OWNERSHIP_INVALID;
static int arg_kill_signal = 0;
static CGroupUnified arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_UNKNOWN;
static SettingsMask arg_settings_mask = 0;
static int arg_settings_trusted = -1;
static char **arg_parameters = NULL;
@@ -487,77 +486,6 @@ static int custom_mount_check_all(void) {
return 0;
}
static int detect_unified_cgroup_hierarchy_from_environment(void) {
const char *e, *var = "SYSTEMD_NSPAWN_UNIFIED_HIERARCHY";
int r;
/* Allow the user to control whether the unified hierarchy is used */
e = getenv(var);
if (!e) {
/* $UNIFIED_CGROUP_HIERARCHY has been renamed to $SYSTEMD_NSPAWN_UNIFIED_HIERARCHY. */
var = "UNIFIED_CGROUP_HIERARCHY";
e = getenv(var);
}
if (!isempty(e)) {
r = parse_boolean(e);
if (r < 0)
return log_error_errno(r, "Failed to parse $%s: %m", var);
if (r > 0)
arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
else
arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
}
return 0;
}
static int detect_unified_cgroup_hierarchy_from_image(const char *directory) {
int r;
if (arg_userns_mode == USER_NAMESPACE_MANAGED) {
/* We only support the unified mode when running unprivileged */
arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
return 0;
}
/* Let's inherit the mode to use from the host system, but let's take into consideration what systemd
* in the image actually supports. */
r = cg_all_unified();
if (r < 0)
return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
if (r > 0) {
/* Unified cgroup hierarchy support was added in 230. Unfortunately the detection
* routine only detects 231, so we'll have a false negative here for 230. If there is no
* systemd installation in the container, we use the unified cgroup hierarchy. */
r = systemd_installation_has_version(directory, "230");
if (r < 0 && r != -ENOENT)
return log_error_errno(r, "Failed to determine systemd version in container: %m");
if (r == 0)
arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
else
arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
} else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0) {
/* Mixed cgroup hierarchy support was added in 233. If there is no systemd installation in
* the container, we use the unified cgroup hierarchy. */
r = systemd_installation_has_version(directory, "233");
if (r < 0 && r != -ENOENT)
return log_error_errno(r, "Failed to determine systemd version in container: %m");
if (r == 0)
arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
else
arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
} else
arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
log_debug("Using %s hierarchy for container.",
arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_NONE ? "legacy" :
arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_SYSTEMD ? "hybrid" : "unified");
return 0;
}
static int parse_capability_spec(const char *spec, uint64_t *ret_mask) {
uint64_t mask = 0;
int r;
@@ -692,7 +620,7 @@ static int parse_environment(void) {
else if (r != -ENXIO)
log_debug_errno(r, "Failed to parse $SYSTEMD_SUPPRESS_SYNC, ignoring: %m");
return detect_unified_cgroup_hierarchy_from_environment();
return 0;
}
static int parse_argv(int argc, char *argv[]) {
@@ -1682,25 +1610,6 @@ static int verify_arguments(void) {
if (arg_userns_mode == USER_NAMESPACE_MANAGED && !arg_private_network)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Managed user namespace operation requires private networking, as otherwise /sys/ may not be mounted.");
if (arg_start_mode == START_PID2 && arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
/* If we are running the stub init in the container, we don't need to look at what the init
* in the container supports, because we are not using it. Let's immediately pick the right
* setting based on the host system configuration.
*
* We only do this, if the user didn't use an environment variable to override the detection.
*/
r = cg_all_unified();
if (r < 0)
return log_error_errno(r, "Failed to determine whether we are in all unified mode.");
if (r > 0)
arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
else if (cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER) > 0)
arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
else
arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
}
if (!(arg_clone_ns_flags & CLONE_NEWPID) ||
!(arg_clone_ns_flags & CLONE_NEWUTS)) {
arg_register = false;
@@ -3432,16 +3341,10 @@ static int inner_child(
r = unshare(CLONE_NEWCGROUP);
if (r < 0)
return log_error_errno(errno, "Failed to unshare cgroup namespace: %m");
r = mount_cgroups(
"",
arg_unified_cgroup_hierarchy,
arg_userns_mode != USER_NAMESPACE_NO,
arg_uid_shift,
arg_uid_range,
arg_selinux_apifs_context,
true);
r = mount_cgroups(/* dest = */ NULL, /* accept_existing = */ false);
} else
r = mount_systemd_cgroup_writable("", arg_unified_cgroup_hierarchy);
r = bind_mount_cgroup_hierarchy();
if (r < 0)
return r;
@@ -4219,21 +4122,6 @@ static int outer_child(
return r;
}
if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
/* OK, we don't know yet which cgroup mode to use yet. Let's figure it out, and tell the parent. */
r = detect_unified_cgroup_hierarchy_from_image(directory);
if (r < 0)
return r;
l = send(fd_outer_socket, &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), MSG_NOSIGNAL);
if (l < 0)
return log_error_errno(errno, "Failed to send cgroup mode: %m");
if (l != sizeof(arg_unified_cgroup_hierarchy))
return log_error_errno(SYNTHETIC_ERRNO(EIO),
"Short write while sending cgroup mode.");
}
r = recursive_chown(directory, chown_uid, chown_range);
if (r < 0)
return r;
@@ -4329,14 +4217,7 @@ static int outer_child(
(void) write_string_filef(p, WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_MODE_0444, SD_ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(arg_uuid));
if (!arg_use_cgns) {
r = mount_cgroups(
directory,
arg_unified_cgroup_hierarchy,
arg_userns_mode != USER_NAMESPACE_NO,
chown_uid,
chown_range,
arg_selinux_apifs_context,
false);
r = mount_cgroups(directory, /* accept_existing = */ true);
if (r < 0)
return r;
}
@@ -5378,16 +5259,6 @@ static int run_container(
}
}
if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
/* The child let us know the support cgroup mode it might have read from the image. */
l = recv(fd_outer_socket_pair[0], &arg_unified_cgroup_hierarchy, sizeof(arg_unified_cgroup_hierarchy), 0);
if (l < 0)
return log_error_errno(errno, "Failed to read cgroup mode: %m");
if (l != sizeof(arg_unified_cgroup_hierarchy))
return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short read while reading cgroup mode (%zi bytes).%s",
l, l == 0 ? " The child is most likely dead." : "");
}
/* Wait for the outer child. */
r = wait_for_terminate_and_check("(sd-namespace)", *pid, WAIT_LOG_ABNORMAL);
if (r < 0)
@@ -5582,17 +5453,12 @@ static int run_container(
r = create_subcgroup(
*pid,
arg_keep_unit,
arg_unified_cgroup_hierarchy,
arg_uid_shift,
userns_fd,
arg_userns_mode);
if (r < 0)
return r;
r = sync_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
if (r < 0)
return r;
/* Notify the child that the parent is ready with all its setup (including cgroup-ification), and
* that the child can now hand over control to the code to run inside the container. */
(void) barrier_place(&barrier); /* #4 */
@@ -5991,6 +5857,15 @@ static int run(int argc, char *argv[]) {
if (arg_cleanup)
return do_cleanup();
r = cg_has_legacy();
if (r < 0)
goto finish;
if (r > 0) {
r = log_error_errno(SYNTHETIC_ERRNO(EPROTO),
"Detected host uses legacy cgroup v1 hierarchy, refusing.");
goto finish;
}
r = cant_be_in_netns();
if (r < 0)
goto finish;
@@ -6021,12 +5896,6 @@ static int run(int argc, char *argv[]) {
if (!arg_private_network && arg_userns_mode != USER_NAMESPACE_NO && arg_uid_shift > 0)
arg_caps_retain &= ~(UINT64_C(1) << CAP_NET_BIND_SERVICE);
r = cg_unified(); /* initialize cache early */
if (r < 0) {
log_error_errno(r, "Failed to determine whether the unified cgroups hierarchy is used: %m");
goto finish;
}
r = verify_arguments();
if (r < 0)
goto finish;
@@ -6039,19 +5908,6 @@ static int run(int argc, char *argv[]) {
if (r < 0)
goto finish;
/* Reapply environment settings. */
(void) detect_unified_cgroup_hierarchy_from_environment();
if (arg_userns_mode == USER_NAMESPACE_MANAGED) {
r = cg_all_unified();
if (r < 0) {
log_error_errno(r, "Failed to determine if we are in unified cgroupv2 mode: %m");
goto finish;
}
if (r == 0)
return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Managed user namespace operation only supported in unified cgroupv2 mode.");
}
/* Ignore SIGPIPE here, because we use splice() on the ptyfwd stuff and that will generate SIGPIPE if
* the result is closed. Note that the container payload child will reset signal mask+handler anyway,
* so just turning this off here means we only turn it off in nspawn itself, not any children. */

31
src/nspawn/test-nspawn-util.c
View File

@@ -1,31 +0,0 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include "nspawn-util.h"
#include "rm-rf.h"
#include "strv.h"
#include "tests.h"
#include "tmpfile-util.h"
TEST(systemd_installation_has_version) {
int r;
FOREACH_STRING(version, "0", "231", PROJECT_VERSION_FULL, "999") {
r = systemd_installation_has_version(saved_argv[1], version);
/* The build environment may not have a systemd installation. */
if (r == -ENOENT)
continue;
ASSERT_OK(r);
log_info("%s has systemd >= %s: %s",
saved_argv[1] ?: "Current installation", version, yes_no(r));
}
_cleanup_(rm_rf_physical_and_freep) char *t = NULL;
ASSERT_OK(mkdtemp_malloc(NULL, &t));
ASSERT_ERROR(systemd_installation_has_version(t, PROJECT_VERSION_FULL), ENOENT);
}
/* This program can be called with a path to an installation root.
* For example: build/test-nspawn-util /var/lib/machines/rawhide
*/
DEFINE_TEST_MAIN(LOG_DEBUG);

85
src/shared/cgroup-setup.c
View File

@@ -868,91 +868,6 @@ int cg_trim_v1_controllers(CGroupMask supported, CGroupMask mask, const char *pa
return r;
}
int cg_install_release_agent(const char *controller, const char *agent) {
_cleanup_free_ char *fs = NULL, *contents = NULL;
const char *sc;
int r;
assert(agent);
r = cg_unified_controller(controller);
if (r < 0)
return r;
if (r > 0) /* doesn't apply to unified hierarchy */
return -EOPNOTSUPP;
r = cg_get_path(controller, NULL, "release_agent", &fs);
if (r < 0)
return r;
r = read_one_line_file(fs, &contents);
if (r < 0)
return r;
sc = strstrip(contents);
if (isempty(sc)) {
r = write_string_file(fs, agent, WRITE_STRING_FILE_DISABLE_BUFFER);
if (r < 0)
return r;
} else if (!path_equal(sc, agent))
return -EEXIST;
fs = mfree(fs);
r = cg_get_path(controller, NULL, "notify_on_release", &fs);
if (r < 0)
return r;
contents = mfree(contents);
r = read_one_line_file(fs, &contents);
if (r < 0)
return r;
sc = strstrip(contents);
if (streq(sc, "0")) {
r = write_string_file(fs, "1", WRITE_STRING_FILE_DISABLE_BUFFER);
if (r < 0)
return r;
return 1;
}
if (!streq(sc, "1"))
return -EIO;
return 0;
}
int cg_uninstall_release_agent(const char *controller) {
_cleanup_free_ char *fs = NULL;
int r;
r = cg_unified_controller(controller);
if (r < 0)
return r;
if (r > 0) /* Doesn't apply to unified hierarchy */
return -EOPNOTSUPP;
r = cg_get_path(controller, NULL, "notify_on_release", &fs);
if (r < 0)
return r;
r = write_string_file(fs, "0", WRITE_STRING_FILE_DISABLE_BUFFER);
if (r < 0)
return r;
fs = mfree(fs);
r = cg_get_path(controller, NULL, "release_agent", &fs);
if (r < 0)
return r;
r = write_string_file(fs, "", WRITE_STRING_FILE_DISABLE_BUFFER);
if (r < 0)
return r;
return 0;
}
int cg_has_legacy(void) {
struct statfs fs;

3
src/shared/cgroup-setup.h
View File

@@ -38,7 +38,4 @@ int cg_migrate_recursive_fallback(const char *cfrom, const char *pfrom, const ch
int cg_migrate_v1_controllers(CGroupMask supported, CGroupMask mask, const char *from, cg_migrate_callback_t to_callback, void *userdata);
int cg_trim_v1_controllers(CGroupMask supported, CGroupMask mask, const char *path, bool delete_root);
int cg_install_release_agent(const char *controller, const char *agent);
int cg_uninstall_release_agent(const char *controller);
int cg_has_legacy(void);

15
src/shared/mount-setup.c
View File

@@ -66,6 +66,21 @@ static bool cgroupfs_recursiveprot_supported(void) {
return r > 0;
}
int mount_cgroupfs(const char *path) {
assert(path);
/* Mount a separate cgroupfs instance, taking all options we initial set into account. This is
* especially useful when cgroup namespace is *not* employed, since the kernel overrides all
* previous options if a new mount is established in initial cgns (c.f.
* https://github.com/torvalds/linux/blob/b69bb476dee99d564d65d418e9a20acca6f32c3f/kernel/cgroup/cgroup.c#L1984)
*
* The options shall be kept in sync with those in mount_table below. */
return mount_nofollow_verbose(LOG_ERR, "cgroup2", path, "cgroup2",
MS_NOSUID|MS_NOEXEC|MS_NODEV,
cgroupfs_recursiveprot_supported() ? "nsdelegate,memory_recursiveprot" : "nsdelegate");
}
static const MountPoint mount_table[] = {
{ "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
NULL, MNT_FATAL|MNT_IN_CONTAINER|MNT_FOLLOW_SYMLINK },

2
src/shared/mount-setup.h
View File

@@ -8,3 +8,5 @@ bool mount_point_ignore(const char *path);
int mount_setup_early(void);
int mount_setup(bool loaded_policy, bool leave_propagation);
int mount_cgroupfs(const char *path);

41
test/units/TEST-13-NSPAWN.nspawn.sh
View File

@@ -49,15 +49,6 @@ at_exit() {
trap at_exit EXIT
# check cgroup-v2
IS_CGROUPSV2_SUPPORTED=no
mkdir -p /tmp/cgroup2
if mount -t cgroup2 cgroup2 /tmp/cgroup2; then
IS_CGROUPSV2_SUPPORTED=yes
umount /tmp/cgroup2
fi
rmdir /tmp/cgroup2
# check cgroup namespaces
IS_CGNS_SUPPORTED=no
if [[ -f /proc/1/ns/cgroup ]]; then
@@ -880,36 +871,30 @@ EOF
}
matrix_run_one() {
local cgroupsv2="${1:?}"
local use_cgns="${2:?}"
local api_vfs_writable="${3:?}"
local use_cgns="${1:?}"
local api_vfs_writable="${2:?}"
local root
if [[ "$cgroupsv2" == "yes" && "$IS_CGROUPSV2_SUPPORTED" == "no" ]]; then
echo >&2 "Unified cgroup hierarchy is not supported, skipping..."
return 0
fi
if [[ "$use_cgns" == "yes" && "$IS_CGNS_SUPPORTED" == "no" ]]; then
echo >&2 "CGroup namespaces are not supported, skipping..."
return 0
fi
root="$(mktemp -d "/var/lib/machines/TEST-13-NSPAWN.unified-$1-cgns-$2-api-vfs-writable-$3.XXX")"
root="$(mktemp -d "/var/lib/machines/TEST-13-NSPAWN.cgns-$1-api-vfs-writable-$2.XXX")"
create_dummy_container "$root"
SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
systemd-nspawn --register=no \
--directory="$root" \
--boot
SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
systemd-nspawn --register=no \
--directory="$root" \
--private-network \
--boot
if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
if SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
systemd-nspawn --register=no \
--directory="$root" \
--private-users=pick \
@@ -919,7 +904,7 @@ matrix_run_one() {
[[ "$IS_USERNS_SUPPORTED" == "no" && "$api_vfs_writable" == "network" ]] && return 1
fi
if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
if SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
systemd-nspawn --register=no \
--directory="$root" \
--private-network \
@@ -945,7 +930,7 @@ matrix_run_one() {
# --network-namespace-path and network-related options cannot be used together
for net_opt in "${net_opts[@]}"; do
echo "$netns_opt in combination with $net_opt should fail"
if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
if SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
systemd-nspawn --register=no \
--directory="$root" \
--boot \
@@ -957,7 +942,7 @@ matrix_run_one() {
done
# allow combination of --network-namespace-path and --private-network
SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
systemd-nspawn --register=no \
--directory="$root" \
--boot \
@@ -967,7 +952,7 @@ matrix_run_one() {
# test --network-namespace-path works with a network namespace created by "ip netns"
ip netns add nspawn_test
netns_opt="--network-namespace-path=/run/netns/nspawn_test"
SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
systemd-nspawn --register=no \
--directory="$root" \
--network-namespace-path=/run/netns/nspawn_test \
@@ -983,10 +968,8 @@ testcase_api_vfs() {
local api_vfs_writable
for api_vfs_writable in yes no network; do
matrix_run_one no no $api_vfs_writable
matrix_run_one yes no $api_vfs_writable
matrix_run_one no yes $api_vfs_writable
matrix_run_one yes yes $api_vfs_writable
matrix_run_one no $api_vfs_writable
matrix_run_one yes $api_vfs_writable
done
}