core: general cgroup rework

Replace the very generic cgroup hookup with a much simpler one. With
this change only the high-level cgroup settings remain, the ability to
set arbitrary cgroup attributes is removed, so is support for adding
units to arbitrary cgroup controllers or setting arbitrary paths for
them (especially paths that are different for the various controllers).

This also introduces a new -.slice root slice, that is the parent of
system.slice and friends. This enables easy admin configuration of
root-level cgrouo properties.

This replaces DeviceDeny= by DevicePolicy=, and implicitly adds in
/dev/null, /dev/zero and friends if DeviceAllow= is used (unless this is
turned off by DevicePolicy=).

1 files changed, 45 insertions, 29 deletions

diff --git a/src/shared/mkdir.c b/src/shared/mkdir.c
index 0e51b64f69..e21a0f3989 100644
--- a/src/shared/mkdir.c
+++ b/src/shared/mkdir.c
@@ -26,15 +26,16 @@
 #include <stdlib.h>
 #include <stdio.h>
 
-#include "mkdir.h"
 #include "label.h"
 #include "util.h"
+#include "path-util.h"
+#include "mkdir.h"
 
 int mkdir_label(const char *path, mode_t mode) {
         return label_mkdir(path, mode, true);
 }
 
-static int makedir_safe(const char *path, mode_t mode, uid_t uid, gid_t gid, bool apply) {
+static int mkdir_safe_internal(const char *path, mode_t mode, uid_t uid, gid_t gid, bool apply) {
         struct stat st;
 
         if (label_mkdir(path, mode, apply) >= 0)
@@ -56,36 +57,50 @@ static int makedir_safe(const char *path, mode_t mode, uid_t uid, gid_t gid, boo
 }
 
 int mkdir_safe(const char *path, mode_t mode, uid_t uid, gid_t gid) {
-        return makedir_safe(path, mode, uid, gid, false);
+        return mkdir_safe_internal(path, mode, uid, gid, false);
 }
 
 int mkdir_safe_label(const char *path, mode_t mode, uid_t uid, gid_t gid) {
-        return makedir_safe(path, mode, uid, gid, true);
+        return mkdir_safe_internal(path, mode, uid, gid, true);
 }
 
-static int makedir_parents(const char *path, mode_t mode, bool apply) {
+static int is_dir(const char* path) {
         struct stat st;
+
+        if (stat(path, &st) < 0)
+                return -errno;
+
+        return S_ISDIR(st.st_mode);
+}
+
+static int mkdir_parents_internal(const char *prefix, const char *path, mode_t mode, bool apply) {
         const char *p, *e;
+        int r;
 
         assert(path);
 
+        if (prefix && !path_startswith(path, prefix))
+                return -ENOTDIR;
+
         /* return immediately if directory exists */
         e = strrchr(path, '/');
         if (!e)
                 return -EINVAL;
+
+        if (e == path)
+                return 0;
+
         p = strndupa(path, e - path);
-        if (stat(p, &st) >= 0) {
-                if ((st.st_mode & S_IFMT) == S_IFDIR)
-                        return 0;
-                else
-                        return -ENOTDIR;
-        }
+        r = is_dir(p);
+        if (r > 0)
+                return 0;
+        if (r == 0)
+                return -ENOTDIR;
 
         /* create every parent directory in the path, except the last component */
         p = path + strspn(path, "/");
         for (;;) {
-                int r;
-                char *t;
+                char t[strlen(path) + 1];
 
                 e = p + strcspn(p, "/");
                 p = e + strspn(e, "/");
@@ -95,39 +110,36 @@ static int makedir_parents(const char *path, mode_t mode, bool apply) {
                 if (*p == 0)
                         return 0;
 
-                t = strndup(path, e - path);
-                if (!t)
-                        return -ENOMEM;
+                memcpy(t, path, e - path);
+                t[e-path] = 0;
 
-                r = label_mkdir(t, mode, apply);
-                free(t);
+                if (prefix && path_startswith(prefix, t))
+                        continue;
 
+                r = label_mkdir(t, mode, apply);
                 if (r < 0 && errno != EEXIST)
                         return -errno;
         }
 }
 
 int mkdir_parents(const char *path, mode_t mode) {
-        return makedir_parents(path, mode, false);
+        return mkdir_parents_internal(NULL, path, mode, false);
 }
 
 int mkdir_parents_label(const char *path, mode_t mode) {
-        return makedir_parents(path, mode, true);
+        return mkdir_parents_internal(NULL, path, mode, true);
 }
 
-static int is_dir(const char* path) {
-        struct stat st;
-        if (stat(path, &st) < 0)
-                return -errno;
-        return S_ISDIR(st.st_mode);
+int mkdir_parents_prefix(const char *prefix, const char *path, mode_t mode) {
+        return mkdir_parents_internal(prefix, path, mode, true);
 }
 
-static int makedir_p(const char *path, mode_t mode, bool apply) {
+static int mkdir_p_internal(const char *prefix, const char *path, mode_t mode, bool apply) {
         int r;
 
         /* Like mkdir -p */
 
-        r = makedir_parents(path, mode, apply);
+        r = mkdir_parents_internal(prefix, path, mode, apply);
         if (r < 0)
                 return r;
 
@@ -139,9 +151,13 @@ static int makedir_p(const char *path, mode_t mode, bool apply) {
 }
 
 int mkdir_p(const char *path, mode_t mode) {
-        return makedir_p(path, mode, false);
+        return mkdir_p_internal(NULL, path, mode, false);
 }
 
 int mkdir_p_label(const char *path, mode_t mode) {
-        return makedir_p(path, mode, true);
+        return mkdir_p_internal(NULL, path, mode, true);
+}
+
+int mkdir_p_prefix(const char *prefix, const char *path, mode_t mode) {
+        return mkdir_p_internal(prefix, path, mode, false);
 }