summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/core/mount-setup.c41
-rw-r--r--src/nspawn/nspawn.c130
-rw-r--r--src/shared/cgroup-util.c61
-rw-r--r--src/shared/cgroup-util.h2
4 files changed, 188 insertions, 46 deletions
diff --git a/src/core/mount-setup.c b/src/core/mount-setup.c
index 342f5520c9..bd3a0352d6 100644
--- a/src/core/mount-setup.c
+++ b/src/core/mount-setup.c
@@ -44,6 +44,7 @@
#include "efivars.h"
#include "smack-util.h"
#include "def.h"
+#include "cgroup-util.h"
typedef enum MountMode {
MNT_NONE = 0,
@@ -227,49 +228,17 @@ int mount_setup_early(void) {
int mount_cgroup_controllers(char ***join_controllers) {
_cleanup_set_free_free_ Set *controllers = NULL;
- _cleanup_fclose_ FILE *f;
- char buf[LINE_MAX];
int r;
/* Mount all available cgroup controllers that are built into the kernel. */
- f = fopen("/proc/cgroups", "re");
- if (!f) {
- log_error_errno(errno, "Failed to enumerate cgroup controllers: %m");
- return 0;
- }
-
controllers = set_new(&string_hash_ops);
if (!controllers)
return log_oom();
- /* Ignore the header line */
- (void) fgets(buf, sizeof(buf), f);
-
- for (;;) {
- char *controller;
- int enabled = 0;
-
- if (fscanf(f, "%ms %*i %*i %i", &controller, &enabled) != 2) {
-
- if (feof(f))
- break;
-
- log_error("Failed to parse /proc/cgroups.");
- return -EIO;
- }
-
- if (!enabled) {
- free(controller);
- continue;
- }
-
- r = set_consume(controllers, controller);
- if (r < 0) {
- log_error("Failed to add controller to set.");
- return r;
- }
- }
+ r = cg_kernel_controllers(controllers);
+ if (r < 0)
+ return log_error_errno(r, "Failed to enumerate cgroup controllers: %m");
for (;;) {
_cleanup_free_ char *options = NULL, *controller = NULL, *where = NULL;
@@ -348,7 +317,7 @@ int mount_cgroup_controllers(char ***join_controllers) {
/* Now that we mounted everything, let's make the tmpfs the
* cgroup file systems are mounted into read-only. */
- mount("tmpfs", "/sys/fs/cgroup", "tmpfs", MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY, "mode=755");
+ (void) mount("tmpfs", "/sys/fs/cgroup", "tmpfs", MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY, "mode=755");
return 0;
}
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 6aaceac30b..1ac0a7008c 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -869,6 +869,112 @@ static int mount_binds(const char *dest, char **l, bool ro) {
return 0;
}
+static int mount_cgroup_hierarchy(const char *dest, const char *controller, const char *hierarchy, bool read_only) {
+ char *to;
+ int r;
+
+ to = strappenda(dest, "/sys/fs/cgroup/", hierarchy);
+
+ r = path_is_mount_point(to, false);
+ if (r < 0)
+ return log_error_errno(r, "Failed to determine if %s is mounted already: %m", to);
+ if (r > 0)
+ return 0;
+
+ mkdir_p(to, 0755);
+
+ if (mount("cgroup", to, "cgroup", MS_NOSUID|MS_NOEXEC|MS_NODEV|(read_only ? MS_RDONLY : 0), controller) < 0)
+ return log_error_errno(errno, "Failed to mount to %s: %m", to);
+
+ return 1;
+}
+
+static int mount_cgroup(const char *dest) {
+ _cleanup_set_free_free_ Set *controllers = NULL;
+ _cleanup_free_ char *own_cgroup_path = NULL;
+ const char *cgroup_root, *systemd_root, *systemd_own;
+ int r;
+
+ controllers = set_new(&string_hash_ops);
+ if (!controllers)
+ return log_oom();
+
+ r = cg_kernel_controllers(controllers);
+ if (r < 0)
+ return log_error_errno(r, "Failed to determine cgroup controllers: %m");
+
+ r = cg_pid_get_path(NULL, 0, &own_cgroup_path);
+ if (r < 0)
+ return log_error_errno(r, "Failed to determine our own cgroup path: %m");
+
+ cgroup_root = strappenda(dest, "/sys/fs/cgroup");
+ if (mount("tmpfs", cgroup_root, "tmpfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME, "mode=755") < 0)
+ return log_error_errno(errno, "Failed to mount tmpfs to /sys/fs/cgroup: %m");
+
+ for (;;) {
+ _cleanup_free_ char *controller = NULL, *origin = NULL, *combined = NULL;
+
+ controller = set_steal_first(controllers);
+ if (!controller)
+ break;
+
+ origin = strappend("/sys/fs/cgroup/", controller);
+ if (!origin)
+ return log_oom();
+
+ r = readlink_malloc(origin, &combined);
+ if (r == -EINVAL) {
+ /* Not a symbolic link, but directly a single cgroup hierarchy */
+
+ r = mount_cgroup_hierarchy(dest, controller, controller, true);
+ if (r < 0)
+ return r;
+
+ } else if (r < 0)
+ return log_error_errno(r, "Failed to read link %s: %m", origin);
+ else {
+ _cleanup_free_ char *target = NULL;
+
+ target = strjoin(dest, "/sys/fs/cgroup/", controller, NULL);
+ if (!target)
+ return log_oom();
+
+ /* A symbolic link, a combination of controllers in one hierarchy */
+
+ if (!filename_is_valid(combined)) {
+ log_warning("Ignoring invalid combined hierarchy %s.", combined);
+ continue;
+ }
+
+ r = mount_cgroup_hierarchy(dest, combined, combined, true);
+ if (r < 0)
+ return r;
+
+ if (symlink(combined, target) < 0)
+ return log_error_errno(errno, "Failed to create symlink for combined hiearchy: %m");
+ }
+ }
+
+ r = mount_cgroup_hierarchy(dest, "name=systemd", "systemd", false);
+ if (r < 0)
+ return r;
+
+ /* Make our own cgroup a (writable) bind mount */
+ systemd_own = strappenda(dest, "/sys/fs/cgroup/systemd", own_cgroup_path);
+ if (mount(systemd_own, systemd_own, NULL, MS_BIND, NULL) < 0)
+ return log_error_errno(errno, "Failed to turn %s into a bind mount: %m", own_cgroup_path);
+
+ /* And then remount the systemd cgroup root read-only */
+ systemd_root = strappenda(dest, "/sys/fs/cgroup/systemd");
+ if (mount(NULL, systemd_root, NULL, MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, NULL) < 0)
+ return log_error_errno(errno, "Failed to mount cgroup root read-only: %m");
+
+ if (mount(NULL, cgroup_root, NULL, MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY, "mode=755") < 0)
+ return log_error_errno(errno, "Failed to remount %s read-only: %m", cgroup_root);
+
+ return 0;
+}
+
static int mount_tmpfs(const char *dest) {
char **i, **o;
@@ -3309,6 +3415,11 @@ int main(int argc, char *argv[]) {
kmsg_socket_pair[1] = safe_close(kmsg_socket_pair[1]);
+ /* Tell the parent that we are ready, and that
+ * it can cgroupify us to that we lack access
+ * to certain devices and resources. */
+ (void) barrier_place(&barrier);
+
if (setup_boot_id(arg_directory) < 0)
_exit(EXIT_FAILURE);
@@ -3330,10 +3441,12 @@ int main(int argc, char *argv[]) {
if (mount_tmpfs(arg_directory) < 0)
_exit(EXIT_FAILURE);
- /* Tell the parent that we are ready, and that
- * it can cgroupify us to that we lack access
- * to certain devices and resources. */
- (void)barrier_place(&barrier);
+ /* Wait until we are cgroup-ified, so that we
+ * can mount the right cgroup path writable */
+ (void) barrier_sync_next(&barrier);
+
+ if (mount_cgroup(arg_directory) < 0)
+ _exit(EXIT_FAILURE);
if (chdir(arg_directory) < 0) {
log_error_errno(errno, "chdir(%s) failed: %m", arg_directory);
@@ -3472,8 +3585,10 @@ int main(int argc, char *argv[]) {
fdset_free(fds);
fds = NULL;
- /* wait for child-setup to be done */
- if (barrier_place_and_sync(&barrier)) {
+ /* Wait for the most basic Child-setup to be done,
+ * before we add hardware to it, and place it in a
+ * cgroup. */
+ if (barrier_sync_next(&barrier)) {
_cleanup_event_unref_ sd_event *event = NULL;
_cleanup_(pty_forward_freep) PTYForward *forward = NULL;
char last_char = 0;
@@ -3515,6 +3630,9 @@ int main(int argc, char *argv[]) {
* control to the code to run inside the container. */
(void) barrier_place(&barrier);
+ /* And wait that the child is completely ready now. */
+ (void) barrier_place_and_sync(&barrier);
+
sd_notify(false,
"READY=1\n"
"STATUS=Container running.");
diff --git a/src/shared/cgroup-util.c b/src/shared/cgroup-util.c
index 1bcba01887..86729f14bf 100644
--- a/src/shared/cgroup-util.c
+++ b/src/shared/cgroup-util.c
@@ -502,14 +502,16 @@ int cg_get_path(const char *controller, const char *path, const char *suffix, ch
}
static int check_hierarchy(const char *p) {
- char *cc;
+ const char *cc;
assert(p);
+ if (!filename_is_valid(p))
+ return 0;
+
/* Check if this controller actually really exists */
- cc = alloca(strlen("/sys/fs/cgroup/") + strlen(p) + 1);
- strcpy(stpcpy(cc, "/sys/fs/cgroup/"), p);
- if (access(cc, F_OK) < 0)
+ cc = strappenda("/sys/fs/cgroup/", p);
+ if (laccess(cc, F_OK) < 0)
return -errno;
return 0;
@@ -1732,3 +1734,54 @@ CGroupControllerMask cg_mask_supported(void) {
return mask;
}
+
+int cg_kernel_controllers(Set *controllers) {
+ _cleanup_fclose_ FILE *f = NULL;
+ char buf[LINE_MAX];
+ int r;
+
+ assert(controllers);
+
+ f = fopen("/proc/cgroups", "re");
+ if (!f) {
+ if (errno == ENOENT)
+ return 0;
+ return -errno;
+ }
+
+ /* Ignore the header line */
+ (void) fgets(buf, sizeof(buf), f);
+
+ for (;;) {
+ char *controller;
+ int enabled = 0;
+
+ errno = 0;
+ if (fscanf(f, "%ms %*i %*i %i", &controller, &enabled) != 2) {
+
+ if (feof(f))
+ break;
+
+ if (ferror(f) && errno)
+ return -errno;
+
+ return -EBADMSG;
+ }
+
+ if (!enabled) {
+ free(controller);
+ continue;
+ }
+
+ if (!filename_is_valid(controller)) {
+ free(controller);
+ return -EBADMSG;
+ }
+
+ r = set_consume(controllers, controller);
+ if (r < 0)
+ return r;
+ }
+
+ return 0;
+}
diff --git a/src/shared/cgroup-util.h b/src/shared/cgroup-util.h
index 5e1e445c33..89dc2b1135 100644
--- a/src/shared/cgroup-util.h
+++ b/src/shared/cgroup-util.h
@@ -132,3 +132,5 @@ int cg_migrate_everywhere(CGroupControllerMask supported, const char *from, cons
int cg_trim_everywhere(CGroupControllerMask supported, const char *path, bool delete_root);
CGroupControllerMask cg_mask_supported(void);
+
+int cg_kernel_controllers(Set *controllers);
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-11-27 10:26:39 +0000