summaryrefslogtreecommitdiff
path: root/src/nspawn/nspawn-cgroup.c
AgeCommit message (Collapse)Author
2017-06-16aLuke Shumaker
2017-06-16nspawn: Add a special "INHERIT" cgroup modeLuke Shumaker
2017-06-16nspawn: Divorce the code deciding the cgroup mounts from the code performing ↵Luke Shumaker
them TODO: a better commit message
2017-06-16nspawn: Be more robust when deciding to create subcgroups or chown cgroupsLuke Shumaker
To demonstrate the breakage in the chown part: Be using an interactive terminal, go to spawn a shell in a container; using --register=no, and using userns. It will end up chown()ing the cgroup of your terminal session to the container! And you will be left with that after you quit the container! Similarly. the subcgroup bit will try create subcgroups for the parent and child even they share the cgroup with other processes (as they likely to if --register=no); and will find only partial success, leaving the cgroup with all controllers disabled. What we really care about is if the child process is alone in the cgroup, so we'll take a peek at cgroup.procs for that cgroup to find out.
2017-06-16nspawn: Improve error messagesLuke Shumaker
2017-06-16nspawn: Clarify sync_cgroup(); tmp dirname, error messageLuke Shumaker
sync_cgroup() can sync name=systemd->unified or unified->name=systemd, depending on the setup. However, the names of things, comments, and error messages all assume (send the fals impression) that it only goes name=systemd->unfied.
2017-06-16nspawn: mount_legacy_cgns_supported(): Rename variables to not lieLuke Shumaker
mount_legacy_cgns_supported() is very clearly meant to be a version of mount_legacy_cgns_unsupported() modified to cope with the fact that it has already chroot()ed, and thus can't look at the host /sys. So, the loops and such look similar. However, to cope with the fact that it can't look at /sys, it deals with hierarchies in the outermost loop, rather than controllers. Yet, it kept the list variable named "controllers". That's confusing.
2017-06-16nspawn: Merge chown_cgroup(), sync_cgroup(), and create_subcgroup() into one ↵Luke Shumaker
cgroup_setup()
2017-06-16nspawn: Detect the outer_cgver once, and pass that aroundLuke Shumaker
Yes, the relevant functions in cgroup-util actually do cache the values with static variables. But passing it around as a value makes the flow much nicer. The symmetry of having both the inner and outer cg versions as a CGroupUnified enum makes the code much easier to grok; this could be done with cg_version(), but I still think this is more readable.
2017-06-16nspawn: nspawn-cgroup.{c,h}: s/unified_requested/inner_cgver/Luke Shumaker
2017-06-16nspawn: Move cgroup mount stuff from nspawn-mount.c to nspawn-cgroup.cLuke Shumaker
2017-06-16nspawn: Rename arg_uid_shift -> uid_shiftLuke Shumaker
Naming it arg_uid_shift is confusing because of the global arg_uid_shift in nspawn.c
2016-10-14nspawn: remove unused variable (#4369)Thomas H. P. Andersen
2016-10-13nspawn: cleanup and chown the synced cgroup hierarchy (#4223)Evgeny Vereshchagin
Fixes: #4181
2016-10-11nspawn,mount-util: add [u]mount_verbose and use it in nspawnZbigniew Jędrzejewski-Szmek
This makes it easier to debug failed nspawn invocations: Mounting sysfs on /var/lib/machines/fedora-rawhide/sys (MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV "")... Mounting tmpfs on /var/lib/machines/fedora-rawhide/dev (MS_NOSUID|MS_STRICTATIME "mode=755,uid=1450901504,gid=1450901504")... Mounting tmpfs on /var/lib/machines/fedora-rawhide/dev/shm (MS_NOSUID|MS_NODEV|MS_STRICTATIME "mode=1777,uid=1450901504,gid=1450901504")... Mounting tmpfs on /var/lib/machines/fedora-rawhide/run (MS_NOSUID|MS_NODEV|MS_STRICTATIME "mode=755,uid=1450901504,gid=1450901504")... Bind-mounting /sys/fs/selinux on /var/lib/machines/fedora-rawhide/sys/fs/selinux (MS_BIND "")... Remounting /var/lib/machines/fedora-rawhide/sys/fs/selinux (MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_BIND|MS_REMOUNT "")... Mounting proc on /proc (MS_NOSUID|MS_NOEXEC|MS_NODEV "")... Bind-mounting /proc/sys on /proc/sys (MS_BIND "")... Remounting /proc/sys (MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_BIND|MS_REMOUNT "")... Bind-mounting /proc/sysrq-trigger on /proc/sysrq-trigger (MS_BIND "")... Remounting /proc/sysrq-trigger (MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_BIND|MS_REMOUNT "")... Mounting tmpfs on /tmp (MS_STRICTATIME "mode=1777,uid=0,gid=0")... Mounting tmpfs on /sys/fs/cgroup (MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME "mode=755,uid=0,gid=0")... Mounting cgroup on /sys/fs/cgroup/systemd (MS_NOSUID|MS_NOEXEC|MS_NODEV "none,name=systemd,xattr")... Failed to mount cgroup on /sys/fs/cgroup/systemd (MS_NOSUID|MS_NOEXEC|MS_NODEV "none,name=systemd,xattr"): No such file or directory
2016-08-17core: use the unified hierarchy for the systemd cgroup controller hierarchyTejun Heo
Currently, systemd uses either the legacy hierarchies or the unified hierarchy. When the legacy hierarchies are used, systemd uses a named legacy hierarchy mounted on /sys/fs/cgroup/systemd without any kernel controllers for process management. Due to the shortcomings in the legacy hierarchy, this involves a lot of workarounds and complexities. Because the unified hierarchy can be mounted and used in parallel to legacy hierarchies, there's no reason for systemd to use a legacy hierarchy for management even if the kernel resource controllers need to be mounted on legacy hierarchies. It can simply mount the unified hierarchy under /sys/fs/cgroup/systemd and use it without affecting other legacy hierarchies. This disables a significant amount of fragile workaround logics and would allow using features which depend on the unified hierarchy membership such bpf cgroup v2 membership test. In time, this would also allow deleting the said complexities. This patch updates systemd so that it prefers the unified hierarchy for the systemd cgroup controller hierarchy when legacy hierarchies are used for kernel resource controllers. * cg_unified(@controller) is introduced which tests whether the specific controller in on unified hierarchy and used to choose the unified hierarchy code path for process and service management when available. Kernel controller specific operations remain gated by cg_all_unified(). * "systemd.legacy_systemd_cgroup_controller" kernel argument can be used to force the use of legacy hierarchy for systemd cgroup controller. * nspawn: By default nspawn uses the same hierarchies as the host. If UNIFIED_CGROUP_HIERARCHY is set to 1, unified hierarchy is used for all. If 0, legacy for all. * nspawn: arg_unified_cgroup_hierarchy is made an enum and now encodes one of three options - legacy, only systemd controller on unified, and unified. The value is passed into mount setup functions and controls cgroup configuration. * nspawn: Interpretation of SYSTEMD_CGROUP_CONTROLLER to the actual mount option is moved to mount_legacy_cgroup_hierarchy() so that it can take an appropriate action depending on the configuration of the host. v2: - CGroupUnified enum replaces open coded integer values to indicate the cgroup operation mode. - Various style updates. v3: Fixed a bug in detect_unified_cgroup_hierarchy() introduced during v2. v4: Restored legacy container on unified host support and fixed another bug in detect_unified_cgroup_hierarchy().
2016-08-15core: rename cg_unified() to cg_all_unified()Tejun Heo
A following patch will update cgroup handling so that the systemd controller (/sys/fs/cgroup/systemd) can use the unified hierarchy even if the kernel resource controllers are on the legacy hierarchies. This would require distinguishing whether all controllers are on cgroup v2 or only the systemd controller is. In preparation, this patch renames cg_unified() to cg_all_unified(). This patch doesn't cause any functional changes.
2016-07-11treewide: fix typos and remove accidental repetition of wordsTorstein Husebø
2016-03-26core: update populated event handling in unified hierarchyTejun Heo
Earlier during the development of unified hierarchy, the populated event was reported through by the dedicated "cgroup.populated" file; however, the interface was updated so that it's reported through the "populated" field of "cgroup.events" file. Update populated event handling logic accordingly.
2016-03-26cgroup2: use new fstype for unified hierarchyAlban Crequy
Since Linux v4.4-rc1, __DEVEL__sane_behavior does not exist anymore and is replaced by a new fstype "cgroup2". With this patch, systemd no longer supports the old (unstable) way of doing unified hierarchy with __DEVEL__sane_behavior and systemd now requires Linux v4.4 for unified hierarchy. Non-unified hierarchy is still the default and is unchanged by this patch. https://github.com/torvalds/linux/commit/67e9c74b8a873408c27ac9a8e4c1d1c8d72c93ff
2016-03-16nspawn: Fix two misspellings of "hierarchy" in error messagesTobias Klauser
2016-02-10tree-wide: remove Emacs lines from all filesDaniel Mack
This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.
2015-12-28nspawn: userns and unified cgroup: chown cgroup.eventsAlban Crequy
When starting a container in a new user namespace, systemd-nspawn chowns the cgroup knob files so they are usable by the container. But the cgroup knob file "cgroup.events" was missing. This file exists when the unified hierarchy is used.
2015-10-27util-lib: split out allocation calls into alloc-util.[ch]Lennart Poettering
2015-10-25util-lib: split out fd-related operations into fd-util.[ch]Lennart Poettering
There are more than enough to deserve their own .c file, hence move them over.
2015-10-24util-lib: split our string related calls from util.[ch] into its own file ↵Lennart Poettering
string-util.[ch] There are more than enough calls doing string manipulations to deserve its own files, hence do something about it. This patch also sorts the #include blocks of all files that needed to be updated, according to the sorting suggestions from CODING_STYLE. Since pretty much every file needs our string manipulation functions this effectively means that most files have sorted #include blocks now. Also touches a few unrelated include files.
2015-09-07nspawn: remove nspawn.h, it's empty nowLennart Poettering
2015-09-07nspawn: split out cgroup related calls into nspawn-cgroup.[ch]Lennart Poettering
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-26 19:02:29 +0000