picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

nspawn: when in hybrid mode, chown() both the legacy and the unified hierarchy to the root in the container

Browse source 
If user namespacing is used, let's make sure that the root user in the
container gets access to both /sys/fs/cgroup/systemd and
/sys/fs/cgroup/unified.

This matches similar logic in cg_set_access().
This commit is contained in:
Lennart Poettering 2017-11-28 17:58:00 +01:00
parent 2d3a5a73e0
commit de54e02d5e
3 changed files with 16 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
src/nspawn/nspawn-cgroup.c
View file

@ -57,7 +57,7 @@ static int chown_cgroup_path(const char *path, uid_t uid_shift) {
return 0;
}
int chown_cgroup(pid_t pid, uid_t uid_shift) {
int chown_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t uid_shift) {
_cleanup_free_ char *path = NULL, *fs = NULL;
int r;
@ -73,6 +73,19 @@ int chown_cgroup(pid_t pid, uid_t uid_shift) {
if (r < 0)
return log_error_errno(r, "Failed to chown() cgroup %s: %m", fs);
if (unified_requested == CGROUP_UNIFIED_SYSTEMD) {
_cleanup_free_ char *lfs = NULL;
/* Always propagate access rights from unified to legacy controller */
r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER_LEGACY, path, NULL, &lfs);
if (r < 0)
return log_error_errno(r, "Failed to get file system path for container cgroup: %m");
r = chown_cgroup_path(lfs, uid_shift);
if (r < 0)
return log_error_errno(r, "Failed to chown() cgroup %s: %m", lfs);
}
return 0;
}

2
src/nspawn/nspawn-cgroup.h
View file

@ -25,6 +25,6 @@
#include "cgroup-util.h"
int chown_cgroup(pid_t pid, uid_t uid_shift);
int chown_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t uid_shift);
int sync_cgroup(pid_t pid, CGroupUnified unified_requested, uid_t uid_shift);
int create_subcgroup(pid_t pid, CGroupUnified unified_requested);

2
src/nspawn/nspawn.c
View file

@ -3619,7 +3619,7 @@ static int run(int master,
return r;
}
r = chown_cgroup(*pid, arg_uid_shift);
r = chown_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
if (r < 0)
return r;