mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-08-28 11:31:16 +00:00
Ensure systemd cgroup ownership is delegated to container with userns
This function is needed for user namespaces, where we need to chmod() the cgroup to the initial uid/gid such that systemd is allowed to use the cgroup. Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
parent
8ca5f46c59
commit
6fb42d7cdc
@ -1067,6 +1067,7 @@ virCgroupSetMemory;
|
|||||||
virCgroupSetMemoryHardLimit;
|
virCgroupSetMemoryHardLimit;
|
||||||
virCgroupSetMemorySoftLimit;
|
virCgroupSetMemorySoftLimit;
|
||||||
virCgroupSetMemSwapHardLimit;
|
virCgroupSetMemSwapHardLimit;
|
||||||
|
virCgroupSetOwner;
|
||||||
virCgroupSupportsCpuBW;
|
virCgroupSupportsCpuBW;
|
||||||
|
|
||||||
|
|
||||||
|
@ -484,6 +484,18 @@ virCgroupPtr virLXCCgroupCreate(virDomainDefPtr def)
|
|||||||
&cgroup) < 0)
|
&cgroup) < 0)
|
||||||
goto cleanup;
|
goto cleanup;
|
||||||
|
|
||||||
|
/* setup control group permissions for user namespace */
|
||||||
|
if (def->idmap.uidmap) {
|
||||||
|
if (virCgroupSetOwner(cgroup,
|
||||||
|
def->idmap.uidmap[0].target,
|
||||||
|
def->idmap.gidmap[0].target,
|
||||||
|
(1 << VIR_CGROUP_CONTROLLER_SYSTEMD)) < 0) {
|
||||||
|
virCgroupFree(&cgroup);
|
||||||
|
cgroup = NULL;
|
||||||
|
goto cleanup;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
cleanup:
|
cleanup:
|
||||||
return cgroup;
|
return cgroup;
|
||||||
}
|
}
|
||||||
|
@ -3608,6 +3608,76 @@ cleanup:
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
int virCgroupSetOwner(virCgroupPtr cgroup,
|
||||||
|
uid_t uid,
|
||||||
|
gid_t gid,
|
||||||
|
int controllers)
|
||||||
|
{
|
||||||
|
int ret = -1;
|
||||||
|
size_t i;
|
||||||
|
char *base = NULL, *entry = NULL;
|
||||||
|
DIR *dh = NULL;
|
||||||
|
|
||||||
|
for (i = 0; i < VIR_CGROUP_CONTROLLER_LAST; i++) {
|
||||||
|
struct dirent *de;
|
||||||
|
|
||||||
|
if (!((1 << i) & controllers))
|
||||||
|
continue;
|
||||||
|
|
||||||
|
if (!cgroup->controllers[i].mountPoint)
|
||||||
|
continue;
|
||||||
|
|
||||||
|
if (virAsprintf(&base, "%s%s", cgroup->controllers[i].mountPoint,
|
||||||
|
cgroup->controllers[i].placement) < 0)
|
||||||
|
goto cleanup;
|
||||||
|
|
||||||
|
if (!(dh = opendir(base))) {
|
||||||
|
virReportSystemError(errno,
|
||||||
|
_("Unable to open dir '%s'"), base);
|
||||||
|
goto cleanup;
|
||||||
|
}
|
||||||
|
|
||||||
|
while ((de = readdir(dh)) != NULL) {
|
||||||
|
if (STREQ(de->d_name, ".") ||
|
||||||
|
STREQ(de->d_name, ".."))
|
||||||
|
continue;
|
||||||
|
|
||||||
|
if (virAsprintf(&entry, "%s/%s", base, de->d_name) < 0)
|
||||||
|
goto cleanup;
|
||||||
|
|
||||||
|
if (chown(entry, uid, gid) < 0) {
|
||||||
|
virReportSystemError(errno,
|
||||||
|
_("cannot chown '%s' to (%u, %u)"),
|
||||||
|
entry, uid, gid);
|
||||||
|
goto cleanup;
|
||||||
|
}
|
||||||
|
|
||||||
|
VIR_FREE(entry);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (chown(base, uid, gid) < 0) {
|
||||||
|
virReportSystemError(errno,
|
||||||
|
_("cannot chown '%s' to (%u, %u)"),
|
||||||
|
base, uid, gid);
|
||||||
|
goto cleanup;
|
||||||
|
}
|
||||||
|
|
||||||
|
VIR_FREE(base);
|
||||||
|
closedir(dh);
|
||||||
|
dh = NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
ret = 0;
|
||||||
|
|
||||||
|
cleanup:
|
||||||
|
if (dh)
|
||||||
|
closedir(dh);
|
||||||
|
VIR_FREE(entry);
|
||||||
|
VIR_FREE(base);
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* virCgroupSupportsCpuBW():
|
* virCgroupSupportsCpuBW():
|
||||||
* Check whether the host supports CFS bandwidth.
|
* Check whether the host supports CFS bandwidth.
|
||||||
|
@ -249,4 +249,9 @@ int virCgroupIsolateMount(virCgroupPtr group,
|
|||||||
|
|
||||||
bool virCgroupSupportsCpuBW(virCgroupPtr cgroup);
|
bool virCgroupSupportsCpuBW(virCgroupPtr cgroup);
|
||||||
|
|
||||||
|
int virCgroupSetOwner(virCgroupPtr cgroup,
|
||||||
|
uid_t uid,
|
||||||
|
gid_t gid,
|
||||||
|
int controllers);
|
||||||
|
|
||||||
#endif /* __VIR_CGROUP_H__ */
|
#endif /* __VIR_CGROUP_H__ */
|
||||||
|
Loading…
Reference in New Issue
Block a user