From 310c5654023cd224f4c016872e39335b1b3ac603 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 13 Nov 2014 14:34:42 +0100
Subject: [PATCH] core: introduce new Delegate=yes/no property controlling
creation of cgroup subhierarchies
For priviliged units this resource control property ensures that the
processes have all controllers systemd manages enabled.
For unpriviliged services (those with User= set) this ensures that
access rights to the service cgroup is granted to the user in question,
to create further subgroups. Note that this only applies to the
name=systemd hierarchy though, as access to other controllers is not
safe for unpriviliged processes.
Delegate=yes should be set for container scopes where a systemd instance
inside the container shall manage the hierarchies below its own cgroup
and have access to all controllers.
Delegate=yes should also be set for user@.service, so that systemd
--user can run, controlling its own cgroup tree.
This commit changes machined, systemd-nspawn@.service and user@.service
to set this boolean, in order to ensure that container management will
just work, and the user systemd instance can run fine.
(cherry picked from a931ad47a8623163a29d898224d8a8c1177ffdaf)
Resolves: #1139223
---
man/systemd.resource-control.xml | 14 ++++++++++++
src/core/cgroup.c | 19 +++++++++++++++--
src/core/cgroup.h | 2 ++
src/core/dbus-cgroup.c | 40 +++++++++++++++++++++++++++++++++++
src/core/execute.c | 23 +++++++++++++++++---
src/core/execute.h | 2 ++
src/core/load-fragment-gperf.gperf.m4 | 3 ++-
src/core/mount.c | 1 +
src/core/service.c | 1 +
src/core/socket.c | 1 +
src/core/swap.c | 1 +
src/machine/machined-dbus.c | 10 +++++++++
src/shared/cgroup-util.h | 3 ++-
units/systemd-nspawn@.service.in | 1 +
14 files changed, 114 insertions(+), 7 deletions(-)
diff --git a/man/systemd.resource-control.xml b/man/systemd.resource-control.xml
index 8688905..3748c0c 100644
--- a/man/systemd.resource-control.xml
+++ b/man/systemd.resource-control.xml
@@ -327,6 +327,20 @@ along with systemd; If not, see <http://www.gnu.org/licenses/>.
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><varname>Delegate=</varname></term>
+
+ <listitem>
+ <para>Turns on delegation of further resource control
+ partitioning to processes of the unit. For unpriviliged
+ services (i.e. those using the <varname>User=</varname>
+ setting) this allows processes to create a subhierarchy
+ beneath its control group path. For priviliged services and
+ scopes this ensures the processes will have all control
+ group controllers enabled.</para>
+ </listitem>
+ </varlistentry>
+
</variablelist>
</refsect1>
diff --git a/src/core/cgroup.c b/src/core/cgroup.c
index c215a86..443937b 100644
--- a/src/core/cgroup.c
+++ b/src/core/cgroup.c
@@ -94,14 +94,16 @@ void cgroup_context_dump(CGroupContext *c, FILE* f, const char *prefix) {
"%sCPUShares=%lu\n"
"%sBlockIOWeight=%lu\n"
"%sMemoryLimit=%" PRIu64 "\n"
- "%sDevicePolicy=%s\n",
+ "%sDevicePolicy=%s\n"
+ "%sDelegate=%s\n",
prefix, yes_no(c->cpu_accounting),
prefix, yes_no(c->blockio_accounting),
prefix, yes_no(c->memory_accounting),
prefix, c->cpu_shares,
prefix, c->blockio_weight,
prefix, c->memory_limit,
- prefix, cgroup_device_policy_to_string(c->device_policy));
+ prefix, cgroup_device_policy_to_string(c->device_policy),
+ prefix, yes_no(c->delegate));
LIST_FOREACH(device_allow, a, c->device_allow)
fprintf(f,
@@ -342,6 +344,19 @@ static CGroupControllerMask unit_get_cgroup_mask(Unit *u) {
if (!c)
return 0;
+ /* If delegation is turned on, then turn on all cgroups,
+ * unless the process we fork into it is known to drop
+ * privileges anyway, and shouldn't get access to the
+ * controllers anyway. */
+
+ if (c->delegate) {
+ ExecContext *e;
+
+ e = unit_get_exec_context(u);
+ if (!e || exec_context_maintains_privileges(e))
+ return _CGROUP_CONTROLLER_MASK_ALL;
+ }
+
return cgroup_context_get_mask(c);
}
diff --git a/src/core/cgroup.h b/src/core/cgroup.h
index 0a079e9..d00bcac 100644
--- a/src/core/cgroup.h
+++ b/src/core/cgroup.h
@@ -80,6 +80,8 @@ struct CGroupContext {
CGroupDevicePolicy device_policy;
LIST_HEAD(CGroupDeviceAllow, device_allow);
+
+ bool delegate;
};
#include "unit.h"
diff --git a/src/core/dbus-cgroup.c b/src/core/dbus-cgroup.c
index 9ebcad9..a13c869 100644
--- a/src/core/dbus-cgroup.c
+++ b/src/core/dbus-cgroup.c
@@ -124,6 +124,7 @@ static int bus_cgroup_append_device_allow(DBusMessageIter *i, const char *proper
}
const BusProperty bus_cgroup_context_properties[] = {
+ { "Delegate", bus_property_append_bool, "b", offsetof(CGroupContext, delegate) },
{ "CPUAccounting", bus_property_append_bool, "b", offsetof(CGroupContext, cpu_accounting) },
{ "CPUShares", bus_property_append_ul, "t", offsetof(CGroupContext, cpu_shares) },
{ "BlockIOAccounting", bus_property_append_bool, "b", offsetof(CGroupContext, blockio_accounting) },
@@ -138,6 +139,38 @@ const BusProperty bus_cgroup_context_properties[] = {
{}
};
+static int bus_cgroup_set_transient_property(
+ Unit *u,
+ CGroupContext *c,
+ const char *name,
+ DBusMessageIter *i,
+ UnitSetPropertiesMode mode,
+ DBusError *error) {
+
+ assert(u);
+ assert(c);
+ assert(name);
+ assert(i);
+
+ if (streq(name, "Delegate")) {
+
+ if (dbus_message_iter_get_arg_type(i) != DBUS_TYPE_BOOLEAN)
+ return -EINVAL;
+
+ if (mode != UNIT_CHECK) {
+ dbus_bool_t b;
+
+ dbus_message_iter_get_basic(i, &b);
+ c->delegate = b;
+ unit_write_drop_in_private(u, mode, name, b ? "Delegate=yes" : "Delegate=no");
+ }
+
+ return 1;
+ }
+
+ return 0;
+}
+
int bus_cgroup_set_property(
Unit *u,
CGroupContext *c,
@@ -550,5 +583,12 @@ int bus_cgroup_set_property(
return 1;
}
+ if (u->transient && u->load_state == UNIT_STUB) {
+ int r;
+ r = bus_cgroup_set_transient_property(u, c, name, i, mode, error);
+ if (r != 0)
+ return r;
+ }
+
return 0;
}
diff --git a/src/core/execute.c b/src/core/execute.c
index 06713cc..d814c39 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -1042,6 +1042,7 @@ int exec_spawn(ExecCommand *command,
bool selinux_context_net,
CGroupControllerMask cgroup_supported,
const char *cgroup_path,
+ bool cgroup_delegate,
const char *unit_id,
int idle_pipe[4],
pid_t *ret) {
@@ -1306,8 +1307,10 @@ int exec_spawn(ExecCommand *command,
}
}
-#ifdef HAVE_PAM
- if (cgroup_path && context->user && context->pam_name) {
+ /* If delegation is enabled we'll pass ownership of the cgroup
+ * (but only in systemd's own controller hierarchy!) to the
+ * user of the new process. */
+ if (cgroup_path && context->user && cgroup_delegate) {
err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0644, uid, gid);
if (err < 0) {
r = EXIT_CGROUP;
@@ -1321,7 +1324,6 @@ int exec_spawn(ExecCommand *command,
goto fail_child;
}
}
-#endif
if (apply_permissions) {
err = enforce_groups(context, username, gid);
@@ -2116,6 +2118,21 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
}
+bool exec_context_maintains_privileges(ExecContext *c) {
+ assert(c);
+
+ /* Returns true if the process forked off would run under
+ * an unchanged UID or as root. */
+
+ if (!c->user)
+ return true;
+
+ if (streq(c->user, "root") || streq(c->user, "0"))
+ return true;
+
+ return false;
+}
+
void exec_status_start(ExecStatus *s, pid_t pid) {
assert(s);
diff --git a/src/core/execute.h b/src/core/execute.h
index b66bd5f..03afdf3 100644
--- a/src/core/execute.h
+++ b/src/core/execute.h
@@ -177,6 +177,7 @@ int exec_spawn(ExecCommand *command,
bool selinux_context_net,
CGroupControllerMask cgroup_mask,
const char *cgroup_path,
+ bool cgroup_delegate,
const char *unit_id,
int pipe_fd[2],
pid_t *ret);
@@ -203,6 +204,7 @@ void exec_context_tty_reset(const ExecContext *context);
int exec_context_load_environment(const ExecContext *c, const char *unit_id, char ***l);
bool exec_context_may_touch_console(ExecContext *c);
+bool exec_context_maintains_privileges(ExecContext *c);
void exec_context_serialize(const ExecContext *c, Unit *u, FILE *f);
void exec_status_start(ExecStatus *s, pid_t pid);
diff --git a/src/core/load-fragment-gperf.gperf.m4 b/src/core/load-fragment-gperf.gperf.m4
index ee7cd5d..c6eb757 100644
--- a/src/core/load-fragment-gperf.gperf.m4
+++ b/src/core/load-fragment-gperf.gperf.m4
@@ -96,7 +96,8 @@ $1.BlockIOAccounting, config_parse_bool, 0,
$1.BlockIOWeight, config_parse_blockio_weight, 0, offsetof($1, cgroup_context)
$1.BlockIODeviceWeight, config_parse_blockio_device_weight, 0, offsetof($1, cgroup_context)
$1.BlockIOReadBandwidth, config_parse_blockio_bandwidth, 0, offsetof($1, cgroup_context)
-$1.BlockIOWriteBandwidth, config_parse_blockio_bandwidth, 0, offsetof($1, cgroup_context)'
+$1.BlockIOWriteBandwidth, config_parse_blockio_bandwidth, 0, offsetof($1, cgroup_context)
+$1.Delegate, config_parse_bool, 0, offsetof($1, cgroup_context.delegate)'
)m4_dnl
Unit.Description, config_parse_unit_string_printf, 0, offsetof(Unit, description)
Unit.Documentation, config_parse_documentation, 0, offsetof(Unit, documentation)
diff --git a/src/core/mount.c b/src/core/mount.c
index bbceb92..a9cd28b 100644
--- a/src/core/mount.c
+++ b/src/core/mount.c
@@ -794,6 +794,7 @@ static int mount_spawn(Mount *m, ExecCommand *c, pid_t *_pid) {
false,
UNIT(m)->manager->cgroup_supported,
UNIT(m)->cgroup_path,
+ m->cgroup_context.delegate,
UNIT(m)->id,
NULL,
&pid);
diff --git a/src/core/service.c b/src/core/service.c
index 635a953..5fd69cf 100644
--- a/src/core/service.c
+++ b/src/core/service.c
@@ -1870,6 +1870,7 @@ static int service_spawn(
s->socket_fd_selinux_context_net,
UNIT(s)->manager->cgroup_supported,
path,
+ s->cgroup_context.delegate,
UNIT(s)->id,
s->type == SERVICE_IDLE ? UNIT(s)->manager->idle_pipe : NULL,
&pid);
diff --git a/src/core/socket.c b/src/core/socket.c
index 1a91700..f7fffbe 100644
--- a/src/core/socket.c
+++ b/src/core/socket.c
@@ -1237,6 +1237,7 @@ static int socket_spawn(Socket *s, ExecCommand *c, pid_t *_pid) {
false,
UNIT(s)->manager->cgroup_supported,
UNIT(s)->cgroup_path,
+ s->cgroup_context.delegate,
UNIT(s)->id,
NULL,
&pid);
diff --git a/src/core/swap.c b/src/core/swap.c
index 36ef88b..152a080 100644
--- a/src/core/swap.c
+++ b/src/core/swap.c
@@ -592,6 +592,7 @@ static int swap_spawn(Swap *s, ExecCommand *c, pid_t *_pid) {
false,
UNIT(s)->manager->cgroup_supported,
UNIT(s)->cgroup_path,
+ s->cgroup_context.delegate,
UNIT(s)->id,
NULL,
&pid);
diff --git a/src/machine/machined-dbus.c b/src/machine/machined-dbus.c
index 22caadf..0cebdc5 100644
--- a/src/machine/machined-dbus.c
+++ b/src/machine/machined-dbus.c
@@ -739,9 +739,11 @@ int manager_start_scope(
DBusMessageIter iter, sub, sub2, sub3, sub4;
const char *timeout_stop_property = "TimeoutStopUSec";
const char *pids_property = "PIDs";
+ const char *delegate_property = "Delegate";
uint64_t timeout = 500 * USEC_PER_MSEC;
const char *fail = "fail";
uint32_t u;
+ dbus_bool_t b = 1;
int r;
assert(manager);
@@ -814,6 +816,14 @@ int manager_start_scope(
!dbus_message_iter_close_container(&sub, &sub2))
return log_oom();
+ if (!dbus_message_iter_open_container(&sub, DBUS_TYPE_STRUCT, NULL, &sub2) ||
+ !dbus_message_iter_append_basic(&sub2, DBUS_TYPE_STRING, &delegate_property) ||
+ !dbus_message_iter_open_container(&sub2, DBUS_TYPE_VARIANT, "b", &sub3) ||
+ !dbus_message_iter_append_basic(&sub3, DBUS_TYPE_BOOLEAN, &b) ||
+ !dbus_message_iter_close_container(&sub2, &sub3) ||
+ !dbus_message_iter_close_container(&sub, &sub2))
+ return log_oom();
+
if (more_properties) {
r = copy_many_fields(&sub, more_properties);
if (r < 0)
diff --git a/src/shared/cgroup-util.h b/src/shared/cgroup-util.h
index 0963450..0608b9a 100644
--- a/src/shared/cgroup-util.h
+++ b/src/shared/cgroup-util.h
@@ -34,7 +34,8 @@ typedef enum CGroupControllerMask {
CGROUP_CPUACCT = 2,
CGROUP_BLKIO = 4,
CGROUP_MEMORY = 8,
- CGROUP_DEVICE = 16
+ CGROUP_DEVICE = 16,
+ _CGROUP_CONTROLLER_MASK_ALL = 31
} CGroupControllerMask;
/*
diff --git a/units/systemd-nspawn@.service.in b/units/systemd-nspawn@.service.in
index 8e00736..bdfa89f 100644
--- a/units/systemd-nspawn@.service.in
+++ b/units/systemd-nspawn@.service.in
@@ -12,6 +12,7 @@ Documentation=man:systemd-nspawn(1)
[Service]
ExecStart=@bindir@/systemd-nspawn -bjD /var/lib/container/%i
Type=notify
+Delegate=yes
[Install]
WantedBy=multi-user.target