<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Thu, May 29, 2014 at 10:58 AM, Serge Hallyn <span dir="ltr"><<a href="mailto:serge.hallyn@ubuntu.com" target="_blank">serge.hallyn@ubuntu.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="">Quoting Fajar A. Nugraha (<a href="mailto:list@fajar.net">list@fajar.net</a>):<br>
> On Thu, May 29, 2014 at 5:08 AM, Serge Hallyn <<a href="mailto:serge.hallyn@ubuntu.com">serge.hallyn@ubuntu.com</a>>wrote:<br>
</div><div class="">> > would systemd be happy with it being mounted by lxc using an<br>
> > lxc.mount.entry? I think that would be preferable to relaxing the<br>
> > apparmor policy. i.e.<br>
> ><br>
> > lxc.mount.entry = /sys/fs/cgroup/systemd sys/fs/cgroup/systemd none<br>
> > bind,create=dir,optional 0 0<br>
> ><br>
> ><br>
> Wouldn't that be shadowed by the container mounting its own /sys?<br>
<br>
</div>If lxc mounts /sys then systemd will leave it be.<br>
<div class=""><br></div></blockquote><div><br></div><div>Apparently that line alone doesn't work for me. I also had to add before that:</div><div><br></div><div><div>lxc.mount.entry = sysfs sys sysfs default 0 0</div>
<div>lxc.mount.entry = none sys/fs/cgroup tmpfs rw 0 0</div></div><div><br></div><div> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class="">
> Stephane also pointed out in my (closed) pull request that it would also<br>
> allow the container to mess with the hosts's resource allocation.<br>
<br>
</div>Yes, that's why lxc.mount.auto = cgroup:mixed is better. But the above<br>
mount entry is no worse than letting the container do it through<br>
apparmor.<br></blockquote><div><br></div><div>That does not work, apparently.</div><div><br></div><div>### in confing</div><div><div>lxc.mount.auto = cgroup:mixed</div><div>###<br></div></div><div><br></div><div>### lxc-start output</div>
<div><div><30>systemd[1]: Starting Root Slice.</div><div><27>systemd[1]: Caught <SEGV>, dumped core as pid 12.</div><div><30>systemd[1]: Freezing execution.</div></div><div>###</div><div><br></div>
<div>###</div><div># lxc-attach -n f20 -- mount</div><div>rpool/lxc on / type zfs (rw,noatime,xattr,noacl)</div><div>udev on /dev type devtmpfs (rw,relatime,size=2473540k,nr_inodes=618385,mode=755)</div><div>cgroup on /sys/fs/cgroup type tmpfs (rw,relatime,size=12k,mode=755)</div>
<div>none on /sys/fs/cgroup/cgmanager type tmpfs (rw,relatime,size=4k,mode=755)</div><div>devpts on /dev/lxc/console type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)</div><div>devpts on /dev/lxc/tty1 type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)</div>
<div>devpts on /dev/lxc/tty2 type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)</div><div>devpts on /dev/lxc/tty3 type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)</div><div>devpts on /dev/lxc/tty4 type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)</div>
<div>devpts on /dev/pts type devpts (rw,relatime,gid=5,mode=620,ptmxmode=666)</div><div>proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)</div><div>sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)</div><div>
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)</div><div>tmpfs on /run type tmpfs (rw,nosuid,nodev,mode=755)</div><div>tmpfs on /sys/fs/cgroup type tmpfs (rw,nosuid,nodev,noexec,mode=755)</div><div><div><br></div><div># lxc-attach -n f20 -- ls /sys/fs/cgroup/</div>
<div>blkio cpu,cpuacct cpuset devices freezer hugetlb memory perf_event systemd</div><div><br></div><div># lxc-attach -n f20 -- ls /sys/fs/cgroup/systemd</div></div><div>(no output)</div><div>###<br></div><div><br>
</div><div>It looks like there's two lines for /sys/fs/cgroup? I'm using trusty's lxc-1.0.3.</div><div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class=""><br>
> This works (at least, tested with console and ssh login), and should be<br>
> secure-enough (bind-mount the container subdir, instead of the whole<br>
> systemd cgroup), but complicated.<br>
><br>
> ### snippet of config<br>
> lxc.hook.mount = "/var/lib/lxc/f20/bin/create_container_systemd_cgroup"<br>
> lxc.hook.post-stop = "/var/lib/lxc/f20/bin/remove_container_systemd_cgroup"<br>
> ###<br>
><br>
> ### cat create_container_systemd_cgroup<br>
> #!/bin/bash<br>
> mkdir -p /sys/fs/cgroup/systemd/lxc/$LXC_NAME<br>
> mount -t sysfs sysfs $LXC_ROOTFS_MOUNT/sys<br>
> mount -t tmpfs none $LXC_ROOTFS_MOUNT/sys/fs/cgroup<br>
> mkdir $LXC_ROOTFS_MOUNT/sys/fs/cgroup/systemd<br>
> mount --bind /sys/fs/cgroup/systemd/lxc/$LXC_NAME<br>
> $LXC_ROOTFS_MOUNT/sys/fs/cgroup/systemd<br>
> ###<br>
><br>
> ### cat remove_container_systemd_cgroup<br>
> #!/bin/bash<br>
> [ -n "$LXC_NAME" ] && find /sys/fs/cgroup/systemd/lxc/$LXC_NAME -type d |<br>
> tac | xargs rmdir<br>
> ###<br>
><br>
> Is there a way to simplify this somehow for it to be more suitable in the<br>
> template?<br>
<br>
</div>I suppose we could add a new a lxc.mount.auto = cgroup:systemd option which<br>
only mounts name=systemd, read-only except for the container's own cgroup<br>
which is rw? But when I say we I don't really mean we :)<br>
</blockquote></div><br></div><div class="gmail_extra"><br></div><div class="gmail_extra">Will that work?</div><div class="gmail_extra"><br></div><div class="gmail_extra">systemd cgroup mount is weird in a sense that there's no /lxc/CONTAINER_NAME subdirs under /sys/fs/cgroup/systemd, while there's one under /sys/fs/crgoup/{blkio,cpu,etc}. So for systemd cgroup I don't see which ones should be mount ro and which gets rw.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">The workaround hook I wrote earlier creates the directory /sys/fs/cgroup/systemd/lxc/CONTAINER_NAME on the host, and bind-mount it as the container's /sys/fs/cgroup/systemd.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">-- </div><div class="gmail_extra">Fajar</div></div>