[lxc-devel] [lxc/master] cgroups: enable container without CAP_SYS_ADMIN
brauner on Github
lxc-bot at linuxcontainers.org
Mon Oct 30 13:35:29 UTC 2017
A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 589 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20171030/dcbf516b/attachment.bin>
-------------- next part --------------
From cdfe90a49f516b0f1210d181980f14a4765e10da Mon Sep 17 00:00:00 2001
From: Christian Brauner <christian.brauner at ubuntu.com>
Date: Mon, 30 Oct 2017 14:17:20 +0100
Subject: [PATCH 1/2] cgfsng: fix cgroup2 detection
Signed-off-by: Christian Brauner <christian.brauner at ubuntu.com>
---
src/lxc/cgroups/cgfsng.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
index 897336f07..e43edd7d4 100644
--- a/src/lxc/cgroups/cgfsng.c
+++ b/src/lxc/cgroups/cgfsng.c
@@ -815,7 +815,7 @@ static void add_controller(char **clist, char *mountpoint, char *base_cgroup)
new->fullcgpath = NULL;
/* record if this is the cgroup v2 hierarchy */
- if (!strcmp(base_cgroup, "cgroup2"))
+ if (clist && !strcmp(*clist, "cgroup2"))
new->is_cgroup_v2 = true;
else
new->is_cgroup_v2 = false;
From b635e92d21d2a4d71a553388f18cfa08f44bf1ba Mon Sep 17 00:00:00 2001
From: Christian Brauner <christian.brauner at ubuntu.com>
Date: Mon, 30 Oct 2017 14:16:46 +0100
Subject: [PATCH 2/2] cgroups: enable container without CAP_SYS_ADMIN
In case cgroup namespaces are supported but we do not have CAP_SYS_ADMIN we
need to mount cgroups for the container. This patch enables both privileged and
unprivileged containers without CAP_SYS_ADMIN.
Closes #1737.
Signed-off-by: Christian Brauner <christian.brauner at ubuntu.com>
---
src/lxc/cgroups/cgfs.c | 3 ++-
src/lxc/cgroups/cgfsng.c | 52 +++++++++++++++++++++++++++++++++++++++++++++---
src/lxc/cgroups/cgroup.c | 2 +-
src/lxc/conf.c | 3 ---
src/lxc/conf.h | 1 +
5 files changed, 53 insertions(+), 8 deletions(-)
diff --git a/src/lxc/cgroups/cgfs.c b/src/lxc/cgroups/cgfs.c
index bcbd66134..efd627f04 100644
--- a/src/lxc/cgroups/cgfs.c
+++ b/src/lxc/cgroups/cgfs.c
@@ -1418,11 +1418,12 @@ static bool cgroupfs_mount_cgroup(void *hdata, const char *root, int type)
struct cgfs_data *cgfs_d;
struct cgroup_process_info *info, *base_info;
int r, saved_errno = 0;
+ struct lxc_handler *handler = hdata;
if (cgns_supported())
return true;
- cgfs_d = hdata;
+ cgfs_d = handler->cgroup_data;
if (!cgfs_d)
return false;
base_info = cgfs_d->info;
diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
index e43edd7d4..ec6440c13 100644
--- a/src/lxc/cgroups/cgfsng.c
+++ b/src/lxc/cgroups/cgfsng.c
@@ -50,6 +50,7 @@
#include <linux/types.h>
#include <linux/kdev_t.h>
+#include "caps.h"
#include "cgroup.h"
#include "cgroup_utils.h"
#include "commands.h"
@@ -1616,17 +1617,49 @@ do_secondstage_mounts_if_needed(int type, struct hierarchy *h,
return 0;
}
+static int mount_cgroup_cgns_supported(struct hierarchy *h, const char *controllerpath)
+{
+ int ret;
+ char *controllers = NULL;
+ char *type = "cgroup2";
+
+ if (!h->is_cgroup_v2) {
+ controllers = lxc_string_join(",", (const char **)h->controllers, false);
+ if (!controllers)
+ return -ENOMEM;
+ type = "cgroup";
+ }
+
+ ret = mount("cgroup", controllerpath, type, MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RELATIME, controllers);
+ free(controllers);
+ if (ret < 0) {
+ SYSERROR("Failed to mount %s with cgroup filesystem type %s", controllerpath, type);
+ return -1;
+ }
+
+ DEBUG("Mounted %s with cgroup filesystem type %s", controllerpath, type);
+ return 0;
+}
+
static bool cgfsng_mount(void *hdata, const char *root, int type)
{
- struct cgfsng_handler_data *d = hdata;
+ int i;
char *tmpfspath = NULL;
bool retval = false;
- int i;
+ struct lxc_handler *handler = hdata;
+ struct cgfsng_handler_data *d = handler->cgroup_data;
+ bool has_cgns = false, has_sys_admin = true;
if ((type & LXC_AUTO_CGROUP_MASK) == 0)
return true;
- if (cgns_supported())
+ has_cgns = cgns_supported();
+ if (!lxc_list_empty(&handler->conf->keepcaps))
+ has_sys_admin = in_caplist(CAP_SYS_ADMIN, &handler->conf->keepcaps);
+ else
+ has_sys_admin = !in_caplist(CAP_SYS_ADMIN, &handler->conf->caps);
+
+ if (has_cgns && has_sys_admin)
return true;
tmpfspath = must_make_path(root, "/sys/fs/cgroup", NULL);
@@ -1662,6 +1695,19 @@ static bool cgfsng_mount(void *hdata, const char *root, int type)
free(controllerpath);
goto bad;
}
+
+ if (has_cgns && !has_sys_admin) {
+ /* If cgroup namespaces are supported but the container
+ * will not have CAP_SYS_ADMIN after it has started we
+ * need to mount the cgroups manually.
+ */
+ r = mount_cgroup_cgns_supported(h, controllerpath);
+ free(controllerpath);
+ if (r < 0)
+ goto bad;
+ continue;
+ }
+
if (mount_cgroup_full(type, h, controllerpath, d->container_cgroup) < 0) {
free(controllerpath);
goto bad;
diff --git a/src/lxc/cgroups/cgroup.c b/src/lxc/cgroups/cgroup.c
index 674e30905..36a665b1c 100644
--- a/src/lxc/cgroups/cgroup.c
+++ b/src/lxc/cgroups/cgroup.c
@@ -166,7 +166,7 @@ bool cgroup_chown(struct lxc_handler *handler)
bool cgroup_mount(const char *root, struct lxc_handler *handler, int type)
{
if (ops)
- return ops->mount_cgroup(handler->cgroup_data, root, type);
+ return ops->mount_cgroup(handler, root, type);
return false;
}
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index d2fab9450..44d978430 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -210,9 +210,6 @@ __thread struct lxc_conf *current_config;
struct lxc_conf *current_config;
#endif
-/* Declare this here, since we don't want to reshuffle the whole file. */
-static int in_caplist(int cap, struct lxc_list *caps);
-
static struct mount_opt mount_opt[] = {
{ "async", 1, MS_SYNCHRONOUS },
{ "atime", 1, MS_NOATIME },
diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index c61f861ed..63e71e2d8 100644
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -402,5 +402,6 @@ extern unsigned long add_required_remount_flags(const char *s, const char *d,
unsigned long flags);
extern int run_script(const char *name, const char *section, const char *script,
...);
+extern int in_caplist(int cap, struct lxc_list *caps);
#endif /* __LXC_CONF_H */
More information about the lxc-devel
mailing list