#include "alloc-util.h"
//#include "blockdev-util.h"
//#include "bpf-firewall.h"
+//#include "bus-error.h"
#include "cgroup-util.h"
#include "cgroup.h"
#include "fd-util.h"
}
static void cgroup_apply_firewall(Unit *u) {
- int r;
-
assert(u);
- if (u->type == UNIT_SLICE) /* Skip this for slice units, they are inner cgroup nodes, and since bpf/cgroup is
- * not recursive we don't ever touch the bpf on them */
- return;
+ /* Best-effort: let's apply IP firewalling and/or accounting if that's enabled */
- r = bpf_firewall_compile(u);
- if (r < 0)
+ if (bpf_firewall_compile(u) < 0)
return;
(void) bpf_firewall_install(u);
- return;
}
static void cgroup_context_apply(
*
* Note that on the unified hierarchy it is safe to delegate controllers to unprivileged services. */
- if (u->type == UNIT_SLICE)
- return 0;
-
- c = unit_get_cgroup_context(u);
- if (!c)
- return 0;
-
- if (!c->delegate)
+ if (!unit_cgroup_delegate(u))
return 0;
if (cg_all_unified() <= 0) {
return 0;
}
+ assert_se(c = unit_get_cgroup_context(u));
return c->delegate_controllers;
}
Unit *p;
assert(u);
- /* We never attach BPF to slice units, as they are inner cgroup nodes and cgroup/BPF is not recursive at the
- * moment. */
- if (u->type == UNIT_SLICE)
- return false;
-
c = unit_get_cgroup_context(u);
if (!c)
return false;
}
}
-static const char *migrate_callback(CGroupMask mask, void *userdata) {
- Unit *u = userdata;
+const char *unit_get_realized_cgroup_path(Unit *u, CGroupMask mask) {
- assert(mask != 0);
- assert(u);
+ /* Returns the realized cgroup path of the specified unit where all specified controllers are available. */
while (u) {
+
if (u->cgroup_path &&
u->cgroup_realized &&
(u->cgroup_realized_mask & mask) == mask)
return NULL;
}
+static const char *migrate_callback(CGroupMask mask, void *userdata) {
+ return unit_get_realized_cgroup_path(userdata, mask);
+}
+
char *unit_default_cgroup_path(Unit *u) {
_cleanup_free_ char *escaped = NULL, *slice = NULL;
int r;
u->cgroup_enabled_mask = enable_mask;
u->cgroup_bpf_state = needs_bpf ? UNIT_CGROUP_BPF_ON : UNIT_CGROUP_BPF_OFF;
- if (u->type != UNIT_SLICE && !c->delegate) {
+ if (u->type != UNIT_SLICE && !unit_cgroup_delegate(u)) {
/* Then, possibly move things over, but not if
* subgroups may contain processes, which is the case
return 0;
}
-int unit_attach_pids_to_cgroup(Unit *u) {
+static int unit_attach_pid_to_cgroup_via_bus(Unit *u, pid_t pid, const char *suffix_path) {
+ _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
+ char *pp;
int r;
+
assert(u);
- r = unit_realize_cgroup(u);
+ if (MANAGER_IS_SYSTEM(u->manager))
+ return -EINVAL;
+
+ if (!u->manager->system_bus)
+ return -EIO;
+
+ if (!u->cgroup_path)
+ return -EINVAL;
+
+ /* Determine this unit's cgroup path relative to our cgroup root */
+ pp = path_startswith(u->cgroup_path, u->manager->cgroup_root);
+ if (!pp)
+ return -EINVAL;
+
+ pp = strjoina("/", pp, suffix_path);
+ path_kill_slashes(pp);
+
+ r = sd_bus_call_method(u->manager->system_bus,
+ "org.freedesktop.systemd1",
+ "/org/freedesktop/systemd1",
+ "org.freedesktop.systemd1.Manager",
+ "AttachProcessesToUnit",
+ &error, NULL,
+ "ssau",
+ NULL /* empty unit name means client's unit, i.e. us */, pp, 1, (uint32_t) pid);
if (r < 0)
- return r;
+ return log_unit_debug_errno(u, r, "Failed to attach unit process " PID_FMT " via the bus: %s", pid, bus_error_message(&error, r));
+
+ return 0;
+}
+
+int unit_attach_pids_to_cgroup(Unit *u, Set *pids, const char *suffix_path) {
+ CGroupMask delegated_mask;
+ const char *p;
+ Iterator i;
+ void *pidp;
+ int r, q;
+
+ assert(u);
+
+ if (!UNIT_HAS_CGROUP_CONTEXT(u))
+ return -EINVAL;
+
+ if (set_isempty(pids))
+ return 0;
- r = cg_attach_many_everywhere(u->manager->cgroup_supported, u->cgroup_path, u->pids, migrate_callback, u);
+ r = unit_realize_cgroup(u);
if (r < 0)
return r;
- return 0;
+ if (isempty(suffix_path))
+ p = u->cgroup_path;
+ else
+ p = strjoina(u->cgroup_path, "/", suffix_path);
+
+ delegated_mask = unit_get_delegate_mask(u);
+
+ r = 0;
+ SET_FOREACH(pidp, pids, i) {
+ pid_t pid = PTR_TO_PID(pidp);
+ CGroupController c;
+
+ /* First, attach the PID to the main cgroup hierarchy */
+ q = cg_attach(SYSTEMD_CGROUP_CONTROLLER, p, pid);
+ if (q < 0) {
+ log_unit_debug_errno(u, q, "Couldn't move process " PID_FMT " to requested cgroup '%s': %m", pid, p);
+
+ if (MANAGER_IS_USER(u->manager) && IN_SET(q, -EPERM, -EACCES)) {
+ int z;
+
+ /* If we are in a user instance, and we can't move the process ourselves due to
+ * permission problems, let's ask the system instance about it instead. Since it's more
+ * privileged it might be able to move the process across the leaves of a subtree who's
+ * top node is not owned by us. */
+
+ z = unit_attach_pid_to_cgroup_via_bus(u, pid, suffix_path);
+ if (z < 0)
+ log_unit_debug_errno(u, z, "Couldn't move process " PID_FMT " to requested cgroup '%s' via the system bus either: %m", pid, p);
+ else
+ continue; /* When the bus thing worked via the bus we are fully done for this PID. */
+ }
+
+ if (r >= 0)
+ r = q; /* Remember first error */
+
+ continue;
+ }
+
+ q = cg_all_unified();
+ if (q < 0)
+ return q;
+ if (q > 0)
+ continue;
+
+ /* In the legacy hierarchy, attach the process to the request cgroup if possible, and if not to the
+ * innermost realized one */
+
+ for (c = 0; c < _CGROUP_CONTROLLER_MAX; c++) {
+ CGroupMask bit = CGROUP_CONTROLLER_TO_MASK(c);
+ const char *realized;
+
+ if (!(u->manager->cgroup_supported & bit))
+ continue;
+
+ /* If this controller is delegated and realized, honour the caller's request for the cgroup suffix. */
+ if (delegated_mask & u->cgroup_realized_mask & bit) {
+ q = cg_attach(cgroup_controller_to_string(c), p, pid);
+ if (q >= 0)
+ continue; /* Success! */
+
+ log_unit_debug_errno(u, q, "Failed to attach PID " PID_FMT " to requested cgroup %s in controller %s, falling back to unit's cgroup: %m",
+ pid, p, cgroup_controller_to_string(c));
+ }
+
+ /* So this controller is either not delegate or realized, or something else weird happened. In
+ * that case let's attach the PID at least to the closest cgroup up the tree that is
+ * realized. */
+ realized = unit_get_realized_cgroup_path(u, bit);
+ if (!realized)
+ continue; /* Not even realized in the root slice? Then let's not bother */
+
+ q = cg_attach(cgroup_controller_to_string(c), realized, pid);
+ if (q < 0)
+ log_unit_debug_errno(u, q, "Failed to attach PID " PID_FMT " to realized cgroup %s in controller %s, ignoring: %m",
+ pid, realized, cgroup_controller_to_string(c));
+ }
+ }
+
+ return r;
}
static void cgroup_xattr_apply(Unit *u) {
assert(metric < _CGROUP_IP_ACCOUNTING_METRIC_MAX);
assert(ret);
- /* IP accounting is currently not recursive, and hence we refuse to return any data for slice nodes. Slices are
- * inner cgroup nodes and hence have no processes directly attached, hence their counters would be zero
- * anyway. And if we block this now we can later open this up, if the kernel learns recursive BPF cgroup
- * filters. */
- if (u->type == UNIT_SLICE)
- return -ENODATA;
-
if (!UNIT_CGROUP_BOOL(u, ip_accounting))
return -ENODATA;
}
}
+bool unit_cgroup_delegate(Unit *u) {
+ CGroupContext *c;
+
+ assert(u);
+
+ if (!UNIT_VTABLE(u)->can_delegate)
+ return false;
+
+ c = unit_get_cgroup_context(u);
+ if (!c)
+ return false;
+
+ return c->delegate;
+}
+
void manager_invalidate_startup_units(Manager *m) {
Iterator i;
Unit *u;
void unit_update_cgroup_members_masks(Unit *u);
+const char *unit_get_realized_cgroup_path(Unit *u, CGroupMask mask);
char *unit_default_cgroup_path(Unit *u);
int unit_set_cgroup_path(Unit *u, const char *path);
int unit_pick_cgroup_path(Unit *u);
void unit_add_to_cgroup_empty_queue(Unit *u);
-int unit_attach_pids_to_cgroup(Unit *u);
+int unit_attach_pids_to_cgroup(Unit *u, Set *pids, const char *suffix_path);
#else
# include "logind.h"
#endif // 0
const char* cgroup_device_policy_to_string(CGroupDevicePolicy i) _const_;
CGroupDevicePolicy cgroup_device_policy_from_string(const char *s) _pure_;
+
+bool unit_cgroup_delegate(Unit *u);
#endif // 0
+++ /dev/null
-/* SPDX-License-Identifier: LGPL-2.1+ */
-/***
- This file is part of systemd.
-
- Copyright 2010 Lennart Poettering
-
- systemd is free software; you can redistribute it and/or modify it
- under the terms of the GNU Lesser General Public License as published by
- the Free Software Foundation; either version 2.1 of the License, or
- (at your option) any later version.
-
- systemd is distributed in the hope that it will be useful, but
- WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- Lesser General Public License for more details.
-
- You should have received a copy of the GNU Lesser General Public License
- along with systemd; If not, see <http://www.gnu.org/licenses/>.
-***/
-
-//#include "bus-util.h"
-//#include "dbus-util.h"
-//#include "parse-util.h"
-//#include "path-util.h"
-//#include "unit-printf.h"
-//#include "user-util.h"
-//#include "unit.h"
-
-BUS_DEFINE_SET_TRANSIENT(mode_t, "u", uint32_t, mode_t, "%040o");
-BUS_DEFINE_SET_TRANSIENT(unsigned, "u", uint32_t, unsigned, "%" PRIu32);
-BUS_DEFINE_SET_TRANSIENT_STRING_WITH_CHECK(user, valid_user_group_name_or_id);
-BUS_DEFINE_SET_TRANSIENT_STRING_WITH_CHECK(path, path_is_absolute);
-
-int bus_set_transient_string(
- Unit *u,
- const char *name,
- char **p,
- sd_bus_message *message,
- UnitWriteFlags flags,
- sd_bus_error *error) {
-
- const char *v;
- int r;
-
- assert(p);
-
- r = sd_bus_message_read(message, "s", &v);
- if (r < 0)
- return r;
-
- if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
- r = free_and_strdup(p, empty_to_null(v));
- if (r < 0)
- return r;
-
- unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name,
- "%s=%s", name, strempty(v));
- }
-
- return 1;
-}
-
-int bus_set_transient_bool(
- Unit *u,
- const char *name,
- bool *p,
- sd_bus_message *message,
- UnitWriteFlags flags,
- sd_bus_error *error) {
-
- int v, r;
-
- assert(p);
-
- r = sd_bus_message_read(message, "b", &v);
- if (r < 0)
- return r;
-
- if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
- *p = v;
- unit_write_settingf(u, flags, name, "%s=%s", name, yes_no(v));
- }
-
- return 1;
-}
-
-int bus_set_transient_usec_internal(
- Unit *u,
- const char *name,
- usec_t *p,
- bool fix_0,
- sd_bus_message *message,
- UnitWriteFlags flags,
- sd_bus_error *error) {
-
- usec_t v;
- int r;
-
- assert(p);
-
- r = sd_bus_message_read(message, "u", &v);
- if (r < 0)
- return r;
-
- if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
- char *n, ts[FORMAT_TIMESPAN_MAX];
-
- if (fix_0)
- *p = v ?: USEC_INFINITY;
- else
- *p = v;
-
- n = strndupa(name, strlen(name) - 4);
- unit_write_settingf(u, flags, name, "%sSec=%s", n,
- format_timespan(ts, sizeof(ts), v, USEC_PER_MSEC));
- }
-
- return 1;
-}
+++ /dev/null
-/* SPDX-License-Identifier: LGPL-2.1+ */
-#pragma once
-
-/***
- This file is part of systemd.
-
- Copyright 2010 Lennart Poettering
-
- systemd is free software; you can redistribute it and/or modify it
- under the terms of the GNU Lesser General Public License as published by
- the Free Software Foundation; either version 2.1 of the License, or
- (at your option) any later version.
-
- systemd is distributed in the hope that it will be useful, but
- WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- Lesser General Public License for more details.
-
- You should have received a copy of the GNU Lesser General Public License
- along with systemd; If not, see <http://www.gnu.org/licenses/>.
-***/
-
-//#include "sd-bus.h"
-//#include "unit.h"
-
-#define BUS_DEFINE_SET_TRANSIENT(function, bus_type, type, cast_type, fmt) \
- int bus_set_transient_##function( \
- Unit *u, \
- const char *name, \
- cast_type *p, \
- sd_bus_message *message, \
- UnitWriteFlags flags, \
- sd_bus_error *error) { \
- \
- type v; \
- int r; \
- \
- assert(p); \
- \
- r = sd_bus_message_read(message, bus_type, &v); \
- if (r < 0) \
- return r; \
- \
- if (!UNIT_WRITE_FLAGS_NOOP(flags)) { \
- *p = (cast_type) v; \
- unit_write_settingf(u, flags, name, \
- "%s=" fmt, name, v); \
- } \
- \
- return 1; \
- } \
- struct __useless_struct_to_allow_trailing_semicolon__
-
-#define BUS_DEFINE_SET_TRANSIENT_IS_VALID(function, bus_type, type, cast_type, fmt, check) \
- int bus_set_transient_##function( \
- Unit *u, \
- const char *name, \
- cast_type *p, \
- sd_bus_message *message, \
- UnitWriteFlags flags, \
- sd_bus_error *error) { \
- \
- type v; \
- int r; \
- \
- assert(p); \
- \
- r = sd_bus_message_read(message, bus_type, &v); \
- if (r < 0) \
- return r; \
- \
- if (!check(v)) \
- return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, \
- "Invalid %s setting: " fmt, name, v); \
- \
- if (!UNIT_WRITE_FLAGS_NOOP(flags)) { \
- *p = (cast_type) v; \
- unit_write_settingf(u, flags, name, \
- "%s=" fmt, name, v); \
- } \
- \
- return 1; \
- } \
- struct __useless_struct_to_allow_trailing_semicolon__
-
-#define BUS_DEFINE_SET_TRANSIENT_TO_STRING(function, bus_type, type, cast_type, fmt, to_string) \
- int bus_set_transient_##function( \
- Unit *u, \
- const char *name, \
- cast_type *p, \
- sd_bus_message *message, \
- UnitWriteFlags flags, \
- sd_bus_error *error) { \
- \
- const char *s; \
- type v; \
- int r; \
- \
- assert(p); \
- \
- r = sd_bus_message_read(message, bus_type, &v); \
- if (r < 0) \
- return r; \
- \
- s = to_string(v); \
- if (!s) \
- return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, \
- "Invalid %s setting: " fmt, name, v); \
- \
- if (!UNIT_WRITE_FLAGS_NOOP(flags)) { \
- *p = (cast_type) v; \
- unit_write_settingf(u, flags, name, \
- "%s=%s", name, s); \
- } \
- \
- return 1; \
- } \
- struct __useless_struct_to_allow_trailing_semicolon__
-
-#define BUS_DEFINE_SET_TRANSIENT_TO_STRING_ALLOC(function, bus_type, type, cast_type, fmt, to_string) \
- int bus_set_transient_##function( \
- Unit *u, \
- const char *name, \
- cast_type *p, \
- sd_bus_message *message, \
- UnitWriteFlags flags, \
- sd_bus_error *error) { \
- \
- _cleanup_free_ char *s = NULL; \
- type v; \
- int r; \
- \
- assert(p); \
- \
- r = sd_bus_message_read(message, bus_type, &v); \
- if (r < 0) \
- return r; \
- \
- r = to_string(v, &s); \
- if (r == -EINVAL) \
- return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, \
- "Invalid %s setting: " fmt, name, v); \
- if (r < 0) \
- return r; \
- \
- if (!UNIT_WRITE_FLAGS_NOOP(flags)) { \
- *p = (cast_type) v; \
- unit_write_settingf(u, flags, name, \
- "%s=%s", name, s); \
- } \
- \
- return 1; \
- } \
- struct __useless_struct_to_allow_trailing_semicolon__
-
-#define BUS_DEFINE_SET_TRANSIENT_PARSE(function, type, parse) \
- int bus_set_transient_##function( \
- Unit *u, \
- const char *name, \
- type *p, \
- sd_bus_message *message, \
- UnitWriteFlags flags, \
- sd_bus_error *error) { \
- \
- const char *s; \
- type v; \
- int r; \
- \
- assert(p); \
- \
- r = sd_bus_message_read(message, "s", &s); \
- if (r < 0) \
- return r; \
- \
- v = parse(s); \
- if (v < 0) \
- return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, \
- "Invalid %s setting: %s", name, s); \
- \
- if (!UNIT_WRITE_FLAGS_NOOP(flags)) { \
- *p = v; \
- unit_write_settingf(u, flags, name, \
- "%s=%s", name, s); \
- } \
- \
- return 1; \
- } \
- struct __useless_struct_to_allow_trailing_semicolon__
-
-#define BUS_DEFINE_SET_TRANSIENT_PARSE_PTR(function, type, parse) \
- int bus_set_transient_##function( \
- Unit *u, \
- const char *name, \
- type *p, \
- sd_bus_message *message, \
- UnitWriteFlags flags, \
- sd_bus_error *error) { \
- \
- const char *s; \
- type v; \
- int r; \
- \
- assert(p); \
- \
- r = sd_bus_message_read(message, "s", &s); \
- if (r < 0) \
- return r; \
- \
- r = parse(s, &v); \
- if (r < 0) \
- return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, \
- "Invalid %s setting: %s", name, s); \
- \
- if (!UNIT_WRITE_FLAGS_NOOP(flags)) { \
- *p = v; \
- unit_write_settingf(u, flags, name, \
- "%s=%s", name, strempty(s)); \
- } \
- \
- return 1; \
- } \
- struct __useless_struct_to_allow_trailing_semicolon__
-
-#define BUS_DEFINE_SET_TRANSIENT_STRING_WITH_CHECK(function, check) \
- int bus_set_transient_##function( \
- Unit *u, \
- const char *name, \
- char **p, \
- sd_bus_message *message, \
- UnitWriteFlags flags, \
- sd_bus_error *error) { \
- \
- const char *v; \
- int r; \
- \
- assert(p); \
- \
- r = sd_bus_message_read(message, "s", &v); \
- if (r < 0) \
- return r; \
- \
- if (!isempty(v) && !check(v)) \
- return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, \
- "Invalid %s setting: %s", name, v); \
- \
- if (!UNIT_WRITE_FLAGS_NOOP(flags)) { \
- r = free_and_strdup(p, empty_to_null(v)); \
- if (r < 0) \
- return r; \
- \
- unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, \
- "%s=%s", name, strempty(v)); \
- } \
- \
- return 1; \
- } \
- struct __useless_struct_to_allow_trailing_semicolon__
-
-int bus_set_transient_mode_t(Unit *u, const char *name, mode_t *p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error);
-int bus_set_transient_unsigned(Unit *u, const char *name, unsigned *p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error);
-int bus_set_transient_user(Unit *u, const char *name, char **p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error);
-int bus_set_transient_path(Unit *u, const char *name, char **p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error);
-int bus_set_transient_string(Unit *u, const char *name, char **p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error);
-int bus_set_transient_bool(Unit *u, const char *name, bool *p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error);
-int bus_set_transient_usec_internal(Unit *u, const char *name, usec_t *p, bool fix_0, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error);
-static inline int bus_set_transient_usec(Unit *u, const char *name, usec_t *p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error) {
- return bus_set_transient_usec_internal(u, name, p, false, message, flags, error);
-}
-static inline int bus_set_transient_usec_fix_0(Unit *u, const char *name, usec_t *p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error) {
- return bus_set_transient_usec_internal(u, name, p, true, message, flags, error);
-}
#
# in_files = [['macros.systemd', rpmmacrosdir],
# ['triggers.systemd', ''],
-# ['systemd.pc', pkgconfigdatadir]]
+# ['systemd.pc', pkgconfigdatadir],
+# ['system.conf', pkgsysconfdir]]
#
# foreach item : in_files
# file = item[0]
# policy = configure_file(
# input : 'org.freedesktop.systemd1.policy.in',
# output : 'org.freedesktop.systemd1.policy',
-#endif // 0
- configuration : substs)
-install_data(policy,
- install_dir : polkitpolicydir)
-
-#if 0 /// totally UNNEEDED in elogind
-# install_data('system.conf',
-# 'user.conf',
+# configuration : substs)
+# install_data(policy,
+# install_dir : polkitpolicydir)
+#
+# install_data('user.conf',
# install_dir : pkgsysconfdir)
#
# meson.add_install_script('sh', '-c', mkdir_p.format(systemshutdowndir))
~ianmdlvl / elogind.git / commitdiff