c->blockio_weight = (unsigned long) -1;
c->startup_blockio_weight = (unsigned long) -1;
- c->cpu_quota_per_sec_usec = (usec_t) -1;
+ c->cpu_quota_per_sec_usec = USEC_INFINITY;
}
void cgroup_context_free_device_allow(CGroupContext *c, CGroupDeviceAllow *a) {
"%sBlockIOWeight=%lu\n"
"%sStartupBlockIOWeight=%lu\n"
"%sMemoryLimit=%" PRIu64 "\n"
- "%sDevicePolicy=%s\n",
+ "%sDevicePolicy=%s\n"
+ "%sDelegate=%s\n",
prefix, yes_no(c->cpu_accounting),
prefix, yes_no(c->blockio_accounting),
prefix, yes_no(c->memory_accounting),
prefix, c->cpu_shares,
prefix, c->startup_cpu_shares,
- prefix, strna(format_timespan(u, sizeof(u), c->cpu_quota_per_sec_usec, 1)),
+ prefix, format_timespan(u, sizeof(u), c->cpu_quota_per_sec_usec, 1),
prefix, c->blockio_weight,
prefix, c->startup_blockio_weight,
prefix, c->memory_limit,
- prefix, cgroup_device_policy_to_string(c->device_policy));
+ prefix, cgroup_device_policy_to_string(c->device_policy),
+ prefix, yes_no(c->delegate));
LIST_FOREACH(device_allow, a, c->device_allow)
fprintf(f,
assert(dev);
r = stat(p, &st);
- if (r < 0) {
- log_warning("Couldn't stat device %s: %m", p);
- return -errno;
- }
+ if (r < 0)
+ return log_warning_errno(errno, "Couldn't stat device %s: %m", p);
if (S_ISBLK(st.st_mode))
*dev = st.st_rdev;
r = cg_set_attribute("devices", path, "devices.allow", buf);
if (r < 0)
- log_warning("Failed to set devices.allow on %s: %s", path, strerror(-r));
+ log_full(r == -ENOENT ? LOG_DEBUG : LOG_WARNING, "Failed to set devices.allow on %s: %s", path, strerror(-r));
return r;
}
assert(type == 'b' || type == 'c');
f = fopen("/proc/devices", "re");
- if (!f) {
- log_warning("Cannot open /proc/devices to resolve %s (%c): %m", name, type);
- return -errno;
- }
+ if (!f)
+ return log_warning_errno(errno, "Cannot open /proc/devices to resolve %s (%c): %m", name, type);
FOREACH_LINE(line, f, goto fail) {
char buf[2+DECIMAL_STR_MAX(unsigned)+3+4], *p, *w;
r = cg_set_attribute("devices", path, "devices.allow", buf);
if (r < 0)
- log_warning("Failed to set devices.allow on %s: %s", path, strerror(-r));
+ log_full(r == -ENOENT ? LOG_DEBUG : LOG_WARNING, "Failed to set devices.allow on %s: %s", path, strerror(-r));
}
return 0;
fail:
- log_warning("Failed to read /proc/devices: %m");
+ log_warning_errno(errno, "Failed to read /proc/devices: %m");
return -errno;
}
char buf[MAX(DECIMAL_STR_MAX(unsigned long), DECIMAL_STR_MAX(usec_t)) + 1];
sprintf(buf, "%lu\n",
- state == MANAGER_STARTING && c->startup_cpu_shares != (unsigned long) -1 ? c->startup_cpu_shares :
+ IN_SET(state, MANAGER_STARTING, MANAGER_INITIALIZING) && c->startup_cpu_shares != (unsigned long) -1 ? c->startup_cpu_shares :
c->cpu_shares != (unsigned long) -1 ? c->cpu_shares : 1024);
r = cg_set_attribute("cpu", path, "cpu.shares", buf);
if (r < 0)
- log_warning("Failed to set cpu.shares on %s: %s", path, strerror(-r));
+ log_full(r == -ENOENT ? LOG_DEBUG : LOG_WARNING, "Failed to set cpu.shares on %s: %s", path, strerror(-r));
sprintf(buf, USEC_FMT "\n", CGROUP_CPU_QUOTA_PERIOD_USEC);
r = cg_set_attribute("cpu", path, "cpu.cfs_period_us", buf);
if (r < 0)
- log_warning("Failed to set cpu.cfs_period_us on %s: %s", path, strerror(-r));
+ log_full(r == -ENOENT ? LOG_DEBUG : LOG_WARNING, "Failed to set cpu.cfs_period_us on %s: %s", path, strerror(-r));
- if (c->cpu_quota_per_sec_usec != (usec_t) -1) {
+ if (c->cpu_quota_per_sec_usec != USEC_INFINITY) {
sprintf(buf, USEC_FMT "\n", c->cpu_quota_per_sec_usec * CGROUP_CPU_QUOTA_PERIOD_USEC / USEC_PER_SEC);
r = cg_set_attribute("cpu", path, "cpu.cfs_quota_us", buf);
} else
r = cg_set_attribute("cpu", path, "cpu.cfs_quota_us", "-1");
if (r < 0)
- log_warning("Failed to set cpu.cfs_quota_us on %s: %s", path, strerror(-r));
+ log_full(r == -ENOENT ? LOG_DEBUG : LOG_WARNING, "Failed to set cpu.cfs_quota_us on %s: %s", path, strerror(-r));
}
if (mask & CGROUP_BLKIO) {
CGroupBlockIODeviceBandwidth *b;
if (!is_root) {
- sprintf(buf, "%lu\n", state == MANAGER_STARTING && c->startup_blockio_weight != (unsigned long) -1 ? c->startup_blockio_weight :
+ sprintf(buf, "%lu\n", IN_SET(state, MANAGER_STARTING, MANAGER_INITIALIZING) && c->startup_blockio_weight != (unsigned long) -1 ? c->startup_blockio_weight :
c->blockio_weight != (unsigned long) -1 ? c->blockio_weight : 1000);
r = cg_set_attribute("blkio", path, "blkio.weight", buf);
if (r < 0)
- log_warning("Failed to set blkio.weight on %s: %s", path, strerror(-r));
+ log_full(r == -ENOENT ? LOG_DEBUG : LOG_WARNING, "Failed to set blkio.weight on %s: %s", path, strerror(-r));
/* FIXME: no way to reset this list */
LIST_FOREACH(device_weights, w, c->blockio_device_weights) {
sprintf(buf, "%u:%u %lu", major(dev), minor(dev), w->weight);
r = cg_set_attribute("blkio", path, "blkio.weight_device", buf);
if (r < 0)
- log_error("Failed to set blkio.weight_device on %s: %s", path, strerror(-r));
+ log_full(r == -ENOENT ? LOG_DEBUG : LOG_WARNING, "Failed to set blkio.weight_device on %s: %s", path, strerror(-r));
}
}
sprintf(buf, "%u:%u %" PRIu64 "\n", major(dev), minor(dev), b->bandwidth);
r = cg_set_attribute("blkio", path, a, buf);
if (r < 0)
- log_error("Failed to set %s on %s: %s", a, path, strerror(-r));
+ log_full(r == -ENOENT ? LOG_DEBUG : LOG_WARNING, "Failed to set %s on %s: %s", a, path, strerror(-r));
}
}
r = cg_set_attribute("memory", path, "memory.limit_in_bytes", "-1");
if (r < 0)
- log_error("Failed to set memory.limit_in_bytes on %s: %s", path, strerror(-r));
+ log_full(r == -ENOENT ? LOG_DEBUG : LOG_WARNING, "Failed to set memory.limit_in_bytes on %s: %s", path, strerror(-r));
}
if ((mask & CGROUP_DEVICE) && !is_root) {
else
r = cg_set_attribute("devices", path, "devices.allow", "a");
if (r < 0)
- log_warning("Failed to reset devices.list on %s: %s", path, strerror(-r));
+ log_full(r == -ENOENT ? LOG_DEBUG : LOG_WARNING, "Failed to reset devices.list on %s: %s", path, strerror(-r));
if (c->device_policy == CGROUP_CLOSED ||
(c->device_policy == CGROUP_AUTO && c->device_allow)) {
if (c->cpu_accounting ||
c->cpu_shares != (unsigned long) -1 ||
c->startup_cpu_shares != (unsigned long) -1 ||
- c->cpu_quota_per_sec_usec != (usec_t) -1)
+ c->cpu_quota_per_sec_usec != USEC_INFINITY)
mask |= CGROUP_CPUACCT | CGROUP_CPU;
if (c->blockio_accounting ||
c->memory_limit != (uint64_t) -1)
mask |= CGROUP_MEMORY;
- if (c->device_allow || c->device_policy != CGROUP_AUTO)
+ if (c->device_allow ||
+ c->device_policy != CGROUP_AUTO)
mask |= CGROUP_DEVICE;
return mask;
if (!c)
return 0;
+ /* If delegation is turned on, then turn on all cgroups,
+ * unless the process we fork into it is known to drop
+ * privileges anyway, and shouldn't get access to the
+ * controllers anyway. */
+
+ if (c->delegate) {
+ ExecContext *e;
+
+ e = unit_get_exec_context(u);
+ if (!e || exec_context_maintains_privileges(e))
+ return _CGROUP_CONTROLLER_MASK_ALL;
+ }
+
return cgroup_context_get_mask(c);
}
/* First, create our own group */
r = cg_create_everywhere(u->manager->cgroup_supported, mask, u->cgroup_path);
- if (r < 0) {
- log_error("Failed to create cgroup %s: %s", u->cgroup_path, strerror(-r));
- return r;
- }
+ if (r < 0)
+ return log_error_errno(r, "Failed to create cgroup %s: %m", u->cgroup_path);
/* Keep track that this is now realized */
u->cgroup_realized = true;
/* Then, possibly move things over */
r = cg_migrate_everywhere(u->manager->cgroup_supported, u->cgroup_path, u->cgroup_path, migrate_callback, u);
if (r < 0)
- log_warning("Failed to migrate cgroup from to %s: %s", u->cgroup_path, strerror(-r));
+ log_warning_errno(r, "Failed to migrate cgroup from to %s: %m", u->cgroup_path);
return 0;
}
r = unit_realize_cgroup_now(i, state);
if (r < 0)
- log_warning("Failed to realize cgroups for queued unit %s: %s", i->id, strerror(-r));
+ log_warning_errno(r, "Failed to realize cgroups for queued unit %s: %m", i->id);
n++;
}
r = cg_trim_everywhere(u->manager->cgroup_supported, u->cgroup_path, !unit_has_name(u, SPECIAL_ROOT_SLICE));
if (r < 0)
- log_debug("Failed to destroy cgroup %s: %s", u->cgroup_path, strerror(-r));
+ log_debug_errno(r, "Failed to destroy cgroup %s: %m", u->cgroup_path);
hashmap_remove(u->manager->cgroup_unit, u->cgroup_path);
int manager_setup_cgroup(Manager *m) {
_cleanup_free_ char *path = NULL;
- char *e;
int r;
assert(m);
m->cgroup_root = NULL;
r = cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER, 0, &m->cgroup_root);
- if (r < 0) {
- log_error("Cannot determine cgroup we are running in: %s", strerror(-r));
- return r;
- }
+ if (r < 0)
+ return log_error_errno(r, "Cannot determine cgroup we are running in: %m");
/* LEGACY: Already in /system.slice? If so, let's cut this
* off. This is to support live upgrades from older systemd
* versions where PID 1 was moved there. */
if (m->running_as == SYSTEMD_SYSTEM) {
+ char *e;
+
e = endswith(m->cgroup_root, "/" SPECIAL_SYSTEM_SLICE);
if (!e)
e = endswith(m->cgroup_root, "/system");
/* 2. Show data */
r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, m->cgroup_root, NULL, &path);
- if (r < 0) {
- log_error("Cannot find cgroup mount point: %s", strerror(-r));
- return r;
- }
+ if (r < 0)
+ return log_error_errno(r, "Cannot find cgroup mount point: %m");
log_debug("Using cgroup controller " SYSTEMD_CGROUP_CONTROLLER ". File system hierarchy is at %s.", path);
+ if (!m->test_run) {
- /* 3. Install agent */
- if (m->running_as == SYSTEMD_SYSTEM) {
- r = cg_install_release_agent(SYSTEMD_CGROUP_CONTROLLER, SYSTEMD_CGROUP_AGENT_PATH);
+ /* 3. Install agent */
+ if (m->running_as == SYSTEMD_SYSTEM) {
+ r = cg_install_release_agent(SYSTEMD_CGROUP_CONTROLLER, SYSTEMD_CGROUP_AGENT_PATH);
+ if (r < 0)
+ log_warning_errno(r, "Failed to install release agent, ignoring: %m");
+ else if (r > 0)
+ log_debug("Installed release agent.");
+ else
+ log_debug("Release agent already installed.");
+ }
+
+ /* 4. Make sure we are in the root cgroup */
+ r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, m->cgroup_root, 0);
if (r < 0)
- log_warning("Failed to install release agent, ignoring: %s", strerror(-r));
- else if (r > 0)
- log_debug("Installed release agent.");
- else
- log_debug("Release agent already installed.");
- }
+ return log_error_errno(r, "Failed to create root cgroup hierarchy: %m");
- /* 4. Make sure we are in the root cgroup */
- r = cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER, m->cgroup_root, 0);
- if (r < 0) {
- log_error("Failed to create root cgroup hierarchy: %s", strerror(-r));
- return r;
- }
+ /* 5. And pin it, so that it cannot be unmounted */
+ safe_close(m->pin_cgroupfs_fd);
- /* 5. And pin it, so that it cannot be unmounted */
- safe_close(m->pin_cgroupfs_fd);
+ m->pin_cgroupfs_fd = open(path, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY|O_NONBLOCK);
+ if (m->pin_cgroupfs_fd < 0)
+ return log_error_errno(errno, "Failed to open pin file: %m");
- m->pin_cgroupfs_fd = open(path, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY|O_NONBLOCK);
- if (m->pin_cgroupfs_fd < 0) {
- log_error("Failed to open pin file: %m");
- return -errno;
+ /* 6. Always enable hierarchial support if it exists... */
+ cg_set_attribute("memory", "/", "memory.use_hierarchy", "1");
}
- /* 6. Figure out which controllers are supported */
+ /* 7. Figure out which controllers are supported */
m->cgroup_supported = cg_mask_supported();
- /* 7. Always enable hierarchial support if it exists... */
- cg_set_attribute("memory", "/", "memory.use_hierarchy", "1");
-
return 0;
}