SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core/execute: drop unused function param and cg unified check for cgns

Browse Source 
While at it, remove TODO about assuming availability of cgns.
We generally want to keep that optional still.
This commit is contained in:
Mike Yuan
2025-03-30 18:54:34 +02:00
parent d4bdcecaf9
commit 2b4cfbf91f
3 changed files with 25 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/execute.c
+12 -18
View File
@@ -232,24 +232,18 @@ bool exec_needs_ipc_namespace(const ExecContext *context) {
return context->private_ipc || context->ipc_namespace_path;
}
static bool can_apply_cgroup_namespace(const ExecContext *context, const ExecParameters *params) {
return cg_all_unified() > 0 && ns_type_supported(NAMESPACE_CGROUP);
}
static bool needs_cgroup_namespace(ProtectControlGroups i) {
return IN_SET(i, PROTECT_CONTROL_GROUPS_PRIVATE, PROTECT_CONTROL_GROUPS_STRICT);
}
ProtectControlGroups exec_get_protect_control_groups(const ExecContext *context, const ExecParameters *params) {
ProtectControlGroups exec_get_protect_control_groups(const ExecContext *context) {
assert(context);
/* If cgroup namespace is configured via ProtectControlGroups=private or strict but we can't actually
* use cgroup namespace, either from not having unified hierarchy or kernel support, we ignore the
* setting and do not unshare the namespace. ProtectControlGroups=private and strict get downgraded
* to no and yes respectively. This ensures that strict always gets a read-only mount of /sys/fs/cgroup.
*
* TODO: Remove fallback once cgroupv1 support is removed in v258. */
if (needs_cgroup_namespace(context->protect_control_groups) && !can_apply_cgroup_namespace(context, params)) {
* use cgroup namespace, we ignore the setting and do not unshare the namespace.
* ProtectControlGroups=private and strict get downgraded to no and yes respectively. This ensures
* that strict always gets a read-only mount of /sys/fs/cgroup/. */
if (needs_cgroup_namespace(context->protect_control_groups) && !ns_type_supported(NAMESPACE_CGROUP)) {
if (context->protect_control_groups == PROTECT_CONTROL_GROUPS_PRIVATE)
return PROTECT_CONTROL_GROUPS_NO;
if (context->protect_control_groups == PROTECT_CONTROL_GROUPS_STRICT)
@@ -258,22 +252,22 @@ ProtectControlGroups exec_get_protect_control_groups(const ExecContext *context,
return context->protect_control_groups;
}
bool exec_needs_cgroup_namespace(const ExecContext *context, const ExecParameters *params) {
bool exec_needs_cgroup_namespace(const ExecContext *context) {
assert(context);
return needs_cgroup_namespace(exec_get_protect_control_groups(context, params));
return needs_cgroup_namespace(exec_get_protect_control_groups(context));
}
bool exec_needs_cgroup_mount(const ExecContext *context, const ExecParameters *params) {
bool exec_needs_cgroup_mount(const ExecContext *context) {
assert(context);
return exec_get_protect_control_groups(context, params) != PROTECT_CONTROL_GROUPS_NO;
return exec_get_protect_control_groups(context) != PROTECT_CONTROL_GROUPS_NO;
}
bool exec_is_cgroup_mount_read_only(const ExecContext *context, const ExecParameters *params) {
bool exec_is_cgroup_mount_read_only(const ExecContext *context) {
assert(context);
return IN_SET(exec_get_protect_control_groups(context, params), PROTECT_CONTROL_GROUPS_YES, PROTECT_CONTROL_GROUPS_STRICT);
return IN_SET(exec_get_protect_control_groups(context), PROTECT_CONTROL_GROUPS_YES, PROTECT_CONTROL_GROUPS_STRICT);
}
bool exec_needs_pid_namespace(const ExecContext *context) {
@@ -331,7 +325,7 @@ bool exec_needs_mount_namespace(
context->protect_kernel_tunables ||
context->protect_kernel_modules ||
context->protect_kernel_logs ||
exec_needs_cgroup_mount(context, params) ||
exec_needs_cgroup_mount(context) ||
context->protect_proc != PROTECT_PROC_DEFAULT ||
context->proc_subset != PROC_SUBSET_ALL ||
exec_needs_ipc_namespace(context) ||