SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #29482 from poettering/cgroup-func-rename

Browse Source 
core: various clean-ups in cgroup.[ch] and around
This commit is contained in:
Yu Watanabe
2023-10-07 22:18:14 +09:00
committed by GitHub
parent d210507621 49b6babb76
commit 328539c21c
8 changed files with 100 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/cgroup.c
+70 -56
View File
@@ -52,7 +52,7 @@
* out specific attributes from us. */
#define LOG_LEVEL_CGROUP_WRITE(r) (IN_SET(abs(r), ENOENT, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING)
uint64_t tasks_max_resolve(const TasksMax *tasks_max) {
uint64_t cgroup_tasks_max_resolve(const CGroupTasksMax *tasks_max) {
if (tasks_max->scale == 0)
return tasks_max->value;
@@ -171,7 +171,7 @@ void cgroup_context_init(CGroupContext *c) {
.blockio_weight = CGROUP_BLKIO_WEIGHT_INVALID,
.startup_blockio_weight = CGROUP_BLKIO_WEIGHT_INVALID,
.tasks_max = TASKS_MAX_UNSET,
.tasks_max = CGROUP_TASKS_MAX_UNSET,
.moom_swap = MANAGED_OOM_AUTO,
.moom_mem_pressure = MANAGED_OOM_AUTO,
@@ -561,7 +561,7 @@ void cgroup_context_dump(Unit *u, FILE* f, const char *prefix) {
prefix, c->memory_zswap_max, format_cgroup_memory_limit_comparison(cdj, sizeof(cdj), u, "MemoryZSwapMax"),
prefix, c->startup_memory_zswap_max, format_cgroup_memory_limit_comparison(cdk, sizeof(cdk), u, "StartupMemoryZSwapMax"),
prefix, c->memory_limit,
prefix, tasks_max_resolve(&c->tasks_max),
prefix, cgroup_tasks_max_resolve(&c->tasks_max),
prefix, cgroup_device_policy_to_string(c->device_policy),
prefix, strempty(disable_controllers_str),
prefix, delegate_str,
@@ -695,7 +695,7 @@ void cgroup_context_dump_socket_bind_item(const CGroupSocketBindItem *item, FILE
}
}
int cgroup_add_device_allow(CGroupContext *c, const char *dev, const char *mode) {
int cgroup_context_add_device_allow(CGroupContext *c, const char *dev, const char *mode) {
_cleanup_free_ CGroupDeviceAllow *a = NULL;
_cleanup_free_ char *d = NULL;
@@ -724,7 +724,7 @@ int cgroup_add_device_allow(CGroupContext *c, const char *dev, const char *mode)
return 0;
}
int cgroup_add_bpf_foreign_program(CGroupContext *c, uint32_t attach_type, const char *bpffs_path) {
int cgroup_context_add_bpf_foreign_program(CGroupContext *c, uint32_t attach_type, const char *bpffs_path) {
CGroupBPFForeignProgram *p;
_cleanup_free_ char *d = NULL;
@@ -782,43 +782,35 @@ UNIT_DEFINE_ANCESTOR_MEMORY_LOOKUP(memory_low);
UNIT_DEFINE_ANCESTOR_MEMORY_LOOKUP(startup_memory_low);
UNIT_DEFINE_ANCESTOR_MEMORY_LOOKUP(memory_min);
static void unit_set_xattr_graceful(Unit *u, const char *cgroup_path, const char *name, const void *data, size_t size) {
static void unit_set_xattr_graceful(Unit *u, const char *name, const void *data, size_t size) {
int r;
assert(u);
assert(name);
if (!cgroup_path) {
if (!u->cgroup_path)
return;
if (!u->cgroup_path)
return;
cgroup_path = u->cgroup_path;
}
r = cg_set_xattr(cgroup_path, name, data, size, 0);
r = cg_set_xattr(u->cgroup_path, name, data, size, 0);
if (r < 0)
log_unit_debug_errno(u, r, "Failed to set '%s' xattr on control group %s, ignoring: %m", name, empty_to_root(cgroup_path));
log_unit_debug_errno(u, r, "Failed to set '%s' xattr on control group %s, ignoring: %m", name, empty_to_root(u->cgroup_path));
}
static void unit_remove_xattr_graceful(Unit *u, const char *cgroup_path, const char *name) {
static void unit_remove_xattr_graceful(Unit *u, const char *name) {
int r;
assert(u);
assert(name);
if (!cgroup_path) {
if (!u->cgroup_path)
return;
if (!u->cgroup_path)
return;
cgroup_path = u->cgroup_path;
}
r = cg_remove_xattr(cgroup_path, name);
r = cg_remove_xattr(u->cgroup_path, name);
if (r < 0 && !ERRNO_IS_XATTR_ABSENT(r))
log_unit_debug_errno(u, r, "Failed to remove '%s' xattr flag on control group %s, ignoring: %m", name, empty_to_root(cgroup_path));
log_unit_debug_errno(u, r, "Failed to remove '%s' xattr flag on control group %s, ignoring: %m", name, empty_to_root(u->cgroup_path));
}
void cgroup_oomd_xattr_apply(Unit *u, const char *cgroup_path) {
static void cgroup_oomd_xattr_apply(Unit *u) {
CGroupContext *c;
assert(u);
@@ -828,19 +820,19 @@ void cgroup_oomd_xattr_apply(Unit *u, const char *cgroup_path) {
return;
if (c->moom_preference == MANAGED_OOM_PREFERENCE_OMIT)
unit_set_xattr_graceful(u, cgroup_path, "user.oomd_omit", "1", 1);
unit_set_xattr_graceful(u, "user.oomd_omit", "1", 1);
if (c->moom_preference == MANAGED_OOM_PREFERENCE_AVOID)
unit_set_xattr_graceful(u, cgroup_path, "user.oomd_avoid", "1", 1);
unit_set_xattr_graceful(u, "user.oomd_avoid", "1", 1);
if (c->moom_preference != MANAGED_OOM_PREFERENCE_AVOID)
unit_remove_xattr_graceful(u, cgroup_path, "user.oomd_avoid");
unit_remove_xattr_graceful(u, "user.oomd_avoid");
if (c->moom_preference != MANAGED_OOM_PREFERENCE_OMIT)
unit_remove_xattr_graceful(u, cgroup_path, "user.oomd_omit");
unit_remove_xattr_graceful(u, "user.oomd_omit");
}
int cgroup_log_xattr_apply(Unit *u, const char *cgroup_path) {
static int cgroup_log_xattr_apply(Unit *u) {
ExecContext *c;
size_t len, allowed_patterns_len, denied_patterns_len;
_cleanup_free_ char *patterns = NULL, *allowed_patterns = NULL, *denied_patterns = NULL;
@@ -856,7 +848,7 @@ int cgroup_log_xattr_apply(Unit *u, const char *cgroup_path) {
return 0;
if (set_isempty(c->log_filter_allowed_patterns) && set_isempty(c->log_filter_denied_patterns)) {
unit_remove_xattr_graceful(u, cgroup_path, "user.journald_log_filter_patterns");
unit_remove_xattr_graceful(u, "user.journald_log_filter_patterns");
return 0;
}
@@ -881,31 +873,29 @@ int cgroup_log_xattr_apply(Unit *u, const char *cgroup_path) {
*(last++) = '\xff';
memcpy_safe(last, denied_patterns, denied_patterns_len);
unit_set_xattr_graceful(u, cgroup_path, "user.journald_log_filter_patterns", patterns, len);
unit_set_xattr_graceful(u, "user.journald_log_filter_patterns", patterns, len);
return 0;
}
static void cgroup_xattr_apply(Unit *u) {
static void cgroup_invocation_id_xattr_apply(Unit *u) {
bool b;
int r;
assert(u);
/* The 'user.*' xattrs can be set from a user manager. */
cgroup_oomd_xattr_apply(u, u->cgroup_path);
cgroup_log_xattr_apply(u, u->cgroup_path);
if (!MANAGER_IS_SYSTEM(u->manager))
return;
b = !sd_id128_is_null(u->invocation_id);
FOREACH_STRING(xn, "trusted.invocation_id", "user.invocation_id") {
if (b)
unit_set_xattr_graceful(u, NULL, xn, SD_ID128_TO_STRING(u->invocation_id), 32);
unit_set_xattr_graceful(u, xn, SD_ID128_TO_STRING(u->invocation_id), 32);
else
unit_remove_xattr_graceful(u, NULL, xn);
unit_remove_xattr_graceful(u, xn);
}
}
static void cgroup_delegate_xattr_apply(Unit *u) {
bool b;
assert(u);
/* Indicate on the cgroup whether delegation is on, via an xattr. This is best-effort, as old kernels
* didn't support xattrs on cgroups at all. Later they got support for setting 'trusted.*' xattrs,
@@ -918,10 +908,16 @@ static void cgroup_xattr_apply(Unit *u) {
b = unit_cgroup_delegate(u);
FOREACH_STRING(xn, "trusted.delegate", "user.delegate") {
if (b)
unit_set_xattr_graceful(u, NULL, xn, "1", 1);
unit_set_xattr_graceful(u, xn, "1", 1);
else
unit_remove_xattr_graceful(u, NULL, xn);
unit_remove_xattr_graceful(u, xn);
}
}
static void cgroup_survive_xattr_apply(Unit *u) {
int r;
assert(u);
if (u->survive_final_kill_signal) {
r = cg_set_xattr(
@@ -945,11 +941,26 @@ static void cgroup_xattr_apply(Unit *u) {
"group %s, ignoring: %m",
empty_to_root(u->cgroup_path));
} else {
unit_remove_xattr_graceful(u, /* cgroup_path= */ NULL, "user.survive_final_kill_signal");
unit_remove_xattr_graceful(u, /* cgroup_path= */ NULL, "trusted.survive_final_kill_signal");
unit_remove_xattr_graceful(u, "user.survive_final_kill_signal");
unit_remove_xattr_graceful(u, "trusted.survive_final_kill_signal");
}
}
static void cgroup_xattr_apply(Unit *u) {
assert(u);
/* The 'user.*' xattrs can be set from a user manager. */
cgroup_oomd_xattr_apply(u);
cgroup_log_xattr_apply(u);
if (!MANAGER_IS_SYSTEM(u->manager))
return;
cgroup_invocation_id_xattr_apply(u);
cgroup_delegate_xattr_apply(u);
cgroup_survive_xattr_apply(u);
}
static int lookup_block_device(const char *p, dev_t *ret) {
dev_t rdev, dev = 0;
mode_t mode;
@@ -1376,19 +1387,20 @@ static void cgroup_apply_firewall(Unit *u) {
(void) bpf_firewall_install(u);
}
void cgroup_modify_nft_set(Unit *u, bool add) {
void unit_modify_nft_set(Unit *u, bool add) {
int r;
CGroupContext *c;
assert(u);
if (!MANAGER_IS_SYSTEM(u->manager))
return;
if (!UNIT_HAS_CGROUP_CONTEXT(u))
return;
if (cg_all_unified() <= 0)
return;
assert_se(c = unit_get_cgroup_context(u));
if (u->cgroup_id == 0)
return;
@@ -1400,6 +1412,8 @@ void cgroup_modify_nft_set(Unit *u, bool add) {
assert(u->manager->fw_ctx);
}
CGroupContext *c = ASSERT_PTR(unit_get_cgroup_context(u));
FOREACH_ARRAY(nft_set, c->nft_set_context.sets, c->nft_set_context.n_sets) {
uint64_t element = u->cgroup_id;
@@ -1816,9 +1830,9 @@ static void cgroup_context_apply(
* which is desirable so that there's an official way to release control of the sysctl from
* systemd: set the limit to unbounded and reload. */
if (tasks_max_isset(&c->tasks_max)) {
if (cgroup_tasks_max_isset(&c->tasks_max)) {
u->manager->sysctl_pid_max_changed = true;
r = procfs_tasks_set_limit(tasks_max_resolve(&c->tasks_max));
r = procfs_tasks_set_limit(cgroup_tasks_max_resolve(&c->tasks_max));
} else if (u->manager->sysctl_pid_max_changed)
r = procfs_tasks_set_limit(TASKS_MAX);
else
@@ -1831,10 +1845,10 @@ static void cgroup_context_apply(
/* The attribute itself is not available on the host root cgroup, and in the container case we want to
* leave it for the container manager. */
if (!is_local_root) {
if (tasks_max_isset(&c->tasks_max)) {
if (cgroup_tasks_max_isset(&c->tasks_max)) {
char buf[DECIMAL_STR_MAX(uint64_t) + 1];
xsprintf(buf, "%" PRIu64 "\n", tasks_max_resolve(&c->tasks_max));
xsprintf(buf, "%" PRIu64 "\n", cgroup_tasks_max_resolve(&c->tasks_max));
(void) set_attribute_and_warn(u, "pids", "pids.max", buf);
} else
(void) set_attribute_and_warn(u, "pids", "pids.max", "max\n");
@@ -1853,7 +1867,7 @@ static void cgroup_context_apply(
if (apply_mask & CGROUP_MASK_BPF_RESTRICT_NETWORK_INTERFACES)
cgroup_apply_restrict_network_interfaces(u);
cgroup_modify_nft_set(u, /* add = */ true);
unit_modify_nft_set(u, /* add = */ true);
}
static bool unit_get_needs_bpf_firewall(Unit *u) {
@@ -1952,7 +1966,7 @@ static CGroupMask unit_get_cgroup_mask(Unit *u) {
mask |= CGROUP_MASK_DEVICES | CGROUP_MASK_BPF_DEVICES;
if (c->tasks_accounting ||
tasks_max_isset(&c->tasks_max))
cgroup_tasks_max_isset(&c->tasks_max))
mask |= CGROUP_MASK_PIDS;
return CGROUP_MASK_EXTEND_JOINED(mask);
@@ -3031,7 +3045,7 @@ void unit_prune_cgroup(Unit *u) {
(void) lsm_bpf_cleanup(u); /* Remove cgroup from the global LSM BPF map */
#endif
cgroup_modify_nft_set(u, /* add = */ false);
unit_modify_nft_set(u, /* add = */ false);
is_root_slice = unit_has_name(u, SPECIAL_ROOT_SLICE);
src/core/cgroup.h
+9 -12
View File
@@ -11,20 +11,20 @@
#include "pidref.h"
#include "time-util.h"
typedef struct TasksMax {
typedef struct CGroupTasksMax {
/* If scale == 0, just use value; otherwise, value / scale.
* See tasks_max_resolve(). */
uint64_t value;
uint64_t scale;
} TasksMax;
} CGroupTasksMax;
#define TASKS_MAX_UNSET ((TasksMax) { .value = UINT64_MAX, .scale = 0 })
#define CGROUP_TASKS_MAX_UNSET ((CGroupTasksMax) { .value = UINT64_MAX, .scale = 0 })
static inline bool tasks_max_isset(const TasksMax *tasks_max) {
static inline bool cgroup_tasks_max_isset(const CGroupTasksMax *tasks_max) {
return tasks_max->value != UINT64_MAX || tasks_max->scale != 0;
}
uint64_t tasks_max_resolve(const TasksMax *tasks_max);
uint64_t cgroup_tasks_max_resolve(const CGroupTasksMax *tasks_max);
typedef struct CGroupContext CGroupContext;
typedef struct CGroupDeviceAllow CGroupDeviceAllow;
@@ -212,7 +212,7 @@ struct CGroupContext {
LIST_HEAD(CGroupSocketBindItem, socket_bind_deny);
/* Common */
TasksMax tasks_max;
CGroupTasksMax tasks_max;
/* Settings for systemd-oomd */
ManagedOOMMode moom_swap;
@@ -275,13 +275,10 @@ static inline bool cgroup_context_want_memory_pressure(const CGroupContext *c) {
(c->memory_pressure_watch == CGROUP_PRESSURE_WATCH_AUTO && c->memory_accounting);
}
int cgroup_add_device_allow(CGroupContext *c, const char *dev, const char *mode);
int cgroup_add_bpf_foreign_program(CGroupContext *c, uint32_t attach_type, const char *path);
int cgroup_context_add_device_allow(CGroupContext *c, const char *dev, const char *mode);
int cgroup_context_add_bpf_foreign_program(CGroupContext *c, uint32_t attach_type, const char *path);
void cgroup_oomd_xattr_apply(Unit *u, const char *cgroup_path);
int cgroup_log_xattr_apply(Unit *u, const char *cgroup_path);
void cgroup_modify_nft_set(Unit *u, bool add);
void unit_modify_nft_set(Unit *u, bool add);
CGroupMask unit_get_own_mask(Unit *u);
CGroupMask unit_get_delegate_mask(Unit *u);
src/core/dbus-cgroup.c
+6 -6
View File
@@ -27,7 +27,7 @@
#include "percent-util.h"
#include "socket-util.h"
BUS_DEFINE_PROPERTY_GET(bus_property_get_tasks_max, "t", TasksMax, tasks_max_resolve);
BUS_DEFINE_PROPERTY_GET(bus_property_get_tasks_max, "t", CGroupTasksMax, cgroup_tasks_max_resolve);
BUS_DEFINE_PROPERTY_GET_ENUM(bus_property_get_cgroup_pressure_watch, cgroup_pressure_watch, CGroupPressureWatch);
static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_cgroup_device_policy, cgroup_device_policy, CGroupDevicePolicy);
@@ -746,7 +746,7 @@ static int bus_cgroup_set_transient_property(
name);
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
r = cgroup_add_bpf_foreign_program(c, attach_type, p);
r = cgroup_context_add_bpf_foreign_program(c, attach_type, p);
if (r < 0)
return r;
}
@@ -1025,7 +1025,7 @@ static int bus_cgroup_set_cpu_weight(
static int bus_cgroup_set_tasks_max(
Unit *u,
const char *name,
TasksMax *p,
CGroupTasksMax *p,
sd_bus_message *message,
UnitWriteFlags flags,
sd_bus_error *error) {
@@ -1044,7 +1044,7 @@ static int bus_cgroup_set_tasks_max(
"Value specified in %s is out of range", name);
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
*p = (TasksMax) { .value = v, .scale = 0 }; /* When .scale==0, .value is the absolute value */
*p = (CGroupTasksMax) { .value = v, .scale = 0 }; /* When .scale==0, .value is the absolute value */
unit_invalidate_cgroup(u, CGROUP_MASK_PIDS);
if (v == CGROUP_LIMIT_MAX)
@@ -1061,7 +1061,7 @@ static int bus_cgroup_set_tasks_max(
static int bus_cgroup_set_tasks_max_scale(
Unit *u,
const char *name,
TasksMax *p,
CGroupTasksMax *p,
sd_bus_message *message,
UnitWriteFlags flags,
sd_bus_error *error) {
@@ -1080,7 +1080,7 @@ static int bus_cgroup_set_tasks_max_scale(
"Value specified in %s is out of range", name);
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
*p = (TasksMax) { v, UINT32_MAX }; /* .scale is not 0, so this is interpreted as v/UINT32_MAX. */
*p = (CGroupTasksMax) { v, UINT32_MAX }; /* .scale is not 0, so this is interpreted as v/UINT32_MAX. */
unit_invalidate_cgroup(u, CGROUP_MASK_PIDS);
uint32_t scaled = DIV_ROUND_UP((uint64_t) v * 100U, (uint64_t) UINT32_MAX);
src/core/load-fragment.c
+7 -7
View File
@@ -3917,23 +3917,23 @@ int config_parse_tasks_max(
void *userdata) {
const Unit *u = userdata;
TasksMax *tasks_max = data;
CGroupTasksMax *tasks_max = data;
uint64_t v;
int r;
if (isempty(rvalue)) {
*tasks_max = u ? u->manager->defaults.tasks_max : TASKS_MAX_UNSET;
*tasks_max = u ? u->manager->defaults.tasks_max : CGROUP_TASKS_MAX_UNSET;
return 0;
}
if (streq(rvalue, "infinity")) {
*tasks_max = TASKS_MAX_UNSET;
*tasks_max = CGROUP_TASKS_MAX_UNSET;
return 0;
}
r = parse_permyriad(rvalue);
if (r >= 0)
*tasks_max = (TasksMax) { r, 10000U }; /* r‱ */
*tasks_max = (CGroupTasksMax) { r, 10000U }; /* r‱ */
else {
r = safe_atou64(rvalue, &v);
if (r < 0) {
@@ -3946,7 +3946,7 @@ int config_parse_tasks_max(
return 0;
}
*tasks_max = (TasksMax) { v };
*tasks_max = (CGroupTasksMax) { v };
}
return 0;
@@ -4195,7 +4195,7 @@ int config_parse_device_allow(
return 0;
}
return cgroup_add_device_allow(c, resolved, p);
return cgroup_context_add_device_allow(c, resolved, p);
}
int config_parse_io_device_weight(
@@ -5978,7 +5978,7 @@ int config_parse_bpf_foreign_program(
if (r < 0)
return 0;
r = cgroup_add_bpf_foreign_program(c, attach_type, resolved);
r = cgroup_context_add_bpf_foreign_program(c, attach_type, resolved);
if (r < 0)
return log_error_errno(r, "Failed to add foreign BPF program to cgroup context: %m");
src/core/manager.c
+1 -1
View File
@@ -112,7 +112,7 @@
/* How many units and jobs to process of the bus queue before returning to the event loop. */
#define MANAGER_BUS_MESSAGE_BUDGET 100U
#define DEFAULT_TASKS_MAX ((TasksMax) { 15U, 100U }) /* 15% */
#define DEFAULT_TASKS_MAX ((CGroupTasksMax) { 15U, 100U }) /* 15% */
static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata);
static int manager_dispatch_cgroups_agent_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata);
src/core/manager.h
+1 -1
View File
@@ -167,7 +167,7 @@ typedef struct UnitDefaults {
bool tasks_accounting;
bool ip_accounting;
TasksMax tasks_max;
CGroupTasksMax tasks_max;
usec_t timer_accuracy_usec;
OOMPolicy oom_policy;
src/core/unit.c
+5 -8
View File
@@ -3843,10 +3843,7 @@ int unit_coldplug(Unit *u) {
if (u->nop_job)
RET_GATHER(r, job_coldplug(u->nop_job));
CGroupContext *c = unit_get_cgroup_context(u);
if (c)
cgroup_modify_nft_set(u, /* add = */ true);
unit_modify_nft_set(u, /* add = */ true);
return r;
}
@@ -4385,12 +4382,12 @@ int unit_patch_contexts(Unit *u) {
/* When RootImage= or MountImages= is specified, the following devices are touched. */
FOREACH_STRING(p, "/dev/loop-control", "/dev/mapper/control") {
r = cgroup_add_device_allow(cc, p, "rw");
r = cgroup_context_add_device_allow(cc, p, "rw");
if (r < 0)
return r;
}
FOREACH_STRING(p, "block-loop", "block-blkext", "block-device-mapper") {
r = cgroup_add_device_allow(cc, p, "rwm");
r = cgroup_context_add_device_allow(cc, p, "rwm");
if (r < 0)
return r;
}
@@ -4405,14 +4402,14 @@ int unit_patch_contexts(Unit *u) {
}
if (ec->protect_clock) {
r = cgroup_add_device_allow(cc, "char-rtc", "r");
r = cgroup_context_add_device_allow(cc, "char-rtc", "r");
if (r < 0)
return r;
}
/* If there are encrypted credentials we might need to access the TPM. */
if (exec_context_has_encrypted_credentials(ec)) {
r = cgroup_add_device_allow(cc, "char-tpm", "rw");
r = cgroup_context_add_device_allow(cc, "char-tpm", "rw");
if (r < 0)
return r;
}
src/test/test-cgroup-mask.c
+1 -1
View File
@@ -58,7 +58,7 @@ TEST_RET(cgroup_mask, .sd_booted = true) {
m->defaults.blockio_accounting =
m->defaults.io_accounting =
m->defaults.tasks_accounting = false;
m->defaults.tasks_max = TASKS_MAX_UNSET;
m->defaults.tasks_max = CGROUP_TASKS_MAX_UNSET;
assert_se(manager_startup(m, NULL, NULL, NULL) >= 0);