From 89186093485b52ca957d17842fc1f7c87958454a Mon Sep 17 00:00:00 2001 From: Nick Rosbrook Date: Tue, 22 Nov 2022 10:33:55 -0500 Subject: [PATCH 1/2] oomd: always allow root-owned cgroups to set ManagedOOMPreference Commit 652a4efb66a ("oomd: loosen the restriction on ManagedOOMPreference") made the change to allow ManagedOOMPreference on a cgroup candidate when the monitored cgroup and cgroup candidate are owned by the same user. The commit assumed that this check was sufficient to continue allowing ManagedOOMPreference on all cgroups owned by root. However, it caused a regression for unprivileged LXD containers where e.g. /sys/fs/cgroup is owned by nobody (uid=65534). Fix this by explicitly allowing the ManagedOOMPreference if uid == 0 in oomd_fetch_cgroup_oom_preference(). --- src/oom/oomd-util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/oom/oomd-util.c b/src/oom/oomd-util.c index 1fc81d1843..70a1dc941e 100644 --- a/src/oom/oomd-util.c +++ b/src/oom/oomd-util.c @@ -164,7 +164,7 @@ int oomd_fetch_cgroup_oom_preference(OomdCGroupContext *ctx, const char *prefix) if (r < 0) return log_debug_errno(r, "Failed to get owner/group from %s: %m", ctx->path); - if (uid == prefix_uid) { + if (uid == prefix_uid || uid == 0) { /* Ignore most errors when reading the xattr since it is usually unset and cgroup xattrs are only used * as an optional feature of systemd-oomd (and the system might not even support them). */ r = cg_get_xattr_bool(SYSTEMD_CGROUP_CONTROLLER, ctx->path, "user.oomd_avoid"); From f05bcc18941eef5c2f93cfa06660eb06e0dc4c55 Mon Sep 17 00:00:00 2001 From: Nick Rosbrook Date: Tue, 22 Nov 2022 11:30:03 -0500 Subject: [PATCH 2/2] oomd: fix unreachable test case in test-oomd-util This conditional with !empty_or_root(ctx->path) always returns false because the most recent oomd_cgroup_context_acquire() call was with the root cgroup. Make sure this test case can be reached by checking cgroup instead of ctx->path. While here, use an unused uid (61183) instead of the nobody uid so the test case does not fail in unprivileged LXD containers. --- src/oom/test-oomd-util.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/oom/test-oomd-util.c b/src/oom/test-oomd-util.c index 176e3a8d69..faa75c5578 100644 --- a/src/oom/test-oomd-util.c +++ b/src/oom/test-oomd-util.c @@ -475,9 +475,9 @@ static void test_oomd_fetch_cgroup_oom_preference(void) { /* Assert that avoid/omit are not set if the cgroup and prefix are not * owned by the same user.*/ - if (test_xattrs && !empty_or_root(ctx->path)) { + if (test_xattrs && !empty_or_root(cgroup)) { ctx = oomd_cgroup_context_free(ctx); - assert_se(cg_set_access(SYSTEMD_CGROUP_CONTROLLER, cgroup, 65534, 0) >= 0); + assert_se(cg_set_access(SYSTEMD_CGROUP_CONTROLLER, cgroup, 61183, 0) >= 0); assert_se(oomd_cgroup_context_acquire(cgroup, &ctx) == 0); assert_se(oomd_fetch_cgroup_oom_preference(ctx, NULL) == 0);