From bde7e12255a82f9b714fb3e44c291a79f7647cc9 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 11 Oct 2023 11:09:09 +0200 Subject: [PATCH 1/4] limits-util: suppress noisy debug message when reading tasks in top-level cgroup We have the "tasks.max" cgroup attribute only if we run in a cgroup namespace, but not on the host. Hence let's handle ENODATA silently simply to reduce the debug noise generated. --- src/basic/limits-util.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/basic/limits-util.c b/src/basic/limits-util.c index dc0a2a6c94..9597c4c41c 100644 --- a/src/basic/limits-util.c +++ b/src/basic/limits-util.c @@ -156,8 +156,11 @@ uint64_t system_tasks_max(void) { if (r < 0) log_debug_errno(r, "Failed to determine cgroup root path, ignoring: %m"); else { + /* We'll have the "pids.max" attribute on the our root cgroup only if we are in a + * CLONE_NEWCGROUP namespace. On the top-level namespace this attribute is missing, hence + * suppress any message about that */ r = cg_get_attribute_as_uint64("pids", root, "pids.max", &c); - if (r < 0) + if (r < 0 && r != -ENODATA) log_debug_errno(r, "Failed to read pids.max attribute of root cgroup, ignoring: %m"); } From 91a6447607635802ac2278b7997cde687e2549a4 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 11 Oct 2023 11:11:12 +0200 Subject: [PATCH 2/4] fdset: improve debug logging for left-over fds Let's show which fds are closed as part of the left-over fd set logic on daemon reload/reexec cycles. This is useful to debug accidentally unclaimed fds. --- src/shared/fdset.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/shared/fdset.c b/src/shared/fdset.c index f5dcdce218..b62f15c649 100644 --- a/src/shared/fdset.c +++ b/src/shared/fdset.c @@ -54,6 +54,8 @@ void fdset_close(FDSet *s) { void *p; while ((p = set_steal_first(MAKE_SET(s)))) { + int fd = PTR_TO_FD(p); + /* Valgrind's fd might have ended up in this set here, due to fdset_new_fill(). We'll ignore * all failures here, so that the EBADFD that valgrind will return us on close() doesn't * influence us */ @@ -62,8 +64,14 @@ void fdset_close(FDSet *s) { * which has no effect at all, since they are only duplicates. So don't be surprised about * these log messages. */ - log_debug("Closing set fd %i", PTR_TO_FD(p)); - (void) close_nointr(PTR_TO_FD(p)); + if (DEBUG_LOGGING) { + _cleanup_free_ char *path = NULL; + + (void) fd_get_path(fd, &path); + log_debug("Closing set fd %i (%s)", fd, strna(path)); + } + + (void) close_nointr(fd); } } From 58f1bd9b4ab889d0378a236d759649d4b45395f9 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 11 Oct 2023 11:22:49 +0200 Subject: [PATCH 3/4] bpf-lsm: suppress noisy debug log message if we remove a unit from the bpf-lsm table where it was never added There's really no point in logging about one of the most common cases we have: that no BPF-LSM policy was installed for a specific unit. --- src/core/bpf-lsm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/core/bpf-lsm.c b/src/core/bpf-lsm.c index 5f614ead04..22200bd939 100644 --- a/src/core/bpf-lsm.c +++ b/src/core/bpf-lsm.c @@ -228,11 +228,14 @@ int lsm_bpf_cleanup(const Unit *u) { if (!u->manager->restrict_fs) return 0; + if (u->cgroup_id == 0) + return 0; + int fd = sym_bpf_map__fd(u->manager->restrict_fs->maps.cgroup_hash); if (fd < 0) return log_unit_error_errno(u, errno, "bpf-lsm: Failed to get BPF map fd: %m"); - if (sym_bpf_map_delete_elem(fd, &u->cgroup_id) != 0) + if (sym_bpf_map_delete_elem(fd, &u->cgroup_id) != 0 && errno != ENOENT) return log_unit_debug_errno(u, errno, "bpf-lsm: Failed to delete cgroup entry from LSM BPF map: %m"); return 0; From 6fd38dc83ad5ae99355280ab81925d52fdfec038 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 11 Oct 2023 11:26:25 +0200 Subject: [PATCH 4/4] killall: suppress debug log if some cgroup doesn't have survive_final_kill_signal xattr set This is the default case, hence really no reason to be noisy about that. --- src/shared/killall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/shared/killall.c b/src/shared/killall.c index 1011cd83d3..ef715dbdfe 100644 --- a/src/shared/killall.c +++ b/src/shared/killall.c @@ -60,7 +60,7 @@ static bool is_survivor_cgroup(pid_t pid) { /* user xattr support was added to kernel v5.7, try with the trusted namespace as a fallback */ if (ERRNO_IS_NEG_XATTR_ABSENT(r)) r = cg_get_xattr_bool(cgroup_path, "trusted.survive_final_kill_signal"); - if (r < 0) + if (r < 0 && !ERRNO_IS_NEG_XATTR_ABSENT(r)) log_debug_errno(r, "Failed to get survive_final_kill_signal xattr of %s, ignoring: %m", cgroup_path);