SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cgroup: Add support for ProtectControlGroups= private and strict

Browse Source 
This commit adds two settings private and strict to
the ProtectControlGroups= property. Private will unshare the cgroup
namespace and mount a read-write private cgroup2 filesystem at /sys/fs/cgroup.
Strict does the same except the mount is read-only. Since the unit is
running in a cgroup namespace, the new root of /sys/fs/cgroup is the unit's
own cgroup.

We also add a new dbus property ProtectControlGroupsEx which accepts strings
instead of boolean. This will allow users to use private/strict via dbus
and systemd-run in addition to service files.

Note private and strict fall back to no and yes respectively if the kernel
doesn't support cgroup2 or system is not using unified hierarchy.

Fixes: #34634
This commit is contained in:
Ryan Wilson
2024-10-28 08:37:36 -07:00
parent 5fe2923828
commit cd58b5a135
10 changed files with 323 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd.exec.xml
+15 -7
View File
@@ -2117,14 +2117,22 @@ BindReadOnlyPaths=/var/lib/systemd</programlisting>
<varlistentry>
<term><varname>ProtectControlGroups=</varname></term>
<listitem><para>Takes a boolean argument. If true, the Linux Control Groups (<citerefentry
project='man-pages'><refentrytitle>cgroups</refentrytitle><manvolnum>7</manvolnum></citerefentry>) hierarchies
<listitem><para>Takes a boolean argument or the special values <literal>private</literal> or
<literal>strict</literal>. If true, the Linux Control Groups (<citerefentry project='man-pages'>
<refentrytitle>cgroups</refentrytitle><manvolnum>7</manvolnum></citerefentry>) hierarchies
accessible through <filename>/sys/fs/cgroup/</filename> will be made read-only to all processes of the
unit. Except for container managers no services should require write access to the control groups hierarchies;
it is hence recommended to turn this on for most services. For this setting the same restrictions regarding
mount propagation and privileges apply as for <varname>ReadOnlyPaths=</varname> and related calls, see
above. Defaults to off. If <varname>ProtectControlGroups=</varname> is set, <varname>MountAPIVFS=yes</varname>
is implied.</para>
unit. If set to <literal>private</literal>, the unit will run in a cgroup namespace with a private
writable mount of <filename>/sys/fs/cgroup/</filename>. If set to <literal>strict</literal>, the unit
will run in a cgroup namespace with a private read-only mount of <filename>/sys/fs/cgroup/</filename>.
Defaults to off. If <varname>ProtectControlGroups=</varname> is set, <varname>MountAPIVFS=yes</varname>
is implied. Note <literal>private</literal> and <literal>strict</literal> are downgraded to false and
true respectively unless the system is using the unified control group hierarchy and the kernel supports
cgroup namespaces.</para>
<para>Except for container managers no services should require write access to the control groups hierarchies;
it is hence recommended to set <varname>ProtectControlGroups=</varname> to true or <literal>strict</literal>
for most services. For this setting the same restrictions regarding mount propagation and privileges apply
as for <varname>ReadOnlyPaths=</varname> and related settings, see above.</para>
<xi:include href="system-only.xml" xpointer="singular"/>