SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cgroup-util: drop cg_freezer_supported() and cg_ns_supported() (#37201)

Browse Source
This commit is contained in:
Yu Watanabe
2025-04-22 08:58:52 +09:00
committed by GitHub
parent 239afa5971 497e607ca0
commit f62465b870
13 changed files with 17 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/basic/cgroup-util.c
-29
View File
@@ -241,35 +241,6 @@ int cg_read_event(
}
}
bool cg_ns_supported(void) {
static thread_local int supported = -1;
if (supported >= 0)
return supported;
if (access("/proc/self/ns/cgroup", F_OK) >= 0)
return (supported = true);
if (errno != ENOENT)
log_debug_errno(errno, "Failed to check whether /proc/self/ns/cgroup is available, assuming not: %m");
return (supported = false);
}
bool cg_freezer_supported(void) {
static thread_local int supported = -1;
if (supported >= 0)
return supported;
if (cg_all_unified() <= 0)
return (supported = false);
if (access("/sys/fs/cgroup/init.scope/cgroup.freeze", F_OK) >= 0)
return (supported = true);
if (errno != ENOENT)
log_debug_errno(errno, "Failed to check whether cgroup freezer is available, assuming not: %m");
return (supported = false);
}
bool cg_kill_supported(void) {
static thread_local int supported = -1;
src/basic/cgroup-util.h
-2
View File
@@ -311,8 +311,6 @@ int cg_mask_supported_subtree(const char *root, CGroupMask *ret);
int cg_mask_from_string(const char *s, CGroupMask *ret);
int cg_mask_to_string(CGroupMask mask, char **ret);
bool cg_ns_supported(void);
bool cg_freezer_supported(void);
bool cg_kill_supported(void);
int cg_all_unified(void);
src/basic/namespace-util.c
+7
View File
@@ -48,6 +48,13 @@ NamespaceType clone_flag_to_namespace_type(unsigned long clone_flag) {
return _NAMESPACE_TYPE_INVALID;
}
bool namespace_type_supported(NamespaceType type) {
assert(type >= 0 && type < _NAMESPACE_TYPE_MAX);
const char *p = pid_namespace_path(0, type);
return access(p, F_OK) >= 0;
}
static int pidref_namespace_open_by_type_internal(const PidRef *pidref, NamespaceType type, bool *need_verify) {
int r;
src/basic/namespace-util.h
+2
View File
@@ -28,6 +28,8 @@ extern const struct namespace_info {
NamespaceType clone_flag_to_namespace_type(unsigned long clone_flag);
bool namespace_type_supported(NamespaceType type);
int pidref_namespace_open_by_type(const PidRef *pidref, NamespaceType type);
int namespace_open_by_type(NamespaceType type);
src/core/cgroup.c
-3
View File
@@ -4385,9 +4385,6 @@ int unit_cgroup_freezer_action(Unit *u, FreezerAction action) {
assert(action >= 0);
assert(action < _FREEZER_ACTION_MAX);
if (!cg_freezer_supported())
return 0;
unit_next_freezer_state(u, action, &next, &objective);
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
src/core/exec-invoke.c
+3 -3
View File
@@ -1820,7 +1820,7 @@ static int apply_protect_hostname(const ExecContext *c, const ExecParameters *p,
if (c->protect_hostname == PROTECT_HOSTNAME_NO)
return 0;
if (ns_type_supported(NAMESPACE_UTS)) {
if (namespace_type_supported(NAMESPACE_UTS)) {
if (unshare(CLONE_NEWUTS) < 0) {
if (!ERRNO_IS_NOT_SUPPORTED(errno) && !ERRNO_IS_PRIVILEGE(errno)) {
*ret_exit_status = EXIT_NAMESPACE;
@@ -4339,7 +4339,7 @@ static int setup_delegated_namespaces(
* own user namespace). We need CAP_NET_ADMIN to be able to configure the loopback device in
* the new network namespace. And if we don't have that, then we could only create a network
* namespace without the ability to set up "lo". Hence gracefully skip things then. */
if (ns_type_supported(NAMESPACE_NET) && have_effective_cap(CAP_NET_ADMIN) > 0) {
if (namespace_type_supported(NAMESPACE_NET) && have_effective_cap(CAP_NET_ADMIN) > 0) {
r = setup_shareable_ns(runtime->shared->netns_storage_socket, CLONE_NEWNET);
if (ERRNO_IS_NEG_PRIVILEGE(r))
log_exec_notice_errno(context, params, r,
@@ -4361,7 +4361,7 @@ static int setup_delegated_namespaces(
exec_namespace_is_delegated(context, params, have_cap_sys_admin, CLONE_NEWIPC) == delegate &&
runtime->shared && runtime->shared->ipcns_storage_socket[0] >= 0) {
if (ns_type_supported(NAMESPACE_IPC)) {
if (namespace_type_supported(NAMESPACE_IPC)) {
r = setup_shareable_ns(runtime->shared->ipcns_storage_socket, CLONE_NEWIPC);
if (ERRNO_IS_NEG_PRIVILEGE(r))
log_exec_warning_errno(context, params, r,
src/core/execute.c
+2 -2
View File
@@ -243,7 +243,7 @@ ProtectControlGroups exec_get_protect_control_groups(const ExecContext *context)
* use cgroup namespace, we ignore the setting and do not unshare the namespace.
* ProtectControlGroups=private and strict get downgraded to no and yes respectively. This ensures
* that strict always gets a read-only mount of /sys/fs/cgroup/. */
if (needs_cgroup_namespace(context->protect_control_groups) && !ns_type_supported(NAMESPACE_CGROUP)) {
if (needs_cgroup_namespace(context->protect_control_groups) && !namespace_type_supported(NAMESPACE_CGROUP)) {
if (context->protect_control_groups == PROTECT_CONTROL_GROUPS_PRIVATE)
return PROTECT_CONTROL_GROUPS_NO;
if (context->protect_control_groups == PROTECT_CONTROL_GROUPS_STRICT)
@@ -273,7 +273,7 @@ bool exec_is_cgroup_mount_read_only(const ExecContext *context) {
bool exec_needs_pid_namespace(const ExecContext *context) {
assert(context);
return context->private_pids != PRIVATE_PIDS_NO && ns_type_supported(NAMESPACE_PID);
return context->private_pids != PRIVATE_PIDS_NO && namespace_type_supported(NAMESPACE_PID);
}
bool exec_needs_mount_namespace(
src/core/namespace.c
-24
View File
@@ -3263,17 +3263,6 @@ int open_shareable_ns_path(int ns_storage_socket[static 2], const char *path, un
return 1;
}
bool ns_type_supported(NamespaceType type) {
const char *t, *ns_proc;
t = namespace_type_to_string(type);
if (!t) /* Don't know how to translate this? Then it's not supported */
return false;
ns_proc = strjoina("/proc/self/ns/", t);
return access(ns_proc, F_OK) == 0;
}
static const char *const protect_home_table[_PROTECT_HOME_MAX] = {
[PROTECT_HOME_NO] = "no",
[PROTECT_HOME_YES] = "yes",
@@ -3309,19 +3298,6 @@ static const char *const protect_control_groups_table[_PROTECT_CONTROL_GROUPS_MA
DEFINE_STRING_TABLE_LOOKUP_WITH_BOOLEAN(protect_control_groups, ProtectControlGroups, PROTECT_CONTROL_GROUPS_YES);
static const char* const namespace_type_table[] = {
[NAMESPACE_MOUNT] = "mnt",
[NAMESPACE_CGROUP] = "cgroup",
[NAMESPACE_UTS] = "uts",
[NAMESPACE_IPC] = "ipc",
[NAMESPACE_USER] = "user",
[NAMESPACE_PID] = "pid",
[NAMESPACE_NET] = "net",
[NAMESPACE_TIME] = "time",
};
DEFINE_STRING_TABLE_LOOKUP(namespace_type, NamespaceType);
static const char* const protect_proc_table[_PROTECT_PROC_MAX] = {
[PROTECT_PROC_DEFAULT] = "default",
[PROTECT_PROC_NOACCESS] = "noaccess",
src/core/namespace.h
-5
View File
@@ -258,8 +258,3 @@ int temporary_filesystem_add(TemporaryFileSystem **t, size_t *n,
MountImage* mount_image_free_many(MountImage *m, size_t *n);
int mount_image_add(MountImage **m, size_t *n, const MountImage *item);
const char* namespace_type_to_string(NamespaceType t) _const_;
NamespaceType namespace_type_from_string(const char *s) _pure_;
bool ns_type_supported(NamespaceType type);
src/core/socket.c
+1 -1
View File
@@ -1570,7 +1570,7 @@ static int socket_address_listen_in_cgroup(
s->exec_runtime->shared &&
s->exec_runtime->shared->netns_storage_socket[0] >= 0) {
if (ns_type_supported(NAMESPACE_NET)) {
if (namespace_type_supported(NAMESPACE_NET)) {
r = setup_shareable_ns(s->exec_runtime->shared->netns_storage_socket, CLONE_NEWNET);
if (r < 0) {
log_unit_error_errno(UNIT(s), r, "Failed to join network namespace: %m");
src/core/unit.c
+1 -1
View File
@@ -6296,7 +6296,7 @@ int unit_freezer_action(Unit *u, FreezerAction action) {
assert(u);
assert(IN_SET(action, FREEZER_FREEZE, FREEZER_THAW));
if (!cg_freezer_supported() || !unit_can_freeze(u))
if (!unit_can_freeze(u))
return -EOPNOTSUPP;
if (u->job)
src/nspawn/nspawn.c
+1 -1
View File
@@ -588,7 +588,7 @@ static int parse_environment(void) {
/* SYSTEMD_NSPAWN_USE_CGNS=0 can be used to disable CLONE_NEWCGROUP use,
* even if it is supported. If not supported, it has no effect. */
if (!cg_ns_supported())
if (!namespace_type_supported(NAMESPACE_CGROUP))
arg_use_cgns = false;
else {
r = getenv_bool("SYSTEMD_NSPAWN_USE_CGNS");
src/test/test-tables.c
-1
View File
@@ -82,7 +82,6 @@ int main(int argc, char **argv) {
test_table(mount_result, MOUNT_RESULT);
test_table(mount_state, MOUNT_STATE);
test_table(name_policy, NAMEPOLICY);
test_table(namespace_type, NAMESPACE_TYPE);
test_table(notify_access, NOTIFY_ACCESS);
test_table(notify_state, NOTIFY_STATE);
test_table(output_mode, OUTPUT_MODE);