From 0fbb569de1dcc06118dba006cf7a40caf6cd94d0 Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Tue, 30 Jul 2024 11:53:32 +0200 Subject: [PATCH 1/2] cgroup-util: Ignore kernel threads in cg_kill_items() Similar to the implementation of cgroup.kill in the kernel, let's skip kernel threads in cg_kill_items() as trying to kill kernel threads as an unprivileged process will fail with EPERM and doesn't do anything when running privileged. --- src/basic/cgroup-util.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/basic/cgroup-util.c b/src/basic/cgroup-util.c index 65fbd09159..c2150c00c6 100644 --- a/src/basic/cgroup-util.c +++ b/src/basic/cgroup-util.c @@ -369,6 +369,12 @@ static int cg_kill_items( if (set_get(s, PID_TO_PTR(pidref.pid)) == PID_TO_PTR(pidref.pid)) continue; + /* Ignore kernel threads to mimick the behavior of cgroup.kill. */ + if (pidref_is_kernel_thread(&pidref) > 0) { + log_debug("Ignoring kernel thread with pid " PID_FMT " in cgroup '%s'", pidref.pid, path); + continue; + } + if (log_kill) ret_log_kill = log_kill(&pidref, sig, userdata); From ead48ec35c863650944352a3455f26ce3b393058 Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Wed, 31 Jul 2024 13:38:50 +0200 Subject: [PATCH 2/2] cgroup-util: Don't try to open pidfd for kernel threads The kernel might start returning -EINVAL when trying to open pidfd's for kernel threads so let's not try to open pidfd's for kernel threads. --- src/basic/cgroup-util.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/basic/cgroup-util.c b/src/basic/cgroup-util.c index c2150c00c6..ffce7504f4 100644 --- a/src/basic/cgroup-util.c +++ b/src/basic/cgroup-util.c @@ -149,7 +149,9 @@ int cg_read_pidref(FILE *f, PidRef *ret, CGroupFlags flags) { if (pid == 0) return -EREMOTE; - if (FLAGS_SET(flags, CGROUP_NO_PIDFD)) { + /* We might read kernel thread pids from cgroup.procs for which we cannot create a pidfd so + * catch those and don't try to create a pidfd for them. */ + if (FLAGS_SET(flags, CGROUP_NO_PIDFD) || pid_is_kernel_thread(pid) > 0) { *ret = PIDREF_MAKE_FROM_PID(pid); return 1; }