[devel] [PATCH v2 6/6] Add preliminary cgroup support

[Arseny Maslennikov <arseny@altlinux.org>]

From: Alexey Gladkov <legion@altlinux.org>

A new configuration option allows to put all request handlers to a
particular cgroup path, which is built according to a specified template.

Note that cgroup1 API is not supported in favour of cgroup2.

Signed-off-by: Alexey Gladkov <legion@altlinux.org>
Signed-off-by: Arseny Maslennikov <arseny@altlinux.org>
---
 hasher-priv/Makefile      |   2 +-
 hasher-priv/caller_task.c |   3 +
 hasher-priv/cgroup.c      | 119 ++++++++++++++++++++++++++++++++++++++
 hasher-priv/config.c      |   5 ++
 hasher-priv/priv.h        |   2 +
 hasher-priv/server.conf   |   9 +++
 6 files changed, 139 insertions(+), 1 deletion(-)
 create mode 100644 hasher-priv/cgroup.c

diff --git a/hasher-priv/Makefile b/hasher-priv/Makefile
index 6e6b1e5..be25fb7 100644
--- a/hasher-priv/Makefile
+++ b/hasher-priv/Makefile
@@ -52,7 +52,7 @@ server_SRC = hasher-privd.c \
 	chdir.c chdiruid.c chid.c child.c chrootuid.c cmdline.c \
 	config.c fds.c getconf.c getugid.c ipc.c killuid.c io_log.c io_x11.c \
 	makedev.c mount.c net.c parent.c pass.c pty.c signal.c tty.c \
-	unshare.c xmalloc.c x11.c
+	unshare.c xmalloc.c x11.c cgroup.c
 server_OBJ = $(server_SRC:.c=.o)
 
 DEP = $(SRC:.c=.d) $(server_SRC:.c=.d)
diff --git a/hasher-priv/caller_task.c b/hasher-priv/caller_task.c
index 46745a2..48d8fbd 100644
--- a/hasher-priv/caller_task.c
+++ b/hasher-priv/caller_task.c
@@ -100,6 +100,9 @@ caller_task(struct task *task)
 
 	setproctitle("%s for [%u:%u]: %s", "task handler", caller_uid, caller_num, task2str(task->type));
 
+	if (join_cgroup() < 0)
+		exit(rc);
+
 	if ((rc = reopen_iostreams(task->stdin, task->stdout, task->stderr)) < 0)
 		exit(rc);
 
diff --git a/hasher-priv/cgroup.c b/hasher-priv/cgroup.c
new file mode 100644
index 0000000..ac14938
--- /dev/null
+++ b/hasher-priv/cgroup.c
@@ -0,0 +1,119 @@
+
+/*
+  Copyright (C) 2019  Alexey Gladkov <legion@altlinux.org>
+
+  The cgroup helper for hasher-privd program.
+
+  SPDX-License-Identifier: GPL-2.0-or-later
+*/
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include <unistd.h>
+#include <stdio.h>
+#include <stdarg.h>
+#include <string.h>
+#include <fcntl.h>
+#include <errno.h>
+
+#include "logging.h"
+#include "priv.h"
+
+int
+join_cgroup(void)
+{
+	int ret = 0;
+
+	if (!server_cgroup_template)
+		return ret;
+
+	char cgroup_path[MAXPATHLEN];
+
+	size_t i, j, escape;
+	size_t len = strlen(server_cgroup_template);
+	int fd = -1;
+
+	i = j = escape = 0;
+
+	for (; i < len; i++) {
+		if (j > sizeof(cgroup_path)) {
+			err("path too long");
+			ret = -1;
+			goto fail;
+		}
+
+		if (escape) {
+			ssize_t n = 0;
+			char *p = cgroup_path + j;
+			size_t sz = (size_t) (p - cgroup_path);
+
+			switch (server_cgroup_template[i]) {
+				case 'u':
+					n = snprintf(p, sz, "%s", caller_user);
+					break;
+				case 'U':
+					n = snprintf(p, sz, "%u", caller_uid);
+					break;
+				case 'G':
+					n = snprintf(p, sz, "%u", caller_gid);
+					break;
+				case 'N':
+					n = snprintf(p, sz, "%u", caller_num);
+					break;
+				case '%':
+					n = snprintf(p, sz, "%%");
+					break;
+			}
+
+			if (n <= 0) {
+				err("unable to expand escape sequence: %%%c",
+				    server_cgroup_template[i]);
+				ret = -1;
+				goto fail;
+			}
+
+			j += (size_t) n;
+
+			escape = 0;
+			continue;
+
+		} else if (server_cgroup_template[i] == '%') {
+			escape = 1;
+			continue;
+
+		} else if (server_cgroup_template[i] == '/' && j > 0) {
+			cgroup_path[j] = '\0';
+
+			errno = 0;
+			if (mkdir(cgroup_path, 0755) < 0 && errno != EEXIST) {
+				err("mkdir: %s: errno=%d: %m", cgroup_path, errno);
+				ret = -1;
+				goto fail;
+			}
+		}
+
+		cgroup_path[j++] = server_cgroup_template[i];
+	}
+
+	cgroup_path[j] = '\0';
+
+	if ((fd = open(cgroup_path, O_CREAT | O_WRONLY | O_CLOEXEC, 0644)) < 0) {
+		err("open: %s: %m", cgroup_path);
+		ret = -1;
+		goto fail;
+	}
+
+	if (dprintf(fd, "%d\n", getpid()) < 0) {
+		err("dprintf: %s: unable to write pid", cgroup_path);
+		ret = -1;
+	}
+fail:
+	if (fd >= 0 && close(fd) < 0) {
+		err("close: %s: %m", cgroup_path);
+		ret = -1;
+	}
+
+	return ret;
+}
diff --git a/hasher-priv/config.c b/hasher-priv/config.c
index ce83e15..9729982 100644
--- a/hasher-priv/config.c
+++ b/hasher-priv/config.c
@@ -30,6 +30,7 @@ const char *const *chroot_prefix_list;
 const char *chroot_prefix_path;
 const char *change_user1, *change_user2;
 char *server_access_group = NULL;
+char *server_cgroup_template = NULL;
 char *server_pidfile = NULL;
 const char *term;
 const char *x11_display, *x11_key;
@@ -671,6 +672,9 @@ set_server_config(const char *name, const char *value, const char *filename)
 	} else if (!strcasecmp("access_group", name)) {
 		free(server_access_group);
 		server_access_group = xstrdup(value);
+	} else if (!strcasecmp("cgroup_template", name)) {
+		free(server_cgroup_template);
+		server_cgroup_template = xstrdup(value);
 	} else {
 		bad_option_name(name, filename);
 	}
@@ -771,4 +775,5 @@ free_server_configuration(void)
 {
 	free(server_pidfile);
 	free(server_access_group);
+	free(server_cgroup_template);
 }
diff --git a/hasher-priv/priv.h b/hasher-priv/priv.h
index 7d5a5a5..6e8a032 100644
--- a/hasher-priv/priv.h
+++ b/hasher-priv/priv.h
@@ -120,6 +120,7 @@ int     do_chrootuid2(void);
 
 int process_caller_task(int, struct task *);
 pid_t fork_server(int, uid_t, gid_t, unsigned);
+int join_cgroup(void);
 
 extern const char *chroot_path;
 extern const char **chroot_argv;
@@ -162,6 +163,7 @@ extern work_limit_t wlimit;
 extern int server_log_priority;
 extern unsigned long server_session_timeout;
 extern char *server_access_group;
+extern char *server_cgroup_template;
 extern char *server_pidfile;
 extern gid_t server_gid;
 
diff --git a/hasher-priv/server.conf b/hasher-priv/server.conf
index 2d740a6..57744f9 100644
--- a/hasher-priv/server.conf
+++ b/hasher-priv/server.conf
@@ -11,3 +11,12 @@ session_timeout=3600
 
 # Allow users of this group to interact with hasher-privd via the control socket.
 access_group=hashman
+
+# Template for cgroup path to which task handler should be added.
+#
+# %u -- Session's user name.
+# %U -- Session's user numeric ID.
+# %G -- Session's group numeric ID.
+# %N -- Session's user number.
+#
+#cgroup_template=/sys/fs/cgroup2/hasher-priv/%u/cgroup.procs
-- 
2.25.4