From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on sa.local.altlinux.org X-Spam-Level: X-Spam-Status: No, score=-1.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, T_DKIM_INVALID autolearn=no autolearn_force=no version=3.4.1 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=altlinux.org; s=dkim; h=Subject:Content-Transfer-Encoding:MIME-Version: References:In-Reply-To:Message-Id:Date:Cc:To:From:Sender:Reply-To: Content-Type:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help: List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=dsJAvfhiP8kzkvSU3uqmAyv67IOpf3NH9w7HFmlFZTs=; b=de122hvuOmlV7zWmbM0LtDy2g5 sWS93O/T89IhWYLpvmqp2Yr7OsNybsdjzfTXKDxqAcfbJwqYGa5lQ+R3TJXqiDp12RLD8WJP3MFFc rvqi3riSXZdd4qdGO0BN/KmEO//2u/6PxSG1/EJ4ilHZsQC+i7tb98nSUpm/Q3QMfUrAHYTEaURak HATVzfm0WVzv0oo3GHkynBzT+kg2A7V7/QDAzRF0J9LFit6CYWHR+XEIaJ0EojZS/duCH7v7rWOsC btEAP1+WnyFog2pQ3LRAk/nhZC7hqhinn9aZpTGR9OJxYYYlbZ/sYuwo9HdP8i5GwWhz6Jb3dxkQW sOQBaBjQ==; From: Arseny Maslennikov To: devel@lists.altlinux.org, ldv@altlinux.org Date: Thu, 22 Oct 2020 14:43:43 +0300 Message-Id: <20201022114343.1810141-7-arseny@altlinux.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201022114343.1810141-1-arseny@altlinux.org> References: <20201022114343.1810141-1-arseny@altlinux.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SA-Exim-Connect-IP: 37.204.119.143 X-SA-Exim-Mail-From: arseny@altlinux.org X-SA-Exim-Version: 4.2.1 X-SA-Exim-Scanned: Yes (on mail.cs.msu.ru) Cc: Arseny Maslennikov , Alexey Gladkov Subject: [devel] [PATCH v2 6/6] Add preliminary cgroup support X-BeenThere: devel@lists.altlinux.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: ALT Linux Team development discussions List-Id: ALT Linux Team development discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Oct 2020 11:44:01 -0000 Archived-At: List-Archive: List-Post: From: Alexey Gladkov A new configuration option allows to put all request handlers to a particular cgroup path, which is built according to a specified template. Note that cgroup1 API is not supported in favour of cgroup2. Signed-off-by: Alexey Gladkov Signed-off-by: Arseny Maslennikov --- hasher-priv/Makefile | 2 +- hasher-priv/caller_task.c | 3 + hasher-priv/cgroup.c | 119 ++++++++++++++++++++++++++++++++++++++ hasher-priv/config.c | 5 ++ hasher-priv/priv.h | 2 + hasher-priv/server.conf | 9 +++ 6 files changed, 139 insertions(+), 1 deletion(-) create mode 100644 hasher-priv/cgroup.c diff --git a/hasher-priv/Makefile b/hasher-priv/Makefile index 6e6b1e5..be25fb7 100644 --- a/hasher-priv/Makefile +++ b/hasher-priv/Makefile @@ -52,7 +52,7 @@ server_SRC = hasher-privd.c \ chdir.c chdiruid.c chid.c child.c chrootuid.c cmdline.c \ config.c fds.c getconf.c getugid.c ipc.c killuid.c io_log.c io_x11.c \ makedev.c mount.c net.c parent.c pass.c pty.c signal.c tty.c \ - unshare.c xmalloc.c x11.c + unshare.c xmalloc.c x11.c cgroup.c server_OBJ = $(server_SRC:.c=.o) DEP = $(SRC:.c=.d) $(server_SRC:.c=.d) diff --git a/hasher-priv/caller_task.c b/hasher-priv/caller_task.c index 46745a2..48d8fbd 100644 --- a/hasher-priv/caller_task.c +++ b/hasher-priv/caller_task.c @@ -100,6 +100,9 @@ caller_task(struct task *task) setproctitle("%s for [%u:%u]: %s", "task handler", caller_uid, caller_num, task2str(task->type)); + if (join_cgroup() < 0) + exit(rc); + if ((rc = reopen_iostreams(task->stdin, task->stdout, task->stderr)) < 0) exit(rc); diff --git a/hasher-priv/cgroup.c b/hasher-priv/cgroup.c new file mode 100644 index 0000000..ac14938 --- /dev/null +++ b/hasher-priv/cgroup.c @@ -0,0 +1,119 @@ + +/* + Copyright (C) 2019 Alexey Gladkov + + The cgroup helper for hasher-privd program. + + SPDX-License-Identifier: GPL-2.0-or-later +*/ + +#include +#include +#include + +#include +#include +#include +#include +#include +#include + +#include "logging.h" +#include "priv.h" + +int +join_cgroup(void) +{ + int ret = 0; + + if (!server_cgroup_template) + return ret; + + char cgroup_path[MAXPATHLEN]; + + size_t i, j, escape; + size_t len = strlen(server_cgroup_template); + int fd = -1; + + i = j = escape = 0; + + for (; i < len; i++) { + if (j > sizeof(cgroup_path)) { + err("path too long"); + ret = -1; + goto fail; + } + + if (escape) { + ssize_t n = 0; + char *p = cgroup_path + j; + size_t sz = (size_t) (p - cgroup_path); + + switch (server_cgroup_template[i]) { + case 'u': + n = snprintf(p, sz, "%s", caller_user); + break; + case 'U': + n = snprintf(p, sz, "%u", caller_uid); + break; + case 'G': + n = snprintf(p, sz, "%u", caller_gid); + break; + case 'N': + n = snprintf(p, sz, "%u", caller_num); + break; + case '%': + n = snprintf(p, sz, "%%"); + break; + } + + if (n <= 0) { + err("unable to expand escape sequence: %%%c", + server_cgroup_template[i]); + ret = -1; + goto fail; + } + + j += (size_t) n; + + escape = 0; + continue; + + } else if (server_cgroup_template[i] == '%') { + escape = 1; + continue; + + } else if (server_cgroup_template[i] == '/' && j > 0) { + cgroup_path[j] = '\0'; + + errno = 0; + if (mkdir(cgroup_path, 0755) < 0 && errno != EEXIST) { + err("mkdir: %s: errno=%d: %m", cgroup_path, errno); + ret = -1; + goto fail; + } + } + + cgroup_path[j++] = server_cgroup_template[i]; + } + + cgroup_path[j] = '\0'; + + if ((fd = open(cgroup_path, O_CREAT | O_WRONLY | O_CLOEXEC, 0644)) < 0) { + err("open: %s: %m", cgroup_path); + ret = -1; + goto fail; + } + + if (dprintf(fd, "%d\n", getpid()) < 0) { + err("dprintf: %s: unable to write pid", cgroup_path); + ret = -1; + } +fail: + if (fd >= 0 && close(fd) < 0) { + err("close: %s: %m", cgroup_path); + ret = -1; + } + + return ret; +} diff --git a/hasher-priv/config.c b/hasher-priv/config.c index ce83e15..9729982 100644 --- a/hasher-priv/config.c +++ b/hasher-priv/config.c @@ -30,6 +30,7 @@ const char *const *chroot_prefix_list; const char *chroot_prefix_path; const char *change_user1, *change_user2; char *server_access_group = NULL; +char *server_cgroup_template = NULL; char *server_pidfile = NULL; const char *term; const char *x11_display, *x11_key; @@ -671,6 +672,9 @@ set_server_config(const char *name, const char *value, const char *filename) } else if (!strcasecmp("access_group", name)) { free(server_access_group); server_access_group = xstrdup(value); + } else if (!strcasecmp("cgroup_template", name)) { + free(server_cgroup_template); + server_cgroup_template = xstrdup(value); } else { bad_option_name(name, filename); } @@ -771,4 +775,5 @@ free_server_configuration(void) { free(server_pidfile); free(server_access_group); + free(server_cgroup_template); } diff --git a/hasher-priv/priv.h b/hasher-priv/priv.h index 7d5a5a5..6e8a032 100644 --- a/hasher-priv/priv.h +++ b/hasher-priv/priv.h @@ -120,6 +120,7 @@ int do_chrootuid2(void); int process_caller_task(int, struct task *); pid_t fork_server(int, uid_t, gid_t, unsigned); +int join_cgroup(void); extern const char *chroot_path; extern const char **chroot_argv; @@ -162,6 +163,7 @@ extern work_limit_t wlimit; extern int server_log_priority; extern unsigned long server_session_timeout; extern char *server_access_group; +extern char *server_cgroup_template; extern char *server_pidfile; extern gid_t server_gid; diff --git a/hasher-priv/server.conf b/hasher-priv/server.conf index 2d740a6..57744f9 100644 --- a/hasher-priv/server.conf +++ b/hasher-priv/server.conf @@ -11,3 +11,12 @@ session_timeout=3600 # Allow users of this group to interact with hasher-privd via the control socket. access_group=hashman + +# Template for cgroup path to which task handler should be added. +# +# %u -- Session's user name. +# %U -- Session's user numeric ID. +# %G -- Session's group numeric ID. +# %N -- Session's user number. +# +#cgroup_template=/sys/fs/cgroup2/hasher-priv/%u/cgroup.procs -- 2.25.4