2 * lxc: linux Container library
4 * Copyright © 2016 Canonical Ltd.
7 * Serge Hallyn <serge.hallyn@ubuntu.com>
8 * Christian Brauner <christian.brauner@ubuntu.com>
10 * This library is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU Lesser General Public
12 * License as published by the Free Software Foundation; either
13 * version 2.1 of the License, or (at your option) any later version.
15 * This library is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 * Lesser General Public License for more details.
20 * You should have received a copy of the GNU Lesser General Public
21 * License along with this library; if not, write to the Free Software
22 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
26 * cgfs-ng.c: this is a new, simplified implementation of a filesystem
27 * cgroup backend. The original cgfs.c was designed to be as flexible
28 * as possible. It would try to find cgroup filesystems no matter where
29 * or how you had them mounted, and deduce the most usable mount for
32 * This new implementation assumes that cgroup filesystems are mounted
33 * under /sys/fs/cgroup/clist where clist is either the controller, or
34 * a comma-separated list of controllers.
44 #include <linux/kdev_t.h>
45 #include <linux/types.h>
50 #include <sys/types.h>
55 #include "cgroup_utils.h"
61 #include "memory_utils.h"
62 #include "storage/storage.h"
66 #include "include/strlcpy.h"
70 #include "include/strlcat.h"
73 lxc_log_define(cgfsng
, cgroup
);
75 static void free_string_list(char **clist
)
82 for (i
= 0; clist
[i
]; i
++)
88 /* Given a pointer to a null-terminated array of pointers, realloc to add one
89 * entry, and point the new entry to NULL. Do not fail. Return the index to the
90 * second-to-last entry - that is, the one which is now available for use
91 * (keeping the list null-terminated).
93 static int append_null_to_list(void ***list
)
98 for (; (*list
)[newentry
]; newentry
++)
101 *list
= must_realloc(*list
, (newentry
+ 2) * sizeof(void **));
102 (*list
)[newentry
+ 1] = NULL
;
106 /* Given a null-terminated array of strings, check whether @entry is one of the
109 static bool string_in_list(char **list
, const char *entry
)
116 for (i
= 0; list
[i
]; i
++)
117 if (strcmp(list
[i
], entry
) == 0)
123 /* Return a copy of @entry prepending "name=", i.e. turn "systemd" into
124 * "name=systemd". Do not fail.
126 static char *cg_legacy_must_prefix_named(char *entry
)
132 prefixed
= must_realloc(NULL
, len
+ 6);
134 memcpy(prefixed
, "name=", STRLITERALLEN("name="));
135 memcpy(prefixed
+ STRLITERALLEN("name="), entry
, len
);
136 prefixed
[len
+ 5] = '\0';
141 /* Append an entry to the clist. Do not fail. @clist must be NULL the first time
144 * We also handle named subsystems here. Any controller which is not a kernel
145 * subsystem, we prefix "name=". Any which is both a kernel and named subsystem,
146 * we refuse to use because we're not sure which we have here.
147 * (TODO: We could work around this in some cases by just remounting to be
148 * unambiguous, or by comparing mountpoint contents with current cgroup.)
150 * The last entry will always be NULL.
152 static void must_append_controller(char **klist
, char **nlist
, char ***clist
,
158 if (string_in_list(klist
, entry
) && string_in_list(nlist
, entry
)) {
159 ERROR("Refusing to use ambiguous controller \"%s\"", entry
);
160 ERROR("It is both a named and kernel subsystem");
164 newentry
= append_null_to_list((void ***)clist
);
166 if (strncmp(entry
, "name=", 5) == 0)
167 copy
= must_copy_string(entry
);
168 else if (string_in_list(klist
, entry
))
169 copy
= must_copy_string(entry
);
171 copy
= cg_legacy_must_prefix_named(entry
);
173 (*clist
)[newentry
] = copy
;
176 /* Given a handler's cgroup data, return the struct hierarchy for the controller
177 * @c, or NULL if there is none.
179 struct hierarchy
*get_hierarchy(struct cgroup_ops
*ops
, const char *controller
)
185 if (!ops
->hierarchies
) {
186 TRACE("There are no useable cgroup controllers");
190 for (i
= 0; ops
->hierarchies
[i
]; i
++) {
192 /* This is the empty unified hierarchy. */
193 if (ops
->hierarchies
[i
]->controllers
&&
194 !ops
->hierarchies
[i
]->controllers
[0])
195 return ops
->hierarchies
[i
];
200 if (string_in_list(ops
->hierarchies
[i
]->controllers
, controller
))
201 return ops
->hierarchies
[i
];
205 WARN("There is no useable %s controller", controller
);
207 WARN("There is no empty unified cgroup hierarchy");
212 #define BATCH_SIZE 50
213 static void batch_realloc(char **mem
, size_t oldlen
, size_t newlen
)
215 int newbatches
= (newlen
/ BATCH_SIZE
) + 1;
216 int oldbatches
= (oldlen
/ BATCH_SIZE
) + 1;
218 if (!*mem
|| newbatches
> oldbatches
) {
219 *mem
= must_realloc(*mem
, newbatches
* BATCH_SIZE
);
223 static void append_line(char **dest
, size_t oldlen
, char *new, size_t newlen
)
225 size_t full
= oldlen
+ newlen
;
227 batch_realloc(dest
, oldlen
, full
+ 1);
229 memcpy(*dest
+ oldlen
, new, newlen
+ 1);
232 /* Slurp in a whole file */
233 static char *read_file(const char *fnam
)
235 __do_free
char *line
= NULL
;
236 __do_fclose
FILE *f
= NULL
;
239 size_t len
= 0, fulllen
= 0;
241 f
= fopen(fnam
, "r");
244 while ((linelen
= getline(&line
, &len
, f
)) != -1) {
245 append_line(&buf
, fulllen
, line
, linelen
);
251 /* Taken over modified from the kernel sources. */
252 #define NBITS 32 /* bits in uint32_t */
253 #define DIV_ROUND_UP(n, d) (((n) + (d)-1) / (d))
254 #define BITS_TO_LONGS(nr) DIV_ROUND_UP(nr, NBITS)
256 static void set_bit(unsigned bit
, uint32_t *bitarr
)
258 bitarr
[bit
/ NBITS
] |= (1 << (bit
% NBITS
));
261 static void clear_bit(unsigned bit
, uint32_t *bitarr
)
263 bitarr
[bit
/ NBITS
] &= ~(1 << (bit
% NBITS
));
266 static bool is_set(unsigned bit
, uint32_t *bitarr
)
268 return (bitarr
[bit
/ NBITS
] & (1 << (bit
% NBITS
))) != 0;
271 /* Create cpumask from cpulist aka turn:
279 static uint32_t *lxc_cpumask(char *buf
, size_t nbits
)
285 arrlen
= BITS_TO_LONGS(nbits
);
286 bitarr
= calloc(arrlen
, sizeof(uint32_t));
290 lxc_iterate_parts(token
, buf
, ",") {
295 start
= strtoul(token
, NULL
, 0);
297 range
= strchr(token
, '-');
299 end
= strtoul(range
+ 1, NULL
, 0);
301 if (!(start
<= end
)) {
312 set_bit(start
++, bitarr
);
318 /* Turn cpumask into simple, comma-separated cpulist. */
319 static char *lxc_cpumask_to_cpulist(uint32_t *bitarr
, size_t nbits
)
324 char **cpulist
= NULL
;
325 char numstr
[INTTYPE_TO_STRLEN(size_t)] = {0};
327 for (i
= 0; i
<= nbits
; i
++) {
328 if (!is_set(i
, bitarr
))
331 ret
= snprintf(numstr
, sizeof(numstr
), "%zu", i
);
332 if (ret
< 0 || (size_t)ret
>= sizeof(numstr
)) {
333 lxc_free_array((void **)cpulist
, free
);
337 ret
= lxc_append_string(&cpulist
, numstr
);
339 lxc_free_array((void **)cpulist
, free
);
347 tmp
= lxc_string_join(",", (const char **)cpulist
, false);
348 lxc_free_array((void **)cpulist
, free
);
353 static ssize_t
get_max_cpus(char *cpulist
)
356 char *maxcpus
= cpulist
;
359 c1
= strrchr(maxcpus
, ',');
363 c2
= strrchr(maxcpus
, '-');
377 cpus
= strtoul(c1
, NULL
, 0);
384 #define __ISOL_CPUS "/sys/devices/system/cpu/isolated"
385 #define __OFFLINE_CPUS "/sys/devices/system/cpu/offline"
386 static bool cg_legacy_filter_and_set_cpus(char *path
, bool am_initialized
)
388 __do_free
char *cpulist
= NULL
, *fpath
= NULL
, *isolcpus
= NULL
,
389 *offlinecpus
= NULL
, *posscpus
= NULL
;
390 __do_free
uint32_t *isolmask
= NULL
, *offlinemask
= NULL
,
396 ssize_t maxisol
= 0, maxoffline
= 0, maxposs
= 0;
397 bool bret
= false, flipped_bit
= false;
399 lastslash
= strrchr(path
, '/');
401 ERROR("Failed to detect \"/\" in \"%s\"", path
);
406 fpath
= must_make_path(path
, "cpuset.cpus", NULL
);
408 posscpus
= read_file(fpath
);
410 SYSERROR("Failed to read file \"%s\"", fpath
);
414 /* Get maximum number of cpus found in possible cpuset. */
415 maxposs
= get_max_cpus(posscpus
);
416 if (maxposs
< 0 || maxposs
>= INT_MAX
- 1)
419 if (file_exists(__ISOL_CPUS
)) {
420 isolcpus
= read_file(__ISOL_CPUS
);
422 SYSERROR("Failed to read file \"%s\"", __ISOL_CPUS
);
426 if (isdigit(isolcpus
[0])) {
427 /* Get maximum number of cpus found in isolated cpuset. */
428 maxisol
= get_max_cpus(isolcpus
);
429 if (maxisol
< 0 || maxisol
>= INT_MAX
- 1)
433 if (maxposs
< maxisol
)
437 TRACE("The path \""__ISOL_CPUS
"\" to read isolated cpus from does not exist");
440 if (file_exists(__OFFLINE_CPUS
)) {
441 offlinecpus
= read_file(__OFFLINE_CPUS
);
443 SYSERROR("Failed to read file \"%s\"", __OFFLINE_CPUS
);
447 if (isdigit(offlinecpus
[0])) {
448 /* Get maximum number of cpus found in offline cpuset. */
449 maxoffline
= get_max_cpus(offlinecpus
);
450 if (maxoffline
< 0 || maxoffline
>= INT_MAX
- 1)
454 if (maxposs
< maxoffline
)
455 maxposs
= maxoffline
;
458 TRACE("The path \""__OFFLINE_CPUS
"\" to read offline cpus from does not exist");
461 if ((maxisol
== 0) && (maxoffline
== 0)) {
462 cpulist
= move_ptr(posscpus
);
466 possmask
= lxc_cpumask(posscpus
, maxposs
);
468 ERROR("Failed to create cpumask for possible cpus");
473 isolmask
= lxc_cpumask(isolcpus
, maxposs
);
475 ERROR("Failed to create cpumask for isolated cpus");
480 if (maxoffline
> 0) {
481 offlinemask
= lxc_cpumask(offlinecpus
, maxposs
);
483 ERROR("Failed to create cpumask for offline cpus");
488 for (i
= 0; i
<= maxposs
; i
++) {
489 if ((isolmask
&& !is_set(i
, isolmask
)) ||
490 (offlinemask
&& !is_set(i
, offlinemask
)) ||
491 !is_set(i
, possmask
))
495 clear_bit(i
, possmask
);
499 DEBUG("No isolated or offline cpus present in cpuset");
502 DEBUG("Removed isolated or offline cpus from cpuset");
504 cpulist
= lxc_cpumask_to_cpulist(possmask
, maxposs
);
506 ERROR("Failed to create cpu list");
511 if (!am_initialized
) {
512 fpath
= must_make_path(path
, "cpuset.cpus", NULL
);
513 ret
= lxc_write_to_file(fpath
, cpulist
, strlen(cpulist
), false,
516 SYSERROR("Failed to write cpu list to \"%s\"", fpath
);
520 TRACE("Copied cpu settings of parent cgroup");
526 /* Copy contents of parent(@path)/@file to @path/@file */
527 static bool copy_parent_file(char *path
, char *file
)
529 __do_free
char *child_path
= NULL
, *parent_path
= NULL
, *value
= NULL
;
533 char *lastslash
= NULL
;
535 lastslash
= strrchr(path
, '/');
537 ERROR("Failed to detect \"/\" in \"%s\"", path
);
542 parent_path
= must_make_path(path
, file
, NULL
);
543 len
= lxc_read_from_file(parent_path
, NULL
, 0);
545 SYSERROR("Failed to determine buffer size");
549 value
= must_realloc(NULL
, len
+ 1);
550 ret
= lxc_read_from_file(parent_path
, value
, len
);
552 SYSERROR("Failed to read from parent file \"%s\"", parent_path
);
557 child_path
= must_make_path(path
, file
, NULL
);
558 ret
= lxc_write_to_file(child_path
, value
, len
, false, 0666);
560 SYSERROR("Failed to write \"%s\" to file \"%s\"", value
, child_path
);
564 /* Initialize the cpuset hierarchy in first directory of @gname and set
565 * cgroup.clone_children so that children inherit settings. Since the
566 * h->base_path is populated by init or ourselves, we know it is already
569 static bool cg_legacy_handle_cpuset_hierarchy(struct hierarchy
*h
, char *cgname
)
571 __do_free
char *cgpath
= NULL
, *clonechildrenpath
= NULL
;
576 if (!string_in_list(h
->controllers
, "cpuset"))
581 slash
= strchr(cgname
, '/');
585 cgpath
= must_make_path(h
->mountpoint
, h
->container_base_path
, cgname
, NULL
);
589 ret
= mkdir(cgpath
, 0755);
591 if (errno
!= EEXIST
) {
592 SYSERROR("Failed to create directory \"%s\"", cgpath
);
597 clonechildrenpath
= must_make_path(cgpath
, "cgroup.clone_children", NULL
);
598 /* unified hierarchy doesn't have clone_children */
599 if (!file_exists(clonechildrenpath
))
602 ret
= lxc_read_from_file(clonechildrenpath
, &v
, 1);
604 SYSERROR("Failed to read file \"%s\"", clonechildrenpath
);
608 /* Make sure any isolated cpus are removed from cpuset.cpus. */
609 if (!cg_legacy_filter_and_set_cpus(cgpath
, v
== '1')) {
610 SYSERROR("Failed to remove isolated cpus");
614 /* Already set for us by someone else. */
616 DEBUG("\"cgroup.clone_children\" was already set to \"1\"");
620 /* copy parent's settings */
621 if (!copy_parent_file(cgpath
, "cpuset.mems")) {
622 SYSERROR("Failed to copy \"cpuset.mems\" settings");
626 ret
= lxc_write_to_file(clonechildrenpath
, "1", 1, false, 0666);
628 /* Set clone_children so children inherit our settings */
629 SYSERROR("Failed to write 1 to \"%s\"", clonechildrenpath
);
636 /* Given two null-terminated lists of strings, return true if any string is in
639 static bool controller_lists_intersect(char **l1
, char **l2
)
646 for (i
= 0; l1
[i
]; i
++) {
647 if (string_in_list(l2
, l1
[i
]))
654 /* For a null-terminated list of controllers @clist, return true if any of those
655 * controllers is already listed the null-terminated list of hierarchies @hlist.
656 * Realistically, if one is present, all must be present.
658 static bool controller_list_is_dup(struct hierarchy
**hlist
, char **clist
)
665 for (i
= 0; hlist
[i
]; i
++)
666 if (controller_lists_intersect(hlist
[i
]->controllers
, clist
))
672 /* Return true if the controller @entry is found in the null-terminated list of
673 * hierarchies @hlist.
675 static bool controller_found(struct hierarchy
**hlist
, char *entry
)
682 for (i
= 0; hlist
[i
]; i
++)
683 if (string_in_list(hlist
[i
]->controllers
, entry
))
689 /* Return true if all of the controllers which we require have been found. The
690 * required list is freezer and anything in lxc.cgroup.use.
692 static bool all_controllers_found(struct cgroup_ops
*ops
)
695 struct hierarchy
**hlist
= ops
->hierarchies
;
697 if (!ops
->cgroup_use
)
700 for (cur
= ops
->cgroup_use
; cur
&& *cur
; cur
++)
701 if (!controller_found(hlist
, *cur
)) {
702 ERROR("No %s controller mountpoint found", *cur
);
709 /* Get the controllers from a mountinfo line There are other ways we could get
710 * this info. For lxcfs, field 3 is /cgroup/controller-list. For cgroupfs, we
711 * could parse the mount options. But we simply assume that the mountpoint must
712 * be /sys/fs/cgroup/controller-list
714 static char **cg_hybrid_get_controllers(char **klist
, char **nlist
, char *line
,
717 /* The fourth field is /sys/fs/cgroup/comma-delimited-controller-list
718 * for legacy hierarchies.
722 char *p
= line
, *sep
= ",";
725 for (i
= 0; i
< 4; i
++) {
732 /* Note, if we change how mountinfo works, then our caller will need to
733 * verify /sys/fs/cgroup/ in this field.
735 if (strncmp(p
, "/sys/fs/cgroup/", 15) != 0) {
736 ERROR("Found hierarchy not under /sys/fs/cgroup: \"%s\"", p
);
743 ERROR("Corrupt mountinfo");
748 if (type
== CGROUP_SUPER_MAGIC
) {
749 __do_free
char *dup
= NULL
;
751 /* strdup() here for v1 hierarchies. Otherwise
752 * lxc_iterate_parts() will destroy mountpoints such as
753 * "/sys/fs/cgroup/cpu,cpuacct".
755 dup
= must_copy_string(p
);
759 lxc_iterate_parts (tok
, dup
, sep
)
760 must_append_controller(klist
, nlist
, &aret
, tok
);
767 static char **cg_unified_make_empty_controller(void)
772 newentry
= append_null_to_list((void ***)&aret
);
773 aret
[newentry
] = NULL
;
777 static char **cg_unified_get_controllers(const char *file
)
779 __do_free
char *buf
= NULL
;
784 buf
= read_file(file
);
788 lxc_iterate_parts(tok
, buf
, sep
) {
792 newentry
= append_null_to_list((void ***)&aret
);
793 copy
= must_copy_string(tok
);
794 aret
[newentry
] = copy
;
800 static struct hierarchy
*add_hierarchy(struct hierarchy
***h
, char **clist
, char *mountpoint
,
801 char *container_base_path
, int type
)
803 struct hierarchy
*new;
806 new = must_realloc(NULL
, sizeof(*new));
807 new->controllers
= clist
;
808 new->mountpoint
= mountpoint
;
809 new->container_base_path
= container_base_path
;
810 new->container_full_path
= NULL
;
811 new->monitor_full_path
= NULL
;
813 new->cgroup2_chown
= NULL
;
815 newentry
= append_null_to_list((void ***)h
);
816 (*h
)[newentry
] = new;
820 /* Get a copy of the mountpoint from @line, which is a line from
821 * /proc/self/mountinfo.
823 static char *cg_hybrid_get_mountpoint(char *line
)
828 char *p
= line
, *sret
= NULL
;
830 for (i
= 0; i
< 4; i
++) {
837 if (strncmp(p
, "/sys/fs/cgroup/", 15) != 0)
840 p2
= strchr(p
+ 15, ' ');
846 sret
= must_realloc(NULL
, len
+ 1);
847 memcpy(sret
, p
, len
);
852 /* Given a multi-line string, return a null-terminated copy of the current line. */
853 static char *copy_to_eol(char *p
)
855 char *p2
= strchr(p
, '\n'), *sret
;
862 sret
= must_realloc(NULL
, len
+ 1);
863 memcpy(sret
, p
, len
);
868 /* cgline: pointer to character after the first ':' in a line in a \n-terminated
869 * /proc/self/cgroup file. Check whether controller c is present.
871 static bool controller_in_clist(char *cgline
, char *c
)
873 __do_free
char *tmp
= NULL
;
877 eol
= strchr(cgline
, ':');
882 tmp
= must_realloc(NULL
, len
+ 1);
883 memcpy(tmp
, cgline
, len
);
886 lxc_iterate_parts(tok
, tmp
, ",")
887 if (strcmp(tok
, c
) == 0)
893 /* @basecginfo is a copy of /proc/$$/cgroup. Return the current cgroup for
896 static char *cg_hybrid_get_current_cgroup(char *basecginfo
, char *controller
,
899 char *p
= basecginfo
;
902 bool is_cgv2_base_cgroup
= false;
904 /* cgroup v2 entry in "/proc/<pid>/cgroup": "0::/some/path" */
905 if ((type
== CGROUP2_SUPER_MAGIC
) && (*p
== '0'))
906 is_cgv2_base_cgroup
= true;
913 if (is_cgv2_base_cgroup
|| (controller
&& controller_in_clist(p
, controller
))) {
918 return copy_to_eol(p
);
928 static void must_append_string(char ***list
, char *entry
)
933 newentry
= append_null_to_list((void ***)list
);
934 copy
= must_copy_string(entry
);
935 (*list
)[newentry
] = copy
;
938 static int get_existing_subsystems(char ***klist
, char ***nlist
)
940 __do_free
char *line
= NULL
;
941 __do_fclose
FILE *f
= NULL
;
944 f
= fopen("/proc/self/cgroup", "r");
948 while (getline(&line
, &len
, f
) != -1) {
950 p
= strchr(line
, ':');
959 /* If the kernel has cgroup v2 support, then /proc/self/cgroup
960 * contains an entry of the form:
964 * In this case we use "cgroup2" as controller name.
967 must_append_string(klist
, "cgroup2");
971 lxc_iterate_parts(tok
, p
, ",") {
972 if (strncmp(tok
, "name=", 5) == 0)
973 must_append_string(nlist
, tok
);
975 must_append_string(klist
, tok
);
982 static void trim(char *s
)
987 while ((len
> 1) && (s
[len
- 1] == '\n'))
991 static void lxc_cgfsng_print_hierarchies(struct cgroup_ops
*ops
)
994 struct hierarchy
**it
;
996 if (!ops
->hierarchies
) {
997 TRACE(" No hierarchies found");
1001 TRACE(" Hierarchies:");
1002 for (i
= 0, it
= ops
->hierarchies
; it
&& *it
; it
++, i
++) {
1006 TRACE(" %d: base_cgroup: %s", i
, (*it
)->container_base_path
? (*it
)->container_base_path
: "(null)");
1007 TRACE(" mountpoint: %s", (*it
)->mountpoint
? (*it
)->mountpoint
: "(null)");
1008 TRACE(" controllers:");
1009 for (j
= 0, cit
= (*it
)->controllers
; cit
&& *cit
; cit
++, j
++)
1010 TRACE(" %d: %s", j
, *cit
);
1014 static void lxc_cgfsng_print_basecg_debuginfo(char *basecginfo
, char **klist
,
1020 TRACE("basecginfo is:");
1021 TRACE("%s", basecginfo
);
1023 for (k
= 0, it
= klist
; it
&& *it
; it
++, k
++)
1024 TRACE("kernel subsystem %d: %s", k
, *it
);
1026 for (k
= 0, it
= nlist
; it
&& *it
; it
++, k
++)
1027 TRACE("named subsystem %d: %s", k
, *it
);
1030 static int cgroup_rmdir(struct hierarchy
**hierarchies
,
1031 const char *container_cgroup
)
1035 if (!container_cgroup
|| !hierarchies
)
1038 for (i
= 0; hierarchies
[i
]; i
++) {
1040 struct hierarchy
*h
= hierarchies
[i
];
1042 if (!h
->container_full_path
)
1045 ret
= recursive_destroy(h
->container_full_path
);
1047 WARN("Failed to destroy \"%s\"", h
->container_full_path
);
1049 free(h
->container_full_path
);
1050 h
->container_full_path
= NULL
;
1056 struct generic_userns_exec_data
{
1057 struct hierarchy
**hierarchies
;
1058 const char *container_cgroup
;
1059 struct lxc_conf
*conf
;
1060 uid_t origuid
; /* target uid in parent namespace */
1064 static int cgroup_rmdir_wrapper(void *data
)
1067 struct generic_userns_exec_data
*arg
= data
;
1068 uid_t nsuid
= (arg
->conf
->root_nsuid_map
!= NULL
) ? 0 : arg
->conf
->init_uid
;
1069 gid_t nsgid
= (arg
->conf
->root_nsgid_map
!= NULL
) ? 0 : arg
->conf
->init_gid
;
1071 ret
= setresgid(nsgid
, nsgid
, nsgid
);
1073 SYSERROR("Failed to setresgid(%d, %d, %d)", (int)nsgid
,
1074 (int)nsgid
, (int)nsgid
);
1078 ret
= setresuid(nsuid
, nsuid
, nsuid
);
1080 SYSERROR("Failed to setresuid(%d, %d, %d)", (int)nsuid
,
1081 (int)nsuid
, (int)nsuid
);
1085 ret
= setgroups(0, NULL
);
1086 if (ret
< 0 && errno
!= EPERM
) {
1087 SYSERROR("Failed to setgroups(0, NULL)");
1091 return cgroup_rmdir(arg
->hierarchies
, arg
->container_cgroup
);
1094 __cgfsng_ops
static void cgfsng_payload_destroy(struct cgroup_ops
*ops
,
1095 struct lxc_handler
*handler
)
1098 struct generic_userns_exec_data wrap
;
1100 if (!ops
->hierarchies
)
1104 wrap
.container_cgroup
= ops
->container_cgroup
;
1105 wrap
.hierarchies
= ops
->hierarchies
;
1106 wrap
.conf
= handler
->conf
;
1108 if (handler
->conf
&& !lxc_list_empty(&handler
->conf
->id_map
))
1109 ret
= userns_exec_1(handler
->conf
, cgroup_rmdir_wrapper
, &wrap
,
1110 "cgroup_rmdir_wrapper");
1112 ret
= cgroup_rmdir(ops
->hierarchies
, ops
->container_cgroup
);
1114 WARN("Failed to destroy cgroups");
1119 __cgfsng_ops
static void cgfsng_monitor_destroy(struct cgroup_ops
*ops
,
1120 struct lxc_handler
*handler
)
1123 struct lxc_conf
*conf
= handler
->conf
;
1124 char pidstr
[INTTYPE_TO_STRLEN(pid_t
)];
1126 if (!ops
->hierarchies
)
1129 len
= snprintf(pidstr
, sizeof(pidstr
), "%d", handler
->monitor_pid
);
1130 if (len
< 0 || (size_t)len
>= sizeof(pidstr
))
1133 for (int i
= 0; ops
->hierarchies
[i
]; i
++) {
1134 __do_free
char *pivot_path
= NULL
;
1137 char pivot_cgroup
[] = PIVOT_CGROUP
;
1138 struct hierarchy
*h
= ops
->hierarchies
[i
];
1140 if (!h
->monitor_full_path
)
1143 if (conf
&& conf
->cgroup_meta
.dir
)
1144 pivot_path
= must_make_path(h
->mountpoint
,
1145 h
->container_base_path
,
1146 conf
->cgroup_meta
.dir
,
1148 "cgroup.procs", NULL
);
1150 pivot_path
= must_make_path(h
->mountpoint
,
1151 h
->container_base_path
,
1153 "cgroup.procs", NULL
);
1155 chop
= strrchr(pivot_path
, '/');
1160 * Make sure not to pass in the ro string literal PIVOT_CGROUP
1163 if (!cg_legacy_handle_cpuset_hierarchy(h
, pivot_cgroup
)) {
1164 WARN("Failed to handle legacy cpuset controller");
1168 ret
= mkdir_p(pivot_path
, 0755);
1169 if (ret
< 0 && errno
!= EEXIST
) {
1170 SYSWARN("Failed to create cgroup \"%s\"\n", pivot_path
);
1177 /* Move ourselves into the pivot cgroup to delete our own
1180 ret
= lxc_write_to_file(pivot_path
, pidstr
, len
, false, 0666);
1182 SYSWARN("Failed to move monitor %s to \"%s\"\n", pidstr
, pivot_path
);
1186 ret
= recursive_destroy(h
->monitor_full_path
);
1188 WARN("Failed to destroy \"%s\"", h
->monitor_full_path
);
1192 static bool cg_unified_create_cgroup(struct hierarchy
*h
, char *cgname
)
1194 __do_free
char *add_controllers
= NULL
, *cgroup
= NULL
;
1195 size_t i
, parts_len
;
1197 size_t full_len
= 0;
1198 char **parts
= NULL
;
1201 if (h
->version
!= CGROUP2_SUPER_MAGIC
)
1204 if (!h
->controllers
)
1207 /* For now we simply enable all controllers that we have detected by
1208 * creating a string like "+memory +pids +cpu +io".
1209 * TODO: In the near future we might want to support "-<controller>"
1210 * etc. but whether supporting semantics like this make sense will need
1213 for (it
= h
->controllers
; it
&& *it
; it
++) {
1214 full_len
+= strlen(*it
) + 2;
1215 add_controllers
= must_realloc(add_controllers
, full_len
+ 1);
1217 if (h
->controllers
[0] == *it
)
1218 add_controllers
[0] = '\0';
1220 (void)strlcat(add_controllers
, "+", full_len
+ 1);
1221 (void)strlcat(add_controllers
, *it
, full_len
+ 1);
1223 if ((it
+ 1) && *(it
+ 1))
1224 (void)strlcat(add_controllers
, " ", full_len
+ 1);
1227 parts
= lxc_string_split(cgname
, '/');
1231 parts_len
= lxc_array_len((void **)parts
);
1235 cgroup
= must_make_path(h
->mountpoint
, h
->container_base_path
, NULL
);
1236 for (i
= 0; i
< parts_len
; i
++) {
1238 __do_free
char *target
= NULL
;
1240 cgroup
= must_append_path(cgroup
, parts
[i
], NULL
);
1241 target
= must_make_path(cgroup
, "cgroup.subtree_control", NULL
);
1242 ret
= lxc_write_to_file(target
, add_controllers
, full_len
, false, 0666);
1244 SYSERROR("Could not enable \"%s\" controllers in the "
1245 "unified cgroup \"%s\"", add_controllers
, cgroup
);
1253 lxc_free_array((void **)parts
, free
);
1257 static int mkdir_eexist_on_last(const char *dir
, mode_t mode
)
1259 const char *tmp
= dir
;
1260 const char *orig
= dir
;
1263 orig_len
= strlen(dir
);
1265 __do_free
char *makeme
;
1269 dir
= tmp
+ strspn(tmp
, "/");
1270 tmp
= dir
+ strcspn(dir
, "/");
1273 cur_len
= dir
- orig
;
1274 makeme
= strndup(orig
, cur_len
);
1278 ret
= mkdir(makeme
, mode
);
1280 if ((errno
!= EEXIST
) || (orig_len
== cur_len
)) {
1281 SYSERROR("Failed to create directory \"%s\"", makeme
);
1285 } while (tmp
!= dir
);
1290 static bool monitor_create_path_for_hierarchy(struct hierarchy
*h
, char *cgname
)
1294 if (!cg_legacy_handle_cpuset_hierarchy(h
, cgname
)) {
1295 ERROR("Failed to handle legacy cpuset controller");
1299 h
->monitor_full_path
= must_make_path(h
->mountpoint
, h
->container_base_path
, cgname
, NULL
);
1300 ret
= mkdir_eexist_on_last(h
->monitor_full_path
, 0755);
1302 ERROR("Failed to create cgroup \"%s\"", h
->monitor_full_path
);
1306 return cg_unified_create_cgroup(h
, cgname
);
1309 static bool container_create_path_for_hierarchy(struct hierarchy
*h
, char *cgname
)
1313 if (!cg_legacy_handle_cpuset_hierarchy(h
, cgname
)) {
1314 ERROR("Failed to handle legacy cpuset controller");
1318 h
->container_full_path
= must_make_path(h
->mountpoint
, h
->container_base_path
, cgname
, NULL
);
1319 ret
= mkdir_eexist_on_last(h
->container_full_path
, 0755);
1321 ERROR("Failed to create cgroup \"%s\"", h
->container_full_path
);
1325 return cg_unified_create_cgroup(h
, cgname
);
1328 static void remove_path_for_hierarchy(struct hierarchy
*h
, char *cgname
, bool monitor
)
1334 full_path
= h
->monitor_full_path
;
1336 full_path
= h
->container_full_path
;
1338 ret
= rmdir(full_path
);
1340 SYSERROR("Failed to rmdir(\"%s\") from failed creation attempt", full_path
);
1345 h
->monitor_full_path
= NULL
;
1347 h
->container_full_path
= NULL
;
1350 __cgfsng_ops
static inline bool cgfsng_monitor_create(struct cgroup_ops
*ops
,
1351 struct lxc_handler
*handler
)
1353 __do_free
char *monitor_cgroup
= NULL
;
1357 struct lxc_conf
*conf
= handler
->conf
;
1362 if (!ops
->hierarchies
)
1365 if (conf
->cgroup_meta
.dir
)
1366 tmp
= lxc_string_join("/",
1367 (const char *[]){conf
->cgroup_meta
.dir
,
1368 ops
->monitor_pattern
,
1369 handler
->name
, NULL
},
1372 tmp
= must_make_path(ops
->monitor_pattern
, handler
->name
, NULL
);
1376 len
= strlen(tmp
) + 5; /* leave room for -NNN\0 */
1377 monitor_cgroup
= must_realloc(tmp
, len
);
1378 offset
= monitor_cgroup
+ len
- 5;
1383 int ret
= snprintf(offset
, 5, "-%d", idx
);
1384 if (ret
< 0 || (size_t)ret
>= 5)
1388 for (i
= 0; ops
->hierarchies
[i
]; i
++) {
1389 if (!monitor_create_path_for_hierarchy(ops
->hierarchies
[i
],
1391 ERROR("Failed to create cgroup \"%s\"",
1392 ops
->hierarchies
[i
]->monitor_full_path
);
1393 for (int j
= 0; j
< i
; j
++)
1394 remove_path_for_hierarchy(ops
->hierarchies
[j
],
1402 } while (ops
->hierarchies
[i
] && idx
> 0 && idx
< 1000);
1407 INFO("The monitor process uses \"%s\" as cgroup", monitor_cgroup
);
1411 /* Try to create the same cgroup in all hierarchies. Start with cgroup_pattern;
1412 * next cgroup_pattern-1, -2, ..., -999.
1414 __cgfsng_ops
static inline bool cgfsng_payload_create(struct cgroup_ops
*ops
,
1415 struct lxc_handler
*handler
)
1417 __do_free
char *container_cgroup
= NULL
, *tmp
= NULL
;
1422 struct lxc_conf
*conf
= handler
->conf
;
1424 if (ops
->container_cgroup
)
1430 if (!ops
->hierarchies
)
1433 if (conf
->cgroup_meta
.dir
)
1434 tmp
= lxc_string_join("/", (const char *[]){conf
->cgroup_meta
.dir
, handler
->name
, NULL
}, false);
1436 tmp
= lxc_string_replace("%n", handler
->name
, ops
->cgroup_pattern
);
1438 ERROR("Failed expanding cgroup name pattern");
1442 len
= strlen(tmp
) + 5; /* leave room for -NNN\0 */
1443 container_cgroup
= must_realloc(NULL
, len
);
1444 (void)strlcpy(container_cgroup
, tmp
, len
);
1445 offset
= container_cgroup
+ len
- 5;
1449 int ret
= snprintf(offset
, 5, "-%d", idx
);
1450 if (ret
< 0 || (size_t)ret
>= 5)
1454 for (i
= 0; ops
->hierarchies
[i
]; i
++) {
1455 if (!container_create_path_for_hierarchy(ops
->hierarchies
[i
],
1456 container_cgroup
)) {
1457 ERROR("Failed to create cgroup \"%s\"",
1458 ops
->hierarchies
[i
]->container_full_path
);
1459 for (int j
= 0; j
< i
; j
++)
1460 remove_path_for_hierarchy(ops
->hierarchies
[j
],
1467 } while (ops
->hierarchies
[i
] && idx
> 0 && idx
< 1000);
1472 INFO("The container process uses \"%s\" as cgroup", container_cgroup
);
1473 ops
->container_cgroup
= move_ptr(container_cgroup
);
1477 __cgfsng_ops
static bool __do_cgroup_enter(struct cgroup_ops
*ops
, pid_t pid
,
1481 char pidstr
[INTTYPE_TO_STRLEN(pid_t
)];
1483 if (!ops
->hierarchies
)
1486 len
= snprintf(pidstr
, sizeof(pidstr
), "%d", pid
);
1487 if (len
< 0 || (size_t)len
>= sizeof(pidstr
))
1490 for (int i
= 0; ops
->hierarchies
[i
]; i
++) {
1492 __do_free
char *path
= NULL
;
1495 path
= must_make_path(ops
->hierarchies
[i
]->monitor_full_path
,
1496 "cgroup.procs", NULL
);
1498 path
= must_make_path(ops
->hierarchies
[i
]->container_full_path
,
1499 "cgroup.procs", NULL
);
1500 ret
= lxc_write_to_file(path
, pidstr
, len
, false, 0666);
1502 SYSERROR("Failed to enter cgroup \"%s\"", path
);
1510 __cgfsng_ops
static bool cgfsng_monitor_enter(struct cgroup_ops
*ops
, pid_t pid
)
1512 return __do_cgroup_enter(ops
, pid
, true);
1515 static bool cgfsng_payload_enter(struct cgroup_ops
*ops
, pid_t pid
)
1517 return __do_cgroup_enter(ops
, pid
, false);
1520 static int chowmod(char *path
, uid_t chown_uid
, gid_t chown_gid
,
1525 ret
= chown(path
, chown_uid
, chown_gid
);
1527 SYSWARN("Failed to chown(%s, %d, %d)", path
, (int)chown_uid
, (int)chown_gid
);
1531 ret
= chmod(path
, chmod_mode
);
1533 SYSWARN("Failed to chmod(%s, %d)", path
, (int)chmod_mode
);
1540 /* chgrp the container cgroups to container group. We leave
1541 * the container owner as cgroup owner. So we must make the
1542 * directories 775 so that the container can create sub-cgroups.
1544 * Also chown the tasks and cgroup.procs files. Those may not
1545 * exist depending on kernel version.
1547 static int chown_cgroup_wrapper(void *data
)
1551 struct generic_userns_exec_data
*arg
= data
;
1552 uid_t nsuid
= (arg
->conf
->root_nsuid_map
!= NULL
) ? 0 : arg
->conf
->init_uid
;
1553 gid_t nsgid
= (arg
->conf
->root_nsgid_map
!= NULL
) ? 0 : arg
->conf
->init_gid
;
1555 ret
= setresgid(nsgid
, nsgid
, nsgid
);
1557 SYSERROR("Failed to setresgid(%d, %d, %d)",
1558 (int)nsgid
, (int)nsgid
, (int)nsgid
);
1562 ret
= setresuid(nsuid
, nsuid
, nsuid
);
1564 SYSERROR("Failed to setresuid(%d, %d, %d)",
1565 (int)nsuid
, (int)nsuid
, (int)nsuid
);
1569 ret
= setgroups(0, NULL
);
1570 if (ret
< 0 && errno
!= EPERM
) {
1571 SYSERROR("Failed to setgroups(0, NULL)");
1575 destuid
= get_ns_uid(arg
->origuid
);
1576 if (destuid
== LXC_INVALID_UID
)
1579 for (i
= 0; arg
->hierarchies
[i
]; i
++) {
1580 __do_free
char *fullpath
= NULL
;
1581 char *path
= arg
->hierarchies
[i
]->container_full_path
;
1583 ret
= chowmod(path
, destuid
, nsgid
, 0775);
1587 /* Failures to chown() these are inconvenient but not
1588 * detrimental We leave these owned by the container launcher,
1589 * so that container root can write to the files to attach. We
1590 * chmod() them 664 so that container systemd can write to the
1591 * files (which systemd in wily insists on doing).
1594 if (arg
->hierarchies
[i
]->version
== CGROUP_SUPER_MAGIC
) {
1595 fullpath
= must_make_path(path
, "tasks", NULL
);
1596 (void)chowmod(fullpath
, destuid
, nsgid
, 0664);
1599 fullpath
= must_make_path(path
, "cgroup.procs", NULL
);
1600 (void)chowmod(fullpath
, destuid
, nsgid
, 0664);
1602 if (arg
->hierarchies
[i
]->version
!= CGROUP2_SUPER_MAGIC
)
1605 for (char **p
= arg
->hierarchies
[i
]->cgroup2_chown
; p
&& *p
; p
++) {
1606 fullpath
= must_make_path(path
, *p
, NULL
);
1607 (void)chowmod(fullpath
, destuid
, nsgid
, 0664);
1614 __cgfsng_ops
static bool cgfsng_chown(struct cgroup_ops
*ops
,
1615 struct lxc_conf
*conf
)
1617 struct generic_userns_exec_data wrap
;
1619 if (lxc_list_empty(&conf
->id_map
))
1622 if (!ops
->hierarchies
)
1625 wrap
.origuid
= geteuid();
1627 wrap
.hierarchies
= ops
->hierarchies
;
1630 if (userns_exec_1(conf
, chown_cgroup_wrapper
, &wrap
,
1631 "chown_cgroup_wrapper") < 0) {
1632 ERROR("Error requesting cgroup chown in new user namespace");
1639 /* cgroup-full:* is done, no need to create subdirs */
1640 static bool cg_mount_needs_subdirs(int type
)
1642 if (type
>= LXC_AUTO_CGROUP_FULL_RO
)
1648 /* After $rootfs/sys/fs/container/controller/the/cg/path has been created,
1649 * remount controller ro if needed and bindmount the cgroupfs onto
1650 * control/the/cg/path.
1652 static int cg_legacy_mount_controllers(int type
, struct hierarchy
*h
,
1653 char *controllerpath
, char *cgpath
,
1654 const char *container_cgroup
)
1656 __do_free
char *sourcepath
= NULL
;
1657 int ret
, remount_flags
;
1658 int flags
= MS_BIND
;
1660 if (type
== LXC_AUTO_CGROUP_RO
|| type
== LXC_AUTO_CGROUP_MIXED
) {
1661 ret
= mount(controllerpath
, controllerpath
, "cgroup", MS_BIND
, NULL
);
1663 SYSERROR("Failed to bind mount \"%s\" onto \"%s\"",
1664 controllerpath
, controllerpath
);
1668 remount_flags
= add_required_remount_flags(controllerpath
,
1670 flags
| MS_REMOUNT
);
1671 ret
= mount(controllerpath
, controllerpath
, "cgroup",
1672 remount_flags
| MS_REMOUNT
| MS_BIND
| MS_RDONLY
,
1675 SYSERROR("Failed to remount \"%s\" ro", controllerpath
);
1679 INFO("Remounted %s read-only", controllerpath
);
1682 sourcepath
= must_make_path(h
->mountpoint
, h
->container_base_path
,
1683 container_cgroup
, NULL
);
1684 if (type
== LXC_AUTO_CGROUP_RO
)
1687 ret
= mount(sourcepath
, cgpath
, "cgroup", flags
, NULL
);
1689 SYSERROR("Failed to mount \"%s\" onto \"%s\"", h
->controllers
[0], cgpath
);
1692 INFO("Mounted \"%s\" onto \"%s\"", h
->controllers
[0], cgpath
);
1694 if (flags
& MS_RDONLY
) {
1695 remount_flags
= add_required_remount_flags(sourcepath
, cgpath
,
1696 flags
| MS_REMOUNT
);
1697 ret
= mount(sourcepath
, cgpath
, "cgroup", remount_flags
, NULL
);
1699 SYSERROR("Failed to remount \"%s\" ro", cgpath
);
1702 INFO("Remounted %s read-only", cgpath
);
1705 INFO("Completed second stage cgroup automounts for \"%s\"", cgpath
);
1709 /* __cg_mount_direct
1711 * Mount cgroup hierarchies directly without using bind-mounts. The main
1712 * uses-cases are mounting cgroup hierarchies in cgroup namespaces and mounting
1713 * cgroups for the LXC_AUTO_CGROUP_FULL option.
1715 static int __cg_mount_direct(int type
, struct hierarchy
*h
,
1716 const char *controllerpath
)
1719 __do_free
char *controllers
= NULL
;
1720 char *fstype
= "cgroup2";
1721 unsigned long flags
= 0;
1726 flags
|= MS_RELATIME
;
1728 if (type
== LXC_AUTO_CGROUP_RO
|| type
== LXC_AUTO_CGROUP_FULL_RO
)
1731 if (h
->version
!= CGROUP2_SUPER_MAGIC
) {
1732 controllers
= lxc_string_join(",", (const char **)h
->controllers
, false);
1738 ret
= mount("cgroup", controllerpath
, fstype
, flags
, controllers
);
1740 SYSERROR("Failed to mount \"%s\" with cgroup filesystem type %s", controllerpath
, fstype
);
1744 DEBUG("Mounted \"%s\" with cgroup filesystem type %s", controllerpath
, fstype
);
1748 static inline int cg_mount_in_cgroup_namespace(int type
, struct hierarchy
*h
,
1749 const char *controllerpath
)
1751 return __cg_mount_direct(type
, h
, controllerpath
);
1754 static inline int cg_mount_cgroup_full(int type
, struct hierarchy
*h
,
1755 const char *controllerpath
)
1757 if (type
< LXC_AUTO_CGROUP_FULL_RO
|| type
> LXC_AUTO_CGROUP_FULL_MIXED
)
1760 return __cg_mount_direct(type
, h
, controllerpath
);
1763 __cgfsng_ops
static bool cgfsng_mount(struct cgroup_ops
*ops
,
1764 struct lxc_handler
*handler
,
1765 const char *root
, int type
)
1767 __do_free
char *tmpfspath
= NULL
;
1769 bool has_cgns
= false, retval
= false, wants_force_mount
= false;
1771 if (!ops
->hierarchies
)
1774 if ((type
& LXC_AUTO_CGROUP_MASK
) == 0)
1777 if (type
& LXC_AUTO_CGROUP_FORCE
) {
1778 type
&= ~LXC_AUTO_CGROUP_FORCE
;
1779 wants_force_mount
= true;
1782 if (!wants_force_mount
){
1783 if (!lxc_list_empty(&handler
->conf
->keepcaps
))
1784 wants_force_mount
= !in_caplist(CAP_SYS_ADMIN
, &handler
->conf
->keepcaps
);
1786 wants_force_mount
= in_caplist(CAP_SYS_ADMIN
, &handler
->conf
->caps
);
1789 has_cgns
= cgns_supported();
1790 if (has_cgns
&& !wants_force_mount
)
1793 if (type
== LXC_AUTO_CGROUP_NOSPEC
)
1794 type
= LXC_AUTO_CGROUP_MIXED
;
1795 else if (type
== LXC_AUTO_CGROUP_FULL_NOSPEC
)
1796 type
= LXC_AUTO_CGROUP_FULL_MIXED
;
1799 tmpfspath
= must_make_path(root
, "/sys/fs/cgroup", NULL
);
1800 ret
= safe_mount(NULL
, tmpfspath
, "tmpfs",
1801 MS_NOSUID
| MS_NODEV
| MS_NOEXEC
| MS_RELATIME
,
1802 "size=10240k,mode=755", root
);
1806 for (i
= 0; ops
->hierarchies
[i
]; i
++) {
1807 __do_free
char *controllerpath
= NULL
, *path2
= NULL
;
1808 struct hierarchy
*h
= ops
->hierarchies
[i
];
1809 char *controller
= strrchr(h
->mountpoint
, '/');
1815 controllerpath
= must_make_path(tmpfspath
, controller
, NULL
);
1816 if (dir_exists(controllerpath
))
1819 ret
= mkdir(controllerpath
, 0755);
1821 SYSERROR("Error creating cgroup path: %s", controllerpath
);
1825 if (has_cgns
&& wants_force_mount
) {
1826 /* If cgroup namespaces are supported but the container
1827 * will not have CAP_SYS_ADMIN after it has started we
1828 * need to mount the cgroups manually.
1830 ret
= cg_mount_in_cgroup_namespace(type
, h
, controllerpath
);
1837 ret
= cg_mount_cgroup_full(type
, h
, controllerpath
);
1841 if (!cg_mount_needs_subdirs(type
))
1844 path2
= must_make_path(controllerpath
, h
->container_base_path
,
1845 ops
->container_cgroup
, NULL
);
1846 ret
= mkdir_p(path2
, 0755);
1850 ret
= cg_legacy_mount_controllers(type
, h
, controllerpath
,
1851 path2
, ops
->container_cgroup
);
1861 static int recursive_count_nrtasks(char *dirname
)
1863 __do_free
char *path
= NULL
;
1864 __do_closedir
DIR *dir
= NULL
;
1865 struct dirent
*direntp
;
1868 dir
= opendir(dirname
);
1872 while ((direntp
= readdir(dir
))) {
1875 if (!strcmp(direntp
->d_name
, ".") ||
1876 !strcmp(direntp
->d_name
, ".."))
1879 path
= must_make_path(dirname
, direntp
->d_name
, NULL
);
1881 if (lstat(path
, &mystat
))
1884 if (!S_ISDIR(mystat
.st_mode
))
1887 count
+= recursive_count_nrtasks(path
);
1890 path
= must_make_path(dirname
, "cgroup.procs", NULL
);
1891 ret
= lxc_count_file_lines(path
);
1898 __cgfsng_ops
static int cgfsng_nrtasks(struct cgroup_ops
*ops
)
1900 __do_free
char *path
= NULL
;
1903 if (!ops
->container_cgroup
|| !ops
->hierarchies
)
1906 path
= must_make_path(ops
->hierarchies
[0]->container_full_path
, NULL
);
1907 count
= recursive_count_nrtasks(path
);
1911 /* Only root needs to escape to the cgroup of its init. */
1912 __cgfsng_ops
static bool cgfsng_escape(const struct cgroup_ops
*ops
,
1913 struct lxc_conf
*conf
)
1917 if (conf
->cgroup_meta
.relative
|| geteuid() || !ops
->hierarchies
)
1920 for (i
= 0; ops
->hierarchies
[i
]; i
++) {
1922 __do_free
char *fullpath
= NULL
;
1924 fullpath
= must_make_path(ops
->hierarchies
[i
]->mountpoint
,
1925 ops
->hierarchies
[i
]->container_base_path
,
1926 "cgroup.procs", NULL
);
1927 ret
= lxc_write_to_file(fullpath
, "0", 2, false, 0666);
1929 SYSERROR("Failed to escape to cgroup \"%s\"", fullpath
);
1937 __cgfsng_ops
static int cgfsng_num_hierarchies(struct cgroup_ops
*ops
)
1941 if (!ops
->hierarchies
)
1944 for (; ops
->hierarchies
[i
]; i
++)
1950 __cgfsng_ops
static bool cgfsng_get_hierarchies(struct cgroup_ops
*ops
, int n
, char ***out
)
1954 if (!ops
->hierarchies
)
1957 /* sanity check n */
1958 for (i
= 0; i
< n
; i
++)
1959 if (!ops
->hierarchies
[i
])
1962 *out
= ops
->hierarchies
[i
]->controllers
;
1967 #define THAWED "THAWED"
1968 #define THAWED_LEN (strlen(THAWED))
1970 /* TODO: If the unified cgroup hierarchy grows a freezer controller this needs
1973 __cgfsng_ops
static bool cgfsng_unfreeze(struct cgroup_ops
*ops
)
1976 __do_free
char *fullpath
= NULL
;
1977 struct hierarchy
*h
;
1979 h
= get_hierarchy(ops
, "freezer");
1983 fullpath
= must_make_path(h
->container_full_path
, "freezer.state", NULL
);
1984 ret
= lxc_write_to_file(fullpath
, THAWED
, THAWED_LEN
, false, 0666);
1991 __cgfsng_ops
static const char *cgfsng_get_cgroup(struct cgroup_ops
*ops
,
1992 const char *controller
)
1994 struct hierarchy
*h
;
1996 h
= get_hierarchy(ops
, controller
);
1998 WARN("Failed to find hierarchy for controller \"%s\"",
1999 controller
? controller
: "(null)");
2003 return h
->container_full_path
? h
->container_full_path
+ strlen(h
->mountpoint
) : NULL
;
2006 /* Given a cgroup path returned from lxc_cmd_get_cgroup_path, build a full path,
2007 * which must be freed by the caller.
2009 static inline char *build_full_cgpath_from_monitorpath(struct hierarchy
*h
,
2011 const char *filename
)
2013 return must_make_path(h
->mountpoint
, inpath
, filename
, NULL
);
2016 /* Technically, we're always at a delegation boundary here (This is especially
2017 * true when cgroup namespaces are available.). The reasoning is that in order
2018 * for us to have been able to start a container in the first place the root
2019 * cgroup must have been a leaf node. Now, either the container's init system
2020 * has populated the cgroup and kept it as a leaf node or it has created
2021 * subtrees. In the former case we will simply attach to the leaf node we
2022 * created when we started the container in the latter case we create our own
2023 * cgroup for the attaching process.
2025 static int __cg_unified_attach(const struct hierarchy
*h
, const char *name
,
2026 const char *lxcpath
, const char *pidstr
,
2027 size_t pidstr_len
, const char *controller
)
2029 __do_free
char *base_path
= NULL
, *container_cgroup
= NULL
,
2033 int fret
= -1, idx
= 0;
2035 container_cgroup
= lxc_cmd_get_cgroup_path(name
, lxcpath
, controller
);
2037 if (!container_cgroup
)
2040 base_path
= must_make_path(h
->mountpoint
, container_cgroup
, NULL
);
2041 full_path
= must_make_path(base_path
, "cgroup.procs", NULL
);
2042 /* cgroup is populated */
2043 ret
= lxc_write_to_file(full_path
, pidstr
, pidstr_len
, false, 0666);
2044 if (ret
< 0 && errno
!= EBUSY
)
2050 len
= strlen(base_path
) + STRLITERALLEN("/lxc-1000") +
2051 STRLITERALLEN("/cgroup-procs");
2052 full_path
= must_realloc(NULL
, len
+ 1);
2055 ret
= snprintf(full_path
, len
+ 1, "%s/lxc-%d",
2058 ret
= snprintf(full_path
, len
+ 1, "%s/lxc", base_path
);
2059 if (ret
< 0 || (size_t)ret
>= len
+ 1)
2062 ret
= mkdir_p(full_path
, 0755);
2063 if (ret
< 0 && errno
!= EEXIST
)
2066 (void)strlcat(full_path
, "/cgroup.procs", len
+ 1);
2067 ret
= lxc_write_to_file(full_path
, pidstr
, len
, false, 0666);
2071 /* this is a non-leaf node */
2076 } while (idx
< 1000);
2086 __cgfsng_ops
static bool cgfsng_attach(struct cgroup_ops
*ops
, const char *name
,
2087 const char *lxcpath
, pid_t pid
)
2090 char pidstr
[INTTYPE_TO_STRLEN(pid_t
)];
2092 if (!ops
->hierarchies
)
2095 len
= snprintf(pidstr
, sizeof(pidstr
), "%d", pid
);
2096 if (len
< 0 || (size_t)len
>= sizeof(pidstr
))
2099 for (i
= 0; ops
->hierarchies
[i
]; i
++) {
2100 __do_free
char *path
= NULL
;
2101 char *fullpath
= NULL
;
2102 struct hierarchy
*h
= ops
->hierarchies
[i
];
2104 if (h
->version
== CGROUP2_SUPER_MAGIC
) {
2105 ret
= __cg_unified_attach(h
, name
, lxcpath
, pidstr
, len
,
2113 path
= lxc_cmd_get_cgroup_path(name
, lxcpath
, h
->controllers
[0]);
2118 fullpath
= build_full_cgpath_from_monitorpath(h
, path
, "cgroup.procs");
2119 ret
= lxc_write_to_file(fullpath
, pidstr
, len
, false, 0666);
2121 SYSERROR("Failed to attach %d to %s", (int)pid
, fullpath
);
2129 /* Called externally (i.e. from 'lxc-cgroup') to query cgroup limits. Here we
2130 * don't have a cgroup_data set up, so we ask the running container through the
2131 * commands API for the cgroup path.
2133 __cgfsng_ops
static int cgfsng_get(struct cgroup_ops
*ops
, const char *filename
,
2134 char *value
, size_t len
, const char *name
,
2135 const char *lxcpath
)
2137 __do_free
char *path
= NULL
;
2138 __do_free
char *controller
= NULL
;
2140 struct hierarchy
*h
;
2143 controller
= must_copy_string(filename
);
2144 p
= strchr(controller
, '.');
2148 path
= lxc_cmd_get_cgroup_path(name
, lxcpath
, controller
);
2153 h
= get_hierarchy(ops
, controller
);
2155 __do_free
char *fullpath
= NULL
;
2157 fullpath
= build_full_cgpath_from_monitorpath(h
, path
, filename
);
2158 ret
= lxc_read_from_file(fullpath
, value
, len
);
2164 /* Called externally (i.e. from 'lxc-cgroup') to set new cgroup limits. Here we
2165 * don't have a cgroup_data set up, so we ask the running container through the
2166 * commands API for the cgroup path.
2168 __cgfsng_ops
static int cgfsng_set(struct cgroup_ops
*ops
,
2169 const char *filename
, const char *value
,
2170 const char *name
, const char *lxcpath
)
2172 __do_free
char *path
= NULL
;
2173 __do_free
char *controller
= NULL
;
2175 struct hierarchy
*h
;
2178 controller
= must_copy_string(filename
);
2179 p
= strchr(controller
, '.');
2183 path
= lxc_cmd_get_cgroup_path(name
, lxcpath
, controller
);
2188 h
= get_hierarchy(ops
, controller
);
2190 __do_free
char *fullpath
= NULL
;
2192 fullpath
= build_full_cgpath_from_monitorpath(h
, path
, filename
);
2193 ret
= lxc_write_to_file(fullpath
, value
, strlen(value
), false, 0666);
2199 /* take devices cgroup line
2201 * and convert it to a valid
2202 * type major:minor mode
2203 * line. Return <0 on error. Dest is a preallocated buffer long enough to hold
2206 static int convert_devpath(const char *invalue
, char *dest
)
2208 __do_free
char *path
= NULL
;
2211 unsigned long minor
, major
;
2216 path
= must_copy_string(invalue
);
2218 /* Read path followed by mode. Ignore any trailing text.
2219 * A ' # comment' would be legal. Technically other text is not
2220 * legal, we could check for that if we cared to.
2222 for (n_parts
= 1, p
= path
; *p
; p
++) {
2244 ret
= stat(path
, &sb
);
2248 mode_t m
= sb
.st_mode
& S_IFMT
;
2257 ERROR("Unsupported device type %i for \"%s\"", m
, path
);
2262 major
= MAJOR(sb
.st_rdev
);
2263 minor
= MINOR(sb
.st_rdev
);
2264 ret
= snprintf(dest
, 50, "%c %lu:%lu %s", type
, major
, minor
, mode
);
2265 if (ret
< 0 || ret
>= 50) {
2266 ERROR("Error on configuration value \"%c %lu:%lu %s\" (max 50 "
2267 "chars)", type
, major
, minor
, mode
);
2268 ret
= -ENAMETOOLONG
;
2277 /* Called from setup_limits - here we have the container's cgroup_data because
2278 * we created the cgroups.
2280 static int cg_legacy_set_data(struct cgroup_ops
*ops
, const char *filename
,
2283 __do_free
char *controller
= NULL
;
2284 __do_free
char *fullpath
= NULL
;
2286 /* "b|c <2^64-1>:<2^64-1> r|w|m" = 47 chars max */
2287 char converted_value
[50];
2288 struct hierarchy
*h
;
2291 controller
= must_copy_string(filename
);
2292 p
= strchr(controller
, '.');
2296 if (strcmp("devices.allow", filename
) == 0 && value
[0] == '/') {
2297 ret
= convert_devpath(value
, converted_value
);
2300 value
= converted_value
;
2303 h
= get_hierarchy(ops
, controller
);
2305 ERROR("Failed to setup limits for the \"%s\" controller. "
2306 "The controller seems to be unused by \"cgfsng\" cgroup "
2307 "driver or not enabled on the cgroup hierarchy",
2313 fullpath
= must_make_path(h
->container_full_path
, filename
, NULL
);
2314 ret
= lxc_write_to_file(fullpath
, value
, strlen(value
), false, 0666);
2318 static bool __cg_legacy_setup_limits(struct cgroup_ops
*ops
,
2319 struct lxc_list
*cgroup_settings
,
2322 __do_free
struct lxc_list
*sorted_cgroup_settings
= NULL
;
2323 struct lxc_list
*iterator
, *next
;
2324 struct lxc_cgroup
*cg
;
2327 if (lxc_list_empty(cgroup_settings
))
2330 if (!ops
->hierarchies
)
2333 sorted_cgroup_settings
= sort_cgroup_settings(cgroup_settings
);
2334 if (!sorted_cgroup_settings
)
2337 lxc_list_for_each(iterator
, sorted_cgroup_settings
) {
2338 cg
= iterator
->elem
;
2340 if (do_devices
== !strncmp("devices", cg
->subsystem
, 7)) {
2341 if (cg_legacy_set_data(ops
, cg
->subsystem
, cg
->value
)) {
2342 if (do_devices
&& (errno
== EACCES
|| errno
== EPERM
)) {
2343 WARN("Failed to set \"%s\" to \"%s\"",
2344 cg
->subsystem
, cg
->value
);
2347 WARN("Failed to set \"%s\" to \"%s\"",
2348 cg
->subsystem
, cg
->value
);
2351 DEBUG("Set controller \"%s\" set to \"%s\"",
2352 cg
->subsystem
, cg
->value
);
2357 INFO("Limits for the legacy cgroup hierarchies have been setup");
2359 lxc_list_for_each_safe(iterator
, sorted_cgroup_settings
, next
) {
2360 lxc_list_del(iterator
);
2367 static bool __cg_unified_setup_limits(struct cgroup_ops
*ops
,
2368 struct lxc_list
*cgroup_settings
)
2370 struct lxc_list
*iterator
;
2371 struct hierarchy
*h
= ops
->unified
;
2373 if (lxc_list_empty(cgroup_settings
))
2379 lxc_list_for_each(iterator
, cgroup_settings
) {
2380 __do_free
char *fullpath
= NULL
;
2382 struct lxc_cgroup
*cg
= iterator
->elem
;
2384 fullpath
= must_make_path(h
->container_full_path
, cg
->subsystem
, NULL
);
2385 ret
= lxc_write_to_file(fullpath
, cg
->value
, strlen(cg
->value
), false, 0666);
2387 SYSERROR("Failed to set \"%s\" to \"%s\"",
2388 cg
->subsystem
, cg
->value
);
2391 TRACE("Set \"%s\" to \"%s\"", cg
->subsystem
, cg
->value
);
2394 INFO("Limits for the unified cgroup hierarchy have been setup");
2398 __cgfsng_ops
static bool cgfsng_setup_limits(struct cgroup_ops
*ops
,
2399 struct lxc_conf
*conf
,
2404 bret
= __cg_legacy_setup_limits(ops
, &conf
->cgroup
, do_devices
);
2408 return __cg_unified_setup_limits(ops
, &conf
->cgroup2
);
2411 static bool cgroup_use_wants_controllers(const struct cgroup_ops
*ops
,
2414 char **cur_ctrl
, **cur_use
;
2416 if (!ops
->cgroup_use
)
2419 for (cur_ctrl
= controllers
; cur_ctrl
&& *cur_ctrl
; cur_ctrl
++) {
2422 for (cur_use
= ops
->cgroup_use
; cur_use
&& *cur_use
; cur_use
++) {
2423 if (strcmp(*cur_use
, *cur_ctrl
) != 0)
2439 static void cg_unified_delegate(char ***delegate
)
2441 __do_free
char *tmp
= NULL
;
2443 char *standard
[] = {"cgroup.subtree_control", "cgroup.threads", NULL
};
2445 tmp
= read_file("/sys/kernel/cgroup/delegate");
2447 for (char **p
= standard
; p
&& *p
; p
++) {
2448 idx
= append_null_to_list((void ***)delegate
);
2449 (*delegate
)[idx
] = must_copy_string(*p
);
2453 lxc_iterate_parts (token
, tmp
, " \t\n") {
2455 * We always need to chown this for both cgroup and
2458 if (strcmp(token
, "cgroup.procs") == 0)
2461 idx
= append_null_to_list((void ***)delegate
);
2462 (*delegate
)[idx
] = must_copy_string(token
);
2467 /* At startup, parse_hierarchies finds all the info we need about cgroup
2468 * mountpoints and current cgroups, and stores it in @d.
2470 static bool cg_hybrid_init(struct cgroup_ops
*ops
, bool relative
,
2473 __do_free
char *basecginfo
= NULL
;
2474 __do_free
char *line
= NULL
;
2475 __do_fclose
FILE *f
= NULL
;
2478 char **klist
= NULL
, **nlist
= NULL
;
2480 /* Root spawned containers escape the current cgroup, so use init's
2481 * cgroups as our base in that case.
2483 if (!relative
&& (geteuid() == 0))
2484 basecginfo
= read_file("/proc/1/cgroup");
2486 basecginfo
= read_file("/proc/self/cgroup");
2490 ret
= get_existing_subsystems(&klist
, &nlist
);
2492 ERROR("Failed to retrieve available legacy cgroup controllers");
2496 f
= fopen("/proc/self/mountinfo", "r");
2498 ERROR("Failed to open \"/proc/self/mountinfo\"");
2502 lxc_cgfsng_print_basecg_debuginfo(basecginfo
, klist
, nlist
);
2504 while (getline(&line
, &len
, f
) != -1) {
2507 struct hierarchy
*new;
2508 char *base_cgroup
= NULL
, *mountpoint
= NULL
;
2509 char **controller_list
= NULL
;
2511 type
= get_cgroup_version(line
);
2515 if (type
== CGROUP2_SUPER_MAGIC
&& ops
->unified
)
2518 if (ops
->cgroup_layout
== CGROUP_LAYOUT_UNKNOWN
) {
2519 if (type
== CGROUP2_SUPER_MAGIC
)
2520 ops
->cgroup_layout
= CGROUP_LAYOUT_UNIFIED
;
2521 else if (type
== CGROUP_SUPER_MAGIC
)
2522 ops
->cgroup_layout
= CGROUP_LAYOUT_LEGACY
;
2523 } else if (ops
->cgroup_layout
== CGROUP_LAYOUT_UNIFIED
) {
2524 if (type
== CGROUP_SUPER_MAGIC
)
2525 ops
->cgroup_layout
= CGROUP_LAYOUT_HYBRID
;
2526 } else if (ops
->cgroup_layout
== CGROUP_LAYOUT_LEGACY
) {
2527 if (type
== CGROUP2_SUPER_MAGIC
)
2528 ops
->cgroup_layout
= CGROUP_LAYOUT_HYBRID
;
2531 controller_list
= cg_hybrid_get_controllers(klist
, nlist
, line
, type
);
2532 if (!controller_list
&& type
== CGROUP_SUPER_MAGIC
)
2535 if (type
== CGROUP_SUPER_MAGIC
)
2536 if (controller_list_is_dup(ops
->hierarchies
, controller_list
))
2539 mountpoint
= cg_hybrid_get_mountpoint(line
);
2541 ERROR("Failed parsing mountpoint from \"%s\"", line
);
2545 if (type
== CGROUP_SUPER_MAGIC
)
2546 base_cgroup
= cg_hybrid_get_current_cgroup(basecginfo
, controller_list
[0], CGROUP_SUPER_MAGIC
);
2548 base_cgroup
= cg_hybrid_get_current_cgroup(basecginfo
, NULL
, CGROUP2_SUPER_MAGIC
);
2550 ERROR("Failed to find current cgroup");
2555 prune_init_scope(base_cgroup
);
2556 if (type
== CGROUP2_SUPER_MAGIC
)
2557 writeable
= test_writeable_v2(mountpoint
, base_cgroup
);
2559 writeable
= test_writeable_v1(mountpoint
, base_cgroup
);
2563 if (type
== CGROUP2_SUPER_MAGIC
) {
2564 char *cgv2_ctrl_path
;
2566 cgv2_ctrl_path
= must_make_path(mountpoint
, base_cgroup
,
2567 "cgroup.controllers",
2570 controller_list
= cg_unified_get_controllers(cgv2_ctrl_path
);
2571 free(cgv2_ctrl_path
);
2572 if (!controller_list
) {
2573 controller_list
= cg_unified_make_empty_controller();
2574 TRACE("No controllers are enabled for "
2575 "delegation in the unified hierarchy");
2579 /* Exclude all controllers that cgroup use does not want. */
2580 if (!cgroup_use_wants_controllers(ops
, controller_list
))
2583 new = add_hierarchy(&ops
->hierarchies
, controller_list
, mountpoint
, base_cgroup
, type
);
2584 if (type
== CGROUP2_SUPER_MAGIC
&& !ops
->unified
) {
2586 cg_unified_delegate(&new->cgroup2_chown
);
2593 free_string_list(controller_list
);
2598 free_string_list(klist
);
2599 free_string_list(nlist
);
2601 TRACE("Writable cgroup hierarchies:");
2602 lxc_cgfsng_print_hierarchies(ops
);
2604 /* verify that all controllers in cgroup.use and all crucial
2605 * controllers are accounted for
2607 if (!all_controllers_found(ops
))
2613 static int cg_is_pure_unified(void)
2619 ret
= statfs("/sys/fs/cgroup", &fs
);
2623 if (is_fs_type(&fs
, CGROUP2_SUPER_MAGIC
))
2624 return CGROUP2_SUPER_MAGIC
;
2629 /* Get current cgroup from /proc/self/cgroup for the cgroupfs v2 hierarchy. */
2630 static char *cg_unified_get_current_cgroup(bool relative
)
2632 __do_free
char *basecginfo
= NULL
;
2636 if (!relative
&& (geteuid() == 0))
2637 basecginfo
= read_file("/proc/1/cgroup");
2639 basecginfo
= read_file("/proc/self/cgroup");
2643 base_cgroup
= strstr(basecginfo
, "0::/");
2645 goto cleanup_on_err
;
2647 base_cgroup
= base_cgroup
+ 3;
2648 copy
= copy_to_eol(base_cgroup
);
2650 goto cleanup_on_err
;
2659 static int cg_unified_init(struct cgroup_ops
*ops
, bool relative
,
2662 __do_free
char *subtree_path
= NULL
;
2666 struct hierarchy
*new;
2667 char *base_cgroup
= NULL
;
2669 ret
= cg_is_pure_unified();
2670 if (ret
== -ENOMEDIUM
)
2673 if (ret
!= CGROUP2_SUPER_MAGIC
)
2676 base_cgroup
= cg_unified_get_current_cgroup(relative
);
2679 prune_init_scope(base_cgroup
);
2681 /* We assume that we have already been given controllers to delegate
2682 * further down the hierarchy. If not it is up to the user to delegate
2685 mountpoint
= must_copy_string("/sys/fs/cgroup");
2686 subtree_path
= must_make_path(mountpoint
, base_cgroup
,
2687 "cgroup.subtree_control", NULL
);
2688 delegatable
= cg_unified_get_controllers(subtree_path
);
2690 delegatable
= cg_unified_make_empty_controller();
2691 if (!delegatable
[0])
2692 TRACE("No controllers are enabled for delegation");
2694 /* TODO: If the user requested specific controllers via lxc.cgroup.use
2695 * we should verify here. The reason I'm not doing it right is that I'm
2696 * not convinced that lxc.cgroup.use will be the future since it is a
2697 * global property. I much rather have an option that lets you request
2698 * controllers per container.
2701 new = add_hierarchy(&ops
->hierarchies
, delegatable
, mountpoint
, base_cgroup
, CGROUP2_SUPER_MAGIC
);
2703 cg_unified_delegate(&new->cgroup2_chown
);
2705 ops
->cgroup_layout
= CGROUP_LAYOUT_UNIFIED
;
2707 return CGROUP2_SUPER_MAGIC
;
2710 static bool cg_init(struct cgroup_ops
*ops
, struct lxc_conf
*conf
)
2714 bool relative
= conf
->cgroup_meta
.relative
;
2716 tmp
= lxc_global_config_value("lxc.cgroup.use");
2718 __do_free
char *pin
= NULL
;
2721 pin
= must_copy_string(tmp
);
2724 lxc_iterate_parts(cur
, chop
, ",")
2725 must_append_string(&ops
->cgroup_use
, cur
);
2728 ret
= cg_unified_init(ops
, relative
, !lxc_list_empty(&conf
->id_map
));
2732 if (ret
== CGROUP2_SUPER_MAGIC
)
2735 return cg_hybrid_init(ops
, relative
, !lxc_list_empty(&conf
->id_map
));
2738 __cgfsng_ops
static bool cgfsng_data_init(struct cgroup_ops
*ops
)
2740 const char *cgroup_pattern
;
2742 /* copy system-wide cgroup information */
2743 cgroup_pattern
= lxc_global_config_value("lxc.cgroup.pattern");
2744 if (!cgroup_pattern
) {
2745 /* lxc.cgroup.pattern is only NULL on error. */
2746 ERROR("Failed to retrieve cgroup pattern");
2749 ops
->cgroup_pattern
= must_copy_string(cgroup_pattern
);
2750 ops
->monitor_pattern
= MONITOR_CGROUP
;
2755 struct cgroup_ops
*cgfsng_ops_init(struct lxc_conf
*conf
)
2757 struct cgroup_ops
*cgfsng_ops
;
2759 cgfsng_ops
= malloc(sizeof(struct cgroup_ops
));
2763 memset(cgfsng_ops
, 0, sizeof(struct cgroup_ops
));
2764 cgfsng_ops
->cgroup_layout
= CGROUP_LAYOUT_UNKNOWN
;
2766 if (!cg_init(cgfsng_ops
, conf
)) {
2771 cgfsng_ops
->data_init
= cgfsng_data_init
;
2772 cgfsng_ops
->payload_destroy
= cgfsng_payload_destroy
;
2773 cgfsng_ops
->monitor_destroy
= cgfsng_monitor_destroy
;
2774 cgfsng_ops
->monitor_create
= cgfsng_monitor_create
;
2775 cgfsng_ops
->monitor_enter
= cgfsng_monitor_enter
;
2776 cgfsng_ops
->payload_create
= cgfsng_payload_create
;
2777 cgfsng_ops
->payload_enter
= cgfsng_payload_enter
;
2778 cgfsng_ops
->escape
= cgfsng_escape
;
2779 cgfsng_ops
->num_hierarchies
= cgfsng_num_hierarchies
;
2780 cgfsng_ops
->get_hierarchies
= cgfsng_get_hierarchies
;
2781 cgfsng_ops
->get_cgroup
= cgfsng_get_cgroup
;
2782 cgfsng_ops
->get
= cgfsng_get
;
2783 cgfsng_ops
->set
= cgfsng_set
;
2784 cgfsng_ops
->unfreeze
= cgfsng_unfreeze
;
2785 cgfsng_ops
->setup_limits
= cgfsng_setup_limits
;
2786 cgfsng_ops
->driver
= "cgfsng";
2787 cgfsng_ops
->version
= "1.0.0";
2788 cgfsng_ops
->attach
= cgfsng_attach
;
2789 cgfsng_ops
->chown
= cgfsng_chown
;
2790 cgfsng_ops
->mount
= cgfsng_mount
;
2791 cgfsng_ops
->nrtasks
= cgfsng_nrtasks
;