2 * lxc: linux Container library
4 * Copyright © 2016 Canonical Ltd.
7 * Serge Hallyn <serge.hallyn@ubuntu.com>
8 * Christian Brauner <christian.brauner@ubuntu.com>
10 * This library is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU Lesser General Public
12 * License as published by the Free Software Foundation; either
13 * version 2.1 of the License, or (at your option) any later version.
15 * This library is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 * Lesser General Public License for more details.
20 * You should have received a copy of the GNU Lesser General Public
21 * License along with this library; if not, write to the Free Software
22 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
26 * cgfs-ng.c: this is a new, simplified implementation of a filesystem
27 * cgroup backend. The original cgfs.c was designed to be as flexible
28 * as possible. It would try to find cgroup filesystems no matter where
29 * or how you had them mounted, and deduce the most usable mount for
32 * This new implementation assumes that cgroup filesystems are mounted
33 * under /sys/fs/cgroup/clist where clist is either the controller, or
34 * a comma-separated list of controllers.
44 #include <linux/kdev_t.h>
45 #include <linux/types.h>
50 #include <sys/types.h>
55 #include "cgroup_utils.h"
61 #include "memory_utils.h"
62 #include "storage/storage.h"
66 #include "include/strlcpy.h"
70 #include "include/strlcat.h"
73 lxc_log_define(cgfsng
, cgroup
);
75 static void free_string_list(char **clist
)
82 for (i
= 0; clist
[i
]; i
++)
88 /* Given a pointer to a null-terminated array of pointers, realloc to add one
89 * entry, and point the new entry to NULL. Do not fail. Return the index to the
90 * second-to-last entry - that is, the one which is now available for use
91 * (keeping the list null-terminated).
93 static int append_null_to_list(void ***list
)
98 for (; (*list
)[newentry
]; newentry
++)
101 *list
= must_realloc(*list
, (newentry
+ 2) * sizeof(void **));
102 (*list
)[newentry
+ 1] = NULL
;
106 /* Given a null-terminated array of strings, check whether @entry is one of the
109 static bool string_in_list(char **list
, const char *entry
)
116 for (i
= 0; list
[i
]; i
++)
117 if (strcmp(list
[i
], entry
) == 0)
123 /* Return a copy of @entry prepending "name=", i.e. turn "systemd" into
124 * "name=systemd". Do not fail.
126 static char *cg_legacy_must_prefix_named(char *entry
)
132 prefixed
= must_realloc(NULL
, len
+ 6);
134 memcpy(prefixed
, "name=", STRLITERALLEN("name="));
135 memcpy(prefixed
+ STRLITERALLEN("name="), entry
, len
);
136 prefixed
[len
+ 5] = '\0';
141 /* Append an entry to the clist. Do not fail. @clist must be NULL the first time
144 * We also handle named subsystems here. Any controller which is not a kernel
145 * subsystem, we prefix "name=". Any which is both a kernel and named subsystem,
146 * we refuse to use because we're not sure which we have here.
147 * (TODO: We could work around this in some cases by just remounting to be
148 * unambiguous, or by comparing mountpoint contents with current cgroup.)
150 * The last entry will always be NULL.
152 static void must_append_controller(char **klist
, char **nlist
, char ***clist
,
158 if (string_in_list(klist
, entry
) && string_in_list(nlist
, entry
)) {
159 ERROR("Refusing to use ambiguous controller \"%s\"", entry
);
160 ERROR("It is both a named and kernel subsystem");
164 newentry
= append_null_to_list((void ***)clist
);
166 if (strncmp(entry
, "name=", 5) == 0)
167 copy
= must_copy_string(entry
);
168 else if (string_in_list(klist
, entry
))
169 copy
= must_copy_string(entry
);
171 copy
= cg_legacy_must_prefix_named(entry
);
173 (*clist
)[newentry
] = copy
;
176 /* Given a handler's cgroup data, return the struct hierarchy for the controller
177 * @c, or NULL if there is none.
179 struct hierarchy
*get_hierarchy(struct cgroup_ops
*ops
, const char *controller
)
185 if (!ops
->hierarchies
) {
186 TRACE("There are no useable cgroup controllers");
190 for (i
= 0; ops
->hierarchies
[i
]; i
++) {
192 /* This is the empty unified hierarchy. */
193 if (ops
->hierarchies
[i
]->controllers
&&
194 !ops
->hierarchies
[i
]->controllers
[0])
195 return ops
->hierarchies
[i
];
200 if (string_in_list(ops
->hierarchies
[i
]->controllers
, controller
))
201 return ops
->hierarchies
[i
];
205 WARN("There is no useable %s controller", controller
);
207 WARN("There is no empty unified cgroup hierarchy");
212 #define BATCH_SIZE 50
213 static void batch_realloc(char **mem
, size_t oldlen
, size_t newlen
)
215 int newbatches
= (newlen
/ BATCH_SIZE
) + 1;
216 int oldbatches
= (oldlen
/ BATCH_SIZE
) + 1;
218 if (!*mem
|| newbatches
> oldbatches
) {
219 *mem
= must_realloc(*mem
, newbatches
* BATCH_SIZE
);
223 static void append_line(char **dest
, size_t oldlen
, char *new, size_t newlen
)
225 size_t full
= oldlen
+ newlen
;
227 batch_realloc(dest
, oldlen
, full
+ 1);
229 memcpy(*dest
+ oldlen
, new, newlen
+ 1);
232 /* Slurp in a whole file */
233 static char *read_file(const char *fnam
)
236 char *line
= NULL
, *buf
= NULL
;
237 size_t len
= 0, fulllen
= 0;
240 f
= fopen(fnam
, "r");
243 while ((linelen
= getline(&line
, &len
, f
)) != -1) {
244 append_line(&buf
, fulllen
, line
, linelen
);
252 /* Taken over modified from the kernel sources. */
253 #define NBITS 32 /* bits in uint32_t */
254 #define DIV_ROUND_UP(n, d) (((n) + (d)-1) / (d))
255 #define BITS_TO_LONGS(nr) DIV_ROUND_UP(nr, NBITS)
257 static void set_bit(unsigned bit
, uint32_t *bitarr
)
259 bitarr
[bit
/ NBITS
] |= (1 << (bit
% NBITS
));
262 static void clear_bit(unsigned bit
, uint32_t *bitarr
)
264 bitarr
[bit
/ NBITS
] &= ~(1 << (bit
% NBITS
));
267 static bool is_set(unsigned bit
, uint32_t *bitarr
)
269 return (bitarr
[bit
/ NBITS
] & (1 << (bit
% NBITS
))) != 0;
272 /* Create cpumask from cpulist aka turn:
280 static uint32_t *lxc_cpumask(char *buf
, size_t nbits
)
286 arrlen
= BITS_TO_LONGS(nbits
);
287 bitarr
= calloc(arrlen
, sizeof(uint32_t));
291 lxc_iterate_parts(token
, buf
, ",") {
296 start
= strtoul(token
, NULL
, 0);
298 range
= strchr(token
, '-');
300 end
= strtoul(range
+ 1, NULL
, 0);
302 if (!(start
<= end
)) {
313 set_bit(start
++, bitarr
);
319 /* Turn cpumask into simple, comma-separated cpulist. */
320 static char *lxc_cpumask_to_cpulist(uint32_t *bitarr
, size_t nbits
)
324 char **cpulist
= NULL
;
325 char numstr
[INTTYPE_TO_STRLEN(size_t)] = {0};
327 for (i
= 0; i
<= nbits
; i
++) {
328 if (!is_set(i
, bitarr
))
331 ret
= snprintf(numstr
, sizeof(numstr
), "%zu", i
);
332 if (ret
< 0 || (size_t)ret
>= sizeof(numstr
)) {
333 lxc_free_array((void **)cpulist
, free
);
337 ret
= lxc_append_string(&cpulist
, numstr
);
339 lxc_free_array((void **)cpulist
, free
);
347 return lxc_string_join(",", (const char **)cpulist
, false);
350 static ssize_t
get_max_cpus(char *cpulist
)
353 char *maxcpus
= cpulist
;
356 c1
= strrchr(maxcpus
, ',');
360 c2
= strrchr(maxcpus
, '-');
374 cpus
= strtoul(c1
, NULL
, 0);
381 #define __ISOL_CPUS "/sys/devices/system/cpu/isolated"
382 static bool cg_legacy_filter_and_set_cpus(char *path
, bool am_initialized
)
386 char *lastslash
, *fpath
, oldv
;
387 ssize_t maxisol
= 0, maxposs
= 0;
388 char *cpulist
= NULL
, *isolcpus
= NULL
, *posscpus
= NULL
;
389 uint32_t *isolmask
= NULL
, *possmask
= NULL
;
390 bool bret
= false, flipped_bit
= false;
392 lastslash
= strrchr(path
, '/');
394 ERROR("Failed to detect \"/\" in \"%s\"", path
);
399 fpath
= must_make_path(path
, "cpuset.cpus", NULL
);
400 posscpus
= read_file(fpath
);
402 SYSERROR("Failed to read file \"%s\"", fpath
);
406 /* Get maximum number of cpus found in possible cpuset. */
407 maxposs
= get_max_cpus(posscpus
);
408 if (maxposs
< 0 || maxposs
>= INT_MAX
- 1)
411 if (!file_exists(__ISOL_CPUS
)) {
412 /* This system doesn't expose isolated cpus. */
413 DEBUG("The path \""__ISOL_CPUS
"\" to read isolated cpus from does not exist");
415 /* No isolated cpus but we weren't already initialized by
416 * someone. We should simply copy the parents cpuset.cpus
419 if (!am_initialized
) {
420 DEBUG("Copying cpu settings of parent cgroup");
423 /* No isolated cpus but we were already initialized by someone.
424 * Nothing more to do for us.
429 isolcpus
= read_file(__ISOL_CPUS
);
431 SYSERROR("Failed to read file \""__ISOL_CPUS
"\"");
434 if (!isdigit(isolcpus
[0])) {
435 TRACE("No isolated cpus detected");
437 /* No isolated cpus but we weren't already initialized by
438 * someone. We should simply copy the parents cpuset.cpus
441 if (!am_initialized
) {
442 DEBUG("Copying cpu settings of parent cgroup");
445 /* No isolated cpus but we were already initialized by someone.
446 * Nothing more to do for us.
451 /* Get maximum number of cpus found in isolated cpuset. */
452 maxisol
= get_max_cpus(isolcpus
);
453 if (maxisol
< 0 || maxisol
>= INT_MAX
- 1)
456 if (maxposs
< maxisol
)
460 possmask
= lxc_cpumask(posscpus
, maxposs
);
462 ERROR("Failed to create cpumask for possible cpus");
466 isolmask
= lxc_cpumask(isolcpus
, maxposs
);
468 ERROR("Failed to create cpumask for isolated cpus");
472 for (i
= 0; i
<= maxposs
; i
++) {
473 if (!is_set(i
, isolmask
) || !is_set(i
, possmask
))
477 clear_bit(i
, possmask
);
481 DEBUG("No isolated cpus present in cpuset");
484 DEBUG("Removed isolated cpus from cpuset");
486 cpulist
= lxc_cpumask_to_cpulist(possmask
, maxposs
);
488 ERROR("Failed to create cpu list");
495 fpath
= must_make_path(path
, "cpuset.cpus", NULL
);
496 ret
= lxc_write_to_file(fpath
, cpulist
, strlen(cpulist
), false, 0666);
498 SYSERROR("Failed to write cpu list to \"%s\"", fpath
);
511 if (posscpus
!= cpulist
)
519 /* Copy contents of parent(@path)/@file to @path/@file */
520 static bool copy_parent_file(char *path
, char *file
)
523 char *fpath
, *lastslash
, oldv
;
527 lastslash
= strrchr(path
, '/');
529 ERROR("Failed to detect \"/\" in \"%s\"", path
);
534 fpath
= must_make_path(path
, file
, NULL
);
535 len
= lxc_read_from_file(fpath
, NULL
, 0);
539 value
= must_realloc(NULL
, len
+ 1);
540 ret
= lxc_read_from_file(fpath
, value
, len
);
546 fpath
= must_make_path(path
, file
, NULL
);
547 ret
= lxc_write_to_file(fpath
, value
, len
, false, 0666);
549 SYSERROR("Failed to write \"%s\" to file \"%s\"", value
, fpath
);
555 SYSERROR("Failed to read file \"%s\"", fpath
);
561 /* Initialize the cpuset hierarchy in first directory of @gname and set
562 * cgroup.clone_children so that children inherit settings. Since the
563 * h->base_path is populated by init or ourselves, we know it is already
566 static bool cg_legacy_handle_cpuset_hierarchy(struct hierarchy
*h
, char *cgname
)
570 char *cgpath
, *clonechildrenpath
, *slash
;
572 if (!string_in_list(h
->controllers
, "cpuset"))
577 slash
= strchr(cgname
, '/');
581 cgpath
= must_make_path(h
->mountpoint
, h
->container_base_path
, cgname
, NULL
);
585 ret
= mkdir(cgpath
, 0755);
587 if (errno
!= EEXIST
) {
588 SYSERROR("Failed to create directory \"%s\"", cgpath
);
594 clonechildrenpath
= must_make_path(cgpath
, "cgroup.clone_children", NULL
);
595 /* unified hierarchy doesn't have clone_children */
596 if (!file_exists(clonechildrenpath
)) {
597 free(clonechildrenpath
);
602 ret
= lxc_read_from_file(clonechildrenpath
, &v
, 1);
604 SYSERROR("Failed to read file \"%s\"", clonechildrenpath
);
605 free(clonechildrenpath
);
610 /* Make sure any isolated cpus are removed from cpuset.cpus. */
611 if (!cg_legacy_filter_and_set_cpus(cgpath
, v
== '1')) {
612 SYSERROR("Failed to remove isolated cpus");
613 free(clonechildrenpath
);
618 /* Already set for us by someone else. */
620 DEBUG("\"cgroup.clone_children\" was already set to \"1\"");
621 free(clonechildrenpath
);
626 /* copy parent's settings */
627 if (!copy_parent_file(cgpath
, "cpuset.mems")) {
628 SYSERROR("Failed to copy \"cpuset.mems\" settings");
630 free(clonechildrenpath
);
635 ret
= lxc_write_to_file(clonechildrenpath
, "1", 1, false, 0666);
637 /* Set clone_children so children inherit our settings */
638 SYSERROR("Failed to write 1 to \"%s\"", clonechildrenpath
);
639 free(clonechildrenpath
);
642 free(clonechildrenpath
);
646 /* Given two null-terminated lists of strings, return true if any string is in
649 static bool controller_lists_intersect(char **l1
, char **l2
)
656 for (i
= 0; l1
[i
]; i
++) {
657 if (string_in_list(l2
, l1
[i
]))
664 /* For a null-terminated list of controllers @clist, return true if any of those
665 * controllers is already listed the null-terminated list of hierarchies @hlist.
666 * Realistically, if one is present, all must be present.
668 static bool controller_list_is_dup(struct hierarchy
**hlist
, char **clist
)
675 for (i
= 0; hlist
[i
]; i
++)
676 if (controller_lists_intersect(hlist
[i
]->controllers
, clist
))
682 /* Return true if the controller @entry is found in the null-terminated list of
683 * hierarchies @hlist.
685 static bool controller_found(struct hierarchy
**hlist
, char *entry
)
692 for (i
= 0; hlist
[i
]; i
++)
693 if (string_in_list(hlist
[i
]->controllers
, entry
))
699 /* Return true if all of the controllers which we require have been found. The
700 * required list is freezer and anything in lxc.cgroup.use.
702 static bool all_controllers_found(struct cgroup_ops
*ops
)
705 struct hierarchy
**hlist
= ops
->hierarchies
;
707 if (!ops
->cgroup_use
)
710 for (cur
= ops
->cgroup_use
; cur
&& *cur
; cur
++)
711 if (!controller_found(hlist
, *cur
)) {
712 ERROR("No %s controller mountpoint found", *cur
);
719 /* Get the controllers from a mountinfo line There are other ways we could get
720 * this info. For lxcfs, field 3 is /cgroup/controller-list. For cgroupfs, we
721 * could parse the mount options. But we simply assume that the mountpoint must
722 * be /sys/fs/cgroup/controller-list
724 static char **cg_hybrid_get_controllers(char **klist
, char **nlist
, char *line
,
727 /* The fourth field is /sys/fs/cgroup/comma-delimited-controller-list
728 * for legacy hierarchies.
731 char *dup
, *p2
, *tok
;
732 char *p
= line
, *sep
= ",";
735 for (i
= 0; i
< 4; i
++) {
742 /* Note, if we change how mountinfo works, then our caller will need to
743 * verify /sys/fs/cgroup/ in this field.
745 if (strncmp(p
, "/sys/fs/cgroup/", 15) != 0) {
746 ERROR("Found hierarchy not under /sys/fs/cgroup: \"%s\"", p
);
753 ERROR("Corrupt mountinfo");
758 if (type
== CGROUP_SUPER_MAGIC
) {
759 /* strdup() here for v1 hierarchies. Otherwise
760 * lxc_iterate_parts() will destroy mountpoints such as
761 * "/sys/fs/cgroup/cpu,cpuacct".
767 lxc_iterate_parts(tok
, dup
, sep
) {
768 must_append_controller(klist
, nlist
, &aret
, tok
);
778 static char **cg_unified_make_empty_controller(void)
783 newentry
= append_null_to_list((void ***)&aret
);
784 aret
[newentry
] = NULL
;
788 static char **cg_unified_get_controllers(const char *file
)
794 buf
= read_file(file
);
798 lxc_iterate_parts(tok
, buf
, sep
) {
802 newentry
= append_null_to_list((void ***)&aret
);
803 copy
= must_copy_string(tok
);
804 aret
[newentry
] = copy
;
811 static struct hierarchy
*add_hierarchy(struct hierarchy
***h
, char **clist
, char *mountpoint
,
812 char *container_base_path
, int type
)
814 struct hierarchy
*new;
817 new = must_realloc(NULL
, sizeof(*new));
818 new->controllers
= clist
;
819 new->mountpoint
= mountpoint
;
820 new->container_base_path
= container_base_path
;
821 new->container_full_path
= NULL
;
822 new->monitor_full_path
= NULL
;
824 new->cgroup2_chown
= NULL
;
826 newentry
= append_null_to_list((void ***)h
);
827 (*h
)[newentry
] = new;
831 /* Get a copy of the mountpoint from @line, which is a line from
832 * /proc/self/mountinfo.
834 static char *cg_hybrid_get_mountpoint(char *line
)
839 char *p
= line
, *sret
= NULL
;
841 for (i
= 0; i
< 4; i
++) {
848 if (strncmp(p
, "/sys/fs/cgroup/", 15) != 0)
851 p2
= strchr(p
+ 15, ' ');
857 sret
= must_realloc(NULL
, len
+ 1);
858 memcpy(sret
, p
, len
);
863 /* Given a multi-line string, return a null-terminated copy of the current line. */
864 static char *copy_to_eol(char *p
)
866 char *p2
= strchr(p
, '\n'), *sret
;
873 sret
= must_realloc(NULL
, len
+ 1);
874 memcpy(sret
, p
, len
);
879 /* cgline: pointer to character after the first ':' in a line in a \n-terminated
880 * /proc/self/cgroup file. Check whether controller c is present.
882 static bool controller_in_clist(char *cgline
, char *c
)
884 char *tok
, *eol
, *tmp
;
887 eol
= strchr(cgline
, ':');
892 tmp
= must_realloc(NULL
, len
+ 1);
893 memcpy(tmp
, cgline
, len
);
896 lxc_iterate_parts(tok
, tmp
, ",") {
897 if (strcmp(tok
, c
) == 0) {
907 /* @basecginfo is a copy of /proc/$$/cgroup. Return the current cgroup for
910 static char *cg_hybrid_get_current_cgroup(char *basecginfo
, char *controller
,
913 char *p
= basecginfo
;
916 bool is_cgv2_base_cgroup
= false;
918 /* cgroup v2 entry in "/proc/<pid>/cgroup": "0::/some/path" */
919 if ((type
== CGROUP2_SUPER_MAGIC
) && (*p
== '0'))
920 is_cgv2_base_cgroup
= true;
927 if (is_cgv2_base_cgroup
|| (controller
&& controller_in_clist(p
, controller
))) {
932 return copy_to_eol(p
);
942 static void must_append_string(char ***list
, char *entry
)
947 newentry
= append_null_to_list((void ***)list
);
948 copy
= must_copy_string(entry
);
949 (*list
)[newentry
] = copy
;
952 static int get_existing_subsystems(char ***klist
, char ***nlist
)
958 f
= fopen("/proc/self/cgroup", "r");
962 while (getline(&line
, &len
, f
) != -1) {
964 p
= strchr(line
, ':');
973 /* If the kernel has cgroup v2 support, then /proc/self/cgroup
974 * contains an entry of the form:
978 * In this case we use "cgroup2" as controller name.
981 must_append_string(klist
, "cgroup2");
985 lxc_iterate_parts(tok
, p
, ",") {
986 if (strncmp(tok
, "name=", 5) == 0)
987 must_append_string(nlist
, tok
);
989 must_append_string(klist
, tok
);
998 static void trim(char *s
)
1003 while ((len
> 1) && (s
[len
- 1] == '\n'))
1007 static void lxc_cgfsng_print_hierarchies(struct cgroup_ops
*ops
)
1010 struct hierarchy
**it
;
1012 if (!ops
->hierarchies
) {
1013 TRACE(" No hierarchies found");
1017 TRACE(" Hierarchies:");
1018 for (i
= 0, it
= ops
->hierarchies
; it
&& *it
; it
++, i
++) {
1022 TRACE(" %d: base_cgroup: %s", i
, (*it
)->container_base_path
? (*it
)->container_base_path
: "(null)");
1023 TRACE(" mountpoint: %s", (*it
)->mountpoint
? (*it
)->mountpoint
: "(null)");
1024 TRACE(" controllers:");
1025 for (j
= 0, cit
= (*it
)->controllers
; cit
&& *cit
; cit
++, j
++)
1026 TRACE(" %d: %s", j
, *cit
);
1030 static void lxc_cgfsng_print_basecg_debuginfo(char *basecginfo
, char **klist
,
1036 TRACE("basecginfo is:");
1037 TRACE("%s", basecginfo
);
1039 for (k
= 0, it
= klist
; it
&& *it
; it
++, k
++)
1040 TRACE("kernel subsystem %d: %s", k
, *it
);
1042 for (k
= 0, it
= nlist
; it
&& *it
; it
++, k
++)
1043 TRACE("named subsystem %d: %s", k
, *it
);
1046 static int cgroup_rmdir(struct hierarchy
**hierarchies
,
1047 const char *container_cgroup
)
1051 if (!container_cgroup
|| !hierarchies
)
1054 for (i
= 0; hierarchies
[i
]; i
++) {
1056 struct hierarchy
*h
= hierarchies
[i
];
1058 if (!h
->container_full_path
)
1061 ret
= recursive_destroy(h
->container_full_path
);
1063 WARN("Failed to destroy \"%s\"", h
->container_full_path
);
1065 free(h
->container_full_path
);
1066 h
->container_full_path
= NULL
;
1072 struct generic_userns_exec_data
{
1073 struct hierarchy
**hierarchies
;
1074 const char *container_cgroup
;
1075 struct lxc_conf
*conf
;
1076 uid_t origuid
; /* target uid in parent namespace */
1080 static int cgroup_rmdir_wrapper(void *data
)
1083 struct generic_userns_exec_data
*arg
= data
;
1084 uid_t nsuid
= (arg
->conf
->root_nsuid_map
!= NULL
) ? 0 : arg
->conf
->init_uid
;
1085 gid_t nsgid
= (arg
->conf
->root_nsgid_map
!= NULL
) ? 0 : arg
->conf
->init_gid
;
1087 ret
= setresgid(nsgid
, nsgid
, nsgid
);
1089 SYSERROR("Failed to setresgid(%d, %d, %d)", (int)nsgid
,
1090 (int)nsgid
, (int)nsgid
);
1094 ret
= setresuid(nsuid
, nsuid
, nsuid
);
1096 SYSERROR("Failed to setresuid(%d, %d, %d)", (int)nsuid
,
1097 (int)nsuid
, (int)nsuid
);
1101 ret
= setgroups(0, NULL
);
1102 if (ret
< 0 && errno
!= EPERM
) {
1103 SYSERROR("Failed to setgroups(0, NULL)");
1107 return cgroup_rmdir(arg
->hierarchies
, arg
->container_cgroup
);
1110 __cgfsng_ops
static void cgfsng_payload_destroy(struct cgroup_ops
*ops
,
1111 struct lxc_handler
*handler
)
1114 struct generic_userns_exec_data wrap
;
1116 if (!ops
->hierarchies
)
1120 wrap
.container_cgroup
= ops
->container_cgroup
;
1121 wrap
.hierarchies
= ops
->hierarchies
;
1122 wrap
.conf
= handler
->conf
;
1124 if (handler
->conf
&& !lxc_list_empty(&handler
->conf
->id_map
))
1125 ret
= userns_exec_1(handler
->conf
, cgroup_rmdir_wrapper
, &wrap
,
1126 "cgroup_rmdir_wrapper");
1128 ret
= cgroup_rmdir(ops
->hierarchies
, ops
->container_cgroup
);
1130 WARN("Failed to destroy cgroups");
1135 __cgfsng_ops
static void cgfsng_monitor_destroy(struct cgroup_ops
*ops
,
1136 struct lxc_handler
*handler
)
1140 struct lxc_conf
*conf
= handler
->conf
;
1141 char pidstr
[INTTYPE_TO_STRLEN(pid_t
)];
1143 if (!ops
->hierarchies
)
1146 len
= snprintf(pidstr
, sizeof(pidstr
), "%d", handler
->monitor_pid
);
1147 if (len
< 0 || (size_t)len
>= sizeof(pidstr
))
1150 for (int i
= 0; ops
->hierarchies
[i
]; i
++) {
1153 char pivot_cgroup
[] = PIVOT_CGROUP
;
1154 struct hierarchy
*h
= ops
->hierarchies
[i
];
1156 if (!h
->monitor_full_path
)
1159 if (conf
&& conf
->cgroup_meta
.dir
)
1160 pivot_path
= must_make_path(h
->mountpoint
,
1161 h
->container_base_path
,
1162 conf
->cgroup_meta
.dir
,
1164 "cgroup.procs", NULL
);
1166 pivot_path
= must_make_path(h
->mountpoint
,
1167 h
->container_base_path
,
1169 "cgroup.procs", NULL
);
1171 chop
= strrchr(pivot_path
, '/');
1176 * Make sure not to pass in the ro string literal PIVOT_CGROUP
1179 if (!cg_legacy_handle_cpuset_hierarchy(h
, pivot_cgroup
)) {
1180 WARN("Failed to handle legacy cpuset controller");
1184 ret
= mkdir_p(pivot_path
, 0755);
1185 if (ret
< 0 && errno
!= EEXIST
) {
1186 SYSWARN("Failed to create cgroup \"%s\"\n", pivot_path
);
1193 /* Move ourselves into the pivot cgroup to delete our own
1196 ret
= lxc_write_to_file(pivot_path
, pidstr
, len
, false, 0666);
1198 SYSWARN("Failed to move monitor %s to \"%s\"\n", pidstr
, pivot_path
);
1202 ret
= recursive_destroy(h
->monitor_full_path
);
1204 WARN("Failed to destroy \"%s\"", h
->monitor_full_path
);
1211 static bool cg_unified_create_cgroup(struct hierarchy
*h
, char *cgname
)
1213 size_t i
, parts_len
;
1215 size_t full_len
= 0;
1216 char *add_controllers
= NULL
, *cgroup
= NULL
;
1217 char **parts
= NULL
;
1220 if (h
->version
!= CGROUP2_SUPER_MAGIC
)
1223 if (!h
->controllers
)
1226 /* For now we simply enable all controllers that we have detected by
1227 * creating a string like "+memory +pids +cpu +io".
1228 * TODO: In the near future we might want to support "-<controller>"
1229 * etc. but whether supporting semantics like this make sense will need
1232 for (it
= h
->controllers
; it
&& *it
; it
++) {
1233 full_len
+= strlen(*it
) + 2;
1234 add_controllers
= must_realloc(add_controllers
, full_len
+ 1);
1236 if (h
->controllers
[0] == *it
)
1237 add_controllers
[0] = '\0';
1239 (void)strlcat(add_controllers
, "+", full_len
+ 1);
1240 (void)strlcat(add_controllers
, *it
, full_len
+ 1);
1242 if ((it
+ 1) && *(it
+ 1))
1243 (void)strlcat(add_controllers
, " ", full_len
+ 1);
1246 parts
= lxc_string_split(cgname
, '/');
1250 parts_len
= lxc_array_len((void **)parts
);
1254 cgroup
= must_make_path(h
->mountpoint
, h
->container_base_path
, NULL
);
1255 for (i
= 0; i
< parts_len
; i
++) {
1259 cgroup
= must_append_path(cgroup
, parts
[i
], NULL
);
1260 target
= must_make_path(cgroup
, "cgroup.subtree_control", NULL
);
1261 ret
= lxc_write_to_file(target
, add_controllers
, full_len
, false, 0666);
1264 SYSERROR("Could not enable \"%s\" controllers in the "
1265 "unified cgroup \"%s\"", add_controllers
, cgroup
);
1273 lxc_free_array((void **)parts
, free
);
1274 free(add_controllers
);
1279 static int mkdir_eexist_on_last(const char *dir
, mode_t mode
)
1281 const char *tmp
= dir
;
1282 const char *orig
= dir
;
1285 orig_len
= strlen(dir
);
1291 dir
= tmp
+ strspn(tmp
, "/");
1292 tmp
= dir
+ strcspn(dir
, "/");
1295 cur_len
= dir
- orig
;
1296 makeme
= strndup(orig
, cur_len
);
1300 ret
= mkdir(makeme
, mode
);
1302 if ((errno
!= EEXIST
) || (orig_len
== cur_len
)) {
1303 SYSERROR("Failed to create directory \"%s\"", makeme
);
1310 } while (tmp
!= dir
);
1315 static bool monitor_create_path_for_hierarchy(struct hierarchy
*h
, char *cgname
)
1319 if (!cg_legacy_handle_cpuset_hierarchy(h
, cgname
)) {
1320 ERROR("Failed to handle legacy cpuset controller");
1324 h
->monitor_full_path
= must_make_path(h
->mountpoint
, h
->container_base_path
, cgname
, NULL
);
1325 ret
= mkdir_eexist_on_last(h
->monitor_full_path
, 0755);
1327 ERROR("Failed to create cgroup \"%s\"", h
->monitor_full_path
);
1331 return cg_unified_create_cgroup(h
, cgname
);
1334 static bool container_create_path_for_hierarchy(struct hierarchy
*h
, char *cgname
)
1338 if (!cg_legacy_handle_cpuset_hierarchy(h
, cgname
)) {
1339 ERROR("Failed to handle legacy cpuset controller");
1343 h
->container_full_path
= must_make_path(h
->mountpoint
, h
->container_base_path
, cgname
, NULL
);
1344 ret
= mkdir_eexist_on_last(h
->container_full_path
, 0755);
1346 ERROR("Failed to create cgroup \"%s\"", h
->container_full_path
);
1350 return cg_unified_create_cgroup(h
, cgname
);
1353 static void remove_path_for_hierarchy(struct hierarchy
*h
, char *cgname
, bool monitor
)
1359 full_path
= h
->monitor_full_path
;
1361 full_path
= h
->container_full_path
;
1363 ret
= rmdir(full_path
);
1365 SYSERROR("Failed to rmdir(\"%s\") from failed creation attempt", full_path
);
1370 h
->monitor_full_path
= NULL
;
1372 h
->container_full_path
= NULL
;
1375 __cgfsng_ops
static inline bool cgfsng_monitor_create(struct cgroup_ops
*ops
,
1376 struct lxc_handler
*handler
)
1378 char *monitor_cgroup
, *offset
, *tmp
;
1382 struct lxc_conf
*conf
= handler
->conf
;
1387 if (!ops
->hierarchies
)
1390 if (conf
->cgroup_meta
.dir
)
1391 tmp
= lxc_string_join("/",
1392 (const char *[]){conf
->cgroup_meta
.dir
,
1393 ops
->monitor_pattern
,
1394 handler
->name
, NULL
},
1397 tmp
= must_make_path(ops
->monitor_pattern
, handler
->name
, NULL
);
1401 len
= strlen(tmp
) + 5; /* leave room for -NNN\0 */
1402 monitor_cgroup
= must_realloc(tmp
, len
);
1403 offset
= monitor_cgroup
+ len
- 5;
1408 int ret
= snprintf(offset
, 5, "-%d", idx
);
1409 if (ret
< 0 || (size_t)ret
>= 5)
1413 for (i
= 0; ops
->hierarchies
[i
]; i
++) {
1414 if (!monitor_create_path_for_hierarchy(ops
->hierarchies
[i
], monitor_cgroup
)) {
1415 ERROR("Failed to create cgroup \"%s\"", ops
->hierarchies
[i
]->monitor_full_path
);
1416 for (int j
= 0; j
< i
; j
++)
1417 remove_path_for_hierarchy(ops
->hierarchies
[j
], monitor_cgroup
, true);
1423 } while (ops
->hierarchies
[i
] && idx
> 0 && idx
< 1000);
1427 INFO("The monitor process uses \"%s\" as cgroup", monitor_cgroup
);
1431 free(monitor_cgroup
);
1436 /* Try to create the same cgroup in all hierarchies. Start with cgroup_pattern;
1437 * next cgroup_pattern-1, -2, ..., -999.
1439 __cgfsng_ops
static inline bool cgfsng_payload_create(struct cgroup_ops
*ops
,
1440 struct lxc_handler
*handler
)
1444 char *container_cgroup
, *offset
, *tmp
;
1446 struct lxc_conf
*conf
= handler
->conf
;
1448 if (ops
->container_cgroup
) {
1449 WARN("cgfsng_create called a second time: %s", ops
->container_cgroup
);
1456 if (!ops
->hierarchies
)
1459 if (conf
->cgroup_meta
.dir
)
1460 tmp
= lxc_string_join("/", (const char *[]){conf
->cgroup_meta
.dir
, handler
->name
, NULL
}, false);
1462 tmp
= lxc_string_replace("%n", handler
->name
, ops
->cgroup_pattern
);
1464 ERROR("Failed expanding cgroup name pattern");
1468 len
= strlen(tmp
) + 5; /* leave room for -NNN\0 */
1469 container_cgroup
= must_realloc(NULL
, len
);
1470 (void)strlcpy(container_cgroup
, tmp
, len
);
1472 offset
= container_cgroup
+ len
- 5;
1476 ERROR("Too many conflicting cgroup names");
1483 ret
= snprintf(offset
, 5, "-%d", idx
);
1484 if (ret
< 0 || (size_t)ret
>= 5) {
1485 FILE *f
= fopen("/dev/null", "w");
1487 fprintf(f
, "Workaround for GCC7 bug: "
1488 "https://gcc.gnu.org/bugzilla/"
1489 "show_bug.cgi?id=78969");
1495 for (i
= 0; ops
->hierarchies
[i
]; i
++) {
1496 if (!container_create_path_for_hierarchy(ops
->hierarchies
[i
], container_cgroup
)) {
1497 ERROR("Failed to create cgroup \"%s\"", ops
->hierarchies
[i
]->container_full_path
);
1498 for (int j
= 0; j
< i
; j
++)
1499 remove_path_for_hierarchy(ops
->hierarchies
[j
], container_cgroup
, false);
1505 ops
->container_cgroup
= container_cgroup
;
1506 INFO("The container uses \"%s\" as cgroup", container_cgroup
);
1511 free(container_cgroup
);
1516 __cgfsng_ops
static bool __do_cgroup_enter(struct cgroup_ops
*ops
, pid_t pid
,
1520 char pidstr
[INTTYPE_TO_STRLEN(pid_t
)];
1522 if (!ops
->hierarchies
)
1525 len
= snprintf(pidstr
, sizeof(pidstr
), "%d", pid
);
1526 if (len
< 0 || (size_t)len
>= sizeof(pidstr
))
1529 for (int i
= 0; ops
->hierarchies
[i
]; i
++) {
1534 path
= must_make_path(ops
->hierarchies
[i
]->monitor_full_path
,
1535 "cgroup.procs", NULL
);
1537 path
= must_make_path(ops
->hierarchies
[i
]->container_full_path
,
1538 "cgroup.procs", NULL
);
1539 ret
= lxc_write_to_file(path
, pidstr
, len
, false, 0666);
1541 SYSERROR("Failed to enter cgroup \"%s\"", path
);
1551 __cgfsng_ops
static bool cgfsng_monitor_enter(struct cgroup_ops
*ops
, pid_t pid
)
1553 return __do_cgroup_enter(ops
, pid
, true);
1556 static bool cgfsng_payload_enter(struct cgroup_ops
*ops
, pid_t pid
)
1558 return __do_cgroup_enter(ops
, pid
, false);
1561 static int chowmod(char *path
, uid_t chown_uid
, gid_t chown_gid
,
1566 ret
= chown(path
, chown_uid
, chown_gid
);
1568 SYSWARN("Failed to chown(%s, %d, %d)", path
, (int)chown_uid
, (int)chown_gid
);
1572 ret
= chmod(path
, chmod_mode
);
1574 SYSWARN("Failed to chmod(%s, %d)", path
, (int)chmod_mode
);
1581 /* chgrp the container cgroups to container group. We leave
1582 * the container owner as cgroup owner. So we must make the
1583 * directories 775 so that the container can create sub-cgroups.
1585 * Also chown the tasks and cgroup.procs files. Those may not
1586 * exist depending on kernel version.
1588 static int chown_cgroup_wrapper(void *data
)
1592 struct generic_userns_exec_data
*arg
= data
;
1593 uid_t nsuid
= (arg
->conf
->root_nsuid_map
!= NULL
) ? 0 : arg
->conf
->init_uid
;
1594 gid_t nsgid
= (arg
->conf
->root_nsgid_map
!= NULL
) ? 0 : arg
->conf
->init_gid
;
1596 ret
= setresgid(nsgid
, nsgid
, nsgid
);
1598 SYSERROR("Failed to setresgid(%d, %d, %d)",
1599 (int)nsgid
, (int)nsgid
, (int)nsgid
);
1603 ret
= setresuid(nsuid
, nsuid
, nsuid
);
1605 SYSERROR("Failed to setresuid(%d, %d, %d)",
1606 (int)nsuid
, (int)nsuid
, (int)nsuid
);
1610 ret
= setgroups(0, NULL
);
1611 if (ret
< 0 && errno
!= EPERM
) {
1612 SYSERROR("Failed to setgroups(0, NULL)");
1616 destuid
= get_ns_uid(arg
->origuid
);
1617 if (destuid
== LXC_INVALID_UID
)
1620 for (i
= 0; arg
->hierarchies
[i
]; i
++) {
1622 char *path
= arg
->hierarchies
[i
]->container_full_path
;
1624 ret
= chowmod(path
, destuid
, nsgid
, 0775);
1628 /* Failures to chown() these are inconvenient but not
1629 * detrimental We leave these owned by the container launcher,
1630 * so that container root can write to the files to attach. We
1631 * chmod() them 664 so that container systemd can write to the
1632 * files (which systemd in wily insists on doing).
1635 if (arg
->hierarchies
[i
]->version
== CGROUP_SUPER_MAGIC
) {
1636 fullpath
= must_make_path(path
, "tasks", NULL
);
1637 (void)chowmod(fullpath
, destuid
, nsgid
, 0664);
1641 fullpath
= must_make_path(path
, "cgroup.procs", NULL
);
1642 (void)chowmod(fullpath
, destuid
, nsgid
, 0664);
1645 if (arg
->hierarchies
[i
]->version
!= CGROUP2_SUPER_MAGIC
)
1648 for (char **p
= arg
->hierarchies
[i
]->cgroup2_chown
; p
&& *p
; p
++) {
1649 fullpath
= must_make_path(path
, *p
, NULL
);
1650 (void)chowmod(fullpath
, destuid
, nsgid
, 0664);
1658 __cgfsng_ops
static bool cgfsng_chown(struct cgroup_ops
*ops
,
1659 struct lxc_conf
*conf
)
1661 struct generic_userns_exec_data wrap
;
1663 if (lxc_list_empty(&conf
->id_map
))
1666 if (!ops
->hierarchies
)
1669 wrap
.origuid
= geteuid();
1671 wrap
.hierarchies
= ops
->hierarchies
;
1674 if (userns_exec_1(conf
, chown_cgroup_wrapper
, &wrap
,
1675 "chown_cgroup_wrapper") < 0) {
1676 ERROR("Error requesting cgroup chown in new user namespace");
1683 /* cgroup-full:* is done, no need to create subdirs */
1684 static bool cg_mount_needs_subdirs(int type
)
1686 if (type
>= LXC_AUTO_CGROUP_FULL_RO
)
1692 /* After $rootfs/sys/fs/container/controller/the/cg/path has been created,
1693 * remount controller ro if needed and bindmount the cgroupfs onto
1694 * control/the/cg/path.
1696 static int cg_legacy_mount_controllers(int type
, struct hierarchy
*h
,
1697 char *controllerpath
, char *cgpath
,
1698 const char *container_cgroup
)
1700 int ret
, remount_flags
;
1702 int flags
= MS_BIND
;
1704 if (type
== LXC_AUTO_CGROUP_RO
|| type
== LXC_AUTO_CGROUP_MIXED
) {
1705 ret
= mount(controllerpath
, controllerpath
, "cgroup", MS_BIND
, NULL
);
1707 SYSERROR("Failed to bind mount \"%s\" onto \"%s\"",
1708 controllerpath
, controllerpath
);
1712 remount_flags
= add_required_remount_flags(controllerpath
,
1714 flags
| MS_REMOUNT
);
1715 ret
= mount(controllerpath
, controllerpath
, "cgroup",
1716 remount_flags
| MS_REMOUNT
| MS_BIND
| MS_RDONLY
,
1719 SYSERROR("Failed to remount \"%s\" ro", controllerpath
);
1723 INFO("Remounted %s read-only", controllerpath
);
1726 sourcepath
= must_make_path(h
->mountpoint
, h
->container_base_path
,
1727 container_cgroup
, NULL
);
1728 if (type
== LXC_AUTO_CGROUP_RO
)
1731 ret
= mount(sourcepath
, cgpath
, "cgroup", flags
, NULL
);
1733 SYSERROR("Failed to mount \"%s\" onto \"%s\"", h
->controllers
[0], cgpath
);
1737 INFO("Mounted \"%s\" onto \"%s\"", h
->controllers
[0], cgpath
);
1739 if (flags
& MS_RDONLY
) {
1740 remount_flags
= add_required_remount_flags(sourcepath
, cgpath
,
1741 flags
| MS_REMOUNT
);
1742 ret
= mount(sourcepath
, cgpath
, "cgroup", remount_flags
, NULL
);
1744 SYSERROR("Failed to remount \"%s\" ro", cgpath
);
1748 INFO("Remounted %s read-only", cgpath
);
1752 INFO("Completed second stage cgroup automounts for \"%s\"", cgpath
);
1756 /* __cg_mount_direct
1758 * Mount cgroup hierarchies directly without using bind-mounts. The main
1759 * uses-cases are mounting cgroup hierarchies in cgroup namespaces and mounting
1760 * cgroups for the LXC_AUTO_CGROUP_FULL option.
1762 static int __cg_mount_direct(int type
, struct hierarchy
*h
,
1763 const char *controllerpath
)
1766 char *controllers
= NULL
;
1767 char *fstype
= "cgroup2";
1768 unsigned long flags
= 0;
1773 flags
|= MS_RELATIME
;
1775 if (type
== LXC_AUTO_CGROUP_RO
|| type
== LXC_AUTO_CGROUP_FULL_RO
)
1778 if (h
->version
!= CGROUP2_SUPER_MAGIC
) {
1779 controllers
= lxc_string_join(",", (const char **)h
->controllers
, false);
1785 ret
= mount("cgroup", controllerpath
, fstype
, flags
, controllers
);
1788 SYSERROR("Failed to mount \"%s\" with cgroup filesystem type %s", controllerpath
, fstype
);
1792 DEBUG("Mounted \"%s\" with cgroup filesystem type %s", controllerpath
, fstype
);
1796 static inline int cg_mount_in_cgroup_namespace(int type
, struct hierarchy
*h
,
1797 const char *controllerpath
)
1799 return __cg_mount_direct(type
, h
, controllerpath
);
1802 static inline int cg_mount_cgroup_full(int type
, struct hierarchy
*h
,
1803 const char *controllerpath
)
1805 if (type
< LXC_AUTO_CGROUP_FULL_RO
|| type
> LXC_AUTO_CGROUP_FULL_MIXED
)
1808 return __cg_mount_direct(type
, h
, controllerpath
);
1811 __cgfsng_ops
static bool cgfsng_mount(struct cgroup_ops
*ops
,
1812 struct lxc_handler
*handler
,
1813 const char *root
, int type
)
1816 char *tmpfspath
= NULL
;
1817 bool has_cgns
= false, retval
= false, wants_force_mount
= false;
1819 if (!ops
->hierarchies
)
1822 if ((type
& LXC_AUTO_CGROUP_MASK
) == 0)
1825 if (type
& LXC_AUTO_CGROUP_FORCE
) {
1826 type
&= ~LXC_AUTO_CGROUP_FORCE
;
1827 wants_force_mount
= true;
1830 if (!wants_force_mount
){
1831 if (!lxc_list_empty(&handler
->conf
->keepcaps
))
1832 wants_force_mount
= !in_caplist(CAP_SYS_ADMIN
, &handler
->conf
->keepcaps
);
1834 wants_force_mount
= in_caplist(CAP_SYS_ADMIN
, &handler
->conf
->caps
);
1837 has_cgns
= cgns_supported();
1838 if (has_cgns
&& !wants_force_mount
)
1841 if (type
== LXC_AUTO_CGROUP_NOSPEC
)
1842 type
= LXC_AUTO_CGROUP_MIXED
;
1843 else if (type
== LXC_AUTO_CGROUP_FULL_NOSPEC
)
1844 type
= LXC_AUTO_CGROUP_FULL_MIXED
;
1847 tmpfspath
= must_make_path(root
, "/sys/fs/cgroup", NULL
);
1848 ret
= safe_mount(NULL
, tmpfspath
, "tmpfs",
1849 MS_NOSUID
| MS_NODEV
| MS_NOEXEC
| MS_RELATIME
,
1850 "size=10240k,mode=755", root
);
1854 for (i
= 0; ops
->hierarchies
[i
]; i
++) {
1855 char *controllerpath
, *path2
;
1856 struct hierarchy
*h
= ops
->hierarchies
[i
];
1857 char *controller
= strrchr(h
->mountpoint
, '/');
1863 controllerpath
= must_make_path(tmpfspath
, controller
, NULL
);
1864 if (dir_exists(controllerpath
)) {
1865 free(controllerpath
);
1869 ret
= mkdir(controllerpath
, 0755);
1871 SYSERROR("Error creating cgroup path: %s", controllerpath
);
1872 free(controllerpath
);
1876 if (has_cgns
&& wants_force_mount
) {
1877 /* If cgroup namespaces are supported but the container
1878 * will not have CAP_SYS_ADMIN after it has started we
1879 * need to mount the cgroups manually.
1881 ret
= cg_mount_in_cgroup_namespace(type
, h
, controllerpath
);
1882 free(controllerpath
);
1889 ret
= cg_mount_cgroup_full(type
, h
, controllerpath
);
1891 free(controllerpath
);
1895 if (!cg_mount_needs_subdirs(type
)) {
1896 free(controllerpath
);
1900 path2
= must_make_path(controllerpath
, h
->container_base_path
,
1901 ops
->container_cgroup
, NULL
);
1902 ret
= mkdir_p(path2
, 0755);
1904 free(controllerpath
);
1909 ret
= cg_legacy_mount_controllers(type
, h
, controllerpath
,
1910 path2
, ops
->container_cgroup
);
1911 free(controllerpath
);
1923 static int recursive_count_nrtasks(char *dirname
)
1925 struct dirent
*direntp
;
1930 dir
= opendir(dirname
);
1934 while ((direntp
= readdir(dir
))) {
1937 if (!strcmp(direntp
->d_name
, ".") ||
1938 !strcmp(direntp
->d_name
, ".."))
1941 path
= must_make_path(dirname
, direntp
->d_name
, NULL
);
1943 if (lstat(path
, &mystat
))
1946 if (!S_ISDIR(mystat
.st_mode
))
1949 count
+= recursive_count_nrtasks(path
);
1954 path
= must_make_path(dirname
, "cgroup.procs", NULL
);
1955 ret
= lxc_count_file_lines(path
);
1960 (void)closedir(dir
);
1965 __cgfsng_ops
static int cgfsng_nrtasks(struct cgroup_ops
*ops
)
1970 if (!ops
->container_cgroup
|| !ops
->hierarchies
)
1973 path
= must_make_path(ops
->hierarchies
[0]->container_full_path
, NULL
);
1974 count
= recursive_count_nrtasks(path
);
1979 /* Only root needs to escape to the cgroup of its init. */
1980 __cgfsng_ops
static bool cgfsng_escape(const struct cgroup_ops
*ops
,
1981 struct lxc_conf
*conf
)
1985 if (conf
->cgroup_meta
.relative
|| geteuid() || !ops
->hierarchies
)
1988 for (i
= 0; ops
->hierarchies
[i
]; i
++) {
1992 fullpath
= must_make_path(ops
->hierarchies
[i
]->mountpoint
,
1993 ops
->hierarchies
[i
]->container_base_path
,
1994 "cgroup.procs", NULL
);
1995 ret
= lxc_write_to_file(fullpath
, "0", 2, false, 0666);
1997 SYSERROR("Failed to escape to cgroup \"%s\"", fullpath
);
2007 __cgfsng_ops
static int cgfsng_num_hierarchies(struct cgroup_ops
*ops
)
2011 if (!ops
->hierarchies
)
2014 for (; ops
->hierarchies
[i
]; i
++)
2020 __cgfsng_ops
static bool cgfsng_get_hierarchies(struct cgroup_ops
*ops
, int n
, char ***out
)
2024 if (!ops
->hierarchies
)
2027 /* sanity check n */
2028 for (i
= 0; i
< n
; i
++)
2029 if (!ops
->hierarchies
[i
])
2032 *out
= ops
->hierarchies
[i
]->controllers
;
2037 #define THAWED "THAWED"
2038 #define THAWED_LEN (strlen(THAWED))
2040 /* TODO: If the unified cgroup hierarchy grows a freezer controller this needs
2043 __cgfsng_ops
static bool cgfsng_unfreeze(struct cgroup_ops
*ops
)
2047 struct hierarchy
*h
;
2049 h
= get_hierarchy(ops
, "freezer");
2053 fullpath
= must_make_path(h
->container_full_path
, "freezer.state", NULL
);
2054 ret
= lxc_write_to_file(fullpath
, THAWED
, THAWED_LEN
, false, 0666);
2062 __cgfsng_ops
static const char *cgfsng_get_cgroup(struct cgroup_ops
*ops
,
2063 const char *controller
)
2065 struct hierarchy
*h
;
2067 h
= get_hierarchy(ops
, controller
);
2069 WARN("Failed to find hierarchy for controller \"%s\"",
2070 controller
? controller
: "(null)");
2074 return h
->container_full_path
? h
->container_full_path
+ strlen(h
->mountpoint
) : NULL
;
2077 /* Given a cgroup path returned from lxc_cmd_get_cgroup_path, build a full path,
2078 * which must be freed by the caller.
2080 static inline char *build_full_cgpath_from_monitorpath(struct hierarchy
*h
,
2082 const char *filename
)
2084 return must_make_path(h
->mountpoint
, inpath
, filename
, NULL
);
2087 /* Technically, we're always at a delegation boundary here (This is especially
2088 * true when cgroup namespaces are available.). The reasoning is that in order
2089 * for us to have been able to start a container in the first place the root
2090 * cgroup must have been a leaf node. Now, either the container's init system
2091 * has populated the cgroup and kept it as a leaf node or it has created
2092 * subtrees. In the former case we will simply attach to the leaf node we
2093 * created when we started the container in the latter case we create our own
2094 * cgroup for the attaching process.
2096 static int __cg_unified_attach(const struct hierarchy
*h
, const char *name
,
2097 const char *lxcpath
, const char *pidstr
,
2098 size_t pidstr_len
, const char *controller
)
2102 int fret
= -1, idx
= 0;
2103 char *base_path
= NULL
, *container_cgroup
= NULL
, *full_path
= NULL
;
2105 container_cgroup
= lxc_cmd_get_cgroup_path(name
, lxcpath
, controller
);
2107 if (!container_cgroup
)
2110 base_path
= must_make_path(h
->mountpoint
, container_cgroup
, NULL
);
2111 full_path
= must_make_path(base_path
, "cgroup.procs", NULL
);
2112 /* cgroup is populated */
2113 ret
= lxc_write_to_file(full_path
, pidstr
, pidstr_len
, false, 0666);
2114 if (ret
< 0 && errno
!= EBUSY
)
2122 len
= strlen(base_path
) + STRLITERALLEN("/lxc-1000") +
2123 STRLITERALLEN("/cgroup-procs");
2124 full_path
= must_realloc(NULL
, len
+ 1);
2127 ret
= snprintf(full_path
, len
+ 1, "%s/lxc-%d",
2130 ret
= snprintf(full_path
, len
+ 1, "%s/lxc", base_path
);
2131 if (ret
< 0 || (size_t)ret
>= len
+ 1)
2134 ret
= mkdir_p(full_path
, 0755);
2135 if (ret
< 0 && errno
!= EEXIST
)
2138 (void)strlcat(full_path
, "/cgroup.procs", len
+ 1);
2139 ret
= lxc_write_to_file(full_path
, pidstr
, len
, false, 0666);
2143 /* this is a non-leaf node */
2148 } while (idx
< 1000);
2156 free(container_cgroup
);
2162 __cgfsng_ops
static bool cgfsng_attach(struct cgroup_ops
*ops
, const char *name
,
2163 const char *lxcpath
, pid_t pid
)
2166 char pidstr
[INTTYPE_TO_STRLEN(pid_t
)];
2168 if (!ops
->hierarchies
)
2171 len
= snprintf(pidstr
, sizeof(pidstr
), "%d", pid
);
2172 if (len
< 0 || (size_t)len
>= sizeof(pidstr
))
2175 for (i
= 0; ops
->hierarchies
[i
]; i
++) {
2177 char *fullpath
= NULL
;
2178 struct hierarchy
*h
= ops
->hierarchies
[i
];
2180 if (h
->version
== CGROUP2_SUPER_MAGIC
) {
2181 ret
= __cg_unified_attach(h
, name
, lxcpath
, pidstr
, len
,
2189 path
= lxc_cmd_get_cgroup_path(name
, lxcpath
, h
->controllers
[0]);
2194 fullpath
= build_full_cgpath_from_monitorpath(h
, path
, "cgroup.procs");
2196 ret
= lxc_write_to_file(fullpath
, pidstr
, len
, false, 0666);
2198 SYSERROR("Failed to attach %d to %s", (int)pid
, fullpath
);
2208 /* Called externally (i.e. from 'lxc-cgroup') to query cgroup limits. Here we
2209 * don't have a cgroup_data set up, so we ask the running container through the
2210 * commands API for the cgroup path.
2212 __cgfsng_ops
static int cgfsng_get(struct cgroup_ops
*ops
, const char *filename
,
2213 char *value
, size_t len
, const char *name
,
2214 const char *lxcpath
)
2216 __do_free
char *controller
;
2218 struct hierarchy
*h
;
2221 controller
= must_copy_string(filename
);
2222 p
= strchr(controller
, '.');
2226 path
= lxc_cmd_get_cgroup_path(name
, lxcpath
, controller
);
2231 h
= get_hierarchy(ops
, controller
);
2235 fullpath
= build_full_cgpath_from_monitorpath(h
, path
, filename
);
2236 ret
= lxc_read_from_file(fullpath
, value
, len
);
2244 /* Called externally (i.e. from 'lxc-cgroup') to set new cgroup limits. Here we
2245 * don't have a cgroup_data set up, so we ask the running container through the
2246 * commands API for the cgroup path.
2248 __cgfsng_ops
static int cgfsng_set(struct cgroup_ops
*ops
,
2249 const char *filename
, const char *value
,
2250 const char *name
, const char *lxcpath
)
2252 __do_free
char *controller
;
2254 struct hierarchy
*h
;
2257 controller
= must_copy_string(filename
);
2258 p
= strchr(controller
, '.');
2262 path
= lxc_cmd_get_cgroup_path(name
, lxcpath
, controller
);
2267 h
= get_hierarchy(ops
, controller
);
2271 fullpath
= build_full_cgpath_from_monitorpath(h
, path
, filename
);
2272 ret
= lxc_write_to_file(fullpath
, value
, strlen(value
), false, 0666);
2280 /* take devices cgroup line
2282 * and convert it to a valid
2283 * type major:minor mode
2284 * line. Return <0 on error. Dest is a preallocated buffer long enough to hold
2287 static int convert_devpath(const char *invalue
, char *dest
)
2290 char *p
, *path
, type
;
2291 unsigned long minor
, major
;
2296 path
= must_copy_string(invalue
);
2298 /* Read path followed by mode. Ignore any trailing text.
2299 * A ' # comment' would be legal. Technically other text is not
2300 * legal, we could check for that if we cared to.
2302 for (n_parts
= 1, p
= path
; *p
&& n_parts
< 3; p
++) {
2324 ret
= stat(path
, &sb
);
2328 mode_t m
= sb
.st_mode
& S_IFMT
;
2337 ERROR("Unsupported device type %i for \"%s\"", m
, path
);
2342 major
= MAJOR(sb
.st_rdev
);
2343 minor
= MINOR(sb
.st_rdev
);
2344 ret
= snprintf(dest
, 50, "%c %lu:%lu %s", type
, major
, minor
, mode
);
2345 if (ret
< 0 || ret
>= 50) {
2346 ERROR("Error on configuration value \"%c %lu:%lu %s\" (max 50 "
2347 "chars)", type
, major
, minor
, mode
);
2348 ret
= -ENAMETOOLONG
;
2358 /* Called from setup_limits - here we have the container's cgroup_data because
2359 * we created the cgroups.
2361 static int cg_legacy_set_data(struct cgroup_ops
*ops
, const char *filename
,
2364 __do_free
char *controller
;
2366 /* "b|c <2^64-1>:<2^64-1> r|w|m" = 47 chars max */
2367 char converted_value
[50];
2368 struct hierarchy
*h
;
2371 controller
= must_copy_string(filename
);
2372 p
= strchr(controller
, '.');
2376 if (strcmp("devices.allow", filename
) == 0 && value
[0] == '/') {
2377 ret
= convert_devpath(value
, converted_value
);
2380 value
= converted_value
;
2383 h
= get_hierarchy(ops
, controller
);
2385 ERROR("Failed to setup limits for the \"%s\" controller. "
2386 "The controller seems to be unused by \"cgfsng\" cgroup "
2387 "driver or not enabled on the cgroup hierarchy",
2393 fullpath
= must_make_path(h
->container_full_path
, filename
, NULL
);
2394 ret
= lxc_write_to_file(fullpath
, value
, strlen(value
), false, 0666);
2399 static bool __cg_legacy_setup_limits(struct cgroup_ops
*ops
,
2400 struct lxc_list
*cgroup_settings
,
2403 struct lxc_list
*iterator
, *next
, *sorted_cgroup_settings
;
2404 struct lxc_cgroup
*cg
;
2407 if (lxc_list_empty(cgroup_settings
))
2410 if (!ops
->hierarchies
)
2413 sorted_cgroup_settings
= sort_cgroup_settings(cgroup_settings
);
2414 if (!sorted_cgroup_settings
)
2417 lxc_list_for_each(iterator
, sorted_cgroup_settings
) {
2418 cg
= iterator
->elem
;
2420 if (do_devices
== !strncmp("devices", cg
->subsystem
, 7)) {
2421 if (cg_legacy_set_data(ops
, cg
->subsystem
, cg
->value
)) {
2422 if (do_devices
&& (errno
== EACCES
|| errno
== EPERM
)) {
2423 WARN("Failed to set \"%s\" to \"%s\"",
2424 cg
->subsystem
, cg
->value
);
2427 WARN("Failed to set \"%s\" to \"%s\"",
2428 cg
->subsystem
, cg
->value
);
2431 DEBUG("Set controller \"%s\" set to \"%s\"",
2432 cg
->subsystem
, cg
->value
);
2437 INFO("Limits for the legacy cgroup hierarchies have been setup");
2439 lxc_list_for_each_safe(iterator
, sorted_cgroup_settings
, next
) {
2440 lxc_list_del(iterator
);
2443 free(sorted_cgroup_settings
);
2447 static bool __cg_unified_setup_limits(struct cgroup_ops
*ops
,
2448 struct lxc_list
*cgroup_settings
)
2450 struct lxc_list
*iterator
;
2451 struct hierarchy
*h
= ops
->unified
;
2453 if (lxc_list_empty(cgroup_settings
))
2459 lxc_list_for_each(iterator
, cgroup_settings
) {
2462 struct lxc_cgroup
*cg
= iterator
->elem
;
2464 fullpath
= must_make_path(h
->container_full_path
, cg
->subsystem
, NULL
);
2465 ret
= lxc_write_to_file(fullpath
, cg
->value
, strlen(cg
->value
), false, 0666);
2468 SYSERROR("Failed to set \"%s\" to \"%s\"",
2469 cg
->subsystem
, cg
->value
);
2472 TRACE("Set \"%s\" to \"%s\"", cg
->subsystem
, cg
->value
);
2475 INFO("Limits for the unified cgroup hierarchy have been setup");
2479 __cgfsng_ops
static bool cgfsng_setup_limits(struct cgroup_ops
*ops
,
2480 struct lxc_conf
*conf
,
2485 bret
= __cg_legacy_setup_limits(ops
, &conf
->cgroup
, do_devices
);
2489 return __cg_unified_setup_limits(ops
, &conf
->cgroup2
);
2492 static bool cgroup_use_wants_controllers(const struct cgroup_ops
*ops
,
2495 char **cur_ctrl
, **cur_use
;
2497 if (!ops
->cgroup_use
)
2500 for (cur_ctrl
= controllers
; cur_ctrl
&& *cur_ctrl
; cur_ctrl
++) {
2503 for (cur_use
= ops
->cgroup_use
; cur_use
&& *cur_use
; cur_use
++) {
2504 if (strcmp(*cur_use
, *cur_ctrl
) != 0)
2520 static void cg_unified_delegate(char ***delegate
)
2524 char *standard
[] = {"cgroup.subtree_control", "cgroup.threads", NULL
};
2526 tmp
= read_file("/sys/kernel/cgroup/delegate");
2528 for (char **p
= standard
; p
&& *p
; p
++) {
2529 idx
= append_null_to_list((void ***)delegate
);
2530 (*delegate
)[idx
] = must_copy_string(*p
);
2534 lxc_iterate_parts (token
, tmp
, " \t\n") {
2536 * We always need to chown this for both cgroup and
2539 if (strcmp(token
, "cgroup.procs") == 0)
2542 idx
= append_null_to_list((void ***)delegate
);
2543 (*delegate
)[idx
] = must_copy_string(token
);
2549 /* At startup, parse_hierarchies finds all the info we need about cgroup
2550 * mountpoints and current cgroups, and stores it in @d.
2552 static bool cg_hybrid_init(struct cgroup_ops
*ops
, bool relative
,
2560 char **klist
= NULL
, **nlist
= NULL
;
2562 /* Root spawned containers escape the current cgroup, so use init's
2563 * cgroups as our base in that case.
2565 if (!relative
&& (geteuid() == 0))
2566 basecginfo
= read_file("/proc/1/cgroup");
2568 basecginfo
= read_file("/proc/self/cgroup");
2572 ret
= get_existing_subsystems(&klist
, &nlist
);
2574 ERROR("Failed to retrieve available legacy cgroup controllers");
2579 f
= fopen("/proc/self/mountinfo", "r");
2581 ERROR("Failed to open \"/proc/self/mountinfo\"");
2586 lxc_cgfsng_print_basecg_debuginfo(basecginfo
, klist
, nlist
);
2588 while (getline(&line
, &len
, f
) != -1) {
2591 struct hierarchy
*new;
2592 char *base_cgroup
= NULL
, *mountpoint
= NULL
;
2593 char **controller_list
= NULL
;
2595 type
= get_cgroup_version(line
);
2599 if (type
== CGROUP2_SUPER_MAGIC
&& ops
->unified
)
2602 if (ops
->cgroup_layout
== CGROUP_LAYOUT_UNKNOWN
) {
2603 if (type
== CGROUP2_SUPER_MAGIC
)
2604 ops
->cgroup_layout
= CGROUP_LAYOUT_UNIFIED
;
2605 else if (type
== CGROUP_SUPER_MAGIC
)
2606 ops
->cgroup_layout
= CGROUP_LAYOUT_LEGACY
;
2607 } else if (ops
->cgroup_layout
== CGROUP_LAYOUT_UNIFIED
) {
2608 if (type
== CGROUP_SUPER_MAGIC
)
2609 ops
->cgroup_layout
= CGROUP_LAYOUT_HYBRID
;
2610 } else if (ops
->cgroup_layout
== CGROUP_LAYOUT_LEGACY
) {
2611 if (type
== CGROUP2_SUPER_MAGIC
)
2612 ops
->cgroup_layout
= CGROUP_LAYOUT_HYBRID
;
2615 controller_list
= cg_hybrid_get_controllers(klist
, nlist
, line
, type
);
2616 if (!controller_list
&& type
== CGROUP_SUPER_MAGIC
)
2619 if (type
== CGROUP_SUPER_MAGIC
)
2620 if (controller_list_is_dup(ops
->hierarchies
, controller_list
))
2623 mountpoint
= cg_hybrid_get_mountpoint(line
);
2625 ERROR("Failed parsing mountpoint from \"%s\"", line
);
2629 if (type
== CGROUP_SUPER_MAGIC
)
2630 base_cgroup
= cg_hybrid_get_current_cgroup(basecginfo
, controller_list
[0], CGROUP_SUPER_MAGIC
);
2632 base_cgroup
= cg_hybrid_get_current_cgroup(basecginfo
, NULL
, CGROUP2_SUPER_MAGIC
);
2634 ERROR("Failed to find current cgroup");
2639 prune_init_scope(base_cgroup
);
2640 if (type
== CGROUP2_SUPER_MAGIC
)
2641 writeable
= test_writeable_v2(mountpoint
, base_cgroup
);
2643 writeable
= test_writeable_v1(mountpoint
, base_cgroup
);
2647 if (type
== CGROUP2_SUPER_MAGIC
) {
2648 char *cgv2_ctrl_path
;
2650 cgv2_ctrl_path
= must_make_path(mountpoint
, base_cgroup
,
2651 "cgroup.controllers",
2654 controller_list
= cg_unified_get_controllers(cgv2_ctrl_path
);
2655 free(cgv2_ctrl_path
);
2656 if (!controller_list
) {
2657 controller_list
= cg_unified_make_empty_controller();
2658 TRACE("No controllers are enabled for "
2659 "delegation in the unified hierarchy");
2663 /* Exclude all controllers that cgroup use does not want. */
2664 if (!cgroup_use_wants_controllers(ops
, controller_list
))
2667 new = add_hierarchy(&ops
->hierarchies
, controller_list
, mountpoint
, base_cgroup
, type
);
2668 if (type
== CGROUP2_SUPER_MAGIC
&& !ops
->unified
) {
2670 cg_unified_delegate(&new->cgroup2_chown
);
2677 free_string_list(controller_list
);
2682 free_string_list(klist
);
2683 free_string_list(nlist
);
2690 TRACE("Writable cgroup hierarchies:");
2691 lxc_cgfsng_print_hierarchies(ops
);
2693 /* verify that all controllers in cgroup.use and all crucial
2694 * controllers are accounted for
2696 if (!all_controllers_found(ops
))
2702 static int cg_is_pure_unified(void)
2708 ret
= statfs("/sys/fs/cgroup", &fs
);
2712 if (is_fs_type(&fs
, CGROUP2_SUPER_MAGIC
))
2713 return CGROUP2_SUPER_MAGIC
;
2718 /* Get current cgroup from /proc/self/cgroup for the cgroupfs v2 hierarchy. */
2719 static char *cg_unified_get_current_cgroup(bool relative
)
2721 char *basecginfo
, *base_cgroup
;
2724 if (!relative
&& (geteuid() == 0))
2725 basecginfo
= read_file("/proc/1/cgroup");
2727 basecginfo
= read_file("/proc/self/cgroup");
2731 base_cgroup
= strstr(basecginfo
, "0::/");
2733 goto cleanup_on_err
;
2735 base_cgroup
= base_cgroup
+ 3;
2736 copy
= copy_to_eol(base_cgroup
);
2738 goto cleanup_on_err
;
2748 static int cg_unified_init(struct cgroup_ops
*ops
, bool relative
,
2752 char *mountpoint
, *subtree_path
, *tmp
;
2754 struct hierarchy
*new;
2755 char *base_cgroup
= NULL
;
2757 ret
= cg_is_pure_unified();
2758 if (ret
== -ENOMEDIUM
)
2761 if (ret
!= CGROUP2_SUPER_MAGIC
)
2764 base_cgroup
= cg_unified_get_current_cgroup(relative
);
2767 prune_init_scope(base_cgroup
);
2769 /* We assume that we have already been given controllers to delegate
2770 * further down the hierarchy. If not it is up to the user to delegate
2773 mountpoint
= must_copy_string("/sys/fs/cgroup");
2774 subtree_path
= must_make_path(mountpoint
, base_cgroup
,
2775 "cgroup.subtree_control", NULL
);
2776 delegatable
= cg_unified_get_controllers(subtree_path
);
2779 delegatable
= cg_unified_make_empty_controller();
2780 if (!delegatable
[0])
2781 TRACE("No controllers are enabled for delegation");
2783 /* TODO: If the user requested specific controllers via lxc.cgroup.use
2784 * we should verify here. The reason I'm not doing it right is that I'm
2785 * not convinced that lxc.cgroup.use will be the future since it is a
2786 * global property. I much rather have an option that lets you request
2787 * controllers per container.
2790 new = add_hierarchy(&ops
->hierarchies
, delegatable
, mountpoint
, base_cgroup
, CGROUP2_SUPER_MAGIC
);
2792 cg_unified_delegate(&new->cgroup2_chown
);
2794 ops
->cgroup_layout
= CGROUP_LAYOUT_UNIFIED
;
2795 return CGROUP2_SUPER_MAGIC
;
2798 static bool cg_init(struct cgroup_ops
*ops
, struct lxc_conf
*conf
)
2802 bool relative
= conf
->cgroup_meta
.relative
;
2804 tmp
= lxc_global_config_value("lxc.cgroup.use");
2806 char *chop
, *cur
, *pin
;
2808 pin
= must_copy_string(tmp
);
2811 lxc_iterate_parts(cur
, chop
, ",") {
2812 must_append_string(&ops
->cgroup_use
, cur
);
2818 ret
= cg_unified_init(ops
, relative
, !lxc_list_empty(&conf
->id_map
));
2822 if (ret
== CGROUP2_SUPER_MAGIC
)
2825 return cg_hybrid_init(ops
, relative
, !lxc_list_empty(&conf
->id_map
));
2828 __cgfsng_ops
static bool cgfsng_data_init(struct cgroup_ops
*ops
)
2830 const char *cgroup_pattern
;
2832 /* copy system-wide cgroup information */
2833 cgroup_pattern
= lxc_global_config_value("lxc.cgroup.pattern");
2834 if (!cgroup_pattern
) {
2835 /* lxc.cgroup.pattern is only NULL on error. */
2836 ERROR("Failed to retrieve cgroup pattern");
2839 ops
->cgroup_pattern
= must_copy_string(cgroup_pattern
);
2840 ops
->monitor_pattern
= MONITOR_CGROUP
;
2845 struct cgroup_ops
*cgfsng_ops_init(struct lxc_conf
*conf
)
2847 struct cgroup_ops
*cgfsng_ops
;
2849 cgfsng_ops
= malloc(sizeof(struct cgroup_ops
));
2853 memset(cgfsng_ops
, 0, sizeof(struct cgroup_ops
));
2854 cgfsng_ops
->cgroup_layout
= CGROUP_LAYOUT_UNKNOWN
;
2856 if (!cg_init(cgfsng_ops
, conf
)) {
2861 cgfsng_ops
->data_init
= cgfsng_data_init
;
2862 cgfsng_ops
->payload_destroy
= cgfsng_payload_destroy
;
2863 cgfsng_ops
->monitor_destroy
= cgfsng_monitor_destroy
;
2864 cgfsng_ops
->monitor_create
= cgfsng_monitor_create
;
2865 cgfsng_ops
->monitor_enter
= cgfsng_monitor_enter
;
2866 cgfsng_ops
->payload_create
= cgfsng_payload_create
;
2867 cgfsng_ops
->payload_enter
= cgfsng_payload_enter
;
2868 cgfsng_ops
->escape
= cgfsng_escape
;
2869 cgfsng_ops
->num_hierarchies
= cgfsng_num_hierarchies
;
2870 cgfsng_ops
->get_hierarchies
= cgfsng_get_hierarchies
;
2871 cgfsng_ops
->get_cgroup
= cgfsng_get_cgroup
;
2872 cgfsng_ops
->get
= cgfsng_get
;
2873 cgfsng_ops
->set
= cgfsng_set
;
2874 cgfsng_ops
->unfreeze
= cgfsng_unfreeze
;
2875 cgfsng_ops
->setup_limits
= cgfsng_setup_limits
;
2876 cgfsng_ops
->driver
= "cgfsng";
2877 cgfsng_ops
->version
= "1.0.0";
2878 cgfsng_ops
->attach
= cgfsng_attach
;
2879 cgfsng_ops
->chown
= cgfsng_chown
;
2880 cgfsng_ops
->mount
= cgfsng_mount
;
2881 cgfsng_ops
->nrtasks
= cgfsng_nrtasks
;