12df56b9f1
This commit adds extra setup when cgroupsv2 is enabled. In particular, we make sure that the root namespace has setup cgroup.subtree_control with the controllers we need. If the necessary controller are not listed, we have to move all processes out of the root namespace before we can change this (the 'no internal processes' rule: https://unix.stackexchange.com/a/713343). Currently we only handle the case where the nsjail process is the only process in the cgroup. It seems like this would be relatively rare, but since nsjail is frequently the root process in a Docker container (e.g. for hosting CTF challenges), I think this case is common enough to make it worth implementing. This also adds `--detect_cgroupv2`, which will attempt to detect whether `--cgroupv2_mount` is a valid cgroupv2 mount, and if so it will set `use_cgroupv2`. This is useful in containerized environments where you may not know the kernel version ahead of time. References: https://github.com/redpwn/jail/blob/master/internal/cgroup/cgroup2.go
41 lines
1.0 KiB
C++
41 lines
1.0 KiB
C++
/*
|
|
|
|
nsjail - cgroup2 namespacing
|
|
-----------------------------------------
|
|
|
|
Copyright 2014 Google Inc. All Rights Reserved.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
|
|
*/
|
|
|
|
#ifndef NS_CGROUP2_H
|
|
#define NS_CGROUP2_H
|
|
|
|
#include <stdbool.h>
|
|
#include <stddef.h>
|
|
|
|
#include "nsjail.h"
|
|
|
|
namespace cgroup2 {
|
|
|
|
bool initNsFromParent(nsjconf_t* nsjconf, pid_t pid);
|
|
bool initNs(void);
|
|
void finishFromParent(nsjconf_t* nsjconf, pid_t pid);
|
|
bool setup(nsjconf_t *nsjconf);
|
|
bool detectCgroupv2(nsjconf_t *nsjconf);
|
|
|
|
} // namespace cgroup2
|
|
|
|
#endif /* _CGROUP2_H */
|