cgroups/cgfsng: log chown_cgroup_wrapper()

It's becoming more important on cgroup2 to properly delegate cgroups. Signed-off-by: 's avatarChristian Brauner <christian.brauner@ubuntu.com>
parent 584d340b
...@@ -1545,24 +1545,20 @@ static int chown_cgroup_wrapper(void *data) ...@@ -1545,24 +1545,20 @@ static int chown_cgroup_wrapper(void *data)
gid_t nsgid = (arg->conf->root_nsgid_map != NULL) ? 0 : arg->conf->init_gid; gid_t nsgid = (arg->conf->root_nsgid_map != NULL) ? 0 : arg->conf->init_gid;
ret = setresgid(nsgid, nsgid, nsgid); ret = setresgid(nsgid, nsgid, nsgid);
if (ret < 0) { if (ret < 0)
SYSERROR("Failed to setresgid(%d, %d, %d)", return log_error_errno(-1, errno,
(int)nsgid, (int)nsgid, (int)nsgid); "Failed to setresgid(%d, %d, %d)",
return -1; (int)nsgid, (int)nsgid, (int)nsgid);
}
ret = setresuid(nsuid, nsuid, nsuid); ret = setresuid(nsuid, nsuid, nsuid);
if (ret < 0) { if (ret < 0)
SYSERROR("Failed to setresuid(%d, %d, %d)", return log_error_errno(-1, errno,
(int)nsuid, (int)nsuid, (int)nsuid); "Failed to setresuid(%d, %d, %d)",
return -1; (int)nsuid, (int)nsuid, (int)nsuid);
}
ret = setgroups(0, NULL); ret = setgroups(0, NULL);
if (ret < 0 && errno != EPERM) { if (ret < 0 && errno != EPERM)
SYSERROR("Failed to setgroups(0, NULL)"); return log_error_errno(-1, errno, "Failed to setgroups(0, NULL)");
return -1;
}
destuid = get_ns_uid(arg->origuid); destuid = get_ns_uid(arg->origuid);
if (destuid == LXC_INVALID_UID) if (destuid == LXC_INVALID_UID)
...@@ -1574,7 +1570,9 @@ static int chown_cgroup_wrapper(void *data) ...@@ -1574,7 +1570,9 @@ static int chown_cgroup_wrapper(void *data)
ret = chowmod(path, destuid, nsgid, 0775); ret = chowmod(path, destuid, nsgid, 0775);
if (ret < 0) if (ret < 0)
return -1; log_info_errno(continue,
errno, "Failed to change %s to uid %d and gid %d and mode 0755",
path, destuid, nsgid);
/* Failures to chown() these are inconvenient but not /* Failures to chown() these are inconvenient but not
* detrimental We leave these owned by the container launcher, * detrimental We leave these owned by the container launcher,
...@@ -1585,18 +1583,27 @@ static int chown_cgroup_wrapper(void *data) ...@@ -1585,18 +1583,27 @@ static int chown_cgroup_wrapper(void *data)
if (arg->hierarchies[i]->version == CGROUP_SUPER_MAGIC) { if (arg->hierarchies[i]->version == CGROUP_SUPER_MAGIC) {
fullpath = must_make_path(path, "tasks", NULL); fullpath = must_make_path(path, "tasks", NULL);
(void)chowmod(fullpath, destuid, nsgid, 0664); ret = chowmod(fullpath, destuid, nsgid, 0664);
if (ret < 0)
SYSINFO("Failed to change %s to uid %d and gid %d and mode 0664",
fullpath, destuid, nsgid);
} }
fullpath = must_make_path(path, "cgroup.procs", NULL); fullpath = must_make_path(path, "cgroup.procs", NULL);
(void)chowmod(fullpath, destuid, nsgid, 0664); ret = chowmod(fullpath, destuid, nsgid, 0664);
if (ret < 0)
SYSINFO("Failed to change %s to uid %d and gid %d and mode 0664",
fullpath, destuid, nsgid);
if (arg->hierarchies[i]->version != CGROUP2_SUPER_MAGIC) if (arg->hierarchies[i]->version != CGROUP2_SUPER_MAGIC)
continue; continue;
for (char **p = arg->hierarchies[i]->cgroup2_chown; p && *p; p++) { for (char **p = arg->hierarchies[i]->cgroup2_chown; p && *p; p++) {
fullpath = must_make_path(path, *p, NULL); fullpath = must_make_path(path, *p, NULL);
(void)chowmod(fullpath, destuid, nsgid, 0664); ret = chowmod(fullpath, destuid, nsgid, 0664);
if (ret < 0)
SYSINFO("Failed to change %s to uid %d and gid %d and mode 0664",
fullpath, destuid, nsgid);
} }
} }
......
...@@ -523,6 +523,13 @@ __unused static inline void LXC_##LEVEL(struct lxc_log_locinfo* locinfo, \ ...@@ -523,6 +523,13 @@ __unused static inline void LXC_##LEVEL(struct lxc_log_locinfo* locinfo, \
__ret__; \ __ret__; \
}) })
#define log_info_errno(__ret__, __errno__, format, ...) \
({ \
errno = __errno__; \
SYSINFO(format, ##__VA_ARGS__); \
__ret__; \
})
#define log_info(__ret__, format, ...) \ #define log_info(__ret__, format, ...) \
({ \ ({ \
INFO(format, ##__VA_ARGS__); \ INFO(format, ##__VA_ARGS__); \
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment