Unverified Commit de95b436 by Stéphane Graber Committed by GitHub

Merge pull request #3309 from brauner/2020-03-19/fixes

tree-wide: logging fixes and hardening
parents 5e92858c d7d1e27a
...@@ -1002,17 +1002,23 @@ __cgfsng_ops static void cgfsng_payload_destroy(struct cgroup_ops *ops, ...@@ -1002,17 +1002,23 @@ __cgfsng_ops static void cgfsng_payload_destroy(struct cgroup_ops *ops,
{ {
int ret; int ret;
if (!ops) if (!ops) {
log_error_errno(return, ENOENT, "Called with uninitialized cgroup operations"); ERROR("Called with uninitialized cgroup operations");
return;
}
if (!ops->hierarchies) if (!ops->hierarchies)
return; return;
if (!handler) if (!handler) {
log_error_errno(return, EINVAL, "Called with uninitialized handler"); ERROR("Called with uninitialized handler");
return;
}
if (!handler->conf) if (!handler->conf) {
log_error_errno(return, EINVAL, "Called with uninitialized conf"); ERROR("Called with uninitialized conf");
return;
}
#ifdef HAVE_STRUCT_BPF_CGROUP_DEV_CTX #ifdef HAVE_STRUCT_BPF_CGROUP_DEV_CTX
ret = bpf_program_cgroup_detach(handler->conf->cgroup2_devices); ret = bpf_program_cgroup_detach(handler->conf->cgroup2_devices);
...@@ -1033,7 +1039,7 @@ __cgfsng_ops static void cgfsng_payload_destroy(struct cgroup_ops *ops, ...@@ -1033,7 +1039,7 @@ __cgfsng_ops static void cgfsng_payload_destroy(struct cgroup_ops *ops,
ret = cgroup_rmdir(ops->hierarchies, ops->container_cgroup); ret = cgroup_rmdir(ops->hierarchies, ops->container_cgroup);
} }
if (ret < 0) if (ret < 0)
log_warn_errno(return, errno, "Failed to destroy cgroups"); SYSWARN("Failed to destroy cgroups");
} }
__cgfsng_ops static void cgfsng_monitor_destroy(struct cgroup_ops *ops, __cgfsng_ops static void cgfsng_monitor_destroy(struct cgroup_ops *ops,
...@@ -1043,17 +1049,23 @@ __cgfsng_ops static void cgfsng_monitor_destroy(struct cgroup_ops *ops, ...@@ -1043,17 +1049,23 @@ __cgfsng_ops static void cgfsng_monitor_destroy(struct cgroup_ops *ops,
char pidstr[INTTYPE_TO_STRLEN(pid_t)]; char pidstr[INTTYPE_TO_STRLEN(pid_t)];
const struct lxc_conf *conf; const struct lxc_conf *conf;
if (!ops) if (!ops) {
log_error_errno(return, ENOENT, "Called with uninitialized cgroup operations"); ERROR("Called with uninitialized cgroup operations");
return;
}
if (!ops->hierarchies) if (!ops->hierarchies)
return; return;
if (!handler) if (!handler) {
log_error_errno(return, EINVAL, "Called with uninitialized handler"); ERROR("Called with uninitialized handler");
return;
}
if (!handler->conf) if (!handler->conf) {
log_error_errno(return, EINVAL, "Called with uninitialized conf"); ERROR("Called with uninitialized conf");
return;
}
conf = handler->conf; conf = handler->conf;
len = snprintf(pidstr, sizeof(pidstr), "%d", handler->monitor_pid); len = snprintf(pidstr, sizeof(pidstr), "%d", handler->monitor_pid);
...@@ -1079,15 +1091,16 @@ __cgfsng_ops static void cgfsng_monitor_destroy(struct cgroup_ops *ops, ...@@ -1079,15 +1091,16 @@ __cgfsng_ops static void cgfsng_monitor_destroy(struct cgroup_ops *ops,
CGROUP_PIVOT, NULL); CGROUP_PIVOT, NULL);
ret = mkdir_p(pivot_path, 0755); ret = mkdir_p(pivot_path, 0755);
if (ret < 0 && errno != EEXIST) if (ret < 0 && errno != EEXIST) {
log_error_errno(goto try_recursive_destroy, errno, ERROR("Failed to create %s", pivot_path);
"Failed to create %s", pivot_path); goto try_recursive_destroy;
}
ret = lxc_write_openat(pivot_path, "cgroup.procs", pidstr, len); ret = lxc_write_openat(pivot_path, "cgroup.procs", pidstr, len);
if (ret != 0) if (ret != 0) {
log_warn_errno(continue, errno, SYSWARN("Failed to move monitor %s to \"%s\"", pidstr, pivot_path);
"Failed to move monitor %s to \"%s\"", continue;
pidstr, pivot_path); }
try_recursive_destroy: try_recursive_destroy:
ret = recursive_destroy(h->monitor_full_path); ret = recursive_destroy(h->monitor_full_path);
...@@ -1741,10 +1754,10 @@ __cgfsng_ops static bool cgfsng_mount(struct cgroup_ops *ops, ...@@ -1741,10 +1754,10 @@ __cgfsng_ops static bool cgfsng_mount(struct cgroup_ops *ops,
continue; continue;
ret = mkdir(controllerpath, 0755); ret = mkdir(controllerpath, 0755);
if (ret < 0) if (ret < 0) {
log_error_errno(goto on_error, errno, ERROR("Error creating cgroup path: %s", controllerpath);
"Error creating cgroup path: %s", goto on_error;
controllerpath); }
if (has_cgns && wants_force_mount) { if (has_cgns && wants_force_mount) {
/* If cgroup namespaces are supported but the container /* If cgroup namespaces are supported but the container
...@@ -2544,11 +2557,12 @@ __cgfsng_ops static bool cgfsng_setup_limits_legacy(struct cgroup_ops *ops, ...@@ -2544,11 +2557,12 @@ __cgfsng_ops static bool cgfsng_setup_limits_legacy(struct cgroup_ops *ops,
if (do_devices == !strncmp("devices", cg->subsystem, 7)) { if (do_devices == !strncmp("devices", cg->subsystem, 7)) {
if (cg_legacy_set_data(ops, cg->subsystem, cg->value)) { if (cg_legacy_set_data(ops, cg->subsystem, cg->value)) {
if (do_devices && (errno == EACCES || errno == EPERM)) if (do_devices && (errno == EACCES || errno == EPERM)) {
log_warn_errno(continue, errno, "Failed to set \"%s\" to \"%s\"", SYSWARN("Failed to set \"%s\" to \"%s\"", cg->subsystem, cg->value);
cg->subsystem, cg->value); continue;
log_warn_errno(goto out, errno, "Failed to set \"%s\" to \"%s\"", }
cg->subsystem, cg->value); SYSERROR("Failed to set \"%s\" to \"%s\"", cg->subsystem, cg->value);
goto out;
} }
DEBUG("Set controller \"%s\" set to \"%s\"", cg->subsystem, cg->value); DEBUG("Set controller \"%s\" set to \"%s\"", cg->subsystem, cg->value);
} }
...@@ -2830,7 +2844,8 @@ static void cg_unified_delegate(char ***delegate) ...@@ -2830,7 +2844,8 @@ static void cg_unified_delegate(char ***delegate)
idx = append_null_to_list((void ***)delegate); idx = append_null_to_list((void ***)delegate);
(*delegate)[idx] = must_copy_string(*p); (*delegate)[idx] = must_copy_string(*p);
} }
log_warn_errno(return, errno, "Failed to read /sys/kernel/cgroup/delegate"); SYSWARN("Failed to read /sys/kernel/cgroup/delegate");
return;
} }
lxc_iterate_parts (token, buf, " \t\n") { lxc_iterate_parts (token, buf, " \t\n") {
...@@ -2909,19 +2924,25 @@ static int cg_hybrid_init(struct cgroup_ops *ops, bool relative, bool unprivileg ...@@ -2909,19 +2924,25 @@ static int cg_hybrid_init(struct cgroup_ops *ops, bool relative, bool unprivileg
continue; continue;
if (type == CGROUP_SUPER_MAGIC) if (type == CGROUP_SUPER_MAGIC)
if (controller_list_is_dup(ops->hierarchies, controller_list)) if (controller_list_is_dup(ops->hierarchies, controller_list)) {
log_trace_errno(continue, EEXIST, "Skipping duplicating controller"); TRACE("Skipping duplicating controller");
continue;
}
mountpoint = cg_hybrid_get_mountpoint(line); mountpoint = cg_hybrid_get_mountpoint(line);
if (!mountpoint) if (!mountpoint) {
log_error_errno(continue, EINVAL, "Failed parsing mountpoint from \"%s\"", line); ERROR("Failed parsing mountpoint from \"%s\"", line);
continue;
}
if (type == CGROUP_SUPER_MAGIC) if (type == CGROUP_SUPER_MAGIC)
base_cgroup = cg_hybrid_get_current_cgroup(basecginfo, controller_list[0], CGROUP_SUPER_MAGIC); base_cgroup = cg_hybrid_get_current_cgroup(basecginfo, controller_list[0], CGROUP_SUPER_MAGIC);
else else
base_cgroup = cg_hybrid_get_current_cgroup(basecginfo, NULL, CGROUP2_SUPER_MAGIC); base_cgroup = cg_hybrid_get_current_cgroup(basecginfo, NULL, CGROUP2_SUPER_MAGIC);
if (!base_cgroup) if (!base_cgroup) {
log_error_errno(continue, EINVAL, "Failed to find current cgroup"); ERROR("Failed to find current cgroup");
continue;
}
trim(base_cgroup); trim(base_cgroup);
prune_init_scope(base_cgroup); prune_init_scope(base_cgroup);
...@@ -2929,8 +2950,10 @@ static int cg_hybrid_init(struct cgroup_ops *ops, bool relative, bool unprivileg ...@@ -2929,8 +2950,10 @@ static int cg_hybrid_init(struct cgroup_ops *ops, bool relative, bool unprivileg
writeable = test_writeable_v2(mountpoint, base_cgroup); writeable = test_writeable_v2(mountpoint, base_cgroup);
else else
writeable = test_writeable_v1(mountpoint, base_cgroup); writeable = test_writeable_v1(mountpoint, base_cgroup);
if (!writeable) if (!writeable) {
log_trace_errno(continue, EROFS, "The %s group is not writeable", base_cgroup); TRACE("The %s group is not writeable", base_cgroup);
continue;
}
if (type == CGROUP2_SUPER_MAGIC) { if (type == CGROUP2_SUPER_MAGIC) {
char *cgv2_ctrl_path; char *cgv2_ctrl_path;
...@@ -2949,8 +2972,10 @@ static int cg_hybrid_init(struct cgroup_ops *ops, bool relative, bool unprivileg ...@@ -2949,8 +2972,10 @@ static int cg_hybrid_init(struct cgroup_ops *ops, bool relative, bool unprivileg
} }
/* Exclude all controllers that cgroup use does not want. */ /* Exclude all controllers that cgroup use does not want. */
if (!cgroup_use_wants_controllers(ops, controller_list)) if (!cgroup_use_wants_controllers(ops, controller_list)) {
log_trace_errno(continue, EINVAL, "Skipping controller"); TRACE("Skipping controller");
continue;
}
new = add_hierarchy(&ops->hierarchies, move_ptr(controller_list), move_ptr(mountpoint), move_ptr(base_cgroup), type); new = add_hierarchy(&ops->hierarchies, move_ptr(controller_list), move_ptr(mountpoint), move_ptr(base_cgroup), type);
if (type == CGROUP2_SUPER_MAGIC && !ops->unified) { if (type == CGROUP2_SUPER_MAGIC && !ops->unified) {
......
...@@ -385,7 +385,7 @@ int bpf_program_cgroup_attach(struct bpf_program *prog, int type, ...@@ -385,7 +385,7 @@ int bpf_program_cgroup_attach(struct bpf_program *prog, int type,
if (ret < 0) if (ret < 0)
return log_error_errno(-1, errno, "Failed to attach bpf program"); return log_error_errno(-1, errno, "Failed to attach bpf program");
free_replace_move_ptr(prog->attached_path, copy); free_move_ptr(prog->attached_path, copy);
prog->attached_type = type; prog->attached_type = type;
prog->attached_flags = flags; prog->attached_flags = flags;
......
...@@ -477,69 +477,79 @@ __lxc_unused static inline void LXC_##LEVEL(struct lxc_log_locinfo* locinfo, \ ...@@ -477,69 +477,79 @@ __lxc_unused static inline void LXC_##LEVEL(struct lxc_log_locinfo* locinfo, \
} while (0) } while (0)
#endif #endif
#define log_error_errno(__ret__, __errno__, format, ...) \ #define log_error_errno(__ret__, __errno__, format, ...) \
({ \ ({ \
errno = __errno__; \ typeof(__ret__) __internal_ret__ = (__ret__); \
SYSERROR(format, ##__VA_ARGS__); \ errno = (__errno__); \
__ret__; \ SYSERROR(format, ##__VA_ARGS__); \
__internal_ret__; \
}) })
#define log_error(__ret__, format, ...) \ #define log_error(__ret__, format, ...) \
({ \ ({ \
ERROR(format, ##__VA_ARGS__); \ typeof(__ret__) __internal_ret__ = (__ret__); \
__ret__; \ ERROR(format, ##__VA_ARGS__); \
__internal_ret__; \
}) })
#define log_trace_errno(__ret__, __errno__, format, ...) \ #define log_trace_errno(__ret__, __errno__, format, ...) \
({ \ ({ \
errno = __errno__; \ typeof(__ret__) __internal_ret__ = (__ret__); \
SYSTRACE(format, ##__VA_ARGS__); \ errno = __errno__; \
__ret__; \ SYSTRACE(format, ##__VA_ARGS__); \
__internal_ret__; \
}) })
#define log_trace(__ret__, format, ...) \ #define log_trace(__ret__, format, ...) \
({ \ ({ \
TRACE(format, ##__VA_ARGS__); \ typeof(__ret__) __internal_ret__ = (__ret__); \
__ret__; \ TRACE(format, ##__VA_ARGS__); \
__internal_ret__; \
}) })
#define log_warn_errno(__ret__, __errno__, format, ...) \ #define log_warn_errno(__ret__, __errno__, format, ...) \
({ \ ({ \
errno = __errno__; \ typeof(__ret__) __internal_ret__ = (__ret__); \
SYSWARN(format, ##__VA_ARGS__); \ errno = __errno__; \
__ret__; \ SYSWARN(format, ##__VA_ARGS__); \
__internal_ret__; \
}) })
#define log_warn(__ret__, format, ...) \ #define log_warn(__ret__, format, ...) \
({ \ ({ \
WARN(format, ##__VA_ARGS__); \ typeof(__ret__) __internal_ret__ = (__ret__); \
__ret__; \ WARN(format, ##__VA_ARGS__); \
__internal_ret__; \
}) })
#define log_debug_errno(__ret__, __errno__, format, ...) \ #define log_debug_errno(__ret__, __errno__, format, ...) \
({ \ ({ \
errno = __errno__; \ typeof(__ret__) __internal_ret__ = (__ret__); \
SYSDEBUG(format, ##__VA_ARGS__); \ errno = __errno__; \
__ret__; \ SYSDEBUG(format, ##__VA_ARGS__); \
__internal_ret__; \
}) })
#define log_debug(__ret__, format, ...) \ #define log_debug(__ret__, format, ...) \
({ \ ({ \
DEBUG(format, ##__VA_ARGS__); \ typeof(__ret__) __internal_ret__ = (__ret__); \
__ret__; \ DEBUG(format, ##__VA_ARGS__); \
__internal_ret__; \
}) })
#define log_info_errno(__ret__, __errno__, format, ...) \ #define log_info_errno(__ret__, __errno__, format, ...) \
({ \ ({ \
errno = __errno__; \ typeof(__ret__) __internal_ret__ = (__ret__); \
SYSINFO(format, ##__VA_ARGS__); \ errno = __errno__; \
__ret__; \ SYSINFO(format, ##__VA_ARGS__); \
__internal_ret__; \
}) })
#define log_info(__ret__, format, ...) \ #define log_info(__ret__, format, ...) \
({ \ ({ \
INFO(format, ##__VA_ARGS__); \ typeof(__ret__) __internal_ret__ = (__ret__); \
__ret__; \ INFO(format, ##__VA_ARGS__); \
__internal_ret__; \
}) })
extern int lxc_log_fd; extern int lxc_log_fd;
......
...@@ -442,24 +442,23 @@ enum { ...@@ -442,24 +442,23 @@ enum {
__internal_fd__; \ __internal_fd__; \
}) })
#define ret_set_errno(__ret__, __errno__) \ #define ret_set_errno(__ret__, __errno__) \
({ \ ({ \
errno = __errno__; \ typeof(__ret__) __internal_ret__ = (__ret__); \
__ret__; \ errno = (__errno__); \
__internal_ret__; \
}) })
#define ret_errno(__errno__) \ #define ret_errno(__errno__) \
({ \ ({ \
errno = __errno__; \ errno = (__errno__); \
-__errno__; \ -(__errno__); \
}) })
#define free_replace_move_ptr(a, b) \ #define free_move_ptr(a, b) \
({ \ ({ \
free(a); \ free(a); \
(a) = (b); \ (a) = move_ptr((b)); \
(b) = NULL; \
0; \
}) })
/* Container's specific file/directory names */ /* Container's specific file/directory names */
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment