openkylin
/
platform_system_core
mirror of https://gitee.com/openkylin/platform_system_core.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge changes from topic "libprocessgroup_rc" 

* changes:
  CgroupSetupCgroups -> CgroupSetup
  Add libcgrouprc to ld.config.*.txt.
  libprocessgroup: use libcgrouprc to read cgroup.rc
  libprocessgroup_setup: use libcgrouprc_format
  libprocessgroup: Move CgroupSetupCgroups() to libprocessgroup_setup
  libprocessgroup: Add libcgrouprc
  libprocessgroup: Add libcgrouprc_format
This commit is contained in:
Yifan Hong 2019-04-03 19:08:51 +00:00 committed by Gerrit Code Review
parent cd68bda4ec 9d7b89abea
commit 25d42eeaa6
28 changed files with 1026 additions and 433 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
init/Android.bp
View File

@ -61,6 +61,7 @@ cc_defaults {
static_libs: [
"libseccomp_policy",
"libavb",
"libcgrouprc_format",
"libprotobuf-cpp-lite",
"libpropertyinfoserializer",
"libpropertyinfoparser",
@ -82,6 +83,7 @@ cc_defaults {
"liblogwrap",
"liblp",
"libprocessgroup",
"libprocessgroup_setup",
"libselinux",
"libutils",
],

3
init/init.cpp
View File

@ -45,6 +45,7 @@
#include <libavb/libavb.h>
#include <libgsi/libgsi.h>
#include <processgroup/processgroup.h>
#include <processgroup/setup.h>
#include <selinux/android.h>
#ifndef RECOVERY
@ -358,7 +359,7 @@ static Result<Success> SetupCgroupsAction(const BuiltinArguments&) {
// Have to create <CGROUPS_RC_DIR> using make_dir function
// for appropriate sepolicy to be set for it
make_dir(android::base::Dirname(CGROUPS_RC_PATH), 0711);
if (!CgroupSetupCgroups()) {
if (!CgroupSetup()) {
return ErrnoError() << "Failed to setup cgroups";
}

6
libcutils/Android.bp
View File

@ -235,6 +235,7 @@ test_libraries = [
"libbase",
"libjsoncpp",
"libprocessgroup",
"libcgrouprc",
]
cc_test {
@ -249,7 +250,10 @@ cc_test {
name: "libcutils_test_static",
test_suites: ["device-tests"],
defaults: ["libcutils_test_default"],
static_libs: ["libc"] + test_libraries,
static_libs: [
"libc",
"libcgrouprc_format",
] + test_libraries,
stl: "libc++_static",
target: {

1
libprocessgroup/Android.bp
View File

@ -31,6 +31,7 @@ cc_library {
},
shared_libs: [
"libbase",
"libcgrouprc",
"libjsoncpp",
],
// for cutils/android_filesystem_config.h

396
libprocessgroup/cgroup_map.cpp
View File

@ -44,244 +44,42 @@ using android::base::GetBoolProperty;
using android::base::StringPrintf;
using android::base::unique_fd;
static constexpr const char* CGROUPS_DESC_FILE = "/etc/cgroups.json";
static constexpr const char* CGROUPS_DESC_VENDOR_FILE = "/vendor/etc/cgroups.json";
static constexpr const char* CGROUP_PROCS_FILE = "/cgroup.procs";
static constexpr const char* CGROUP_TASKS_FILE = "/tasks";
static constexpr const char* CGROUP_TASKS_FILE_V2 = "/cgroup.tasks";
static bool Mkdir(const std::string& path, mode_t mode, const std::string& uid,
const std::string& gid) {
if (mode == 0) {
mode = 0755;
}
if (mkdir(path.c_str(), mode) != 0) {
/* chmod in case the directory already exists */
if (errno == EEXIST) {
if (fchmodat(AT_FDCWD, path.c_str(), mode, AT_SYMLINK_NOFOLLOW) != 0) {
// /acct is a special case when the directory already exists
// TODO: check if file mode is already what we want instead of using EROFS
if (errno != EROFS) {
PLOG(ERROR) << "fchmodat() failed for " << path;
return false;
}
}
} else {
PLOG(ERROR) << "mkdir() failed for " << path;
return false;
}
}
if (uid.empty()) {
return true;
}
passwd* uid_pwd = getpwnam(uid.c_str());
if (!uid_pwd) {
PLOG(ERROR) << "Unable to decode UID for '" << uid << "'";
return false;
}
uid_t pw_uid = uid_pwd->pw_uid;
gid_t gr_gid = -1;
if (!gid.empty()) {
group* gid_pwd = getgrnam(gid.c_str());
if (!gid_pwd) {
PLOG(ERROR) << "Unable to decode GID for '" << gid << "'";
return false;
}
gr_gid = gid_pwd->gr_gid;
}
if (lchown(path.c_str(), pw_uid, gr_gid) < 0) {
PLOG(ERROR) << "lchown() failed for " << path;
return false;
}
/* chown may have cleared S_ISUID and S_ISGID, chmod again */
if (mode & (S_ISUID | S_ISGID)) {
if (fchmodat(AT_FDCWD, path.c_str(), mode, AT_SYMLINK_NOFOLLOW) != 0) {
PLOG(ERROR) << "fchmodat() failed for " << path;
return false;
}
}
return true;
uint32_t CgroupController::version() const {
CHECK(HasValue());
return ACgroupController_getVersion(controller_);
}
static bool ReadDescriptorsFromFile(const std::string& file_name,
std::map<std::string, CgroupDescriptor>* descriptors) {
std::vector<CgroupDescriptor> result;
std::string json_doc;
if (!android::base::ReadFileToString(file_name, &json_doc)) {
PLOG(ERROR) << "Failed to read task profiles from " << file_name;
return false;
}
Json::Reader reader;
Json::Value root;
if (!reader.parse(json_doc, root)) {
LOG(ERROR) << "Failed to parse cgroups description: " << reader.getFormattedErrorMessages();
return false;
}
if (root.isMember("Cgroups")) {
const Json::Value& cgroups = root["Cgroups"];
for (Json::Value::ArrayIndex i = 0; i < cgroups.size(); ++i) {
std::string name = cgroups[i]["Controller"].asString();
auto iter = descriptors->find(name);
if (iter == descriptors->end()) {
descriptors->emplace(name, CgroupDescriptor(1, name, cgroups[i]["Path"].asString(),
std::strtoul(cgroups[i]["Mode"].asString().c_str(), 0, 8),
cgroups[i]["UID"].asString(), cgroups[i]["GID"].asString()));
} else {
iter->second = CgroupDescriptor(1, name, cgroups[i]["Path"].asString(),
std::strtoul(cgroups[i]["Mode"].asString().c_str(), 0, 8),
cgroups[i]["UID"].asString(), cgroups[i]["GID"].asString());
}
}
}
if (root.isMember("Cgroups2")) {
const Json::Value& cgroups2 = root["Cgroups2"];
auto iter = descriptors->find(CGROUPV2_CONTROLLER_NAME);
if (iter == descriptors->end()) {
descriptors->emplace(CGROUPV2_CONTROLLER_NAME, CgroupDescriptor(2, CGROUPV2_CONTROLLER_NAME, cgroups2["Path"].asString(),
std::strtoul(cgroups2["Mode"].asString().c_str(), 0, 8),
cgroups2["UID"].asString(), cgroups2["GID"].asString()));
} else {
iter->second = CgroupDescriptor(2, CGROUPV2_CONTROLLER_NAME, cgroups2["Path"].asString(),
std::strtoul(cgroups2["Mode"].asString().c_str(), 0, 8),
cgroups2["UID"].asString(), cgroups2["GID"].asString());
}
}
return true;
const char* CgroupController::name() const {
CHECK(HasValue());
return ACgroupController_getName(controller_);
}
static bool ReadDescriptors(std::map<std::string, CgroupDescriptor>* descriptors) {
// load system cgroup descriptors
if (!ReadDescriptorsFromFile(CGROUPS_DESC_FILE, descriptors)) {
return false;
}
// load vendor cgroup descriptors if the file exists
if (!access(CGROUPS_DESC_VENDOR_FILE, F_OK) &&
!ReadDescriptorsFromFile(CGROUPS_DESC_VENDOR_FILE, descriptors)) {
return false;
}
return true;
const char* CgroupController::path() const {
CHECK(HasValue());
return ACgroupController_getPath(controller_);
}
// To avoid issues in sdk_mac build
#if defined(__ANDROID__)
static bool SetupCgroup(const CgroupDescriptor& descriptor) {
const CgroupController* controller = descriptor.controller();
// mkdir <path> [mode] [owner] [group]
if (!Mkdir(controller->path(), descriptor.mode(), descriptor.uid(), descriptor.gid())) {
LOG(ERROR) << "Failed to create directory for " << controller->name() << " cgroup";
return false;
}
int result;
if (controller->version() == 2) {
result = mount("none", controller->path(), "cgroup2", MS_NODEV | MS_NOEXEC | MS_NOSUID,
nullptr);
} else {
// Unfortunately historically cpuset controller was mounted using a mount command
// different from all other controllers. This results in controller attributes not
// to be prepended with controller name. For example this way instead of
// /dev/cpuset/cpuset.cpus the attribute becomes /dev/cpuset/cpus which is what
// the system currently expects.
if (!strcmp(controller->name(), "cpuset")) {
// mount cpuset none /dev/cpuset nodev noexec nosuid
result = mount("none", controller->path(), controller->name(),
MS_NODEV | MS_NOEXEC | MS_NOSUID, nullptr);
} else {
// mount cgroup none <path> nodev noexec nosuid <controller>
result = mount("none", controller->path(), "cgroup", MS_NODEV | MS_NOEXEC | MS_NOSUID,
controller->name());
}
}
if (result < 0) {
PLOG(ERROR) << "Failed to mount " << controller->name() << " cgroup";
return false;
}
return true;
bool CgroupController::HasValue() const {
return controller_ != nullptr;
}
#else
std::string CgroupController::GetTasksFilePath(const std::string& rel_path) const {
std::string tasks_path = path();
// Stubs for non-Android targets.
static bool SetupCgroup(const CgroupDescriptor&) {
return false;
if (!rel_path.empty()) {
tasks_path += "/" + rel_path;
}
return (version() == 1) ? tasks_path + CGROUP_TASKS_FILE : tasks_path + CGROUP_TASKS_FILE_V2;
}
#endif
// WARNING: This function should be called only from SetupCgroups and only once.
// It intentionally leaks an FD, so additional invocation will result in additional leak.
static bool WriteRcFile(const std::map<std::string, CgroupDescriptor>& descriptors) {
// WARNING: We are intentionally leaking the FD to keep the file open forever.
// Let init keep the FD open to prevent file mappings from becoming invalid in
// case the file gets deleted somehow.
int fd = TEMP_FAILURE_RETRY(open(CGROUPS_RC_PATH, O_CREAT | O_WRONLY | O_TRUNC | O_CLOEXEC,
S_IRUSR | S_IRGRP | S_IROTH));
if (fd < 0) {
PLOG(ERROR) << "open() failed for " << CGROUPS_RC_PATH;
return false;
}
CgroupFile fl;
fl.version_ = CgroupFile::FILE_CURR_VERSION;
fl.controller_count_ = descriptors.size();
int ret = TEMP_FAILURE_RETRY(write(fd, &fl, sizeof(fl)));
if (ret < 0) {
PLOG(ERROR) << "write() failed for " << CGROUPS_RC_PATH;
return false;
}
for (const auto& [name, descriptor] : descriptors) {
ret = TEMP_FAILURE_RETRY(write(fd, descriptor.controller(), sizeof(CgroupController)));
if (ret < 0) {
PLOG(ERROR) << "write() failed for " << CGROUPS_RC_PATH;
return false;
}
}
return true;
}
CgroupController::CgroupController(uint32_t version, const std::string& name,
const std::string& path) {
version_ = version;
strncpy(name_, name.c_str(), sizeof(name_) - 1);
name_[sizeof(name_) - 1] = '\0';
strncpy(path_, path.c_str(), sizeof(path_) - 1);
path_[sizeof(path_) - 1] = '\0';
}
std::string CgroupController::GetTasksFilePath(const std::string& path) const {
std::string tasks_path = path_;
if (!path.empty()) {
tasks_path += "/" + path;
}
return (version_ == 1) ? tasks_path + CGROUP_TASKS_FILE : tasks_path + CGROUP_TASKS_FILE_V2;
}
std::string CgroupController::GetProcsFilePath(const std::string& path, uid_t uid,
std::string CgroupController::GetProcsFilePath(const std::string& rel_path, uid_t uid,
pid_t pid) const {
std::string proc_path(path_);
proc_path.append("/").append(path);
std::string proc_path(path());
proc_path.append("/").append(rel_path);
proc_path = regex_replace(proc_path, std::regex("<uid>"), std::to_string(uid));
proc_path = regex_replace(proc_path, std::regex("<pid>"), std::to_string(pid));
@ -302,7 +100,7 @@ bool CgroupController::GetTaskGroup(int tid, std::string* group) const {
return true;
}
std::string cg_tag = StringPrintf(":%s:", name_);
std::string cg_tag = StringPrintf(":%s:", name());
size_t start_pos = content.find(cg_tag);
if (start_pos == std::string::npos) {
return false;
@ -319,25 +117,12 @@ bool CgroupController::GetTaskGroup(int tid, std::string* group) const {
return true;
}
CgroupDescriptor::CgroupDescriptor(uint32_t version, const std::string& name,
const std::string& path, mode_t mode, const std::string& uid,
const std::string& gid)
: controller_(version, name, path), mode_(mode), uid_(uid), gid_(gid) {}
CgroupMap::CgroupMap() : cg_file_data_(nullptr), cg_file_size_(0) {
CgroupMap::CgroupMap() {
if (!LoadRcFile()) {
LOG(ERROR) << "CgroupMap::LoadRcFile called for [" << getpid() << "] failed";
}
}
CgroupMap::~CgroupMap() {
if (cg_file_data_) {
munmap(cg_file_data_, cg_file_size_);
cg_file_data_ = nullptr;
cg_file_size_ = 0;
}
}
CgroupMap& CgroupMap::GetInstance() {
// Deliberately leak this object to avoid a race between destruction on
// process exit and concurrent access from another thread.
@ -346,139 +131,46 @@ CgroupMap& CgroupMap::GetInstance() {
}
bool CgroupMap::LoadRcFile() {
struct stat sb;
if (cg_file_data_) {
// Data already initialized
return true;
if (!loaded_) {
loaded_ = (ACgroupFile_getVersion() != 0);
}
unique_fd fd(TEMP_FAILURE_RETRY(open(CGROUPS_RC_PATH, O_RDONLY | O_CLOEXEC)));
if (fd < 0) {
PLOG(ERROR) << "open() failed for " << CGROUPS_RC_PATH;
return false;
}
if (fstat(fd, &sb) < 0) {
PLOG(ERROR) << "fstat() failed for " << CGROUPS_RC_PATH;
return false;
}
size_t file_size = sb.st_size;
if (file_size < sizeof(CgroupFile)) {
LOG(ERROR) << "Invalid file format " << CGROUPS_RC_PATH;
return false;
}
CgroupFile* file_data = (CgroupFile*)mmap(nullptr, file_size, PROT_READ, MAP_SHARED, fd, 0);
if (file_data == MAP_FAILED) {
PLOG(ERROR) << "Failed to mmap " << CGROUPS_RC_PATH;
return false;
}
if (file_data->version_ != CgroupFile::FILE_CURR_VERSION) {
LOG(ERROR) << CGROUPS_RC_PATH << " file version mismatch";
munmap(file_data, file_size);
return false;
}
if (file_size != sizeof(CgroupFile) + file_data->controller_count_ * sizeof(CgroupController)) {
LOG(ERROR) << CGROUPS_RC_PATH << " file has invalid size";
munmap(file_data, file_size);
return false;
}
cg_file_data_ = file_data;
cg_file_size_ = file_size;
return true;
return loaded_;
}
void CgroupMap::Print() const {
if (!cg_file_data_) {
if (!loaded_) {
LOG(ERROR) << "CgroupMap::Print called for [" << getpid()
<< "] failed, RC file was not initialized properly";
return;
}
LOG(INFO) << "File version = " << cg_file_data_->version_;
LOG(INFO) << "File controller count = " << cg_file_data_->controller_count_;
LOG(INFO) << "File version = " << ACgroupFile_getVersion();
LOG(INFO) << "File controller count = " << ACgroupFile_getControllerCount();
LOG(INFO) << "Mounted cgroups:";
CgroupController* controller = (CgroupController*)(cg_file_data_ + 1);
for (int i = 0; i < cg_file_data_->controller_count_; i++, controller++) {
LOG(INFO) << "\t" << controller->name() << " ver " << controller->version() << " path "
<< controller->path();
auto controller_count = ACgroupFile_getControllerCount();
for (uint32_t i = 0; i < controller_count; ++i) {
const ACgroupController* controller = ACgroupFile_getController(i);
LOG(INFO) << "\t" << ACgroupController_getName(controller) << " ver "
<< ACgroupController_getVersion(controller) << " path "
<< ACgroupController_getPath(controller);
}
}
bool CgroupMap::SetupCgroups() {
std::map<std::string, CgroupDescriptor> descriptors;
if (getpid() != 1) {
LOG(ERROR) << "Cgroup setup can be done only by init process";
return false;
}
// Make sure we do this only one time. No need for std::call_once because
// init is a single-threaded process
if (access(CGROUPS_RC_PATH, F_OK) == 0) {
LOG(WARNING) << "Attempt to call SetupCgroups more than once";
return true;
}
// load cgroups.json file
if (!ReadDescriptors(&descriptors)) {
LOG(ERROR) << "Failed to load cgroup description file";
return false;
}
// setup cgroups
for (const auto& [name, descriptor] : descriptors) {
if (!SetupCgroup(descriptor)) {
// issue a warning and proceed with the next cgroup
// TODO: mark the descriptor as invalid and skip it in WriteRcFile()
LOG(WARNING) << "Failed to setup " << name << " cgroup";
}
}
// mkdir <CGROUPS_RC_DIR> 0711 system system
if (!Mkdir(android::base::Dirname(CGROUPS_RC_PATH), 0711, "system", "system")) {
LOG(ERROR) << "Failed to create directory for " << CGROUPS_RC_PATH << " file";
return false;
}
// Generate <CGROUPS_RC_FILE> file which can be directly mmapped into
// process memory. This optimizes performance, memory usage
// and limits infrormation shared with unprivileged processes
// to the minimum subset of information from cgroups.json
if (!WriteRcFile(descriptors)) {
LOG(ERROR) << "Failed to write " << CGROUPS_RC_PATH << " file";
return false;
}
// chmod 0644 <CGROUPS_RC_PATH>
if (fchmodat(AT_FDCWD, CGROUPS_RC_PATH, 0644, AT_SYMLINK_NOFOLLOW) < 0) {
PLOG(ERROR) << "fchmodat() failed";
return false;
}
return true;
}
const CgroupController* CgroupMap::FindController(const std::string& name) const {
if (!cg_file_data_) {
CgroupController CgroupMap::FindController(const std::string& name) const {
if (!loaded_) {
LOG(ERROR) << "CgroupMap::FindController called for [" << getpid()
<< "] failed, RC file was not initialized properly";
return nullptr;
return CgroupController(nullptr);
}
// skip the file header to get to the first controller
CgroupController* controller = (CgroupController*)(cg_file_data_ + 1);
for (int i = 0; i < cg_file_data_->controller_count_; i++, controller++) {
if (name == controller->name()) {
return controller;
auto controller_count = ACgroupFile_getControllerCount();
for (uint32_t i = 0; i < controller_count; ++i) {
const ACgroupController* controller = ACgroupFile_getController(i);
if (name == ACgroupController_getName(controller)) {
return CgroupController(controller);
}
}
return nullptr;
return CgroupController(nullptr);
}

62
libprocessgroup/cgroup_map.h
View File

@ -20,57 +20,30 @@
#include <sys/types.h>
#include <map>
#include <memory>
#include <mutex>
#include <string>
#include <vector>
// Minimal controller description to be mmapped into process address space
#include <android/cgrouprc.h>
// Convenient wrapper of an ACgroupController pointer.
class CgroupController {
public:
CgroupController() {}
CgroupController(uint32_t version, const std::string& name, const std::string& path);
// Does not own controller
explicit CgroupController(const ACgroupController* controller) : controller_(controller) {}
uint32_t version() const { return version_; }
const char* name() const { return name_; }
const char* path() const { return path_; }
uint32_t version() const;
const char* name() const;
const char* path() const;
bool HasValue() const;
std::string GetTasksFilePath(const std::string& path) const;
std::string GetProcsFilePath(const std::string& path, uid_t uid, pid_t pid) const;
bool GetTaskGroup(int tid, std::string* group) const;
private:
static constexpr size_t CGROUP_NAME_BUF_SZ = 16;
static constexpr size_t CGROUP_PATH_BUF_SZ = 32;
uint32_t version_;
char name_[CGROUP_NAME_BUF_SZ];
char path_[CGROUP_PATH_BUF_SZ];
};
// Complete controller description for mounting cgroups
class CgroupDescriptor {
public:
CgroupDescriptor(uint32_t version, const std::string& name, const std::string& path,
mode_t mode, const std::string& uid, const std::string& gid);
const CgroupController* controller() const { return &controller_; }
mode_t mode() const { return mode_; }
std::string uid() const { return uid_; }
std::string gid() const { return gid_; }
private:
CgroupController controller_;
mode_t mode_;
std::string uid_;
std::string gid_;
};
struct CgroupFile {
static constexpr uint32_t FILE_VERSION_1 = 1;
static constexpr uint32_t FILE_CURR_VERSION = FILE_VERSION_1;
uint32_t version_;
uint32_t controller_count_;
CgroupController controllers_[];
const ACgroupController* controller_ = nullptr;
};
class CgroupMap {
@ -79,16 +52,11 @@ class CgroupMap {
static bool SetupCgroups();
static CgroupMap& GetInstance();
const CgroupController* FindController(const std::string& name) const;
CgroupController FindController(const std::string& name) const;
private:
struct CgroupFile* cg_file_data_;
size_t cg_file_size_;
bool loaded_ = false;
CgroupMap();
~CgroupMap();
bool LoadRcFile();
void Print() const;
};

57
libprocessgroup/cgrouprc/Android.bp Normal file
View File

@ -0,0 +1,57 @@
// Copyright (C) 2019 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
cc_library {
name: "libcgrouprc",
host_supported: true,
recovery_available: true,
// Do not ever mark this as vendor_available; otherwise, vendor modules
// that links to the static library will behave unexpectedly. All on-device
// modules should use libprocessgroup which links to the LL-NDK library
// defined below. The static library is built for tests.
vendor_available: false,
srcs: [
"cgroup_controller.cpp",
"cgroup_file.cpp",
],
cflags: [
"-Wall",
"-Werror",
],
export_include_dirs: [
"include",
],
header_libs: [
"libprocessgroup_headers",
],
shared_libs: [
"libbase",
],
static_libs: [
"libcgrouprc_format",
],
stubs: {
symbol_file: "libcgrouprc.map.txt",
versions: ["29"],
},
version_script: "libcgrouprc.map.txt",
}
llndk_library {
name: "libcgrouprc",
symbol_file: "libcgrouprc.map.txt",
export_include_dirs: [
"include",
],
}

38
libprocessgroup/cgrouprc/cgroup_controller.cpp Normal file
View File

@ -0,0 +1,38 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <android-base/logging.h>
#include <android/cgrouprc.h>
#include "cgrouprc_internal.h"
// All ACgroupController_* functions implicitly convert the pointer back
// to the original CgroupController pointer before invoking the member functions.
uint32_t ACgroupController_getVersion(const ACgroupController* controller) {
CHECK(controller != nullptr);
return controller->version();
}
const char* ACgroupController_getName(const ACgroupController* controller) {
CHECK(controller != nullptr);
return controller->name();
}
const char* ACgroupController_getPath(const ACgroupController* controller) {
CHECK(controller != nullptr);
return controller->path();
}

106
libprocessgroup/cgrouprc/cgroup_file.cpp Normal file
View File

@ -0,0 +1,106 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <sys/mman.h>
#include <sys/stat.h>
#include <memory>
#include <android-base/logging.h>
#include <android-base/stringprintf.h>
#include <android-base/unique_fd.h>
#include <android/cgrouprc.h>
#include <processgroup/processgroup.h>
#include "cgrouprc_internal.h"
using android::base::StringPrintf;
using android::base::unique_fd;
using android::cgrouprc::format::CgroupController;
using android::cgrouprc::format::CgroupFile;
static CgroupFile* LoadRcFile() {
struct stat sb;
unique_fd fd(TEMP_FAILURE_RETRY(open(CGROUPS_RC_PATH, O_RDONLY | O_CLOEXEC)));
if (fd < 0) {
PLOG(ERROR) << "open() failed for " << CGROUPS_RC_PATH;
return nullptr;
}
if (fstat(fd, &sb) < 0) {
PLOG(ERROR) << "fstat() failed for " << CGROUPS_RC_PATH;
return nullptr;
}
size_t file_size = sb.st_size;
if (file_size < sizeof(CgroupFile)) {
LOG(ERROR) << "Invalid file format " << CGROUPS_RC_PATH;
return nullptr;
}
CgroupFile* file_data = (CgroupFile*)mmap(nullptr, file_size, PROT_READ, MAP_SHARED, fd, 0);
if (file_data == MAP_FAILED) {
PLOG(ERROR) << "Failed to mmap " << CGROUPS_RC_PATH;
return nullptr;
}
if (file_data->version_ != CgroupFile::FILE_CURR_VERSION) {
LOG(ERROR) << CGROUPS_RC_PATH << " file version mismatch";
munmap(file_data, file_size);
return nullptr;
}
auto expected = sizeof(CgroupFile) + file_data->controller_count_ * sizeof(CgroupController);
if (file_size != expected) {
LOG(ERROR) << CGROUPS_RC_PATH << " file has invalid size, expected " << expected
<< ", actual " << file_size;
munmap(file_data, file_size);
return nullptr;
}
return file_data;
}
static CgroupFile* GetInstance() {
// Deliberately leak this object (not munmap) to avoid a race between destruction on
// process exit and concurrent access from another thread.
static auto* file = LoadRcFile();
return file;
}
uint32_t ACgroupFile_getVersion() {
auto file = GetInstance();
if (file == nullptr) return 0;
return file->version_;
}
uint32_t ACgroupFile_getControllerCount() {
auto file = GetInstance();
if (file == nullptr) return 0;
return file->controller_count_;
}
const ACgroupController* ACgroupFile_getController(uint32_t index) {
auto file = GetInstance();
if (file == nullptr) return nullptr;
CHECK(index < file->controller_count_);
// Although the object is not actually an ACgroupController object, all ACgroupController_*
// functions implicitly convert ACgroupController* back to CgroupController* before invoking
// member functions.
return static_cast<ACgroupController*>(&file->controllers_[index]);
}

24
libprocessgroup/cgrouprc/cgrouprc_internal.h Normal file
View File

@ -0,0 +1,24 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#pragma once
#include <android/cgrouprc.h>
#include <processgroup/format/cgroup_controller.h>
#include <processgroup/format/cgroup_file.h>
struct ACgroupController : android::cgrouprc::format::CgroupController {};

84
libprocessgroup/cgrouprc/include/android/cgrouprc.h Normal file
View File

@ -0,0 +1,84 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#pragma once
#include <stdint.h>
__BEGIN_DECLS
// For host builds, __INTRODUCED_IN is not defined.
#ifndef __INTRODUCED_IN
#define __INTRODUCED_IN(x)
#endif
struct ACgroupController;
typedef struct ACgroupController ACgroupController;
#if __ANDROID_API__ >= __ANDROID_API_Q__
// ACgroupFile
/**
* Returns file version. See android::cgrouprc::format::CgroupFile for a list of valid versions
* for the file.
* If ACgroupFile_init() isn't called, initialization will be done first.
* If initialization failed, return 0.
*/
__attribute__((warn_unused_result)) uint32_t ACgroupFile_getVersion() __INTRODUCED_IN(29);
/**
* Returns the number of controllers.
* If ACgroupFile_init() isn't called, initialization will be done first.
* If initialization failed, return 0.
*/
__attribute__((warn_unused_result)) uint32_t ACgroupFile_getControllerCount() __INTRODUCED_IN(29);
/**
* Returns the controller at the given index.
* Returnss nullptr if the given index exceeds getControllerCount().
* If ACgroupFile_init() isn't called, initialization will be done first.
* If initialization failed, return 0.
*/
__attribute__((warn_unused_result)) const ACgroupController* ACgroupFile_getController(
uint32_t index) __INTRODUCED_IN(29);
// ACgroupController
/**
* Returns the version of the given controller.
* If the given controller is null, return 0.
*/
__attribute__((warn_unused_result)) uint32_t ACgroupController_getVersion(const ACgroupController*)
__INTRODUCED_IN(29);
/**
* Returns the name of the given controller.
* If the given controller is null, return nullptr.
*/
__attribute__((warn_unused_result)) const char* ACgroupController_getName(const ACgroupController*)
__INTRODUCED_IN(29);
/**
* Returns the path of the given controller.
* If the given controller is null, return nullptr.
*/
__attribute__((warn_unused_result)) const char* ACgroupController_getPath(const ACgroupController*)
__INTRODUCED_IN(29);
__END_DECLS
#endif

11
libprocessgroup/cgrouprc/libcgrouprc.map.txt Normal file
View File

@ -0,0 +1,11 @@
LIBCGROUPRC { # introduced=29
global:
ACgroupFile_getVersion;
ACgroupFile_getControllerCount;
ACgroupFile_getController;
ACgroupController_getVersion;
ACgroupController_getName;
ACgroupController_getPath;
local:
*;
};

32
libprocessgroup/cgrouprc_format/Android.bp Normal file
View File

@ -0,0 +1,32 @@
// Copyright (C) 2019 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
cc_library_static {
name: "libcgrouprc_format",
host_supported: true,
recovery_available: true,
srcs: [
"cgroup_controller.cpp",
],
cflags: [
"-Wall",
"-Werror",
],
export_include_dirs: [
"include",
],
shared_libs: [
"libbase",
],
}

49
libprocessgroup/cgrouprc_format/cgroup_controller.cpp Normal file
View File

@ -0,0 +1,49 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <processgroup/format/cgroup_controller.h>
namespace android {
namespace cgrouprc {
namespace format {
CgroupController::CgroupController(uint32_t version, const std::string& name,
const std::string& path) {
// strlcpy isn't available on host. Although there is an implementation
// in licutils, libcutils itself depends on libcgrouprc_format, causing
// a circular dependency.
version_ = version;
strncpy(name_, name.c_str(), sizeof(name_) - 1);
name_[sizeof(name_) - 1] = '\0';
strncpy(path_, path.c_str(), sizeof(path_) - 1);
path_[sizeof(path_) - 1] = '\0';
}
uint32_t CgroupController::version() const {
return version_;
}
const char* CgroupController::name() const {
return name_;
}
const char* CgroupController::path() const {
return path_;
}
} // namespace format
} // namespace cgrouprc
} // namespace android

47
libprocessgroup/cgrouprc_format/include/processgroup/format/cgroup_controller.h Normal file
View File

@ -0,0 +1,47 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#pragma once
#include <stdint.h>
#include <string>
namespace android {
namespace cgrouprc {
namespace format {
// Minimal controller description to be mmapped into process address space
struct CgroupController {
public:
CgroupController() {}
CgroupController(uint32_t version, const std::string& name, const std::string& path);
uint32_t version() const;
const char* name() const;
const char* path() const;
private:
static constexpr size_t CGROUP_NAME_BUF_SZ = 16;
static constexpr size_t CGROUP_PATH_BUF_SZ = 32;
uint32_t version_;
char name_[CGROUP_NAME_BUF_SZ];
char path_[CGROUP_PATH_BUF_SZ];
};
} // namespace format
} // namespace cgrouprc
} // namespace android

36
libprocessgroup/cgrouprc_format/include/processgroup/format/cgroup_file.h Normal file
View File

@ -0,0 +1,36 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#pragma once
#include <processgroup/format/cgroup_controller.h>
namespace android {
namespace cgrouprc {
namespace format {
struct CgroupFile {
uint32_t version_;
uint32_t controller_count_;
CgroupController controllers_[];
static constexpr uint32_t FILE_VERSION_1 = 1;
static constexpr uint32_t FILE_CURR_VERSION = FILE_VERSION_1;
};
} // namespace format
} // namespace cgrouprc
} // namespace android

1
libprocessgroup/include/processgroup/processgroup.h
View File

@ -26,7 +26,6 @@ __BEGIN_DECLS
static constexpr const char* CGROUPV2_CONTROLLER_NAME = "cgroup2";
static constexpr const char* CGROUPS_RC_PATH = "/dev/cgroup_info/cgroup.rc";
bool CgroupSetupCgroups();
bool CgroupGetControllerPath(const std::string& cgroup_name, std::string* path);
bool CgroupGetAttributePath(const std::string& attr_name, std::string* path);
bool CgroupGetAttributePathForTask(const std::string& attr_name, int tid, std::string* path);

12
libprocessgroup/processgroup.cpp
View File

@ -55,19 +55,15 @@ using namespace std::chrono_literals;
#define PROCESSGROUP_CGROUP_PROCS_FILE "/cgroup.procs"
bool CgroupSetupCgroups() {
return CgroupMap::SetupCgroups();
}
bool CgroupGetControllerPath(const std::string& cgroup_name, std::string* path) {
const CgroupController* controller = CgroupMap::GetInstance().FindController(cgroup_name);
auto controller = CgroupMap::GetInstance().FindController(cgroup_name);
if (controller == nullptr) {
if (!controller.HasValue()) {
return false;
}
if (path) {
*path = controller->path();
*path = controller.path();
}
return true;
@ -111,7 +107,7 @@ bool UsePerAppMemcg() {
static bool isMemoryCgroupSupported() {
std::string cgroup_name;
static bool memcg_supported = (CgroupMap::GetInstance().FindController("memory") != nullptr);
static bool memcg_supported = CgroupMap::GetInstance().FindController("memory").HasValue();
return memcg_supported;
}

10
libprocessgroup/sched_policy.cpp
View File

@ -152,21 +152,21 @@ int set_sched_policy(int tid, SchedPolicy policy) {
}
bool cpusets_enabled() {
static bool enabled = (CgroupMap::GetInstance().FindController("cpuset") != nullptr);
static bool enabled = (CgroupMap::GetInstance().FindController("cpuset").HasValue());
return enabled;
}
bool schedboost_enabled() {
static bool enabled = (CgroupMap::GetInstance().FindController("schedtune") != nullptr);
static bool enabled = (CgroupMap::GetInstance().FindController("schedtune").HasValue());
return enabled;
}
static int getCGroupSubsys(int tid, const char* subsys, std::string& subgroup) {
const CgroupController* controller = CgroupMap::GetInstance().FindController(subsys);
auto controller = CgroupMap::GetInstance().FindController(subsys);
if (!controller) return -1;
if (!controller.HasValue()) return -1;
if (!controller->GetTaskGroup(tid, &subgroup)) {
if (!controller.GetTaskGroup(tid, &subgroup)) {
LOG(ERROR) << "Failed to find cgroup for tid " << tid;
return -1;
}

44
libprocessgroup/setup/Android.bp Normal file
View File

@ -0,0 +1,44 @@
//
// Copyright (C) 2019 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
cc_library_shared {
name: "libprocessgroup_setup",
recovery_available: true,
srcs: [
"cgroup_map_write.cpp",
],
export_include_dirs: [
"include",
],
shared_libs: [
"libbase",
"libcgrouprc",
"libjsoncpp",
],
static_libs: [
"libcgrouprc_format",
],
header_libs: [
"libprocessgroup_headers",
],
export_header_lib_headers: [
"libprocessgroup_headers",
],
cflags: [
"-Wall",
"-Werror",
],
}

43
libprocessgroup/setup/cgroup_descriptor.h Normal file
View File

@ -0,0 +1,43 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#pragma once
#include <processgroup/format/cgroup_controller.h>
namespace android {
namespace cgrouprc {
// Complete controller description for mounting cgroups
class CgroupDescriptor {
public:
CgroupDescriptor(uint32_t version, const std::string& name, const std::string& path,
mode_t mode, const std::string& uid, const std::string& gid);
const format::CgroupController* controller() const { return &controller_; }
mode_t mode() const { return mode_; }
std::string uid() const { return uid_; }
std::string gid() const { return gid_; }
private:
format::CgroupController controller_;
mode_t mode_ = 0;
std::string uid_;
std::string gid_;
};
} // namespace cgrouprc
} // namespace android

334
libprocessgroup/setup/cgroup_map_write.cpp Normal file
View File

@ -0,0 +1,334 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
//#define LOG_NDEBUG 0
#define LOG_TAG "libprocessgroup"
#include <errno.h>
#include <fcntl.h>
#include <grp.h>
#include <pwd.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <time.h>
#include <unistd.h>
#include <regex>
#include <android-base/file.h>
#include <android-base/logging.h>
#include <android-base/properties.h>
#include <android-base/stringprintf.h>
#include <android-base/unique_fd.h>
#include <json/reader.h>
#include <json/value.h>
#include <processgroup/format/cgroup_file.h>
#include <processgroup/processgroup.h>
#include <processgroup/setup.h>
#include "cgroup_descriptor.h"
using android::base::GetBoolProperty;
using android::base::StringPrintf;
using android::base::unique_fd;
namespace android {
namespace cgrouprc {
static constexpr const char* CGROUPS_DESC_FILE = "/etc/cgroups.json";
static constexpr const char* CGROUPS_DESC_VENDOR_FILE = "/vendor/etc/cgroups.json";
static bool Mkdir(const std::string& path, mode_t mode, const std::string& uid,
const std::string& gid) {
if (mode == 0) {
mode = 0755;
}
if (mkdir(path.c_str(), mode) != 0) {
/* chmod in case the directory already exists */
if (errno == EEXIST) {
if (fchmodat(AT_FDCWD, path.c_str(), mode, AT_SYMLINK_NOFOLLOW) != 0) {
// /acct is a special case when the directory already exists
// TODO: check if file mode is already what we want instead of using EROFS
if (errno != EROFS) {
PLOG(ERROR) << "fchmodat() failed for " << path;
return false;
}
}
} else {
PLOG(ERROR) << "mkdir() failed for " << path;
return false;
}
}
if (uid.empty()) {
return true;
}
passwd* uid_pwd = getpwnam(uid.c_str());
if (!uid_pwd) {
PLOG(ERROR) << "Unable to decode UID for '" << uid << "'";
return false;
}
uid_t pw_uid = uid_pwd->pw_uid;
gid_t gr_gid = -1;
if (!gid.empty()) {
group* gid_pwd = getgrnam(gid.c_str());
if (!gid_pwd) {
PLOG(ERROR) << "Unable to decode GID for '" << gid << "'";
return false;
}
gr_gid = gid_pwd->gr_gid;
}
if (lchown(path.c_str(), pw_uid, gr_gid) < 0) {
PLOG(ERROR) << "lchown() failed for " << path;
return false;
}
/* chown may have cleared S_ISUID and S_ISGID, chmod again */
if (mode & (S_ISUID | S_ISGID)) {
if (fchmodat(AT_FDCWD, path.c_str(), mode, AT_SYMLINK_NOFOLLOW) != 0) {
PLOG(ERROR) << "fchmodat() failed for " << path;
return false;
}
}
return true;
}
static bool ReadDescriptorsFromFile(const std::string& file_name,
std::map<std::string, CgroupDescriptor>* descriptors) {
std::vector<CgroupDescriptor> result;
std::string json_doc;
if (!android::base::ReadFileToString(file_name, &json_doc)) {
PLOG(ERROR) << "Failed to read task profiles from " << file_name;
return false;
}
Json::Reader reader;
Json::Value root;
if (!reader.parse(json_doc, root)) {
LOG(ERROR) << "Failed to parse cgroups description: " << reader.getFormattedErrorMessages();
return false;
}
if (root.isMember("Cgroups")) {
const Json::Value& cgroups = root["Cgroups"];
for (Json::Value::ArrayIndex i = 0; i < cgroups.size(); ++i) {
std::string name = cgroups[i]["Controller"].asString();
auto iter = descriptors->find(name);
if (iter == descriptors->end()) {
descriptors->emplace(
name, CgroupDescriptor(
1, name, cgroups[i]["Path"].asString(),
std::strtoul(cgroups[i]["Mode"].asString().c_str(), 0, 8),
cgroups[i]["UID"].asString(), cgroups[i]["GID"].asString()));
} else {
iter->second = CgroupDescriptor(
1, name, cgroups[i]["Path"].asString(),
std::strtoul(cgroups[i]["Mode"].asString().c_str(), 0, 8),
cgroups[i]["UID"].asString(), cgroups[i]["GID"].asString());
}
}
}
if (root.isMember("Cgroups2")) {
const Json::Value& cgroups2 = root["Cgroups2"];
auto iter = descriptors->find(CGROUPV2_CONTROLLER_NAME);
if (iter == descriptors->end()) {
descriptors->emplace(
CGROUPV2_CONTROLLER_NAME,
CgroupDescriptor(2, CGROUPV2_CONTROLLER_NAME, cgroups2["Path"].asString(),
std::strtoul(cgroups2["Mode"].asString().c_str(), 0, 8),
cgroups2["UID"].asString(), cgroups2["GID"].asString()));
} else {
iter->second =
CgroupDescriptor(2, CGROUPV2_CONTROLLER_NAME, cgroups2["Path"].asString(),
std::strtoul(cgroups2["Mode"].asString().c_str(), 0, 8),
cgroups2["UID"].asString(), cgroups2["GID"].asString());
}
}
return true;
}
static bool ReadDescriptors(std::map<std::string, CgroupDescriptor>* descriptors) {
// load system cgroup descriptors
if (!ReadDescriptorsFromFile(CGROUPS_DESC_FILE, descriptors)) {
return false;
}
// load vendor cgroup descriptors if the file exists
if (!access(CGROUPS_DESC_VENDOR_FILE, F_OK) &&
!ReadDescriptorsFromFile(CGROUPS_DESC_VENDOR_FILE, descriptors)) {
return false;
}
return true;
}
// To avoid issues in sdk_mac build
#if defined(__ANDROID__)
static bool SetupCgroup(const CgroupDescriptor& descriptor) {
const format::CgroupController* controller = descriptor.controller();
// mkdir <path> [mode] [owner] [group]
if (!Mkdir(controller->path(), descriptor.mode(), descriptor.uid(), descriptor.gid())) {
LOG(ERROR) << "Failed to create directory for " << controller->name() << " cgroup";
return false;
}
int result;
if (controller->version() == 2) {
result = mount("none", controller->path(), "cgroup2", MS_NODEV | MS_NOEXEC | MS_NOSUID,
nullptr);
} else {
// Unfortunately historically cpuset controller was mounted using a mount command
// different from all other controllers. This results in controller attributes not
// to be prepended with controller name. For example this way instead of
// /dev/cpuset/cpuset.cpus the attribute becomes /dev/cpuset/cpus which is what
// the system currently expects.
if (!strcmp(controller->name(), "cpuset")) {
// mount cpuset none /dev/cpuset nodev noexec nosuid
result = mount("none", controller->path(), controller->name(),
MS_NODEV | MS_NOEXEC | MS_NOSUID, nullptr);
} else {
// mount cgroup none <path> nodev noexec nosuid <controller>
result = mount("none", controller->path(), "cgroup", MS_NODEV | MS_NOEXEC | MS_NOSUID,
controller->name());
}
}
if (result < 0) {
PLOG(ERROR) << "Failed to mount " << controller->name() << " cgroup";
return false;
}
return true;
}
#else
// Stubs for non-Android targets.
static bool SetupCgroup(const CgroupDescriptor&) {
return false;
}
#endif
// WARNING: This function should be called only from SetupCgroups and only once.
// It intentionally leaks an FD, so additional invocation will result in additional leak.
static bool WriteRcFile(const std::map<std::string, CgroupDescriptor>& descriptors) {
// WARNING: We are intentionally leaking the FD to keep the file open forever.
// Let init keep the FD open to prevent file mappings from becoming invalid in
// case the file gets deleted somehow.
int fd = TEMP_FAILURE_RETRY(open(CGROUPS_RC_PATH, O_CREAT | O_WRONLY | O_TRUNC | O_CLOEXEC,
S_IRUSR | S_IRGRP | S_IROTH));
if (fd < 0) {
PLOG(ERROR) << "open() failed for " << CGROUPS_RC_PATH;
return false;
}
format::CgroupFile fl;
fl.version_ = format::CgroupFile::FILE_CURR_VERSION;
fl.controller_count_ = descriptors.size();
int ret = TEMP_FAILURE_RETRY(write(fd, &fl, sizeof(fl)));
if (ret < 0) {
PLOG(ERROR) << "write() failed for " << CGROUPS_RC_PATH;
return false;
}
for (const auto& [name, descriptor] : descriptors) {
ret = TEMP_FAILURE_RETRY(
write(fd, descriptor.controller(), sizeof(format::CgroupController)));
if (ret < 0) {
PLOG(ERROR) << "write() failed for " << CGROUPS_RC_PATH;
return false;
}
}
return true;
}
CgroupDescriptor::CgroupDescriptor(uint32_t version, const std::string& name,
const std::string& path, mode_t mode, const std::string& uid,
const std::string& gid)
: controller_(version, name, path), mode_(mode), uid_(uid), gid_(gid) {}
} // namespace cgrouprc
} // namespace android
bool CgroupSetup() {
using namespace android::cgrouprc;
std::map<std::string, CgroupDescriptor> descriptors;
if (getpid() != 1) {
LOG(ERROR) << "Cgroup setup can be done only by init process";
return false;
}
// Make sure we do this only one time. No need for std::call_once because
// init is a single-threaded process
if (access(CGROUPS_RC_PATH, F_OK) == 0) {
LOG(WARNING) << "Attempt to call SetupCgroups more than once";
return true;
}
// load cgroups.json file
if (!ReadDescriptors(&descriptors)) {
LOG(ERROR) << "Failed to load cgroup description file";
return false;
}
// setup cgroups
for (const auto& [name, descriptor] : descriptors) {
if (!SetupCgroup(descriptor)) {
// issue a warning and proceed with the next cgroup
// TODO: mark the descriptor as invalid and skip it in WriteRcFile()
LOG(WARNING) << "Failed to setup " << name << " cgroup";
}
}
// mkdir <CGROUPS_RC_DIR> 0711 system system
if (!Mkdir(android::base::Dirname(CGROUPS_RC_PATH), 0711, "system", "system")) {
LOG(ERROR) << "Failed to create directory for " << CGROUPS_RC_PATH << " file";
return false;
}
// Generate <CGROUPS_RC_FILE> file which can be directly mmapped into
// process memory. This optimizes performance, memory usage
// and limits infrormation shared with unprivileged processes
// to the minimum subset of information from cgroups.json
if (!WriteRcFile(descriptors)) {
LOG(ERROR) << "Failed to write " << CGROUPS_RC_PATH << " file";
return false;
}
// chmod 0644 <CGROUPS_RC_PATH>
if (fchmodat(AT_FDCWD, CGROUPS_RC_PATH, 0644, AT_SYMLINK_NOFOLLOW) < 0) {
PLOG(ERROR) << "fchmodat() failed";
return false;
}
return true;
}

19
libprocessgroup/setup/include/processgroup/setup.h Normal file
View File

@ -0,0 +1,19 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#pragma once
bool CgroupSetup();

25
libprocessgroup/task_profiles.cpp
View File

@ -46,7 +46,7 @@ using android::base::WriteStringToFile;
bool ProfileAttribute::GetPathForTask(int tid, std::string* path) const {
std::string subgroup;
if (!controller_->GetTaskGroup(tid, &subgroup)) {
if (!controller()->GetTaskGroup(tid, &subgroup)) {
return false;
}
@ -55,9 +55,10 @@ bool ProfileAttribute::GetPathForTask(int tid, std::string* path) const {
}
if (subgroup.empty()) {
*path = StringPrintf("%s/%s", controller_->path(), file_name_.c_str());
*path = StringPrintf("%s/%s", controller()->path(), file_name_.c_str());
} else {
*path = StringPrintf("%s/%s/%s", controller_->path(), subgroup.c_str(), file_name_.c_str());
*path = StringPrintf("%s/%s/%s", controller()->path(), subgroup.c_str(),
file_name_.c_str());
}
return true;
}
@ -135,7 +136,7 @@ bool SetCgroupAction::IsAppDependentPath(const std::string& path) {
return path.find("<uid>", 0) != std::string::npos || path.find("<pid>", 0) != std::string::npos;
}
SetCgroupAction::SetCgroupAction(const CgroupController* c, const std::string& p)
SetCgroupAction::SetCgroupAction(const CgroupController& c, const std::string& p)
: controller_(c), path_(p) {
#ifdef CACHE_FILE_DESCRIPTORS
// cache file descriptor only if path is app independent
@ -145,7 +146,7 @@ SetCgroupAction::SetCgroupAction(const CgroupController* c, const std::string& p
return;
}
std::string tasks_path = c->GetTasksFilePath(p.c_str());
std::string tasks_path = c.GetTasksFilePath(p);
if (access(tasks_path.c_str(), W_OK) != 0) {
// file is not accessible
@ -199,7 +200,7 @@ bool SetCgroupAction::ExecuteForProcess(uid_t uid, pid_t pid) const {
}
// this is app-dependent path, file descriptor is not cached
std::string procs_path = controller_->GetProcsFilePath(path_, uid, pid);
std::string procs_path = controller()->GetProcsFilePath(path_, uid, pid);
unique_fd tmp_fd(TEMP_FAILURE_RETRY(open(procs_path.c_str(), O_WRONLY | O_CLOEXEC)));
if (tmp_fd < 0) {
PLOG(WARNING) << "Failed to open " << procs_path;
@ -212,7 +213,7 @@ bool SetCgroupAction::ExecuteForProcess(uid_t uid, pid_t pid) const {
return true;
#else
std::string procs_path = controller_->GetProcsFilePath(path_, uid, pid);
std::string procs_path = controller()->GetProcsFilePath(path_, uid, pid);
unique_fd tmp_fd(TEMP_FAILURE_RETRY(open(procs_path.c_str(), O_WRONLY | O_CLOEXEC)));
if (tmp_fd < 0) {
// no permissions to access the file, ignore
@ -247,7 +248,7 @@ bool SetCgroupAction::ExecuteForTask(int tid) const {
LOG(ERROR) << "Application profile can't be applied to a thread";
return false;
#else
std::string tasks_path = controller_->GetTasksFilePath(path_);
std::string tasks_path = controller()->GetTasksFilePath(path_);
unique_fd tmp_fd(TEMP_FAILURE_RETRY(open(tasks_path.c_str(), O_WRONLY | O_CLOEXEC)));
if (tmp_fd < 0) {
// no permissions to access the file, ignore
@ -326,8 +327,8 @@ bool TaskProfiles::Load(const CgroupMap& cg_map, const std::string& file_name) {
std::string file_attr = attr[i]["File"].asString();
if (attributes_.find(name) == attributes_.end()) {
const CgroupController* controller = cg_map.FindController(controller_name);
if (controller) {
auto controller = cg_map.FindController(controller_name);
if (controller.HasValue()) {
attributes_[name] = std::make_unique<ProfileAttribute>(controller, file_attr);
} else {
LOG(WARNING) << "Controller " << controller_name << " is not found";
@ -355,8 +356,8 @@ bool TaskProfiles::Load(const CgroupMap& cg_map, const std::string& file_name) {
std::string controller_name = params_val["Controller"].asString();
std::string path = params_val["Path"].asString();
const CgroupController* controller = cg_map.FindController(controller_name);
if (controller) {
auto controller = cg_map.FindController(controller_name);
if (controller.HasValue()) {
profile->Add(std::make_unique<SetCgroupAction>(controller, path));
} else {
LOG(WARNING) << "JoinCgroup: controller " << controller_name << " is not found";

12
libprocessgroup/task_profiles.h
View File

@ -27,16 +27,16 @@
class ProfileAttribute {
public:
ProfileAttribute(const CgroupController* controller, const std::string& file_name)
ProfileAttribute(const CgroupController& controller, const std::string& file_name)
: controller_(controller), file_name_(file_name) {}
const CgroupController* controller() const { return controller_; }
const CgroupController* controller() const { return &controller_; }
const std::string& file_name() const { return file_name_; }
bool GetPathForTask(int tid, std::string* path) const;
private:
const CgroupController* controller_;
CgroupController controller_;
std::string file_name_;
};
@ -106,16 +106,16 @@ class SetAttributeAction : public ProfileAction {
// Set cgroup profile element
class SetCgroupAction : public ProfileAction {
public:
SetCgroupAction(const CgroupController* c, const std::string& p);
SetCgroupAction(const CgroupController& c, const std::string& p);
virtual bool ExecuteForProcess(uid_t uid, pid_t pid) const;
virtual bool ExecuteForTask(int tid) const;
const CgroupController* controller() const { return controller_; }
const CgroupController* controller() const { return &controller_; }
std::string path() const { return path_; }
private:
const CgroupController* controller_;
CgroupController controller_;
std::string path_;
#ifdef CACHE_FILE_DESCRIPTORS
android::base::unique_fd fd_;

2
rootdir/etc/ld.config.legacy.txt
View File

@ -100,6 +100,7 @@ namespace.media.links = default
namespace.media.link.default.shared_libs = libandroid.so
namespace.media.link.default.shared_libs += libbinder_ndk.so
namespace.media.link.default.shared_libs += libc.so
namespace.media.link.default.shared_libs += libcgrouprc.so
namespace.media.link.default.shared_libs += libdl.so
namespace.media.link.default.shared_libs += liblog.so
namespace.media.link.default.shared_libs += libmediametrics.so
@ -143,6 +144,7 @@ namespace.resolv.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.links = default
namespace.resolv.link.default.shared_libs = libc.so
namespace.resolv.link.default.shared_libs += libcgrouprc.so
namespace.resolv.link.default.shared_libs += libm.so
namespace.resolv.link.default.shared_libs += libdl.so
namespace.resolv.link.default.shared_libs += libbinder_ndk.so

1
rootdir/etc/ld.config.txt
View File

@ -212,6 +212,7 @@ namespace.resolv.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.links = default
namespace.resolv.link.default.shared_libs = libc.so
namespace.resolv.link.default.shared_libs += libcgrouprc.so
namespace.resolv.link.default.shared_libs += libm.so
namespace.resolv.link.default.shared_libs += libdl.so
namespace.resolv.link.default.shared_libs += libbinder_ndk.so

2
rootdir/etc/ld.config.vndk_lite.txt
View File

@ -154,6 +154,7 @@ namespace.resolv.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.links = default
namespace.resolv.link.default.shared_libs = libc.so
namespace.resolv.link.default.shared_libs += libcgrouprc.so
namespace.resolv.link.default.shared_libs += libm.so
namespace.resolv.link.default.shared_libs += libdl.so
namespace.resolv.link.default.shared_libs += libbinder_ndk.so
@ -476,6 +477,7 @@ namespace.resolv.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.links = default
namespace.resolv.link.default.shared_libs = libc.so
namespace.resolv.link.default.shared_libs += libcgrouprc.so
namespace.resolv.link.default.shared_libs += libm.so
namespace.resolv.link.default.shared_libs += libdl.so
namespace.resolv.link.default.shared_libs += libbinder_ndk.so