diff --git a/init/Android.bp b/init/Android.bp index 8292aa0e2..69ee34f13 100644 --- a/init/Android.bp +++ b/init/Android.bp @@ -61,6 +61,7 @@ cc_defaults { static_libs: [ "libseccomp_policy", "libavb", + "libcgrouprc_format", "libprotobuf-cpp-lite", "libpropertyinfoserializer", "libpropertyinfoparser", @@ -82,6 +83,7 @@ cc_defaults { "liblogwrap", "liblp", "libprocessgroup", + "libprocessgroup_setup", "libselinux", "libutils", ], diff --git a/init/init.cpp b/init/init.cpp index cdec41cd8..0f44efda4 100644 --- a/init/init.cpp +++ b/init/init.cpp @@ -45,6 +45,7 @@ #include #include #include +#include #include #ifndef RECOVERY @@ -358,7 +359,7 @@ static Result SetupCgroupsAction(const BuiltinArguments&) { // Have to create using make_dir function // for appropriate sepolicy to be set for it make_dir(android::base::Dirname(CGROUPS_RC_PATH), 0711); - if (!CgroupSetupCgroups()) { + if (!CgroupSetup()) { return ErrnoError() << "Failed to setup cgroups"; } diff --git a/libcutils/Android.bp b/libcutils/Android.bp index a27ecef9e..619bc567a 100644 --- a/libcutils/Android.bp +++ b/libcutils/Android.bp @@ -235,6 +235,7 @@ test_libraries = [ "libbase", "libjsoncpp", "libprocessgroup", + "libcgrouprc", ] cc_test { @@ -249,7 +250,10 @@ cc_test { name: "libcutils_test_static", test_suites: ["device-tests"], defaults: ["libcutils_test_default"], - static_libs: ["libc"] + test_libraries, + static_libs: [ + "libc", + "libcgrouprc_format", + ] + test_libraries, stl: "libc++_static", target: { diff --git a/libprocessgroup/Android.bp b/libprocessgroup/Android.bp index 07cbce987..78a02e5d4 100644 --- a/libprocessgroup/Android.bp +++ b/libprocessgroup/Android.bp @@ -31,6 +31,7 @@ cc_library { }, shared_libs: [ "libbase", + "libcgrouprc", "libjsoncpp", ], // for cutils/android_filesystem_config.h diff --git a/libprocessgroup/cgroup_map.cpp b/libprocessgroup/cgroup_map.cpp index 1e66fa4ee..6cd6b6e50 100644 --- a/libprocessgroup/cgroup_map.cpp +++ b/libprocessgroup/cgroup_map.cpp @@ -44,244 +44,42 @@ using android::base::GetBoolProperty; using android::base::StringPrintf; using android::base::unique_fd; -static constexpr const char* CGROUPS_DESC_FILE = "/etc/cgroups.json"; -static constexpr const char* CGROUPS_DESC_VENDOR_FILE = "/vendor/etc/cgroups.json"; - static constexpr const char* CGROUP_PROCS_FILE = "/cgroup.procs"; static constexpr const char* CGROUP_TASKS_FILE = "/tasks"; static constexpr const char* CGROUP_TASKS_FILE_V2 = "/cgroup.tasks"; -static bool Mkdir(const std::string& path, mode_t mode, const std::string& uid, - const std::string& gid) { - if (mode == 0) { - mode = 0755; - } - - if (mkdir(path.c_str(), mode) != 0) { - /* chmod in case the directory already exists */ - if (errno == EEXIST) { - if (fchmodat(AT_FDCWD, path.c_str(), mode, AT_SYMLINK_NOFOLLOW) != 0) { - // /acct is a special case when the directory already exists - // TODO: check if file mode is already what we want instead of using EROFS - if (errno != EROFS) { - PLOG(ERROR) << "fchmodat() failed for " << path; - return false; - } - } - } else { - PLOG(ERROR) << "mkdir() failed for " << path; - return false; - } - } - - if (uid.empty()) { - return true; - } - - passwd* uid_pwd = getpwnam(uid.c_str()); - if (!uid_pwd) { - PLOG(ERROR) << "Unable to decode UID for '" << uid << "'"; - return false; - } - - uid_t pw_uid = uid_pwd->pw_uid; - gid_t gr_gid = -1; - if (!gid.empty()) { - group* gid_pwd = getgrnam(gid.c_str()); - if (!gid_pwd) { - PLOG(ERROR) << "Unable to decode GID for '" << gid << "'"; - return false; - } - gr_gid = gid_pwd->gr_gid; - } - - if (lchown(path.c_str(), pw_uid, gr_gid) < 0) { - PLOG(ERROR) << "lchown() failed for " << path; - return false; - } - - /* chown may have cleared S_ISUID and S_ISGID, chmod again */ - if (mode & (S_ISUID | S_ISGID)) { - if (fchmodat(AT_FDCWD, path.c_str(), mode, AT_SYMLINK_NOFOLLOW) != 0) { - PLOG(ERROR) << "fchmodat() failed for " << path; - return false; - } - } - - return true; +uint32_t CgroupController::version() const { + CHECK(HasValue()); + return ACgroupController_getVersion(controller_); } -static bool ReadDescriptorsFromFile(const std::string& file_name, - std::map* descriptors) { - std::vector result; - std::string json_doc; - - if (!android::base::ReadFileToString(file_name, &json_doc)) { - PLOG(ERROR) << "Failed to read task profiles from " << file_name; - return false; - } - - Json::Reader reader; - Json::Value root; - if (!reader.parse(json_doc, root)) { - LOG(ERROR) << "Failed to parse cgroups description: " << reader.getFormattedErrorMessages(); - return false; - } - - if (root.isMember("Cgroups")) { - const Json::Value& cgroups = root["Cgroups"]; - for (Json::Value::ArrayIndex i = 0; i < cgroups.size(); ++i) { - std::string name = cgroups[i]["Controller"].asString(); - auto iter = descriptors->find(name); - if (iter == descriptors->end()) { - descriptors->emplace(name, CgroupDescriptor(1, name, cgroups[i]["Path"].asString(), - std::strtoul(cgroups[i]["Mode"].asString().c_str(), 0, 8), - cgroups[i]["UID"].asString(), cgroups[i]["GID"].asString())); - } else { - iter->second = CgroupDescriptor(1, name, cgroups[i]["Path"].asString(), - std::strtoul(cgroups[i]["Mode"].asString().c_str(), 0, 8), - cgroups[i]["UID"].asString(), cgroups[i]["GID"].asString()); - } - } - } - - if (root.isMember("Cgroups2")) { - const Json::Value& cgroups2 = root["Cgroups2"]; - auto iter = descriptors->find(CGROUPV2_CONTROLLER_NAME); - if (iter == descriptors->end()) { - descriptors->emplace(CGROUPV2_CONTROLLER_NAME, CgroupDescriptor(2, CGROUPV2_CONTROLLER_NAME, cgroups2["Path"].asString(), - std::strtoul(cgroups2["Mode"].asString().c_str(), 0, 8), - cgroups2["UID"].asString(), cgroups2["GID"].asString())); - } else { - iter->second = CgroupDescriptor(2, CGROUPV2_CONTROLLER_NAME, cgroups2["Path"].asString(), - std::strtoul(cgroups2["Mode"].asString().c_str(), 0, 8), - cgroups2["UID"].asString(), cgroups2["GID"].asString()); - } - } - - return true; +const char* CgroupController::name() const { + CHECK(HasValue()); + return ACgroupController_getName(controller_); } -static bool ReadDescriptors(std::map* descriptors) { - // load system cgroup descriptors - if (!ReadDescriptorsFromFile(CGROUPS_DESC_FILE, descriptors)) { - return false; - } - - // load vendor cgroup descriptors if the file exists - if (!access(CGROUPS_DESC_VENDOR_FILE, F_OK) && - !ReadDescriptorsFromFile(CGROUPS_DESC_VENDOR_FILE, descriptors)) { - return false; - } - - return true; +const char* CgroupController::path() const { + CHECK(HasValue()); + return ACgroupController_getPath(controller_); } -// To avoid issues in sdk_mac build -#if defined(__ANDROID__) - -static bool SetupCgroup(const CgroupDescriptor& descriptor) { - const CgroupController* controller = descriptor.controller(); - - // mkdir [mode] [owner] [group] - if (!Mkdir(controller->path(), descriptor.mode(), descriptor.uid(), descriptor.gid())) { - LOG(ERROR) << "Failed to create directory for " << controller->name() << " cgroup"; - return false; - } - - int result; - if (controller->version() == 2) { - result = mount("none", controller->path(), "cgroup2", MS_NODEV | MS_NOEXEC | MS_NOSUID, - nullptr); - } else { - // Unfortunately historically cpuset controller was mounted using a mount command - // different from all other controllers. This results in controller attributes not - // to be prepended with controller name. For example this way instead of - // /dev/cpuset/cpuset.cpus the attribute becomes /dev/cpuset/cpus which is what - // the system currently expects. - if (!strcmp(controller->name(), "cpuset")) { - // mount cpuset none /dev/cpuset nodev noexec nosuid - result = mount("none", controller->path(), controller->name(), - MS_NODEV | MS_NOEXEC | MS_NOSUID, nullptr); - } else { - // mount cgroup none nodev noexec nosuid - result = mount("none", controller->path(), "cgroup", MS_NODEV | MS_NOEXEC | MS_NOSUID, - controller->name()); - } - } - - if (result < 0) { - PLOG(ERROR) << "Failed to mount " << controller->name() << " cgroup"; - return false; - } - - return true; +bool CgroupController::HasValue() const { + return controller_ != nullptr; } -#else +std::string CgroupController::GetTasksFilePath(const std::string& rel_path) const { + std::string tasks_path = path(); -// Stubs for non-Android targets. -static bool SetupCgroup(const CgroupDescriptor&) { - return false; + if (!rel_path.empty()) { + tasks_path += "/" + rel_path; + } + return (version() == 1) ? tasks_path + CGROUP_TASKS_FILE : tasks_path + CGROUP_TASKS_FILE_V2; } -#endif - -// WARNING: This function should be called only from SetupCgroups and only once. -// It intentionally leaks an FD, so additional invocation will result in additional leak. -static bool WriteRcFile(const std::map& descriptors) { - // WARNING: We are intentionally leaking the FD to keep the file open forever. - // Let init keep the FD open to prevent file mappings from becoming invalid in - // case the file gets deleted somehow. - int fd = TEMP_FAILURE_RETRY(open(CGROUPS_RC_PATH, O_CREAT | O_WRONLY | O_TRUNC | O_CLOEXEC, - S_IRUSR | S_IRGRP | S_IROTH)); - if (fd < 0) { - PLOG(ERROR) << "open() failed for " << CGROUPS_RC_PATH; - return false; - } - - CgroupFile fl; - fl.version_ = CgroupFile::FILE_CURR_VERSION; - fl.controller_count_ = descriptors.size(); - int ret = TEMP_FAILURE_RETRY(write(fd, &fl, sizeof(fl))); - if (ret < 0) { - PLOG(ERROR) << "write() failed for " << CGROUPS_RC_PATH; - return false; - } - - for (const auto& [name, descriptor] : descriptors) { - ret = TEMP_FAILURE_RETRY(write(fd, descriptor.controller(), sizeof(CgroupController))); - if (ret < 0) { - PLOG(ERROR) << "write() failed for " << CGROUPS_RC_PATH; - return false; - } - } - - return true; -} - -CgroupController::CgroupController(uint32_t version, const std::string& name, - const std::string& path) { - version_ = version; - strncpy(name_, name.c_str(), sizeof(name_) - 1); - name_[sizeof(name_) - 1] = '\0'; - strncpy(path_, path.c_str(), sizeof(path_) - 1); - path_[sizeof(path_) - 1] = '\0'; -} - -std::string CgroupController::GetTasksFilePath(const std::string& path) const { - std::string tasks_path = path_; - - if (!path.empty()) { - tasks_path += "/" + path; - } - return (version_ == 1) ? tasks_path + CGROUP_TASKS_FILE : tasks_path + CGROUP_TASKS_FILE_V2; -} - -std::string CgroupController::GetProcsFilePath(const std::string& path, uid_t uid, +std::string CgroupController::GetProcsFilePath(const std::string& rel_path, uid_t uid, pid_t pid) const { - std::string proc_path(path_); - proc_path.append("/").append(path); + std::string proc_path(path()); + proc_path.append("/").append(rel_path); proc_path = regex_replace(proc_path, std::regex(""), std::to_string(uid)); proc_path = regex_replace(proc_path, std::regex(""), std::to_string(pid)); @@ -302,7 +100,7 @@ bool CgroupController::GetTaskGroup(int tid, std::string* group) const { return true; } - std::string cg_tag = StringPrintf(":%s:", name_); + std::string cg_tag = StringPrintf(":%s:", name()); size_t start_pos = content.find(cg_tag); if (start_pos == std::string::npos) { return false; @@ -319,25 +117,12 @@ bool CgroupController::GetTaskGroup(int tid, std::string* group) const { return true; } -CgroupDescriptor::CgroupDescriptor(uint32_t version, const std::string& name, - const std::string& path, mode_t mode, const std::string& uid, - const std::string& gid) - : controller_(version, name, path), mode_(mode), uid_(uid), gid_(gid) {} - -CgroupMap::CgroupMap() : cg_file_data_(nullptr), cg_file_size_(0) { +CgroupMap::CgroupMap() { if (!LoadRcFile()) { LOG(ERROR) << "CgroupMap::LoadRcFile called for [" << getpid() << "] failed"; } } -CgroupMap::~CgroupMap() { - if (cg_file_data_) { - munmap(cg_file_data_, cg_file_size_); - cg_file_data_ = nullptr; - cg_file_size_ = 0; - } -} - CgroupMap& CgroupMap::GetInstance() { // Deliberately leak this object to avoid a race between destruction on // process exit and concurrent access from another thread. @@ -346,139 +131,46 @@ CgroupMap& CgroupMap::GetInstance() { } bool CgroupMap::LoadRcFile() { - struct stat sb; - - if (cg_file_data_) { - // Data already initialized - return true; + if (!loaded_) { + loaded_ = (ACgroupFile_getVersion() != 0); } - - unique_fd fd(TEMP_FAILURE_RETRY(open(CGROUPS_RC_PATH, O_RDONLY | O_CLOEXEC))); - if (fd < 0) { - PLOG(ERROR) << "open() failed for " << CGROUPS_RC_PATH; - return false; - } - - if (fstat(fd, &sb) < 0) { - PLOG(ERROR) << "fstat() failed for " << CGROUPS_RC_PATH; - return false; - } - - size_t file_size = sb.st_size; - if (file_size < sizeof(CgroupFile)) { - LOG(ERROR) << "Invalid file format " << CGROUPS_RC_PATH; - return false; - } - - CgroupFile* file_data = (CgroupFile*)mmap(nullptr, file_size, PROT_READ, MAP_SHARED, fd, 0); - if (file_data == MAP_FAILED) { - PLOG(ERROR) << "Failed to mmap " << CGROUPS_RC_PATH; - return false; - } - - if (file_data->version_ != CgroupFile::FILE_CURR_VERSION) { - LOG(ERROR) << CGROUPS_RC_PATH << " file version mismatch"; - munmap(file_data, file_size); - return false; - } - - if (file_size != sizeof(CgroupFile) + file_data->controller_count_ * sizeof(CgroupController)) { - LOG(ERROR) << CGROUPS_RC_PATH << " file has invalid size"; - munmap(file_data, file_size); - return false; - } - - cg_file_data_ = file_data; - cg_file_size_ = file_size; - - return true; + return loaded_; } void CgroupMap::Print() const { - if (!cg_file_data_) { + if (!loaded_) { LOG(ERROR) << "CgroupMap::Print called for [" << getpid() << "] failed, RC file was not initialized properly"; return; } - LOG(INFO) << "File version = " << cg_file_data_->version_; - LOG(INFO) << "File controller count = " << cg_file_data_->controller_count_; + LOG(INFO) << "File version = " << ACgroupFile_getVersion(); + LOG(INFO) << "File controller count = " << ACgroupFile_getControllerCount(); LOG(INFO) << "Mounted cgroups:"; - CgroupController* controller = (CgroupController*)(cg_file_data_ + 1); - for (int i = 0; i < cg_file_data_->controller_count_; i++, controller++) { - LOG(INFO) << "\t" << controller->name() << " ver " << controller->version() << " path " - << controller->path(); + + auto controller_count = ACgroupFile_getControllerCount(); + for (uint32_t i = 0; i < controller_count; ++i) { + const ACgroupController* controller = ACgroupFile_getController(i); + LOG(INFO) << "\t" << ACgroupController_getName(controller) << " ver " + << ACgroupController_getVersion(controller) << " path " + << ACgroupController_getPath(controller); } } -bool CgroupMap::SetupCgroups() { - std::map descriptors; - - if (getpid() != 1) { - LOG(ERROR) << "Cgroup setup can be done only by init process"; - return false; - } - - // Make sure we do this only one time. No need for std::call_once because - // init is a single-threaded process - if (access(CGROUPS_RC_PATH, F_OK) == 0) { - LOG(WARNING) << "Attempt to call SetupCgroups more than once"; - return true; - } - - // load cgroups.json file - if (!ReadDescriptors(&descriptors)) { - LOG(ERROR) << "Failed to load cgroup description file"; - return false; - } - - // setup cgroups - for (const auto& [name, descriptor] : descriptors) { - if (!SetupCgroup(descriptor)) { - // issue a warning and proceed with the next cgroup - // TODO: mark the descriptor as invalid and skip it in WriteRcFile() - LOG(WARNING) << "Failed to setup " << name << " cgroup"; - } - } - - // mkdir 0711 system system - if (!Mkdir(android::base::Dirname(CGROUPS_RC_PATH), 0711, "system", "system")) { - LOG(ERROR) << "Failed to create directory for " << CGROUPS_RC_PATH << " file"; - return false; - } - - // Generate file which can be directly mmapped into - // process memory. This optimizes performance, memory usage - // and limits infrormation shared with unprivileged processes - // to the minimum subset of information from cgroups.json - if (!WriteRcFile(descriptors)) { - LOG(ERROR) << "Failed to write " << CGROUPS_RC_PATH << " file"; - return false; - } - - // chmod 0644 - if (fchmodat(AT_FDCWD, CGROUPS_RC_PATH, 0644, AT_SYMLINK_NOFOLLOW) < 0) { - PLOG(ERROR) << "fchmodat() failed"; - return false; - } - - return true; -} - -const CgroupController* CgroupMap::FindController(const std::string& name) const { - if (!cg_file_data_) { +CgroupController CgroupMap::FindController(const std::string& name) const { + if (!loaded_) { LOG(ERROR) << "CgroupMap::FindController called for [" << getpid() << "] failed, RC file was not initialized properly"; - return nullptr; + return CgroupController(nullptr); } - // skip the file header to get to the first controller - CgroupController* controller = (CgroupController*)(cg_file_data_ + 1); - for (int i = 0; i < cg_file_data_->controller_count_; i++, controller++) { - if (name == controller->name()) { - return controller; + auto controller_count = ACgroupFile_getControllerCount(); + for (uint32_t i = 0; i < controller_count; ++i) { + const ACgroupController* controller = ACgroupFile_getController(i); + if (name == ACgroupController_getName(controller)) { + return CgroupController(controller); } } - return nullptr; + return CgroupController(nullptr); } diff --git a/libprocessgroup/cgroup_map.h b/libprocessgroup/cgroup_map.h index 304ae155e..d765e600c 100644 --- a/libprocessgroup/cgroup_map.h +++ b/libprocessgroup/cgroup_map.h @@ -20,57 +20,30 @@ #include #include +#include #include #include +#include -// Minimal controller description to be mmapped into process address space +#include + +// Convenient wrapper of an ACgroupController pointer. class CgroupController { public: - CgroupController() {} - CgroupController(uint32_t version, const std::string& name, const std::string& path); + // Does not own controller + explicit CgroupController(const ACgroupController* controller) : controller_(controller) {} - uint32_t version() const { return version_; } - const char* name() const { return name_; } - const char* path() const { return path_; } + uint32_t version() const; + const char* name() const; + const char* path() const; + + bool HasValue() const; std::string GetTasksFilePath(const std::string& path) const; std::string GetProcsFilePath(const std::string& path, uid_t uid, pid_t pid) const; bool GetTaskGroup(int tid, std::string* group) const; - private: - static constexpr size_t CGROUP_NAME_BUF_SZ = 16; - static constexpr size_t CGROUP_PATH_BUF_SZ = 32; - - uint32_t version_; - char name_[CGROUP_NAME_BUF_SZ]; - char path_[CGROUP_PATH_BUF_SZ]; -}; - -// Complete controller description for mounting cgroups -class CgroupDescriptor { - public: - CgroupDescriptor(uint32_t version, const std::string& name, const std::string& path, - mode_t mode, const std::string& uid, const std::string& gid); - - const CgroupController* controller() const { return &controller_; } - mode_t mode() const { return mode_; } - std::string uid() const { return uid_; } - std::string gid() const { return gid_; } - - private: - CgroupController controller_; - mode_t mode_; - std::string uid_; - std::string gid_; -}; - -struct CgroupFile { - static constexpr uint32_t FILE_VERSION_1 = 1; - static constexpr uint32_t FILE_CURR_VERSION = FILE_VERSION_1; - - uint32_t version_; - uint32_t controller_count_; - CgroupController controllers_[]; + const ACgroupController* controller_ = nullptr; }; class CgroupMap { @@ -79,16 +52,11 @@ class CgroupMap { static bool SetupCgroups(); static CgroupMap& GetInstance(); - - const CgroupController* FindController(const std::string& name) const; + CgroupController FindController(const std::string& name) const; private: - struct CgroupFile* cg_file_data_; - size_t cg_file_size_; - + bool loaded_ = false; CgroupMap(); - ~CgroupMap(); - bool LoadRcFile(); void Print() const; }; diff --git a/libprocessgroup/cgrouprc/Android.bp b/libprocessgroup/cgrouprc/Android.bp new file mode 100644 index 000000000..774738dd1 --- /dev/null +++ b/libprocessgroup/cgrouprc/Android.bp @@ -0,0 +1,57 @@ +// Copyright (C) 2019 The Android Open Source Project +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +cc_library { + name: "libcgrouprc", + host_supported: true, + recovery_available: true, + // Do not ever mark this as vendor_available; otherwise, vendor modules + // that links to the static library will behave unexpectedly. All on-device + // modules should use libprocessgroup which links to the LL-NDK library + // defined below. The static library is built for tests. + vendor_available: false, + srcs: [ + "cgroup_controller.cpp", + "cgroup_file.cpp", + ], + cflags: [ + "-Wall", + "-Werror", + ], + export_include_dirs: [ + "include", + ], + header_libs: [ + "libprocessgroup_headers", + ], + shared_libs: [ + "libbase", + ], + static_libs: [ + "libcgrouprc_format", + ], + stubs: { + symbol_file: "libcgrouprc.map.txt", + versions: ["29"], + }, + version_script: "libcgrouprc.map.txt", +} + +llndk_library { + name: "libcgrouprc", + symbol_file: "libcgrouprc.map.txt", + export_include_dirs: [ + "include", + ], +} diff --git a/libprocessgroup/cgrouprc/cgroup_controller.cpp b/libprocessgroup/cgrouprc/cgroup_controller.cpp new file mode 100644 index 000000000..d064d312e --- /dev/null +++ b/libprocessgroup/cgrouprc/cgroup_controller.cpp @@ -0,0 +1,38 @@ +/* + * Copyright (C) 2019 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include +#include + +#include "cgrouprc_internal.h" + +// All ACgroupController_* functions implicitly convert the pointer back +// to the original CgroupController pointer before invoking the member functions. + +uint32_t ACgroupController_getVersion(const ACgroupController* controller) { + CHECK(controller != nullptr); + return controller->version(); +} + +const char* ACgroupController_getName(const ACgroupController* controller) { + CHECK(controller != nullptr); + return controller->name(); +} + +const char* ACgroupController_getPath(const ACgroupController* controller) { + CHECK(controller != nullptr); + return controller->path(); +} diff --git a/libprocessgroup/cgrouprc/cgroup_file.cpp b/libprocessgroup/cgrouprc/cgroup_file.cpp new file mode 100644 index 000000000..e26d84114 --- /dev/null +++ b/libprocessgroup/cgrouprc/cgroup_file.cpp @@ -0,0 +1,106 @@ +/* + * Copyright (C) 2019 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include +#include + +#include + +#include +#include +#include +#include +#include + +#include "cgrouprc_internal.h" + +using android::base::StringPrintf; +using android::base::unique_fd; + +using android::cgrouprc::format::CgroupController; +using android::cgrouprc::format::CgroupFile; + +static CgroupFile* LoadRcFile() { + struct stat sb; + + unique_fd fd(TEMP_FAILURE_RETRY(open(CGROUPS_RC_PATH, O_RDONLY | O_CLOEXEC))); + if (fd < 0) { + PLOG(ERROR) << "open() failed for " << CGROUPS_RC_PATH; + return nullptr; + } + + if (fstat(fd, &sb) < 0) { + PLOG(ERROR) << "fstat() failed for " << CGROUPS_RC_PATH; + return nullptr; + } + + size_t file_size = sb.st_size; + if (file_size < sizeof(CgroupFile)) { + LOG(ERROR) << "Invalid file format " << CGROUPS_RC_PATH; + return nullptr; + } + + CgroupFile* file_data = (CgroupFile*)mmap(nullptr, file_size, PROT_READ, MAP_SHARED, fd, 0); + if (file_data == MAP_FAILED) { + PLOG(ERROR) << "Failed to mmap " << CGROUPS_RC_PATH; + return nullptr; + } + + if (file_data->version_ != CgroupFile::FILE_CURR_VERSION) { + LOG(ERROR) << CGROUPS_RC_PATH << " file version mismatch"; + munmap(file_data, file_size); + return nullptr; + } + + auto expected = sizeof(CgroupFile) + file_data->controller_count_ * sizeof(CgroupController); + if (file_size != expected) { + LOG(ERROR) << CGROUPS_RC_PATH << " file has invalid size, expected " << expected + << ", actual " << file_size; + munmap(file_data, file_size); + return nullptr; + } + + return file_data; +} + +static CgroupFile* GetInstance() { + // Deliberately leak this object (not munmap) to avoid a race between destruction on + // process exit and concurrent access from another thread. + static auto* file = LoadRcFile(); + return file; +} + +uint32_t ACgroupFile_getVersion() { + auto file = GetInstance(); + if (file == nullptr) return 0; + return file->version_; +} + +uint32_t ACgroupFile_getControllerCount() { + auto file = GetInstance(); + if (file == nullptr) return 0; + return file->controller_count_; +} + +const ACgroupController* ACgroupFile_getController(uint32_t index) { + auto file = GetInstance(); + if (file == nullptr) return nullptr; + CHECK(index < file->controller_count_); + // Although the object is not actually an ACgroupController object, all ACgroupController_* + // functions implicitly convert ACgroupController* back to CgroupController* before invoking + // member functions. + return static_cast(&file->controllers_[index]); +} diff --git a/libprocessgroup/cgrouprc/cgrouprc_internal.h b/libprocessgroup/cgrouprc/cgrouprc_internal.h new file mode 100644 index 000000000..cd02f0304 --- /dev/null +++ b/libprocessgroup/cgrouprc/cgrouprc_internal.h @@ -0,0 +1,24 @@ +/* + * Copyright (C) 2019 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#pragma once + +#include + +#include +#include + +struct ACgroupController : android::cgrouprc::format::CgroupController {}; diff --git a/libprocessgroup/cgrouprc/include/android/cgrouprc.h b/libprocessgroup/cgrouprc/include/android/cgrouprc.h new file mode 100644 index 000000000..4edd239e2 --- /dev/null +++ b/libprocessgroup/cgrouprc/include/android/cgrouprc.h @@ -0,0 +1,84 @@ +/* + * Copyright (C) 2019 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#pragma once + +#include + +__BEGIN_DECLS + +// For host builds, __INTRODUCED_IN is not defined. +#ifndef __INTRODUCED_IN +#define __INTRODUCED_IN(x) +#endif + +struct ACgroupController; +typedef struct ACgroupController ACgroupController; + +#if __ANDROID_API__ >= __ANDROID_API_Q__ + +// ACgroupFile + +/** + * Returns file version. See android::cgrouprc::format::CgroupFile for a list of valid versions + * for the file. + * If ACgroupFile_init() isn't called, initialization will be done first. + * If initialization failed, return 0. + */ +__attribute__((warn_unused_result)) uint32_t ACgroupFile_getVersion() __INTRODUCED_IN(29); + +/** + * Returns the number of controllers. + * If ACgroupFile_init() isn't called, initialization will be done first. + * If initialization failed, return 0. + */ +__attribute__((warn_unused_result)) uint32_t ACgroupFile_getControllerCount() __INTRODUCED_IN(29); + +/** + * Returns the controller at the given index. + * Returnss nullptr if the given index exceeds getControllerCount(). + * If ACgroupFile_init() isn't called, initialization will be done first. + * If initialization failed, return 0. + */ +__attribute__((warn_unused_result)) const ACgroupController* ACgroupFile_getController( + uint32_t index) __INTRODUCED_IN(29); + +// ACgroupController + +/** + * Returns the version of the given controller. + * If the given controller is null, return 0. + */ +__attribute__((warn_unused_result)) uint32_t ACgroupController_getVersion(const ACgroupController*) + __INTRODUCED_IN(29); + +/** + * Returns the name of the given controller. + * If the given controller is null, return nullptr. + */ +__attribute__((warn_unused_result)) const char* ACgroupController_getName(const ACgroupController*) + __INTRODUCED_IN(29); + +/** + * Returns the path of the given controller. + * If the given controller is null, return nullptr. + */ +__attribute__((warn_unused_result)) const char* ACgroupController_getPath(const ACgroupController*) + __INTRODUCED_IN(29); + +__END_DECLS + +#endif diff --git a/libprocessgroup/cgrouprc/libcgrouprc.map.txt b/libprocessgroup/cgrouprc/libcgrouprc.map.txt new file mode 100644 index 000000000..91df3929d --- /dev/null +++ b/libprocessgroup/cgrouprc/libcgrouprc.map.txt @@ -0,0 +1,11 @@ +LIBCGROUPRC { # introduced=29 + global: + ACgroupFile_getVersion; + ACgroupFile_getControllerCount; + ACgroupFile_getController; + ACgroupController_getVersion; + ACgroupController_getName; + ACgroupController_getPath; + local: + *; +}; diff --git a/libprocessgroup/cgrouprc_format/Android.bp b/libprocessgroup/cgrouprc_format/Android.bp new file mode 100644 index 000000000..dfbeed73e --- /dev/null +++ b/libprocessgroup/cgrouprc_format/Android.bp @@ -0,0 +1,32 @@ +// Copyright (C) 2019 The Android Open Source Project +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +cc_library_static { + name: "libcgrouprc_format", + host_supported: true, + recovery_available: true, + srcs: [ + "cgroup_controller.cpp", + ], + cflags: [ + "-Wall", + "-Werror", + ], + export_include_dirs: [ + "include", + ], + shared_libs: [ + "libbase", + ], +} diff --git a/libprocessgroup/cgrouprc_format/cgroup_controller.cpp b/libprocessgroup/cgrouprc_format/cgroup_controller.cpp new file mode 100644 index 000000000..877eed872 --- /dev/null +++ b/libprocessgroup/cgrouprc_format/cgroup_controller.cpp @@ -0,0 +1,49 @@ +/* + * Copyright (C) 2019 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include + +namespace android { +namespace cgrouprc { +namespace format { + +CgroupController::CgroupController(uint32_t version, const std::string& name, + const std::string& path) { + // strlcpy isn't available on host. Although there is an implementation + // in licutils, libcutils itself depends on libcgrouprc_format, causing + // a circular dependency. + version_ = version; + strncpy(name_, name.c_str(), sizeof(name_) - 1); + name_[sizeof(name_) - 1] = '\0'; + strncpy(path_, path.c_str(), sizeof(path_) - 1); + path_[sizeof(path_) - 1] = '\0'; +} + +uint32_t CgroupController::version() const { + return version_; +} + +const char* CgroupController::name() const { + return name_; +} + +const char* CgroupController::path() const { + return path_; +} + +} // namespace format +} // namespace cgrouprc +} // namespace android diff --git a/libprocessgroup/cgrouprc_format/include/processgroup/format/cgroup_controller.h b/libprocessgroup/cgrouprc_format/include/processgroup/format/cgroup_controller.h new file mode 100644 index 000000000..64c7532d9 --- /dev/null +++ b/libprocessgroup/cgrouprc_format/include/processgroup/format/cgroup_controller.h @@ -0,0 +1,47 @@ +/* + * Copyright (C) 2019 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#pragma once + +#include +#include + +namespace android { +namespace cgrouprc { +namespace format { + +// Minimal controller description to be mmapped into process address space +struct CgroupController { + public: + CgroupController() {} + CgroupController(uint32_t version, const std::string& name, const std::string& path); + + uint32_t version() const; + const char* name() const; + const char* path() const; + + private: + static constexpr size_t CGROUP_NAME_BUF_SZ = 16; + static constexpr size_t CGROUP_PATH_BUF_SZ = 32; + + uint32_t version_; + char name_[CGROUP_NAME_BUF_SZ]; + char path_[CGROUP_PATH_BUF_SZ]; +}; + +} // namespace format +} // namespace cgrouprc +} // namespace android diff --git a/libprocessgroup/cgrouprc_format/include/processgroup/format/cgroup_file.h b/libprocessgroup/cgrouprc_format/include/processgroup/format/cgroup_file.h new file mode 100644 index 000000000..f1678a114 --- /dev/null +++ b/libprocessgroup/cgrouprc_format/include/processgroup/format/cgroup_file.h @@ -0,0 +1,36 @@ +/* + * Copyright (C) 2019 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#pragma once + +#include + +namespace android { +namespace cgrouprc { +namespace format { + +struct CgroupFile { + uint32_t version_; + uint32_t controller_count_; + CgroupController controllers_[]; + + static constexpr uint32_t FILE_VERSION_1 = 1; + static constexpr uint32_t FILE_CURR_VERSION = FILE_VERSION_1; +}; + +} // namespace format +} // namespace cgrouprc +} // namespace android diff --git a/libprocessgroup/include/processgroup/processgroup.h b/libprocessgroup/include/processgroup/processgroup.h index 46b86762a..86e60356b 100644 --- a/libprocessgroup/include/processgroup/processgroup.h +++ b/libprocessgroup/include/processgroup/processgroup.h @@ -26,7 +26,6 @@ __BEGIN_DECLS static constexpr const char* CGROUPV2_CONTROLLER_NAME = "cgroup2"; static constexpr const char* CGROUPS_RC_PATH = "/dev/cgroup_info/cgroup.rc"; -bool CgroupSetupCgroups(); bool CgroupGetControllerPath(const std::string& cgroup_name, std::string* path); bool CgroupGetAttributePath(const std::string& attr_name, std::string* path); bool CgroupGetAttributePathForTask(const std::string& attr_name, int tid, std::string* path); diff --git a/libprocessgroup/processgroup.cpp b/libprocessgroup/processgroup.cpp index 8884650ee..abe63dd70 100644 --- a/libprocessgroup/processgroup.cpp +++ b/libprocessgroup/processgroup.cpp @@ -55,19 +55,15 @@ using namespace std::chrono_literals; #define PROCESSGROUP_CGROUP_PROCS_FILE "/cgroup.procs" -bool CgroupSetupCgroups() { - return CgroupMap::SetupCgroups(); -} - bool CgroupGetControllerPath(const std::string& cgroup_name, std::string* path) { - const CgroupController* controller = CgroupMap::GetInstance().FindController(cgroup_name); + auto controller = CgroupMap::GetInstance().FindController(cgroup_name); - if (controller == nullptr) { + if (!controller.HasValue()) { return false; } if (path) { - *path = controller->path(); + *path = controller.path(); } return true; @@ -111,7 +107,7 @@ bool UsePerAppMemcg() { static bool isMemoryCgroupSupported() { std::string cgroup_name; - static bool memcg_supported = (CgroupMap::GetInstance().FindController("memory") != nullptr); + static bool memcg_supported = CgroupMap::GetInstance().FindController("memory").HasValue(); return memcg_supported; } diff --git a/libprocessgroup/sched_policy.cpp b/libprocessgroup/sched_policy.cpp index 1eefadab9..c7d0cca4c 100644 --- a/libprocessgroup/sched_policy.cpp +++ b/libprocessgroup/sched_policy.cpp @@ -152,21 +152,21 @@ int set_sched_policy(int tid, SchedPolicy policy) { } bool cpusets_enabled() { - static bool enabled = (CgroupMap::GetInstance().FindController("cpuset") != nullptr); + static bool enabled = (CgroupMap::GetInstance().FindController("cpuset").HasValue()); return enabled; } bool schedboost_enabled() { - static bool enabled = (CgroupMap::GetInstance().FindController("schedtune") != nullptr); + static bool enabled = (CgroupMap::GetInstance().FindController("schedtune").HasValue()); return enabled; } static int getCGroupSubsys(int tid, const char* subsys, std::string& subgroup) { - const CgroupController* controller = CgroupMap::GetInstance().FindController(subsys); + auto controller = CgroupMap::GetInstance().FindController(subsys); - if (!controller) return -1; + if (!controller.HasValue()) return -1; - if (!controller->GetTaskGroup(tid, &subgroup)) { + if (!controller.GetTaskGroup(tid, &subgroup)) { LOG(ERROR) << "Failed to find cgroup for tid " << tid; return -1; } diff --git a/libprocessgroup/setup/Android.bp b/libprocessgroup/setup/Android.bp new file mode 100644 index 000000000..f6fc066f2 --- /dev/null +++ b/libprocessgroup/setup/Android.bp @@ -0,0 +1,44 @@ +// +// Copyright (C) 2019 The Android Open Source Project +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// + +cc_library_shared { + name: "libprocessgroup_setup", + recovery_available: true, + srcs: [ + "cgroup_map_write.cpp", + ], + export_include_dirs: [ + "include", + ], + shared_libs: [ + "libbase", + "libcgrouprc", + "libjsoncpp", + ], + static_libs: [ + "libcgrouprc_format", + ], + header_libs: [ + "libprocessgroup_headers", + ], + export_header_lib_headers: [ + "libprocessgroup_headers", + ], + cflags: [ + "-Wall", + "-Werror", + ], +} diff --git a/libprocessgroup/setup/cgroup_descriptor.h b/libprocessgroup/setup/cgroup_descriptor.h new file mode 100644 index 000000000..597060e35 --- /dev/null +++ b/libprocessgroup/setup/cgroup_descriptor.h @@ -0,0 +1,43 @@ +/* + * Copyright (C) 2019 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#pragma once + +#include + +namespace android { +namespace cgrouprc { + +// Complete controller description for mounting cgroups +class CgroupDescriptor { + public: + CgroupDescriptor(uint32_t version, const std::string& name, const std::string& path, + mode_t mode, const std::string& uid, const std::string& gid); + + const format::CgroupController* controller() const { return &controller_; } + mode_t mode() const { return mode_; } + std::string uid() const { return uid_; } + std::string gid() const { return gid_; } + + private: + format::CgroupController controller_; + mode_t mode_ = 0; + std::string uid_; + std::string gid_; +}; + +} // namespace cgrouprc +} // namespace android diff --git a/libprocessgroup/setup/cgroup_map_write.cpp b/libprocessgroup/setup/cgroup_map_write.cpp new file mode 100644 index 000000000..26703eea7 --- /dev/null +++ b/libprocessgroup/setup/cgroup_map_write.cpp @@ -0,0 +1,334 @@ +/* + * Copyright (C) 2019 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +//#define LOG_NDEBUG 0 +#define LOG_TAG "libprocessgroup" + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "cgroup_descriptor.h" + +using android::base::GetBoolProperty; +using android::base::StringPrintf; +using android::base::unique_fd; + +namespace android { +namespace cgrouprc { + +static constexpr const char* CGROUPS_DESC_FILE = "/etc/cgroups.json"; +static constexpr const char* CGROUPS_DESC_VENDOR_FILE = "/vendor/etc/cgroups.json"; + +static bool Mkdir(const std::string& path, mode_t mode, const std::string& uid, + const std::string& gid) { + if (mode == 0) { + mode = 0755; + } + + if (mkdir(path.c_str(), mode) != 0) { + /* chmod in case the directory already exists */ + if (errno == EEXIST) { + if (fchmodat(AT_FDCWD, path.c_str(), mode, AT_SYMLINK_NOFOLLOW) != 0) { + // /acct is a special case when the directory already exists + // TODO: check if file mode is already what we want instead of using EROFS + if (errno != EROFS) { + PLOG(ERROR) << "fchmodat() failed for " << path; + return false; + } + } + } else { + PLOG(ERROR) << "mkdir() failed for " << path; + return false; + } + } + + if (uid.empty()) { + return true; + } + + passwd* uid_pwd = getpwnam(uid.c_str()); + if (!uid_pwd) { + PLOG(ERROR) << "Unable to decode UID for '" << uid << "'"; + return false; + } + + uid_t pw_uid = uid_pwd->pw_uid; + gid_t gr_gid = -1; + if (!gid.empty()) { + group* gid_pwd = getgrnam(gid.c_str()); + if (!gid_pwd) { + PLOG(ERROR) << "Unable to decode GID for '" << gid << "'"; + return false; + } + gr_gid = gid_pwd->gr_gid; + } + + if (lchown(path.c_str(), pw_uid, gr_gid) < 0) { + PLOG(ERROR) << "lchown() failed for " << path; + return false; + } + + /* chown may have cleared S_ISUID and S_ISGID, chmod again */ + if (mode & (S_ISUID | S_ISGID)) { + if (fchmodat(AT_FDCWD, path.c_str(), mode, AT_SYMLINK_NOFOLLOW) != 0) { + PLOG(ERROR) << "fchmodat() failed for " << path; + return false; + } + } + + return true; +} + +static bool ReadDescriptorsFromFile(const std::string& file_name, + std::map* descriptors) { + std::vector result; + std::string json_doc; + + if (!android::base::ReadFileToString(file_name, &json_doc)) { + PLOG(ERROR) << "Failed to read task profiles from " << file_name; + return false; + } + + Json::Reader reader; + Json::Value root; + if (!reader.parse(json_doc, root)) { + LOG(ERROR) << "Failed to parse cgroups description: " << reader.getFormattedErrorMessages(); + return false; + } + + if (root.isMember("Cgroups")) { + const Json::Value& cgroups = root["Cgroups"]; + for (Json::Value::ArrayIndex i = 0; i < cgroups.size(); ++i) { + std::string name = cgroups[i]["Controller"].asString(); + auto iter = descriptors->find(name); + if (iter == descriptors->end()) { + descriptors->emplace( + name, CgroupDescriptor( + 1, name, cgroups[i]["Path"].asString(), + std::strtoul(cgroups[i]["Mode"].asString().c_str(), 0, 8), + cgroups[i]["UID"].asString(), cgroups[i]["GID"].asString())); + } else { + iter->second = CgroupDescriptor( + 1, name, cgroups[i]["Path"].asString(), + std::strtoul(cgroups[i]["Mode"].asString().c_str(), 0, 8), + cgroups[i]["UID"].asString(), cgroups[i]["GID"].asString()); + } + } + } + + if (root.isMember("Cgroups2")) { + const Json::Value& cgroups2 = root["Cgroups2"]; + auto iter = descriptors->find(CGROUPV2_CONTROLLER_NAME); + if (iter == descriptors->end()) { + descriptors->emplace( + CGROUPV2_CONTROLLER_NAME, + CgroupDescriptor(2, CGROUPV2_CONTROLLER_NAME, cgroups2["Path"].asString(), + std::strtoul(cgroups2["Mode"].asString().c_str(), 0, 8), + cgroups2["UID"].asString(), cgroups2["GID"].asString())); + } else { + iter->second = + CgroupDescriptor(2, CGROUPV2_CONTROLLER_NAME, cgroups2["Path"].asString(), + std::strtoul(cgroups2["Mode"].asString().c_str(), 0, 8), + cgroups2["UID"].asString(), cgroups2["GID"].asString()); + } + } + + return true; +} + +static bool ReadDescriptors(std::map* descriptors) { + // load system cgroup descriptors + if (!ReadDescriptorsFromFile(CGROUPS_DESC_FILE, descriptors)) { + return false; + } + + // load vendor cgroup descriptors if the file exists + if (!access(CGROUPS_DESC_VENDOR_FILE, F_OK) && + !ReadDescriptorsFromFile(CGROUPS_DESC_VENDOR_FILE, descriptors)) { + return false; + } + + return true; +} + +// To avoid issues in sdk_mac build +#if defined(__ANDROID__) + +static bool SetupCgroup(const CgroupDescriptor& descriptor) { + const format::CgroupController* controller = descriptor.controller(); + + // mkdir [mode] [owner] [group] + if (!Mkdir(controller->path(), descriptor.mode(), descriptor.uid(), descriptor.gid())) { + LOG(ERROR) << "Failed to create directory for " << controller->name() << " cgroup"; + return false; + } + + int result; + if (controller->version() == 2) { + result = mount("none", controller->path(), "cgroup2", MS_NODEV | MS_NOEXEC | MS_NOSUID, + nullptr); + } else { + // Unfortunately historically cpuset controller was mounted using a mount command + // different from all other controllers. This results in controller attributes not + // to be prepended with controller name. For example this way instead of + // /dev/cpuset/cpuset.cpus the attribute becomes /dev/cpuset/cpus which is what + // the system currently expects. + if (!strcmp(controller->name(), "cpuset")) { + // mount cpuset none /dev/cpuset nodev noexec nosuid + result = mount("none", controller->path(), controller->name(), + MS_NODEV | MS_NOEXEC | MS_NOSUID, nullptr); + } else { + // mount cgroup none nodev noexec nosuid + result = mount("none", controller->path(), "cgroup", MS_NODEV | MS_NOEXEC | MS_NOSUID, + controller->name()); + } + } + + if (result < 0) { + PLOG(ERROR) << "Failed to mount " << controller->name() << " cgroup"; + return false; + } + + return true; +} + +#else + +// Stubs for non-Android targets. +static bool SetupCgroup(const CgroupDescriptor&) { + return false; +} + +#endif + +// WARNING: This function should be called only from SetupCgroups and only once. +// It intentionally leaks an FD, so additional invocation will result in additional leak. +static bool WriteRcFile(const std::map& descriptors) { + // WARNING: We are intentionally leaking the FD to keep the file open forever. + // Let init keep the FD open to prevent file mappings from becoming invalid in + // case the file gets deleted somehow. + int fd = TEMP_FAILURE_RETRY(open(CGROUPS_RC_PATH, O_CREAT | O_WRONLY | O_TRUNC | O_CLOEXEC, + S_IRUSR | S_IRGRP | S_IROTH)); + if (fd < 0) { + PLOG(ERROR) << "open() failed for " << CGROUPS_RC_PATH; + return false; + } + + format::CgroupFile fl; + fl.version_ = format::CgroupFile::FILE_CURR_VERSION; + fl.controller_count_ = descriptors.size(); + int ret = TEMP_FAILURE_RETRY(write(fd, &fl, sizeof(fl))); + if (ret < 0) { + PLOG(ERROR) << "write() failed for " << CGROUPS_RC_PATH; + return false; + } + + for (const auto& [name, descriptor] : descriptors) { + ret = TEMP_FAILURE_RETRY( + write(fd, descriptor.controller(), sizeof(format::CgroupController))); + if (ret < 0) { + PLOG(ERROR) << "write() failed for " << CGROUPS_RC_PATH; + return false; + } + } + + return true; +} + +CgroupDescriptor::CgroupDescriptor(uint32_t version, const std::string& name, + const std::string& path, mode_t mode, const std::string& uid, + const std::string& gid) + : controller_(version, name, path), mode_(mode), uid_(uid), gid_(gid) {} + +} // namespace cgrouprc +} // namespace android + +bool CgroupSetup() { + using namespace android::cgrouprc; + + std::map descriptors; + + if (getpid() != 1) { + LOG(ERROR) << "Cgroup setup can be done only by init process"; + return false; + } + + // Make sure we do this only one time. No need for std::call_once because + // init is a single-threaded process + if (access(CGROUPS_RC_PATH, F_OK) == 0) { + LOG(WARNING) << "Attempt to call SetupCgroups more than once"; + return true; + } + + // load cgroups.json file + if (!ReadDescriptors(&descriptors)) { + LOG(ERROR) << "Failed to load cgroup description file"; + return false; + } + + // setup cgroups + for (const auto& [name, descriptor] : descriptors) { + if (!SetupCgroup(descriptor)) { + // issue a warning and proceed with the next cgroup + // TODO: mark the descriptor as invalid and skip it in WriteRcFile() + LOG(WARNING) << "Failed to setup " << name << " cgroup"; + } + } + + // mkdir 0711 system system + if (!Mkdir(android::base::Dirname(CGROUPS_RC_PATH), 0711, "system", "system")) { + LOG(ERROR) << "Failed to create directory for " << CGROUPS_RC_PATH << " file"; + return false; + } + + // Generate file which can be directly mmapped into + // process memory. This optimizes performance, memory usage + // and limits infrormation shared with unprivileged processes + // to the minimum subset of information from cgroups.json + if (!WriteRcFile(descriptors)) { + LOG(ERROR) << "Failed to write " << CGROUPS_RC_PATH << " file"; + return false; + } + + // chmod 0644 + if (fchmodat(AT_FDCWD, CGROUPS_RC_PATH, 0644, AT_SYMLINK_NOFOLLOW) < 0) { + PLOG(ERROR) << "fchmodat() failed"; + return false; + } + + return true; +} diff --git a/libprocessgroup/setup/include/processgroup/setup.h b/libprocessgroup/setup/include/processgroup/setup.h new file mode 100644 index 000000000..6ea19793e --- /dev/null +++ b/libprocessgroup/setup/include/processgroup/setup.h @@ -0,0 +1,19 @@ +/* + * Copyright (C) 2019 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#pragma once + +bool CgroupSetup(); diff --git a/libprocessgroup/task_profiles.cpp b/libprocessgroup/task_profiles.cpp index 9362c0387..4b45c8765 100644 --- a/libprocessgroup/task_profiles.cpp +++ b/libprocessgroup/task_profiles.cpp @@ -46,7 +46,7 @@ using android::base::WriteStringToFile; bool ProfileAttribute::GetPathForTask(int tid, std::string* path) const { std::string subgroup; - if (!controller_->GetTaskGroup(tid, &subgroup)) { + if (!controller()->GetTaskGroup(tid, &subgroup)) { return false; } @@ -55,9 +55,10 @@ bool ProfileAttribute::GetPathForTask(int tid, std::string* path) const { } if (subgroup.empty()) { - *path = StringPrintf("%s/%s", controller_->path(), file_name_.c_str()); + *path = StringPrintf("%s/%s", controller()->path(), file_name_.c_str()); } else { - *path = StringPrintf("%s/%s/%s", controller_->path(), subgroup.c_str(), file_name_.c_str()); + *path = StringPrintf("%s/%s/%s", controller()->path(), subgroup.c_str(), + file_name_.c_str()); } return true; } @@ -135,7 +136,7 @@ bool SetCgroupAction::IsAppDependentPath(const std::string& path) { return path.find("", 0) != std::string::npos || path.find("", 0) != std::string::npos; } -SetCgroupAction::SetCgroupAction(const CgroupController* c, const std::string& p) +SetCgroupAction::SetCgroupAction(const CgroupController& c, const std::string& p) : controller_(c), path_(p) { #ifdef CACHE_FILE_DESCRIPTORS // cache file descriptor only if path is app independent @@ -145,7 +146,7 @@ SetCgroupAction::SetCgroupAction(const CgroupController* c, const std::string& p return; } - std::string tasks_path = c->GetTasksFilePath(p.c_str()); + std::string tasks_path = c.GetTasksFilePath(p); if (access(tasks_path.c_str(), W_OK) != 0) { // file is not accessible @@ -199,7 +200,7 @@ bool SetCgroupAction::ExecuteForProcess(uid_t uid, pid_t pid) const { } // this is app-dependent path, file descriptor is not cached - std::string procs_path = controller_->GetProcsFilePath(path_, uid, pid); + std::string procs_path = controller()->GetProcsFilePath(path_, uid, pid); unique_fd tmp_fd(TEMP_FAILURE_RETRY(open(procs_path.c_str(), O_WRONLY | O_CLOEXEC))); if (tmp_fd < 0) { PLOG(WARNING) << "Failed to open " << procs_path; @@ -212,7 +213,7 @@ bool SetCgroupAction::ExecuteForProcess(uid_t uid, pid_t pid) const { return true; #else - std::string procs_path = controller_->GetProcsFilePath(path_, uid, pid); + std::string procs_path = controller()->GetProcsFilePath(path_, uid, pid); unique_fd tmp_fd(TEMP_FAILURE_RETRY(open(procs_path.c_str(), O_WRONLY | O_CLOEXEC))); if (tmp_fd < 0) { // no permissions to access the file, ignore @@ -247,7 +248,7 @@ bool SetCgroupAction::ExecuteForTask(int tid) const { LOG(ERROR) << "Application profile can't be applied to a thread"; return false; #else - std::string tasks_path = controller_->GetTasksFilePath(path_); + std::string tasks_path = controller()->GetTasksFilePath(path_); unique_fd tmp_fd(TEMP_FAILURE_RETRY(open(tasks_path.c_str(), O_WRONLY | O_CLOEXEC))); if (tmp_fd < 0) { // no permissions to access the file, ignore @@ -326,8 +327,8 @@ bool TaskProfiles::Load(const CgroupMap& cg_map, const std::string& file_name) { std::string file_attr = attr[i]["File"].asString(); if (attributes_.find(name) == attributes_.end()) { - const CgroupController* controller = cg_map.FindController(controller_name); - if (controller) { + auto controller = cg_map.FindController(controller_name); + if (controller.HasValue()) { attributes_[name] = std::make_unique(controller, file_attr); } else { LOG(WARNING) << "Controller " << controller_name << " is not found"; @@ -355,8 +356,8 @@ bool TaskProfiles::Load(const CgroupMap& cg_map, const std::string& file_name) { std::string controller_name = params_val["Controller"].asString(); std::string path = params_val["Path"].asString(); - const CgroupController* controller = cg_map.FindController(controller_name); - if (controller) { + auto controller = cg_map.FindController(controller_name); + if (controller.HasValue()) { profile->Add(std::make_unique(controller, path)); } else { LOG(WARNING) << "JoinCgroup: controller " << controller_name << " is not found"; diff --git a/libprocessgroup/task_profiles.h b/libprocessgroup/task_profiles.h index 9ee81c1ef..37cc305d5 100644 --- a/libprocessgroup/task_profiles.h +++ b/libprocessgroup/task_profiles.h @@ -27,16 +27,16 @@ class ProfileAttribute { public: - ProfileAttribute(const CgroupController* controller, const std::string& file_name) + ProfileAttribute(const CgroupController& controller, const std::string& file_name) : controller_(controller), file_name_(file_name) {} - const CgroupController* controller() const { return controller_; } + const CgroupController* controller() const { return &controller_; } const std::string& file_name() const { return file_name_; } bool GetPathForTask(int tid, std::string* path) const; private: - const CgroupController* controller_; + CgroupController controller_; std::string file_name_; }; @@ -106,16 +106,16 @@ class SetAttributeAction : public ProfileAction { // Set cgroup profile element class SetCgroupAction : public ProfileAction { public: - SetCgroupAction(const CgroupController* c, const std::string& p); + SetCgroupAction(const CgroupController& c, const std::string& p); virtual bool ExecuteForProcess(uid_t uid, pid_t pid) const; virtual bool ExecuteForTask(int tid) const; - const CgroupController* controller() const { return controller_; } + const CgroupController* controller() const { return &controller_; } std::string path() const { return path_; } private: - const CgroupController* controller_; + CgroupController controller_; std::string path_; #ifdef CACHE_FILE_DESCRIPTORS android::base::unique_fd fd_; diff --git a/rootdir/etc/ld.config.legacy.txt b/rootdir/etc/ld.config.legacy.txt index 0fccd312c..7324ba96b 100644 --- a/rootdir/etc/ld.config.legacy.txt +++ b/rootdir/etc/ld.config.legacy.txt @@ -100,6 +100,7 @@ namespace.media.links = default namespace.media.link.default.shared_libs = libandroid.so namespace.media.link.default.shared_libs += libbinder_ndk.so namespace.media.link.default.shared_libs += libc.so +namespace.media.link.default.shared_libs += libcgrouprc.so namespace.media.link.default.shared_libs += libdl.so namespace.media.link.default.shared_libs += liblog.so namespace.media.link.default.shared_libs += libmediametrics.so @@ -143,6 +144,7 @@ namespace.resolv.search.paths = /apex/com.android.resolv/${LIB} namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB} namespace.resolv.links = default namespace.resolv.link.default.shared_libs = libc.so +namespace.resolv.link.default.shared_libs += libcgrouprc.so namespace.resolv.link.default.shared_libs += libm.so namespace.resolv.link.default.shared_libs += libdl.so namespace.resolv.link.default.shared_libs += libbinder_ndk.so diff --git a/rootdir/etc/ld.config.txt b/rootdir/etc/ld.config.txt index 84651fbc5..45e80e17c 100644 --- a/rootdir/etc/ld.config.txt +++ b/rootdir/etc/ld.config.txt @@ -212,6 +212,7 @@ namespace.resolv.search.paths = /apex/com.android.resolv/${LIB} namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB} namespace.resolv.links = default namespace.resolv.link.default.shared_libs = libc.so +namespace.resolv.link.default.shared_libs += libcgrouprc.so namespace.resolv.link.default.shared_libs += libm.so namespace.resolv.link.default.shared_libs += libdl.so namespace.resolv.link.default.shared_libs += libbinder_ndk.so diff --git a/rootdir/etc/ld.config.vndk_lite.txt b/rootdir/etc/ld.config.vndk_lite.txt index 272485f80..a762ba8b7 100644 --- a/rootdir/etc/ld.config.vndk_lite.txt +++ b/rootdir/etc/ld.config.vndk_lite.txt @@ -154,6 +154,7 @@ namespace.resolv.search.paths = /apex/com.android.resolv/${LIB} namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB} namespace.resolv.links = default namespace.resolv.link.default.shared_libs = libc.so +namespace.resolv.link.default.shared_libs += libcgrouprc.so namespace.resolv.link.default.shared_libs += libm.so namespace.resolv.link.default.shared_libs += libdl.so namespace.resolv.link.default.shared_libs += libbinder_ndk.so @@ -476,6 +477,7 @@ namespace.resolv.search.paths = /apex/com.android.resolv/${LIB} namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB} namespace.resolv.links = default namespace.resolv.link.default.shared_libs = libc.so +namespace.resolv.link.default.shared_libs += libcgrouprc.so namespace.resolv.link.default.shared_libs += libm.so namespace.resolv.link.default.shared_libs += libdl.so namespace.resolv.link.default.shared_libs += libbinder_ndk.so