Commit 7e47682e authored by Aleksa Sarai's avatar Aleksa Sarai Committed by Tejun Heo
Browse files

cgroup: allow a cgroup subsystem to reject a fork 



Add a new cgroup subsystem callback can_fork that conditionally
states whether or not the fork is accepted or rejected by a cgroup
policy. In addition, add a cancel_fork callback so that if an error
occurs later in the forking process, any state modified by can_fork can
be reverted.

Allow for a private opaque pointer to be passed from cgroup_can_fork to
cgroup_post_fork, allowing for the fork state to be stored by each
subsystem separately.

Also add a tagging system for cgroup_subsys.h to allow for CGROUP_<TAG>
enumerations to be be defined and used. In addition, explicitly add a
CGROUP_CANFORK_COUNT macro to make arrays easier to define.

This is in preparation for implementing the pids cgroup subsystem.

Signed-off-by: default avatarAleksa Sarai <cyphar@cyphar.com>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
parent d770e558

include/linux/cgroup-defs.h

+9 −1
Original line number Diff line number Diff line
@@ -34,12 +34,17 @@ struct seq_file; 


/* define the enumeration of all cgroup subsystems */

#define SUBSYS(_x) _x ## _cgrp_id,

#define SUBSYS_TAG(_t) CGROUP_ ## _t, \

	__unused_tag_ ## _t = CGROUP_ ## _t - 1,

enum cgroup_subsys_id {

#include <linux/cgroup_subsys.h>

	CGROUP_SUBSYS_COUNT,

};

#undef SUBSYS_TAG

#undef SUBSYS



#define CGROUP_CANFORK_COUNT (CGROUP_CANFORK_END - CGROUP_CANFORK_START)



/* bits in struct cgroup_subsys_state flags field */

enum {

	CSS_NO_REF	= (1 << 0), /* no reference counting for this css */
@@ -406,7 +411,9 @@ struct cgroup_subsys { 
			      struct cgroup_taskset *tset);

	void (*attach)(struct cgroup_subsys_state *css,

		       struct cgroup_taskset *tset);

	void (*fork)(struct task_struct *task);

	int (*can_fork)(struct task_struct *task, void **priv_p);

	void (*cancel_fork)(struct task_struct *task, void *priv);

	void (*fork)(struct task_struct *task, void *priv);

	void (*exit)(struct cgroup_subsys_state *css,

		     struct cgroup_subsys_state *old_css,

		     struct task_struct *task);
@@ -491,6 +498,7 @@ static inline void cgroup_threadgroup_change_end(struct task_struct *tsk) 


#else	/* CONFIG_CGROUPS */



#define CGROUP_CANFORK_COUNT 0

#define CGROUP_SUBSYS_COUNT 0



static inline void cgroup_threadgroup_change_begin(struct task_struct *tsk) {}

include/linux/cgroup.h

+13 −2
Original line number Diff line number Diff line
@@ -62,7 +62,12 @@ int proc_cgroup_show(struct seq_file *m, struct pid_namespace *ns, 
		     struct pid *pid, struct task_struct *tsk);



void cgroup_fork(struct task_struct *p);

void cgroup_post_fork(struct task_struct *p);

extern int cgroup_can_fork(struct task_struct *p,

			   void *ss_priv[CGROUP_CANFORK_COUNT]);

extern void cgroup_cancel_fork(struct task_struct *p,

			       void *ss_priv[CGROUP_CANFORK_COUNT]);

extern void cgroup_post_fork(struct task_struct *p,

			     void *old_ss_priv[CGROUP_CANFORK_COUNT]);

void cgroup_exit(struct task_struct *p);



int cgroup_init_early(void);
@@ -524,7 +529,13 @@ static inline int cgroupstats_build(struct cgroupstats *stats, 
				    struct dentry *dentry) { return -EINVAL; }



static inline void cgroup_fork(struct task_struct *p) {}

static inline void cgroup_post_fork(struct task_struct *p) {}

static inline int cgroup_can_fork(struct task_struct *p,

				  void *ss_priv[CGROUP_CANFORK_COUNT])

{ return 0; }

static inline void cgroup_cancel_fork(struct task_struct *p,

				      void *ss_priv[CGROUP_CANFORK_COUNT]) {}

static inline void cgroup_post_fork(struct task_struct *p,

				    void *ss_priv[CGROUP_CANFORK_COUNT]) {}

static inline void cgroup_exit(struct task_struct *p) {}



static inline int cgroup_init_early(void) { return 0; }

include/linux/cgroup_subsys.h

+23 −0
Original line number Diff line number Diff line
@@ -3,6 +3,17 @@ 
 *

 * DO NOT ADD ANY SUBSYSTEM WITHOUT EXPLICIT ACKS FROM CGROUP MAINTAINERS.

 */



/*

 * This file *must* be included with SUBSYS() defined.

 * SUBSYS_TAG() is a noop if undefined.

 */



#ifndef SUBSYS_TAG

#define __TMP_SUBSYS_TAG

#define SUBSYS_TAG(_x)

#endif



#if IS_ENABLED(CONFIG_CPUSETS)

SUBSYS(cpuset)

#endif
@@ -47,12 +58,24 @@ SUBSYS(net_prio) 
SUBSYS(hugetlb)

#endif



/*

 * Subsystems that implement the can_fork() family of callbacks.

 */

SUBSYS_TAG(CANFORK_START)

SUBSYS_TAG(CANFORK_END)



/*

 * The following subsystems are not supported on the default hierarchy.

 */

#if IS_ENABLED(CONFIG_CGROUP_DEBUG)

SUBSYS(debug)

#endif



#ifdef __TMP_SUBSYS_TAG

#undef __TMP_SUBSYS_TAG

#undef SUBSYS_TAG

#endif



/*

 * DO NOT ADD ANY SUBSYSTEM WITHOUT EXPLICIT ACKS FROM CGROUP MAINTAINERS.

 */

kernel/cgroup.c

+71 −2
Original line number Diff line number Diff line
@@ -186,6 +186,9 @@ static u64 css_serial_nr_next = 1; 
static unsigned long have_fork_callback __read_mostly;

static unsigned long have_exit_callback __read_mostly;



/* Ditto for the can_fork callback. */

static unsigned long have_canfork_callback __read_mostly;



static struct cftype cgroup_dfl_base_files[];

static struct cftype cgroup_legacy_base_files[];
@@ -4955,6 +4958,7 @@ static void __init cgroup_init_subsys(struct cgroup_subsys *ss, bool early) 


	have_fork_callback |= (bool)ss->fork << ss->id;

	have_exit_callback |= (bool)ss->exit << ss->id;

	have_canfork_callback |= (bool)ss->can_fork << ss->id;



	/* At system boot, before all subsystems have been

	 * registered, no tasks have been forked, so we don't
@@ -5197,6 +5201,19 @@ static const struct file_operations proc_cgroupstats_operations = { 
	.release = single_release,

};



static void **subsys_canfork_priv_p(void *ss_priv[CGROUP_CANFORK_COUNT], int i)

{

	if (CGROUP_CANFORK_START <= i && i < CGROUP_CANFORK_END)

		return &ss_priv[i - CGROUP_CANFORK_START];

	return NULL;

}



static void *subsys_canfork_priv(void *ss_priv[CGROUP_CANFORK_COUNT], int i)

{

	void **private = subsys_canfork_priv_p(ss_priv, i);

	return private ? *private : NULL;

}



/**

 * cgroup_fork - initialize cgroup related fields during copy_process()

 * @child: pointer to task_struct of forking parent process.
@@ -5211,6 +5228,57 @@ void cgroup_fork(struct task_struct *child) 
	INIT_LIST_HEAD(&child->cg_list);

}



/**

 * cgroup_can_fork - called on a new task before the process is exposed

 * @child: the task in question.

 *

 * This calls the subsystem can_fork() callbacks. If the can_fork() callback

 * returns an error, the fork aborts with that error code. This allows for

 * a cgroup subsystem to conditionally allow or deny new forks.

 */

int cgroup_can_fork(struct task_struct *child,

		    void *ss_priv[CGROUP_CANFORK_COUNT])

{

	struct cgroup_subsys *ss;

	int i, j, ret;



	for_each_subsys_which(ss, i, &have_canfork_callback) {

		ret = ss->can_fork(child, subsys_canfork_priv_p(ss_priv, i));

		if (ret)

			goto out_revert;

	}



	return 0;



out_revert:

	for_each_subsys(ss, j) {

		if (j >= i)

			break;

		if (ss->cancel_fork)

			ss->cancel_fork(child, subsys_canfork_priv(ss_priv, j));

	}



	return ret;

}



/**

 * cgroup_cancel_fork - called if a fork failed after cgroup_can_fork()

 * @child: the task in question

 *

 * This calls the cancel_fork() callbacks if a fork failed *after*

 * cgroup_can_fork() succeded.

 */

void cgroup_cancel_fork(struct task_struct *child,

			void *ss_priv[CGROUP_CANFORK_COUNT])

{

	struct cgroup_subsys *ss;

	int i;



	for_each_subsys(ss, i)

		if (ss->cancel_fork)

			ss->cancel_fork(child, subsys_canfork_priv(ss_priv, i));

}



/**

 * cgroup_post_fork - called on a new task after adding it to the task list

 * @child: the task in question
@@ -5221,7 +5289,8 @@ void cgroup_fork(struct task_struct *child) 
 * cgroup_task_iter_start() - to guarantee that the new task ends up on its

 * list.

 */

void cgroup_post_fork(struct task_struct *child)

void cgroup_post_fork(struct task_struct *child,

		      void *old_ss_priv[CGROUP_CANFORK_COUNT])

{

	struct cgroup_subsys *ss;

	int i;
@@ -5266,7 +5335,7 @@ void cgroup_post_fork(struct task_struct *child) 
	 * and addition to css_set.

	 */

	for_each_subsys_which(ss, i, &have_fork_callback)

		ss->fork(child);

		ss->fork(child, subsys_canfork_priv(old_ss_priv, i));

}



/**

kernel/cgroup_freezer.c

+1 −1
Original line number Diff line number Diff line
@@ -203,7 +203,7 @@ static void freezer_attach(struct cgroup_subsys_state *new_css, 
 * to do anything as freezer_attach() will put @task into the appropriate

 * state.

 */

static void freezer_fork(struct task_struct *task)

static void freezer_fork(struct task_struct *task, void *private)

{

	struct freezer *freezer;

CRA Git | Maintained and supported by SUSTech CRA and CCSE