redmine

Added option "--cgroup-group-name"

... ... @@ -23,13 +23,11 @@
static struct cgroup *cgroup = NULL;
int clsync_cgroup_init() {
char cgroup_name[BUFSIZ+1];
snprintf(cgroup_name, BUFSIZ, "clsync/%u", getpid());
debug(2, "cgroup_name == \"%s\"", cgroup_name);
int clsync_cgroup_init(ctx_t *ctx_p) {
debug(2, "cgroup_name == \"%s\"", ctx_p->cg_groupname);
SAFE( cgroup_init(), return -1; );
SAFE( (cgroup = cgroup_new_cgroup(cgroup_name)) == NULL, return -1; );
SAFE( cgroup_init(), return -1; );
SAFE( (cgroup = cgroup_new_cgroup(ctx_p->cg_groupname)) == NULL, return -1; );
return 0;
}
... ... @@ -70,11 +68,11 @@ int clsync_cgroup_forbid_extra_devices() {
return 0;
}
int clsync_cgroup_attach() {
int clsync_cgroup_attach(ctx_t *ctx_p) {
int rc;
debug(2, "");
if ((rc=cgroup_attach_task_pid(cgroup, getpid()))) {
if ((rc=cgroup_attach_task_pid(cgroup, ctx_p->pid))) {
error("Got error while cgroup_attach_task_pid(): %s", cgroup_strerror(rc));
return -1;
}
... ... @@ -82,17 +80,16 @@ int clsync_cgroup_attach() {
return 0;
}
int clsync_cgroup_deinit() {
int clsync_cgroup_deinit(ctx_t *ctx_p) {
debug(2, "");
pid_t pid = getpid();
setuid(0);
error_on(cgroup_delete_cgroup_ext(cgroup, CGFLAG_DELETE_IGNORE_MIGRATION | CGFLAG_DELETE_RECURSIVE));
cgroup_free(&cgroup);
if (pid != 0)
setuid(pid);
if (ctx_p->uid != 0)
setuid(ctx_p->uid);
return 0;
}
... ...
... ... @@ -17,8 +17,8 @@
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
extern int clsync_cgroup_init();
extern int clsync_cgroup_init(struct ctx *ctx_p);
extern int clsync_cgroup_forbid_extra_devices();
extern int clsync_cgroup_attach();
extern int clsync_cgroup_deinit();
extern int clsync_cgroup_attach(struct ctx *ctx_p);
extern int clsync_cgroup_deinit(struct ctx *ctx_p);
... ...
... ... @@ -194,3 +194,5 @@ filesz:1M\n\
CG_DEV_NULL " w", \
NULL \
}
#define DEFAULT_CG_GROUPNAME "clsync/%PID%"
... ...
... ... @@ -113,6 +113,7 @@ enum flags_enum {
SECURETHREADSPLITTING = 37|OPTION_LONGOPTONLY,
FTS_EXPERIMENTAL_OPTIMIZATION = 38|OPTION_LONGOPTONLY,
FORBIDDEVICES = 39|OPTION_LONGOPTONLY,
CG_GROUPNAME = 40|OPTION_LONGOPTONLY,
};
typedef enum flags_enum flags_t;
... ... @@ -292,6 +293,9 @@ struct ctx {
char *statusfile;
char *socketpath;
char *dump_path;
#ifdef CGROUP_SUPPORT
char *cg_groupname;
#endif
int socket;
mode_t socketmod;
uid_t socketuid;
... ...
... ... @@ -108,6 +108,7 @@ static const struct option long_options[] =
#endif
#ifdef CGROUP_SUPPORT
{"forbid-devices", optional_argument, NULL, FORBIDDEVICES},
{"cgroup-group-name", required_argument, NULL, CG_GROUPNAME},
#endif
{"threading", required_argument, NULL, THREADING},
{"retries", optional_argument, NULL, RETRIES},
... ... @@ -1061,6 +1062,11 @@ int parse_parameter(ctx_t *ctx_p, uint16_t param_id, char *arg, paramsource_t pa
case LABEL:
ctx_p->label = arg;
break;
#ifdef CGROUP_SUPPORT
case CG_GROUPNAME:
ctx_p->cg_groupname = arg;
break;
#endif
case STANDBYFILE:
if(strlen(arg)) {
ctx_p->standbyfile = arg;
... ... @@ -2025,6 +2031,13 @@ int main(int argc, char *argv[]) {
if(nret) ret = nret;
}
#ifdef CGROUP_SUPPORT
if (ctx_p->cg_groupname == NULL) {
ctx_p->cg_groupname = parameter_expand(ctx_p, strdup(DEFAULT_CG_GROUPNAME), 2, NULL, NULL, parameter_get, ctx_p);
ctx_p->flags_values_raw[CG_GROUPNAME] = ctx_p->cg_groupname;
}
#endif
if (ctx_p->dump_path == NULL) {
ctx_p->dump_path = parameter_expand(ctx_p, strdup(DEFAULT_DUMPDIR), 2, NULL, NULL, parameter_get, ctx_p);
ctx_p->flags_values_raw[DUMPDIR] = ctx_p->dump_path;
... ... @@ -2401,9 +2414,9 @@ int main(int argc, char *argv[]) {
#ifdef CGROUP_SUPPORT
if (ctx_p->flags[FORBIDDEVICES]) {
error_on(clsync_cgroup_init());
error_on(clsync_cgroup_init(ctx_p));
error_on(clsync_cgroup_forbid_extra_devices());
error_on(clsync_cgroup_attach());
error_on(clsync_cgroup_attach(ctx_p));
}
#endif
... ...
... ... @@ -1040,6 +1040,16 @@ Outputs clsync version and exits with exitcode "0".
Is not set by default.
.RE
.PP
.B \-\-cgroup\-group\-name
.I cg\-group\-name
.RS
Set cgroup group name [see
.BR cgroup_new_cgroup ()].
Is set to "clsync/%PID%" by default.
.RE
.SH SECURITY OPTIONS
.B \-\-secure\-thread\-splitting
... ...
... ... @@ -284,7 +284,7 @@ int (*_privileged_inotify_rm_watch) (
int wd
);
int (*_privileged_clsync_cgroup_deinit) ();
int (*_privileged_clsync_cgroup_deinit) (ctx_t *ctx_p);
int cap_enable(__u32 caps) {
... ... @@ -810,7 +810,7 @@ void *privileged_handler(void *_ctx_p)
}
# ifdef CGROUP_SUPPORT
case PA_CLSYNC_CGROUP_DEINIT: {
cmd.ret = (void *)(long)clsync_cgroup_deinit();
cmd.ret = (void *)(long)clsync_cgroup_deinit(cmd.arg);
break;
}
# endif
... ... @@ -1144,7 +1144,7 @@ int __privileged_inotify_rm_watch(
}
# ifdef CGROUP_SUPPORT
int __privileged_clsync_cgroup_deinit()
int __privileged_clsync_cgroup_deinit(ctx_t *ctx_p)
{
void *ret = (void *)(long)-1;
... ... @@ -1154,7 +1154,7 @@ int __privileged_clsync_cgroup_deinit()
PC_DEFAULT,
# endif
PA_CLSYNC_CGROUP_DEINIT,
NULL,
ctx_p,
&ret
);
... ...
... ... @@ -79,7 +79,7 @@ extern int (*_privileged_inotify_rm_watch) (
);
#ifdef CGROUP_SUPPORT
extern int (*_privileged_clsync_cgroup_deinit) ();
extern int (*_privileged_clsync_cgroup_deinit) (ctx_t *ctx_p);
#endif
# ifdef HL_LOCK_TRIES_AUTO
... ...
... ... @@ -3884,7 +3884,7 @@ int sync_run(ctx_t *ctx_p) {
#ifdef CGROUP_SUPPORT
// Cleaning up cgroups staff
if (ctx_p->flags[FORBIDDEVICES])
error_on(privileged_clsync_cgroup_deinit());
error_on(privileged_clsync_cgroup_deinit(ctx_p));
#endif
ret |= privileged_deinit(ctx_p);
... ...