exec: use systemd AttachProcessesToUnit as a fallback - #2244
Merged
Merged
Conversation
Moving a process to a cgroup requires write access to cgroup.procs of the common ancestor of the source and the destination cgroups. This is a problem for a rootless user running crun exec in a login session (e.g. via ssh), when the container is created with the systemd cgroup manager: the session scope is outside of [email protected], so the common ancestor is user-$UID.slice, owned by root. As a result, crun exec fails with: write to `.../crun-ID.scope/container/cgroup.procs`: Permission denied In such case, ask systemd to move the process by calling its AttachProcessesToUnit method (which is what runc does). The user systemd instance delegates the operation to the system one when it lacks privileges. The fallback is only used if writing to cgroup.procs failed with EACCES or EPERM, so the common case is not affected. Signed-off-by: Kir Kolyshkin <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moving a process to a cgroup requires write access to
cgroup.procsof the common ancestor of the source and the destination cgroups.This is a problem for a rootless user running
crun execin a login session (e.g. via ssh), when the container is created with the systemd cgroup manager: the session scope is outside of[email protected], so the common ancestor isuser-$UID.slice, owned by root. As a result,crun execfails with:In such case, ask systemd to move the process by calling its
AttachProcessesToUnitmethod (which is what runc does). The user systemd instance delegates the operation to the system one when it lacks privileges.The fallback is only used if writing to
cgroup.procsfailed withEACCESorEPERM, so the common case is not affected.Found by the runc integration tests (see #2238), where rootless tests with systemd are run via
ssh rootless@localhost.