From 27d3dd3df35d9d71ddb2bd24bea6345c8f7b3e92 Mon Sep 17 00:00:00 2001 From: Qiang Huang Date: Wed, 22 Apr 2015 10:18:22 +0800 Subject: [PATCH] don't fail when subsystem not mounted We do this aim two goals: - don't fail when some subsystems are not mounted (devices cgroup is an exception because it will cause secirity issues). - fail hard instead of ignoring the error when a user specifies an option and we are unable to fulfill the request. Signed-off-by: Qiang Huang --- cgroups/fs/apply_raw.go | 5 +++++ cgroups/fs/cpu.go | 2 +- cgroups/fs/cpuset.go | 7 ++++++- cgroups/fs/devices.go | 2 ++ cgroups/fs/memory.go | 3 +-- cgroups/systemd/apply_systemd.go | 21 ++++++++++++++------- 6 files changed, 29 insertions(+), 11 deletions(-) diff --git a/cgroups/fs/apply_raw.go b/cgroups/fs/apply_raw.go index d31f894b..24efa67b 100644 --- a/cgroups/fs/apply_raw.go +++ b/cgroups/fs/apply_raw.go @@ -275,6 +275,11 @@ func (raw *data) join(subsystem string) (string, error) { } func writeFile(dir, file, data string) error { + // Normally dir should not be empty, one case is that cgroup subsystem + // is not mounted, we will get empty dir, and we want it fail here. + if dir == "" { + return fmt.Errorf("no such directory for %s.", file) + } return ioutil.WriteFile(filepath.Join(dir, file), []byte(data), 0700) } diff --git a/cgroups/fs/cpu.go b/cgroups/fs/cpu.go index 1fbf7b15..c9d4ad1a 100644 --- a/cgroups/fs/cpu.go +++ b/cgroups/fs/cpu.go @@ -17,7 +17,7 @@ func (s *CpuGroup) Apply(d *data) error { // We always want to join the cpu group, to allow fair cpu scheduling // on a container basis dir, err := d.join("cpu") - if err != nil { + if err != nil && !cgroups.IsNotFound(err) { return err } diff --git a/cgroups/fs/cpuset.go b/cgroups/fs/cpuset.go index d8465a66..6ad42a58 100644 --- a/cgroups/fs/cpuset.go +++ b/cgroups/fs/cpuset.go @@ -16,7 +16,7 @@ type CpusetGroup struct { func (s *CpusetGroup) Apply(d *data) error { dir, err := d.path("cpuset") - if err != nil { + if err != nil && !cgroups.IsNotFound(err) { return err } @@ -48,6 +48,11 @@ func (s *CpusetGroup) GetStats(path string, stats *cgroups.Stats) error { } func (s *CpusetGroup) ApplyDir(dir string, cgroup *configs.Cgroup, pid int) error { + // This might happen if we have no cpuset cgroup mounted. + // Just do nothing and don't fail. + if dir == "" { + return nil + } if err := s.ensureParent(dir); err != nil { return err } diff --git a/cgroups/fs/devices.go b/cgroups/fs/devices.go index 16e00b1c..50905601 100644 --- a/cgroups/fs/devices.go +++ b/cgroups/fs/devices.go @@ -11,6 +11,8 @@ type DevicesGroup struct { func (s *DevicesGroup) Apply(d *data) error { dir, err := d.join("devices") if err != nil { + // We will return error even it's `not found` error, devices + // cgroup is hard requirement for container's security. return err } diff --git a/cgroups/fs/memory.go b/cgroups/fs/memory.go index d5dbaf65..2dcef0f4 100644 --- a/cgroups/fs/memory.go +++ b/cgroups/fs/memory.go @@ -16,8 +16,7 @@ type MemoryGroup struct { func (s *MemoryGroup) Apply(d *data) error { dir, err := d.join("memory") - // only return an error for memory if it was specified - if err != nil && (d.c.Memory != 0 || d.c.MemoryReservation != 0 || d.c.MemorySwap != 0) { + if err != nil && !cgroups.IsNotFound(err) { return err } defer func() { diff --git a/cgroups/systemd/apply_systemd.go b/cgroups/systemd/apply_systemd.go index 6c87eb77..e1696d08 100644 --- a/cgroups/systemd/apply_systemd.go +++ b/cgroups/systemd/apply_systemd.go @@ -256,6 +256,11 @@ func (m *Manager) GetPaths() map[string]string { } func writeFile(dir, file, data string) error { + // Normally dir should not be empty, one case is that cgroup subsystem + // is not mounted, we will get empty dir, and we want it fail here. + if dir == "" { + return fmt.Errorf("no such directory for %s.", file) + } return ioutil.WriteFile(filepath.Join(dir, file), []byte(data), 0700) } @@ -276,16 +281,16 @@ func join(c *configs.Cgroup, subsystem string, pid int) (string, error) { func joinCpu(c *configs.Cgroup, pid int) error { path, err := getSubsystemPath(c, "cpu") - if err != nil { + if err != nil && !cgroups.IsNotFound(err) { return err } if c.CpuQuota != 0 { - if err = ioutil.WriteFile(filepath.Join(path, "cpu.cfs_quota_us"), []byte(strconv.FormatInt(c.CpuQuota, 10)), 0700); err != nil { + if err = writeFile(path, "cpu.cfs_quota_us", strconv.FormatInt(c.CpuQuota, 10)); err != nil { return err } } if c.CpuPeriod != 0 { - if err = ioutil.WriteFile(filepath.Join(path, "cpu.cfs_period_us"), []byte(strconv.FormatInt(c.CpuPeriod, 10)), 0700); err != nil { + if err = writeFile(path, "cpu.cfs_period_us", strconv.FormatInt(c.CpuPeriod, 10)); err != nil { return err } } @@ -293,7 +298,7 @@ func joinCpu(c *configs.Cgroup, pid int) error { } func joinFreezer(c *configs.Cgroup, pid int) error { - if _, err := join(c, "freezer", pid); err != nil { + if _, err := join(c, "freezer", pid); err != nil && !cgroups.IsNotFound(err) { return err } @@ -393,6 +398,8 @@ func getUnitName(c *configs.Cgroup) string { // This happens at least for v208 when any sibling unit is started. func joinDevices(c *configs.Cgroup, pid int) error { path, err := join(c, "devices", pid) + // Even if it's `not found` error, we'll return err because devices cgroup + // is hard requirement for container security. if err != nil { return err } @@ -420,11 +427,11 @@ func joinMemory(c *configs.Cgroup, pid int) error { } path, err := getSubsystemPath(c, "memory") - if err != nil { + if err != nil && !cgroups.IsNotFound(err) { return err } - return ioutil.WriteFile(filepath.Join(path, "memory.memsw.limit_in_bytes"), []byte(strconv.FormatInt(memorySwap, 10)), 0700) + return writeFile(path, "memory.memsw.limit_in_bytes", strconv.FormatInt(memorySwap, 10)) } // systemd does not atm set up the cpuset controller, so we must manually @@ -432,7 +439,7 @@ func joinMemory(c *configs.Cgroup, pid int) error { // level must have a full setup as the default for a new directory is "no cpus" func joinCpuset(c *configs.Cgroup, pid int) error { path, err := getSubsystemPath(c, "cpuset") - if err != nil { + if err != nil && !cgroups.IsNotFound(err) { return err }