Merged
Conversation
Since Linux v4.4-rc1, __DEVEL__sane_behavior does not exist anymore and is replaced by a new fstype "cgroup2". With this patch, systemd no longer supports the old (unstable) way of doing unified hierarchy with __DEVEL__sane_behavior and systemd now requires Linux v4.4 for unified hierarchy. Non-unified hierarchy is still the default and is unchanged by this patch. torvalds/linux@67e9c74
Earlier during the development of unified hierarchy, the populated event was reported through by the dedicated "cgroup.populated" file; however, the interface was updated so that it's reported through the "populated" field of "cgroup.events" file. Update populated event handling logic accordingly.
After receiving SIGCHLD, one of the ways manager_dispatch_sigchld() maps the now zombie $PID to its unit is through manager_get_unit_by_pid_cgroup() which reads /proc/$PID/cgroup and looks up the unit associated with the cgroup path. On non-unified cgroup hierarchies, a process is immediately migrated to the root cgroup on death and the cgroup lookup would always have returned the unit associated with it, making it rather pointless but safe. On unified hierarchy, a zombie remains associated with the cgroup that it was associated with at the time of death and thus manager_get_unit_by_pid_cgroup() will look up the unit properly. However, by the time manager_dispatch_sigchld() is running, the original cgroup may have become empty and it and its associated unit might already have been removed. If the cgroup path doesn't yield a match, manager_dispatch_sigchld() keeps pruning the leaf component. This means that the function may return a slice unit for a pid and as a slice doesn't have ->sigchld_event() handler, calling invoke_sigchld_event() on it causes a segfault. This patch updates invoke_sigchld_event() so that it skips calling if the handler is not set.
Member
Author
|
Hm, doesn't boot with |
Contributor
Member
Author
|
Yeah, initramfs needed updating, and also selinux policy needs updating (https://bugzilla.redhat.com/show_bug.cgi?id=1322184). This is good to merge. |
pebenito
pushed a commit
to OwlCyberDefense/refpolicy
that referenced
this pull request
Mar 31, 2016
With the new "cgroup2" system added in kernel 4.5, systemd is getting selinux denials when manipulating the cgroup hierarchy. Pull request in systemd with cgroup2 support: systemd/systemd#2903 AVC when writing process numbers to move them to the right cgroup: Mar 29 19:58:30 rawhide kernel: audit: type=1400 audit(1459295910.257:68): avc: denied { write } for pid=1 comm="systemd" name="cgroup.procs" dev="cgroup2" ino=6 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=1 In this case new filesystem "cgroup2" need to be labeled as cgroup_t. Signed-off-by: Lukas Vrabec <[email protected]>
perfinion
pushed a commit
to perfinion/hardened-refpolicy
that referenced
this pull request
May 13, 2016
With the new "cgroup2" system added in kernel 4.5, systemd is getting selinux denials when manipulating the cgroup hierarchy. Pull request in systemd with cgroup2 support: systemd/systemd#2903 AVC when writing process numbers to move them to the right cgroup: Mar 29 19:58:30 rawhide kernel: audit: type=1400 audit(1459295910.257:68): avc: denied { write } for pid=1 comm="systemd" name="cgroup.procs" dev="cgroup2" ino=6 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=1 In this case new filesystem "cgroup2" need to be labeled as cgroup_t. Signed-off-by: Lukas Vrabec <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This replaces #2271 and #2902.
First commit is taken from #2271, but "cgroup" is used as the dummy device name instead of "cgroup2". Commits two and three are from #2902.