ACPR/android_system_core
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge changes from topic "libprocessgroup_rc"

Browse source 
* changes:
  CgroupSetupCgroups -> CgroupSetup
  Add libcgrouprc to ld.config.*.txt.
  libprocessgroup: use libcgrouprc to read cgroup.rc
  libprocessgroup_setup: use libcgrouprc_format
  libprocessgroup: Move CgroupSetupCgroups() to libprocessgroup_setup
  libprocessgroup: Add libcgrouprc
  libprocessgroup: Add libcgrouprc_format
This commit is contained in:
Yifan Hong 2019-04-03 19:08:51 +00:00 • committed by Gerrit Code Review
commit 25d42eeaa6
28 changed files with 1026 additions and 433 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
init/Android.bp
View file

@ -61,6 +61,7 @@ cc_defaults {
static_libs: [ static_libs: [
"libseccomp_policy", "libseccomp_policy",
"libavb", "libavb",
"libcgrouprc_format",
"libprotobuf-cpp-lite", "libprotobuf-cpp-lite",
"libpropertyinfoserializer", "libpropertyinfoserializer",
"libpropertyinfoparser", "libpropertyinfoparser",
@ -82,6 +83,7 @@ cc_defaults {
"liblogwrap", "liblogwrap",
"liblp", "liblp",
"libprocessgroup", "libprocessgroup",
"libprocessgroup_setup",
"libselinux", "libselinux",
"libutils", "libutils",
], ],

3
init/init.cpp
View file

@ -45,6 +45,7 @@
#include <libavb/libavb.h> #include <libavb/libavb.h>
#include <libgsi/libgsi.h> #include <libgsi/libgsi.h>
#include <processgroup/processgroup.h> #include <processgroup/processgroup.h>
#include <processgroup/setup.h>
#include <selinux/android.h> #include <selinux/android.h>
#ifndef RECOVERY #ifndef RECOVERY
@ -358,7 +359,7 @@ static Result<Success> SetupCgroupsAction(const BuiltinArguments&) {
// Have to create <CGROUPS_RC_DIR> using make_dir function // Have to create <CGROUPS_RC_DIR> using make_dir function
// for appropriate sepolicy to be set for it // for appropriate sepolicy to be set for it
make_dir(android::base::Dirname(CGROUPS_RC_PATH), 0711); make_dir(android::base::Dirname(CGROUPS_RC_PATH), 0711);
if (!CgroupSetupCgroups()) { if (!CgroupSetup()) {
return ErrnoError() << "Failed to setup cgroups"; return ErrnoError() << "Failed to setup cgroups";
} }

6
libcutils/Android.bp
View file

@ -235,6 +235,7 @@ test_libraries = [
"libbase", "libbase",
"libjsoncpp", "libjsoncpp",
"libprocessgroup", "libprocessgroup",
"libcgrouprc",
] ]
cc_test { cc_test {
@ -249,7 +250,10 @@ cc_test {
name: "libcutils_test_static", name: "libcutils_test_static",
test_suites: ["device-tests"], test_suites: ["device-tests"],
defaults: ["libcutils_test_default"], defaults: ["libcutils_test_default"],
static_libs: ["libc"] + test_libraries, static_libs: [
"libc",
"libcgrouprc_format",
] + test_libraries,
stl: "libc++_static", stl: "libc++_static",
target: { target: {

1
libprocessgroup/Android.bp
View file

@ -31,6 +31,7 @@ cc_library {
}, },
shared_libs: [ shared_libs: [
"libbase", "libbase",
"libcgrouprc",
"libjsoncpp", "libjsoncpp",
], ],
// for cutils/android_filesystem_config.h // for cutils/android_filesystem_config.h

396
libprocessgroup/cgroup_map.cpp
View file

@ -44,244 +44,42 @@ using android::base::GetBoolProperty;
using android::base::StringPrintf; using android::base::StringPrintf;
using android::base::unique_fd; using android::base::unique_fd;
static constexpr const char* CGROUPS_DESC_FILE = "/etc/cgroups.json";
static constexpr const char* CGROUPS_DESC_VENDOR_FILE = "/vendor/etc/cgroups.json";
static constexpr const char* CGROUP_PROCS_FILE = "/cgroup.procs"; static constexpr const char* CGROUP_PROCS_FILE = "/cgroup.procs";
static constexpr const char* CGROUP_TASKS_FILE = "/tasks"; static constexpr const char* CGROUP_TASKS_FILE = "/tasks";
static constexpr const char* CGROUP_TASKS_FILE_V2 = "/cgroup.tasks"; static constexpr const char* CGROUP_TASKS_FILE_V2 = "/cgroup.tasks";
static bool Mkdir(const std::string& path, mode_t mode, const std::string& uid, uint32_t CgroupController::version() const {
const std::string& gid) { CHECK(HasValue());
if (mode == 0) { return ACgroupController_getVersion(controller_);
mode = 0755;
}
if (mkdir(path.c_str(), mode) != 0) {
/* chmod in case the directory already exists */
if (errno == EEXIST) {
if (fchmodat(AT_FDCWD, path.c_str(), mode, AT_SYMLINK_NOFOLLOW) != 0) {
// /acct is a special case when the directory already exists
// TODO: check if file mode is already what we want instead of using EROFS
if (errno != EROFS) {
PLOG(ERROR) << "fchmodat() failed for " << path;
return false;
}
}
} else {
PLOG(ERROR) << "mkdir() failed for " << path;
return false;
}
}
if (uid.empty()) {
return true;
}
passwd* uid_pwd = getpwnam(uid.c_str());
if (!uid_pwd) {
PLOG(ERROR) << "Unable to decode UID for '" << uid << "'";
return false;
}
uid_t pw_uid = uid_pwd->pw_uid;
gid_t gr_gid = -1;
if (!gid.empty()) {
group* gid_pwd = getgrnam(gid.c_str());
if (!gid_pwd) {
PLOG(ERROR) << "Unable to decode GID for '" << gid << "'";
return false;
}
gr_gid = gid_pwd->gr_gid;
}
if (lchown(path.c_str(), pw_uid, gr_gid) < 0) {
PLOG(ERROR) << "lchown() failed for " << path;
return false;
}
/* chown may have cleared S_ISUID and S_ISGID, chmod again */
if (mode & (S_ISUID | S_ISGID)) {
if (fchmodat(AT_FDCWD, path.c_str(), mode, AT_SYMLINK_NOFOLLOW) != 0) {
PLOG(ERROR) << "fchmodat() failed for " << path;
return false;
}
}
return true;
} }
static bool ReadDescriptorsFromFile(const std::string& file_name, const char* CgroupController::name() const {
std::map<std::string, CgroupDescriptor>* descriptors) { CHECK(HasValue());
std::vector<CgroupDescriptor> result; return ACgroupController_getName(controller_);
std::string json_doc;
if (!android::base::ReadFileToString(file_name, &json_doc)) {
PLOG(ERROR) << "Failed to read task profiles from " << file_name;
return false;
}
Json::Reader reader;
Json::Value root;
if (!reader.parse(json_doc, root)) {
LOG(ERROR) << "Failed to parse cgroups description: " << reader.getFormattedErrorMessages();
return false;
}
if (root.isMember("Cgroups")) {
const Json::Value& cgroups = root["Cgroups"];
for (Json::Value::ArrayIndex i = 0; i < cgroups.size(); ++i) {
std::string name = cgroups[i]["Controller"].asString();
auto iter = descriptors->find(name);
if (iter == descriptors->end()) {
descriptors->emplace(name, CgroupDescriptor(1, name, cgroups[i]["Path"].asString(),
std::strtoul(cgroups[i]["Mode"].asString().c_str(), 0, 8),
cgroups[i]["UID"].asString(), cgroups[i]["GID"].asString()));
} else {
iter->second = CgroupDescriptor(1, name, cgroups[i]["Path"].asString(),
std::strtoul(cgroups[i]["Mode"].asString().c_str(), 0, 8),
cgroups[i]["UID"].asString(), cgroups[i]["GID"].asString());
}
}
}
if (root.isMember("Cgroups2")) {
const Json::Value& cgroups2 = root["Cgroups2"];
auto iter = descriptors->find(CGROUPV2_CONTROLLER_NAME);
if (iter == descriptors->end()) {
descriptors->emplace(CGROUPV2_CONTROLLER_NAME, CgroupDescriptor(2, CGROUPV2_CONTROLLER_NAME, cgroups2["Path"].asString(),
std::strtoul(cgroups2["Mode"].asString().c_str(), 0, 8),
cgroups2["UID"].asString(), cgroups2["GID"].asString()));
} else {
iter->second = CgroupDescriptor(2, CGROUPV2_CONTROLLER_NAME, cgroups2["Path"].asString(),
std::strtoul(cgroups2["Mode"].asString().c_str(), 0, 8),
cgroups2["UID"].asString(), cgroups2["GID"].asString());
}
}
return true;
} }
static bool ReadDescriptors(std::map<std::string, CgroupDescriptor>* descriptors) { const char* CgroupController::path() const {
// load system cgroup descriptors CHECK(HasValue());
if (!ReadDescriptorsFromFile(CGROUPS_DESC_FILE, descriptors)) { return ACgroupController_getPath(controller_);
return false;
}
// load vendor cgroup descriptors if the file exists
if (!access(CGROUPS_DESC_VENDOR_FILE, F_OK) &&
!ReadDescriptorsFromFile(CGROUPS_DESC_VENDOR_FILE, descriptors)) {
return false;
}
return true;
} }
// To avoid issues in sdk_mac build bool CgroupController::HasValue() const {
#if defined(__ANDROID__) return controller_ != nullptr;
static bool SetupCgroup(const CgroupDescriptor& descriptor) {
const CgroupController* controller = descriptor.controller();
// mkdir <path> [mode] [owner] [group]
if (!Mkdir(controller->path(), descriptor.mode(), descriptor.uid(), descriptor.gid())) {
LOG(ERROR) << "Failed to create directory for " << controller->name() << " cgroup";
return false;
}
int result;
if (controller->version() == 2) {
result = mount("none", controller->path(), "cgroup2", MS_NODEV | MS_NOEXEC | MS_NOSUID,
nullptr);
} else {
// Unfortunately historically cpuset controller was mounted using a mount command
// different from all other controllers. This results in controller attributes not
// to be prepended with controller name. For example this way instead of
// /dev/cpuset/cpuset.cpus the attribute becomes /dev/cpuset/cpus which is what
// the system currently expects.
if (!strcmp(controller->name(), "cpuset")) {
// mount cpuset none /dev/cpuset nodev noexec nosuid
result = mount("none", controller->path(), controller->name(),
MS_NODEV | MS_NOEXEC | MS_NOSUID, nullptr);
} else {
// mount cgroup none <path> nodev noexec nosuid <controller>
result = mount("none", controller->path(), "cgroup", MS_NODEV | MS_NOEXEC | MS_NOSUID,
controller->name());
}
}
if (result < 0) {
PLOG(ERROR) << "Failed to mount " << controller->name() << " cgroup";
return false;
}
return true;
} }
#else std::string CgroupController::GetTasksFilePath(const std::string& rel_path) const {
std::string tasks_path = path();
// Stubs for non-Android targets. if (!rel_path.empty()) {
static bool SetupCgroup(const CgroupDescriptor&) { tasks_path += "/" + rel_path;
return false; }
return (version() == 1) ? tasks_path + CGROUP_TASKS_FILE : tasks_path + CGROUP_TASKS_FILE_V2;
} }
#endif std::string CgroupController::GetProcsFilePath(const std::string& rel_path, uid_t uid,
// WARNING: This function should be called only from SetupCgroups and only once.
// It intentionally leaks an FD, so additional invocation will result in additional leak.
static bool WriteRcFile(const std::map<std::string, CgroupDescriptor>& descriptors) {
// WARNING: We are intentionally leaking the FD to keep the file open forever.
// Let init keep the FD open to prevent file mappings from becoming invalid in
// case the file gets deleted somehow.
int fd = TEMP_FAILURE_RETRY(open(CGROUPS_RC_PATH, O_CREAT | O_WRONLY | O_TRUNC | O_CLOEXEC,
S_IRUSR | S_IRGRP | S_IROTH));
if (fd < 0) {
PLOG(ERROR) << "open() failed for " << CGROUPS_RC_PATH;
return false;
}
CgroupFile fl;
fl.version_ = CgroupFile::FILE_CURR_VERSION;
fl.controller_count_ = descriptors.size();
int ret = TEMP_FAILURE_RETRY(write(fd, &fl, sizeof(fl)));
if (ret < 0) {
PLOG(ERROR) << "write() failed for " << CGROUPS_RC_PATH;
return false;
}
for (const auto& [name, descriptor] : descriptors) {
ret = TEMP_FAILURE_RETRY(write(fd, descriptor.controller(), sizeof(CgroupController)));
if (ret < 0) {
PLOG(ERROR) << "write() failed for " << CGROUPS_RC_PATH;
return false;
}
}
return true;
}
CgroupController::CgroupController(uint32_t version, const std::string& name,
const std::string& path) {
version_ = version;
strncpy(name_, name.c_str(), sizeof(name_) - 1);
name_[sizeof(name_) - 1] = '\0';
strncpy(path_, path.c_str(), sizeof(path_) - 1);
path_[sizeof(path_) - 1] = '\0';
}
std::string CgroupController::GetTasksFilePath(const std::string& path) const {
std::string tasks_path = path_;
if (!path.empty()) {
tasks_path += "/" + path;
}
return (version_ == 1) ? tasks_path + CGROUP_TASKS_FILE : tasks_path + CGROUP_TASKS_FILE_V2;
}
std::string CgroupController::GetProcsFilePath(const std::string& path, uid_t uid,
pid_t pid) const { pid_t pid) const {
std::string proc_path(path_); std::string proc_path(path());
proc_path.append("/").append(path); proc_path.append("/").append(rel_path);
proc_path = regex_replace(proc_path, std::regex("<uid>"), std::to_string(uid)); proc_path = regex_replace(proc_path, std::regex("<uid>"), std::to_string(uid));
proc_path = regex_replace(proc_path, std::regex("<pid>"), std::to_string(pid)); proc_path = regex_replace(proc_path, std::regex("<pid>"), std::to_string(pid));
@ -302,7 +100,7 @@ bool CgroupController::GetTaskGroup(int tid, std::string* group) const {
return true; return true;
} }
std::string cg_tag = StringPrintf(":%s:", name_); std::string cg_tag = StringPrintf(":%s:", name());
size_t start_pos = content.find(cg_tag); size_t start_pos = content.find(cg_tag);
if (start_pos == std::string::npos) { if (start_pos == std::string::npos) {
return false; return false;
@ -319,25 +117,12 @@ bool CgroupController::GetTaskGroup(int tid, std::string* group) const {
return true; return true;
} }
CgroupDescriptor::CgroupDescriptor(uint32_t version, const std::string& name, CgroupMap::CgroupMap() {
const std::string& path, mode_t mode, const std::string& uid,
const std::string& gid)
: controller_(version, name, path), mode_(mode), uid_(uid), gid_(gid) {}
CgroupMap::CgroupMap() : cg_file_data_(nullptr), cg_file_size_(0) {
if (!LoadRcFile()) { if (!LoadRcFile()) {
LOG(ERROR) << "CgroupMap::LoadRcFile called for [" << getpid() << "] failed"; LOG(ERROR) << "CgroupMap::LoadRcFile called for [" << getpid() << "] failed";
} }
} }
CgroupMap::~CgroupMap() {
if (cg_file_data_) {
munmap(cg_file_data_, cg_file_size_);
cg_file_data_ = nullptr;
cg_file_size_ = 0;
}
}
CgroupMap& CgroupMap::GetInstance() { CgroupMap& CgroupMap::GetInstance() {
// Deliberately leak this object to avoid a race between destruction on // Deliberately leak this object to avoid a race between destruction on
// process exit and concurrent access from another thread. // process exit and concurrent access from another thread.
@ -346,139 +131,46 @@ CgroupMap& CgroupMap::GetInstance() {
} }
bool CgroupMap::LoadRcFile() { bool CgroupMap::LoadRcFile() {
struct stat sb; if (!loaded_) {
loaded_ = (ACgroupFile_getVersion() != 0);
if (cg_file_data_) {
// Data already initialized
return true;
} }
return loaded_;
unique_fd fd(TEMP_FAILURE_RETRY(open(CGROUPS_RC_PATH, O_RDONLY | O_CLOEXEC)));
if (fd < 0) {
PLOG(ERROR) << "open() failed for " << CGROUPS_RC_PATH;
return false;
}
if (fstat(fd, &sb) < 0) {
PLOG(ERROR) << "fstat() failed for " << CGROUPS_RC_PATH;
return false;
}
size_t file_size = sb.st_size;
if (file_size < sizeof(CgroupFile)) {
LOG(ERROR) << "Invalid file format " << CGROUPS_RC_PATH;
return false;
}
CgroupFile* file_data = (CgroupFile*)mmap(nullptr, file_size, PROT_READ, MAP_SHARED, fd, 0);
if (file_data == MAP_FAILED) {
PLOG(ERROR) << "Failed to mmap " << CGROUPS_RC_PATH;
return false;
}
if (file_data->version_ != CgroupFile::FILE_CURR_VERSION) {
LOG(ERROR) << CGROUPS_RC_PATH << " file version mismatch";
munmap(file_data, file_size);
return false;
}
if (file_size != sizeof(CgroupFile) + file_data->controller_count_ * sizeof(CgroupController)) {
LOG(ERROR) << CGROUPS_RC_PATH << " file has invalid size";
munmap(file_data, file_size);
return false;
}
cg_file_data_ = file_data;
cg_file_size_ = file_size;
return true;
} }
void CgroupMap::Print() const { void CgroupMap::Print() const {
if (!cg_file_data_) { if (!loaded_) {
LOG(ERROR) << "CgroupMap::Print called for [" << getpid() LOG(ERROR) << "CgroupMap::Print called for [" << getpid()
<< "] failed, RC file was not initialized properly"; << "] failed, RC file was not initialized properly";
return; return;
} }
LOG(INFO) << "File version = " << cg_file_data_->version_; LOG(INFO) << "File version = " << ACgroupFile_getVersion();
LOG(INFO) << "File controller count = " << cg_file_data_->controller_count_; LOG(INFO) << "File controller count = " << ACgroupFile_getControllerCount();
LOG(INFO) << "Mounted cgroups:"; LOG(INFO) << "Mounted cgroups:";
CgroupController* controller = (CgroupController*)(cg_file_data_ + 1);
for (int i = 0; i < cg_file_data_->controller_count_; i++, controller++) { auto controller_count = ACgroupFile_getControllerCount();
LOG(INFO) << "\t" << controller->name() << " ver " << controller->version() << " path " for (uint32_t i = 0; i < controller_count; ++i) {
<< controller->path(); const ACgroupController* controller = ACgroupFile_getController(i);
LOG(INFO) << "\t" << ACgroupController_getName(controller) << " ver "
<< ACgroupController_getVersion(controller) << " path "
<< ACgroupController_getPath(controller);
} }
} }
bool CgroupMap::SetupCgroups() { CgroupController CgroupMap::FindController(const std::string& name) const {
std::map<std::string, CgroupDescriptor> descriptors; if (!loaded_) {
if (getpid() != 1) {
LOG(ERROR) << "Cgroup setup can be done only by init process";
return false;
}
// Make sure we do this only one time. No need for std::call_once because
// init is a single-threaded process
if (access(CGROUPS_RC_PATH, F_OK) == 0) {
LOG(WARNING) << "Attempt to call SetupCgroups more than once";
return true;
}
// load cgroups.json file
if (!ReadDescriptors(&descriptors)) {
LOG(ERROR) << "Failed to load cgroup description file";
return false;
}
// setup cgroups
for (const auto& [name, descriptor] : descriptors) {
if (!SetupCgroup(descriptor)) {
// issue a warning and proceed with the next cgroup
// TODO: mark the descriptor as invalid and skip it in WriteRcFile()
LOG(WARNING) << "Failed to setup " << name << " cgroup";
}
}
// mkdir <CGROUPS_RC_DIR> 0711 system system
if (!Mkdir(android::base::Dirname(CGROUPS_RC_PATH), 0711, "system", "system")) {
LOG(ERROR) << "Failed to create directory for " << CGROUPS_RC_PATH << " file";
return false;
}
// Generate <CGROUPS_RC_FILE> file which can be directly mmapped into
// process memory. This optimizes performance, memory usage
// and limits infrormation shared with unprivileged processes
// to the minimum subset of information from cgroups.json
if (!WriteRcFile(descriptors)) {
LOG(ERROR) << "Failed to write " << CGROUPS_RC_PATH << " file";
return false;
}
// chmod 0644 <CGROUPS_RC_PATH>
if (fchmodat(AT_FDCWD, CGROUPS_RC_PATH, 0644, AT_SYMLINK_NOFOLLOW) < 0) {
PLOG(ERROR) << "fchmodat() failed";
return false;
}
return true;
}
const CgroupController* CgroupMap::FindController(const std::string& name) const {
if (!cg_file_data_) {
LOG(ERROR) << "CgroupMap::FindController called for [" << getpid() LOG(ERROR) << "CgroupMap::FindController called for [" << getpid()
<< "] failed, RC file was not initialized properly"; << "] failed, RC file was not initialized properly";
return nullptr; return CgroupController(nullptr);
} }
// skip the file header to get to the first controller auto controller_count = ACgroupFile_getControllerCount();
CgroupController* controller = (CgroupController*)(cg_file_data_ + 1); for (uint32_t i = 0; i < controller_count; ++i) {
for (int i = 0; i < cg_file_data_->controller_count_; i++, controller++) { const ACgroupController* controller = ACgroupFile_getController(i);
if (name == controller->name()) { if (name == ACgroupController_getName(controller)) {
return controller; return CgroupController(controller);
} }
} }
return nullptr; return CgroupController(nullptr);
} }

62
libprocessgroup/cgroup_map.h
View file

@ -20,57 +20,30 @@
#include <sys/types.h> #include <sys/types.h>
#include <map> #include <map>
#include <memory>
#include <mutex> #include <mutex>
#include <string> #include <string>
#include <vector>
// Minimal controller description to be mmapped into process address space #include <android/cgrouprc.h>
// Convenient wrapper of an ACgroupController pointer.
class CgroupController { class CgroupController {
public: public:
CgroupController() {} // Does not own controller
CgroupController(uint32_t version, const std::string& name, const std::string& path); explicit CgroupController(const ACgroupController* controller) : controller_(controller) {}
uint32_t version() const { return version_; } uint32_t version() const;
const char* name() const { return name_; } const char* name() const;
const char* path() const { return path_; } const char* path() const;
bool HasValue() const;
std::string GetTasksFilePath(const std::string& path) const; std::string GetTasksFilePath(const std::string& path) const;
std::string GetProcsFilePath(const std::string& path, uid_t uid, pid_t pid) const; std::string GetProcsFilePath(const std::string& path, uid_t uid, pid_t pid) const;
bool GetTaskGroup(int tid, std::string* group) const; bool GetTaskGroup(int tid, std::string* group) const;
private: private:
static constexpr size_t CGROUP_NAME_BUF_SZ = 16; const ACgroupController* controller_ = nullptr;
static constexpr size_t CGROUP_PATH_BUF_SZ = 32;
uint32_t version_;
char name_[CGROUP_NAME_BUF_SZ];
char path_[CGROUP_PATH_BUF_SZ];
};
// Complete controller description for mounting cgroups
class CgroupDescriptor {
public:
CgroupDescriptor(uint32_t version, const std::string& name, const std::string& path,
mode_t mode, const std::string& uid, const std::string& gid);
const CgroupController* controller() const { return &controller_; }
mode_t mode() const { return mode_; }
std::string uid() const { return uid_; }
std::string gid() const { return gid_; }
private:
CgroupController controller_;
mode_t mode_;
std::string uid_;
std::string gid_;
};
struct CgroupFile {
static constexpr uint32_t FILE_VERSION_1 = 1;
static constexpr uint32_t FILE_CURR_VERSION = FILE_VERSION_1;
uint32_t version_;
uint32_t controller_count_;
CgroupController controllers_[];
}; };
class CgroupMap { class CgroupMap {
@ -79,16 +52,11 @@ class CgroupMap {
static bool SetupCgroups(); static bool SetupCgroups();
static CgroupMap& GetInstance(); static CgroupMap& GetInstance();
CgroupController FindController(const std::string& name) const;
const CgroupController* FindController(const std::string& name) const;
private: private:
struct CgroupFile* cg_file_data_; bool loaded_ = false;
size_t cg_file_size_;
CgroupMap(); CgroupMap();
~CgroupMap();
bool LoadRcFile(); bool LoadRcFile();
void Print() const; void Print() const;
}; };

57
libprocessgroup/cgrouprc/Android.bp Normal file
View file

@ -0,0 +1,57 @@
// Copyright (C) 2019 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
cc_library {
name: "libcgrouprc",
host_supported: true,
recovery_available: true,
// Do not ever mark this as vendor_available; otherwise, vendor modules
// that links to the static library will behave unexpectedly. All on-device
// modules should use libprocessgroup which links to the LL-NDK library
// defined below. The static library is built for tests.
vendor_available: false,
srcs: [
"cgroup_controller.cpp",
"cgroup_file.cpp",
],
cflags: [
"-Wall",
"-Werror",
],
export_include_dirs: [
"include",
],
header_libs: [
"libprocessgroup_headers",
],
shared_libs: [
"libbase",
],
static_libs: [
"libcgrouprc_format",
],
stubs: {
symbol_file: "libcgrouprc.map.txt",
versions: ["29"],
},
version_script: "libcgrouprc.map.txt",
}
llndk_library {
name: "libcgrouprc",
symbol_file: "libcgrouprc.map.txt",
export_include_dirs: [
"include",
],
}

38
libprocessgroup/cgrouprc/cgroup_controller.cpp Normal file
View file

@ -0,0 +1,38 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <android-base/logging.h>
#include <android/cgrouprc.h>
#include "cgrouprc_internal.h"
// All ACgroupController_* functions implicitly convert the pointer back
// to the original CgroupController pointer before invoking the member functions.
uint32_t ACgroupController_getVersion(const ACgroupController* controller) {
CHECK(controller != nullptr);
return controller->version();
}
const char* ACgroupController_getName(const ACgroupController* controller) {
CHECK(controller != nullptr);
return controller->name();
}
const char* ACgroupController_getPath(const ACgroupController* controller) {
CHECK(controller != nullptr);
return controller->path();
}

106
libprocessgroup/cgrouprc/cgroup_file.cpp Normal file
View file

@ -0,0 +1,106 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <sys/mman.h>
#include <sys/stat.h>
#include <memory>
#include <android-base/logging.h>
#include <android-base/stringprintf.h>
#include <android-base/unique_fd.h>
#include <android/cgrouprc.h>
#include <processgroup/processgroup.h>
#include "cgrouprc_internal.h"
using android::base::StringPrintf;
using android::base::unique_fd;
using android::cgrouprc::format::CgroupController;
using android::cgrouprc::format::CgroupFile;
static CgroupFile* LoadRcFile() {
struct stat sb;
unique_fd fd(TEMP_FAILURE_RETRY(open(CGROUPS_RC_PATH, O_RDONLY | O_CLOEXEC)));
if (fd < 0) {
PLOG(ERROR) << "open() failed for " << CGROUPS_RC_PATH;
return nullptr;
}
if (fstat(fd, &sb) < 0) {
PLOG(ERROR) << "fstat() failed for " << CGROUPS_RC_PATH;
return nullptr;
}
size_t file_size = sb.st_size;
if (file_size < sizeof(CgroupFile)) {
LOG(ERROR) << "Invalid file format " << CGROUPS_RC_PATH;
return nullptr;
}
CgroupFile* file_data = (CgroupFile*)mmap(nullptr, file_size, PROT_READ, MAP_SHARED, fd, 0);
if (file_data == MAP_FAILED) {
PLOG(ERROR) << "Failed to mmap " << CGROUPS_RC_PATH;
return nullptr;
}
if (file_data->version_ != CgroupFile::FILE_CURR_VERSION) {
LOG(ERROR) << CGROUPS_RC_PATH << " file version mismatch";
munmap(file_data, file_size);
return nullptr;
}
auto expected = sizeof(CgroupFile) + file_data->controller_count_ * sizeof(CgroupController);
if (file_size != expected) {
LOG(ERROR) << CGROUPS_RC_PATH << " file has invalid size, expected " << expected
<< ", actual " << file_size;
munmap(file_data, file_size);
return nullptr;
}
return file_data;
}
static CgroupFile* GetInstance() {
// Deliberately leak this object (not munmap) to avoid a race between destruction on
// process exit and concurrent access from another thread.
static auto* file = LoadRcFile();
return file;
}
uint32_t ACgroupFile_getVersion() {
auto file = GetInstance();
if (file == nullptr) return 0;
return file->version_;
}
uint32_t ACgroupFile_getControllerCount() {
auto file = GetInstance();
if (file == nullptr) return 0;
return file->controller_count_;
}
const ACgroupController* ACgroupFile_getController(uint32_t index) {
auto file = GetInstance();
if (file == nullptr) return nullptr;
CHECK(index < file->controller_count_);
// Although the object is not actually an ACgroupController object, all ACgroupController_*
// functions implicitly convert ACgroupController* back to CgroupController* before invoking
// member functions.
return static_cast<ACgroupController*>(&file->controllers_[index]);
}

24
libprocessgroup/cgrouprc/cgrouprc_internal.h Normal file
View file

@ -0,0 +1,24 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#pragma once
#include <android/cgrouprc.h>
#include <processgroup/format/cgroup_controller.h>
#include <processgroup/format/cgroup_file.h>
struct ACgroupController : android::cgrouprc::format::CgroupController {};

84
libprocessgroup/cgrouprc/include/android/cgrouprc.h Normal file
View file

@ -0,0 +1,84 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#pragma once
#include <stdint.h>
__BEGIN_DECLS
// For host builds, __INTRODUCED_IN is not defined.
#ifndef __INTRODUCED_IN
#define __INTRODUCED_IN(x)
#endif
struct ACgroupController;
typedef struct ACgroupController ACgroupController;
#if __ANDROID_API__ >= __ANDROID_API_Q__
// ACgroupFile
/**
* Returns file version. See android::cgrouprc::format::CgroupFile for a list of valid versions
* for the file.
* If ACgroupFile_init() isn't called, initialization will be done first.
* If initialization failed, return 0.
*/
__attribute__((warn_unused_result)) uint32_t ACgroupFile_getVersion() __INTRODUCED_IN(29);
/**
* Returns the number of controllers.
* If ACgroupFile_init() isn't called, initialization will be done first.
* If initialization failed, return 0.
*/
__attribute__((warn_unused_result)) uint32_t ACgroupFile_getControllerCount() __INTRODUCED_IN(29);
/**
* Returns the controller at the given index.
* Returnss nullptr if the given index exceeds getControllerCount().
* If ACgroupFile_init() isn't called, initialization will be done first.
* If initialization failed, return 0.
*/
__attribute__((warn_unused_result)) const ACgroupController* ACgroupFile_getController(
uint32_t index) __INTRODUCED_IN(29);
// ACgroupController
/**
* Returns the version of the given controller.
* If the given controller is null, return 0.
*/
__attribute__((warn_unused_result)) uint32_t ACgroupController_getVersion(const ACgroupController*)
__INTRODUCED_IN(29);
/**
* Returns the name of the given controller.
* If the given controller is null, return nullptr.
*/
__attribute__((warn_unused_result)) const char* ACgroupController_getName(const ACgroupController*)
__INTRODUCED_IN(29);
/**
* Returns the path of the given controller.
* If the given controller is null, return nullptr.
*/
__attribute__((warn_unused_result)) const char* ACgroupController_getPath(const ACgroupController*)
__INTRODUCED_IN(29);
__END_DECLS
#endif

11
libprocessgroup/cgrouprc/libcgrouprc.map.txt Normal file
View file

@ -0,0 +1,11 @@
LIBCGROUPRC { # introduced=29
global:
ACgroupFile_getVersion;
ACgroupFile_getControllerCount;
ACgroupFile_getController;
ACgroupController_getVersion;
ACgroupController_getName;
ACgroupController_getPath;
local:
*;
};

32
libprocessgroup/cgrouprc_format/Android.bp Normal file
View file

@ -0,0 +1,32 @@
// Copyright (C) 2019 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
cc_library_static {
name: "libcgrouprc_format",
host_supported: true,
recovery_available: true,
srcs: [
"cgroup_controller.cpp",
],
cflags: [
"-Wall",
"-Werror",
],
export_include_dirs: [
"include",
],
shared_libs: [
"libbase",
],
}

49
libprocessgroup/cgrouprc_format/cgroup_controller.cpp Normal file
View file

@ -0,0 +1,49 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <processgroup/format/cgroup_controller.h>
namespace android {
namespace cgrouprc {
namespace format {
CgroupController::CgroupController(uint32_t version, const std::string& name,
const std::string& path) {
// strlcpy isn't available on host. Although there is an implementation
// in licutils, libcutils itself depends on libcgrouprc_format, causing
// a circular dependency.
version_ = version;
strncpy(name_, name.c_str(), sizeof(name_) - 1);
name_[sizeof(name_) - 1] = '\0';
strncpy(path_, path.c_str(), sizeof(path_) - 1);
path_[sizeof(path_) - 1] = '\0';
}
uint32_t CgroupController::version() const {
return version_;
}
const char* CgroupController::name() const {
return name_;
}
const char* CgroupController::path() const {
return path_;
}
} // namespace format
} // namespace cgrouprc
} // namespace android

47
libprocessgroup/cgrouprc_format/include/processgroup/format/cgroup_controller.h Normal file
View file

@ -0,0 +1,47 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#pragma once
#include <stdint.h>
#include <string>
namespace android {
namespace cgrouprc {
namespace format {
// Minimal controller description to be mmapped into process address space
struct CgroupController {
public:
CgroupController() {}
CgroupController(uint32_t version, const std::string& name, const std::string& path);
uint32_t version() const;
const char* name() const;
const char* path() const;
private:
static constexpr size_t CGROUP_NAME_BUF_SZ = 16;
static constexpr size_t CGROUP_PATH_BUF_SZ = 32;
uint32_t version_;
char name_[CGROUP_NAME_BUF_SZ];
char path_[CGROUP_PATH_BUF_SZ];
};
} // namespace format
} // namespace cgrouprc
} // namespace android

36
libprocessgroup/cgrouprc_format/include/processgroup/format/cgroup_file.h Normal file
View file

@ -0,0 +1,36 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#pragma once
#include <processgroup/format/cgroup_controller.h>
namespace android {
namespace cgrouprc {
namespace format {
struct CgroupFile {
uint32_t version_;
uint32_t controller_count_;
CgroupController controllers_[];
static constexpr uint32_t FILE_VERSION_1 = 1;
static constexpr uint32_t FILE_CURR_VERSION = FILE_VERSION_1;
};
} // namespace format
} // namespace cgrouprc
} // namespace android

1
libprocessgroup/include/processgroup/processgroup.h
View file

@ -26,7 +26,6 @@ __BEGIN_DECLS
static constexpr const char* CGROUPV2_CONTROLLER_NAME = "cgroup2"; static constexpr const char* CGROUPV2_CONTROLLER_NAME = "cgroup2";
static constexpr const char* CGROUPS_RC_PATH = "/dev/cgroup_info/cgroup.rc"; static constexpr const char* CGROUPS_RC_PATH = "/dev/cgroup_info/cgroup.rc";
bool CgroupSetupCgroups();
bool CgroupGetControllerPath(const std::string& cgroup_name, std::string* path); bool CgroupGetControllerPath(const std::string& cgroup_name, std::string* path);
bool CgroupGetAttributePath(const std::string& attr_name, std::string* path); bool CgroupGetAttributePath(const std::string& attr_name, std::string* path);
bool CgroupGetAttributePathForTask(const std::string& attr_name, int tid, std::string* path); bool CgroupGetAttributePathForTask(const std::string& attr_name, int tid, std::string* path);

12
libprocessgroup/processgroup.cpp
View file

@ -55,19 +55,15 @@ using namespace std::chrono_literals;
#define PROCESSGROUP_CGROUP_PROCS_FILE "/cgroup.procs" #define PROCESSGROUP_CGROUP_PROCS_FILE "/cgroup.procs"
bool CgroupSetupCgroups() {
return CgroupMap::SetupCgroups();
}
bool CgroupGetControllerPath(const std::string& cgroup_name, std::string* path) { bool CgroupGetControllerPath(const std::string& cgroup_name, std::string* path) {
const CgroupController* controller = CgroupMap::GetInstance().FindController(cgroup_name); auto controller = CgroupMap::GetInstance().FindController(cgroup_name);
if (controller == nullptr) { if (!controller.HasValue()) {
return false; return false;
} }
if (path) { if (path) {
*path = controller->path(); *path = controller.path();
} }
return true; return true;
@ -111,7 +107,7 @@ bool UsePerAppMemcg() {
static bool isMemoryCgroupSupported() { static bool isMemoryCgroupSupported() {
std::string cgroup_name; std::string cgroup_name;
static bool memcg_supported = (CgroupMap::GetInstance().FindController("memory") != nullptr); static bool memcg_supported = CgroupMap::GetInstance().FindController("memory").HasValue();
return memcg_supported; return memcg_supported;
} }

10
libprocessgroup/sched_policy.cpp
View file

@ -152,21 +152,21 @@ int set_sched_policy(int tid, SchedPolicy policy) {
} }
bool cpusets_enabled() { bool cpusets_enabled() {
static bool enabled = (CgroupMap::GetInstance().FindController("cpuset") != nullptr); static bool enabled = (CgroupMap::GetInstance().FindController("cpuset").HasValue());
return enabled; return enabled;
} }
bool schedboost_enabled() { bool schedboost_enabled() {
static bool enabled = (CgroupMap::GetInstance().FindController("schedtune") != nullptr); static bool enabled = (CgroupMap::GetInstance().FindController("schedtune").HasValue());
return enabled; return enabled;
} }
static int getCGroupSubsys(int tid, const char* subsys, std::string& subgroup) { static int getCGroupSubsys(int tid, const char* subsys, std::string& subgroup) {
const CgroupController* controller = CgroupMap::GetInstance().FindController(subsys); auto controller = CgroupMap::GetInstance().FindController(subsys);
if (!controller) return -1; if (!controller.HasValue()) return -1;
if (!controller->GetTaskGroup(tid, &subgroup)) { if (!controller.GetTaskGroup(tid, &subgroup)) {
LOG(ERROR) << "Failed to find cgroup for tid " << tid; LOG(ERROR) << "Failed to find cgroup for tid " << tid;
return -1; return -1;
} }

44
libprocessgroup/setup/Android.bp Normal file
View file

@ -0,0 +1,44 @@
//
// Copyright (C) 2019 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
cc_library_shared {
name: "libprocessgroup_setup",
recovery_available: true,
srcs: [
"cgroup_map_write.cpp",
],
export_include_dirs: [
"include",
],
shared_libs: [
"libbase",
"libcgrouprc",
"libjsoncpp",
],
static_libs: [
"libcgrouprc_format",
],
header_libs: [
"libprocessgroup_headers",
],
export_header_lib_headers: [
"libprocessgroup_headers",
],
cflags: [
"-Wall",
"-Werror",
],
}

43
libprocessgroup/setup/cgroup_descriptor.h Normal file
View file

@ -0,0 +1,43 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#pragma once
#include <processgroup/format/cgroup_controller.h>
namespace android {
namespace cgrouprc {
// Complete controller description for mounting cgroups
class CgroupDescriptor {
public:
CgroupDescriptor(uint32_t version, const std::string& name, const std::string& path,
mode_t mode, const std::string& uid, const std::string& gid);
const format::CgroupController* controller() const { return &controller_; }
mode_t mode() const { return mode_; }
std::string uid() const { return uid_; }
std::string gid() const { return gid_; }
private:
format::CgroupController controller_;
mode_t mode_ = 0;
std::string uid_;
std::string gid_;
};
} // namespace cgrouprc
} // namespace android

334
libprocessgroup/setup/cgroup_map_write.cpp Normal file
View file

@ -0,0 +1,334 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
//#define LOG_NDEBUG 0
#define LOG_TAG "libprocessgroup"
#include <errno.h>
#include <fcntl.h>
#include <grp.h>
#include <pwd.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <time.h>
#include <unistd.h>
#include <regex>
#include <android-base/file.h>
#include <android-base/logging.h>
#include <android-base/properties.h>
#include <android-base/stringprintf.h>
#include <android-base/unique_fd.h>
#include <json/reader.h>
#include <json/value.h>
#include <processgroup/format/cgroup_file.h>
#include <processgroup/processgroup.h>
#include <processgroup/setup.h>
#include "cgroup_descriptor.h"
using android::base::GetBoolProperty;
using android::base::StringPrintf;
using android::base::unique_fd;
namespace android {
namespace cgrouprc {
static constexpr const char* CGROUPS_DESC_FILE = "/etc/cgroups.json";
static constexpr const char* CGROUPS_DESC_VENDOR_FILE = "/vendor/etc/cgroups.json";
static bool Mkdir(const std::string& path, mode_t mode, const std::string& uid,
const std::string& gid) {
if (mode == 0) {
mode = 0755;
}
if (mkdir(path.c_str(), mode) != 0) {
/* chmod in case the directory already exists */
if (errno == EEXIST) {
if (fchmodat(AT_FDCWD, path.c_str(), mode, AT_SYMLINK_NOFOLLOW) != 0) {
// /acct is a special case when the directory already exists
// TODO: check if file mode is already what we want instead of using EROFS
if (errno != EROFS) {
PLOG(ERROR) << "fchmodat() failed for " << path;
return false;
}
}
} else {
PLOG(ERROR) << "mkdir() failed for " << path;
return false;
}
}
if (uid.empty()) {
return true;
}
passwd* uid_pwd = getpwnam(uid.c_str());
if (!uid_pwd) {
PLOG(ERROR) << "Unable to decode UID for '" << uid << "'";
return false;
}
uid_t pw_uid = uid_pwd->pw_uid;
gid_t gr_gid = -1;
if (!gid.empty()) {
group* gid_pwd = getgrnam(gid.c_str());
if (!gid_pwd) {
PLOG(ERROR) << "Unable to decode GID for '" << gid << "'";
return false;
}
gr_gid = gid_pwd->gr_gid;
}
if (lchown(path.c_str(), pw_uid, gr_gid) < 0) {
PLOG(ERROR) << "lchown() failed for " << path;
return false;
}
/* chown may have cleared S_ISUID and S_ISGID, chmod again */
if (mode & (S_ISUID | S_ISGID)) {
if (fchmodat(AT_FDCWD, path.c_str(), mode, AT_SYMLINK_NOFOLLOW) != 0) {
PLOG(ERROR) << "fchmodat() failed for " << path;
return false;
}
}
return true;
}
static bool ReadDescriptorsFromFile(const std::string& file_name,
std::map<std::string, CgroupDescriptor>* descriptors) {
std::vector<CgroupDescriptor> result;
std::string json_doc;
if (!android::base::ReadFileToString(file_name, &json_doc)) {
PLOG(ERROR) << "Failed to read task profiles from " << file_name;
return false;
}
Json::Reader reader;
Json::Value root;
if (!reader.parse(json_doc, root)) {
LOG(ERROR) << "Failed to parse cgroups description: " << reader.getFormattedErrorMessages();
return false;
}
if (root.isMember("Cgroups")) {
const Json::Value& cgroups = root["Cgroups"];
for (Json::Value::ArrayIndex i = 0; i < cgroups.size(); ++i) {
std::string name = cgroups[i]["Controller"].asString();
auto iter = descriptors->find(name);
if (iter == descriptors->end()) {
descriptors->emplace(
name, CgroupDescriptor(
1, name, cgroups[i]["Path"].asString(),
std::strtoul(cgroups[i]["Mode"].asString().c_str(), 0, 8),
cgroups[i]["UID"].asString(), cgroups[i]["GID"].asString()));
} else {
iter->second = CgroupDescriptor(
1, name, cgroups[i]["Path"].asString(),
std::strtoul(cgroups[i]["Mode"].asString().c_str(), 0, 8),
cgroups[i]["UID"].asString(), cgroups[i]["GID"].asString());
}
}
}
if (root.isMember("Cgroups2")) {
const Json::Value& cgroups2 = root["Cgroups2"];
auto iter = descriptors->find(CGROUPV2_CONTROLLER_NAME);
if (iter == descriptors->end()) {
descriptors->emplace(
CGROUPV2_CONTROLLER_NAME,
CgroupDescriptor(2, CGROUPV2_CONTROLLER_NAME, cgroups2["Path"].asString(),
std::strtoul(cgroups2["Mode"].asString().c_str(), 0, 8),
cgroups2["UID"].asString(), cgroups2["GID"].asString()));
} else {
iter->second =
CgroupDescriptor(2, CGROUPV2_CONTROLLER_NAME, cgroups2["Path"].asString(),
std::strtoul(cgroups2["Mode"].asString().c_str(), 0, 8),
cgroups2["UID"].asString(), cgroups2["GID"].asString());
}
}
return true;
}
static bool ReadDescriptors(std::map<std::string, CgroupDescriptor>* descriptors) {
// load system cgroup descriptors
if (!ReadDescriptorsFromFile(CGROUPS_DESC_FILE, descriptors)) {
return false;
}
// load vendor cgroup descriptors if the file exists
if (!access(CGROUPS_DESC_VENDOR_FILE, F_OK) &&
!ReadDescriptorsFromFile(CGROUPS_DESC_VENDOR_FILE, descriptors)) {
return false;
}
return true;
}
// To avoid issues in sdk_mac build
#if defined(__ANDROID__)
static bool SetupCgroup(const CgroupDescriptor& descriptor) {
const format::CgroupController* controller = descriptor.controller();
// mkdir <path> [mode] [owner] [group]
if (!Mkdir(controller->path(), descriptor.mode(), descriptor.uid(), descriptor.gid())) {
LOG(ERROR) << "Failed to create directory for " << controller->name() << " cgroup";
return false;
}
int result;
if (controller->version() == 2) {
result = mount("none", controller->path(), "cgroup2", MS_NODEV | MS_NOEXEC | MS_NOSUID,
nullptr);
} else {
// Unfortunately historically cpuset controller was mounted using a mount command
// different from all other controllers. This results in controller attributes not
// to be prepended with controller name. For example this way instead of
// /dev/cpuset/cpuset.cpus the attribute becomes /dev/cpuset/cpus which is what
// the system currently expects.
if (!strcmp(controller->name(), "cpuset")) {
// mount cpuset none /dev/cpuset nodev noexec nosuid
result = mount("none", controller->path(), controller->name(),
MS_NODEV | MS_NOEXEC | MS_NOSUID, nullptr);
} else {
// mount cgroup none <path> nodev noexec nosuid <controller>
result = mount("none", controller->path(), "cgroup", MS_NODEV | MS_NOEXEC | MS_NOSUID,
controller->name());
}
}
if (result < 0) {
PLOG(ERROR) << "Failed to mount " << controller->name() << " cgroup";
return false;
}
return true;
}
#else
// Stubs for non-Android targets.
static bool SetupCgroup(const CgroupDescriptor&) {
return false;
}
#endif
// WARNING: This function should be called only from SetupCgroups and only once.
// It intentionally leaks an FD, so additional invocation will result in additional leak.
static bool WriteRcFile(const std::map<std::string, CgroupDescriptor>& descriptors) {
// WARNING: We are intentionally leaking the FD to keep the file open forever.
// Let init keep the FD open to prevent file mappings from becoming invalid in
// case the file gets deleted somehow.
int fd = TEMP_FAILURE_RETRY(open(CGROUPS_RC_PATH, O_CREAT | O_WRONLY | O_TRUNC | O_CLOEXEC,
S_IRUSR | S_IRGRP | S_IROTH));
if (fd < 0) {
PLOG(ERROR) << "open() failed for " << CGROUPS_RC_PATH;
return false;
}
format::CgroupFile fl;
fl.version_ = format::CgroupFile::FILE_CURR_VERSION;
fl.controller_count_ = descriptors.size();
int ret = TEMP_FAILURE_RETRY(write(fd, &fl, sizeof(fl)));
if (ret < 0) {
PLOG(ERROR) << "write() failed for " << CGROUPS_RC_PATH;
return false;
}
for (const auto& [name, descriptor] : descriptors) {
ret = TEMP_FAILURE_RETRY(
write(fd, descriptor.controller(), sizeof(format::CgroupController)));
if (ret < 0) {
PLOG(ERROR) << "write() failed for " << CGROUPS_RC_PATH;
return false;
}
}
return true;
}
CgroupDescriptor::CgroupDescriptor(uint32_t version, const std::string& name,
const std::string& path, mode_t mode, const std::string& uid,
const std::string& gid)
: controller_(version, name, path), mode_(mode), uid_(uid), gid_(gid) {}
} // namespace cgrouprc
} // namespace android
bool CgroupSetup() {
using namespace android::cgrouprc;
std::map<std::string, CgroupDescriptor> descriptors;
if (getpid() != 1) {
LOG(ERROR) << "Cgroup setup can be done only by init process";
return false;
}
// Make sure we do this only one time. No need for std::call_once because
// init is a single-threaded process
if (access(CGROUPS_RC_PATH, F_OK) == 0) {
LOG(WARNING) << "Attempt to call SetupCgroups more than once";
return true;
}
// load cgroups.json file
if (!ReadDescriptors(&descriptors)) {
LOG(ERROR) << "Failed to load cgroup description file";
return false;
}
// setup cgroups
for (const auto& [name, descriptor] : descriptors) {
if (!SetupCgroup(descriptor)) {
// issue a warning and proceed with the next cgroup
// TODO: mark the descriptor as invalid and skip it in WriteRcFile()
LOG(WARNING) << "Failed to setup " << name << " cgroup";
}
}
// mkdir <CGROUPS_RC_DIR> 0711 system system
if (!Mkdir(android::base::Dirname(CGROUPS_RC_PATH), 0711, "system", "system")) {
LOG(ERROR) << "Failed to create directory for " << CGROUPS_RC_PATH << " file";
return false;
}
// Generate <CGROUPS_RC_FILE> file which can be directly mmapped into
// process memory. This optimizes performance, memory usage
// and limits infrormation shared with unprivileged processes
// to the minimum subset of information from cgroups.json
if (!WriteRcFile(descriptors)) {
LOG(ERROR) << "Failed to write " << CGROUPS_RC_PATH << " file";
return false;
}
// chmod 0644 <CGROUPS_RC_PATH>
if (fchmodat(AT_FDCWD, CGROUPS_RC_PATH, 0644, AT_SYMLINK_NOFOLLOW) < 0) {
PLOG(ERROR) << "fchmodat() failed";
return false;
}
return true;
}

19
libprocessgroup/setup/include/processgroup/setup.h Normal file
View file

@ -0,0 +1,19 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#pragma once
bool CgroupSetup();

25
libprocessgroup/task_profiles.cpp
View file

@ -46,7 +46,7 @@ using android::base::WriteStringToFile;
bool ProfileAttribute::GetPathForTask(int tid, std::string* path) const { bool ProfileAttribute::GetPathForTask(int tid, std::string* path) const {
std::string subgroup; std::string subgroup;
if (!controller_->GetTaskGroup(tid, &subgroup)) { if (!controller()->GetTaskGroup(tid, &subgroup)) {
return false; return false;
} }
@ -55,9 +55,10 @@ bool ProfileAttribute::GetPathForTask(int tid, std::string* path) const {
} }
if (subgroup.empty()) { if (subgroup.empty()) {
*path = StringPrintf("%s/%s", controller_->path(), file_name_.c_str()); *path = StringPrintf("%s/%s", controller()->path(), file_name_.c_str());
} else { } else {
*path = StringPrintf("%s/%s/%s", controller_->path(), subgroup.c_str(), file_name_.c_str()); *path = StringPrintf("%s/%s/%s", controller()->path(), subgroup.c_str(),
file_name_.c_str());
} }
return true; return true;
} }
@ -135,7 +136,7 @@ bool SetCgroupAction::IsAppDependentPath(const std::string& path) {
return path.find("<uid>", 0) != std::string::npos || path.find("<pid>", 0) != std::string::npos; return path.find("<uid>", 0) != std::string::npos || path.find("<pid>", 0) != std::string::npos;
} }
SetCgroupAction::SetCgroupAction(const CgroupController* c, const std::string& p) SetCgroupAction::SetCgroupAction(const CgroupController& c, const std::string& p)
: controller_(c), path_(p) { : controller_(c), path_(p) {
#ifdef CACHE_FILE_DESCRIPTORS #ifdef CACHE_FILE_DESCRIPTORS
// cache file descriptor only if path is app independent // cache file descriptor only if path is app independent
@ -145,7 +146,7 @@ SetCgroupAction::SetCgroupAction(const CgroupController* c, const std::string& p
return; return;
} }
std::string tasks_path = c->GetTasksFilePath(p.c_str()); std::string tasks_path = c.GetTasksFilePath(p);
if (access(tasks_path.c_str(), W_OK) != 0) { if (access(tasks_path.c_str(), W_OK) != 0) {
// file is not accessible // file is not accessible
@ -199,7 +200,7 @@ bool SetCgroupAction::ExecuteForProcess(uid_t uid, pid_t pid) const {
} }
// this is app-dependent path, file descriptor is not cached // this is app-dependent path, file descriptor is not cached
std::string procs_path = controller_->GetProcsFilePath(path_, uid, pid); std::string procs_path = controller()->GetProcsFilePath(path_, uid, pid);
unique_fd tmp_fd(TEMP_FAILURE_RETRY(open(procs_path.c_str(), O_WRONLY | O_CLOEXEC))); unique_fd tmp_fd(TEMP_FAILURE_RETRY(open(procs_path.c_str(), O_WRONLY | O_CLOEXEC)));
if (tmp_fd < 0) { if (tmp_fd < 0) {
PLOG(WARNING) << "Failed to open " << procs_path; PLOG(WARNING) << "Failed to open " << procs_path;
@ -212,7 +213,7 @@ bool SetCgroupAction::ExecuteForProcess(uid_t uid, pid_t pid) const {
return true; return true;
#else #else
std::string procs_path = controller_->GetProcsFilePath(path_, uid, pid); std::string procs_path = controller()->GetProcsFilePath(path_, uid, pid);
unique_fd tmp_fd(TEMP_FAILURE_RETRY(open(procs_path.c_str(), O_WRONLY | O_CLOEXEC))); unique_fd tmp_fd(TEMP_FAILURE_RETRY(open(procs_path.c_str(), O_WRONLY | O_CLOEXEC)));
if (tmp_fd < 0) { if (tmp_fd < 0) {
// no permissions to access the file, ignore // no permissions to access the file, ignore
@ -247,7 +248,7 @@ bool SetCgroupAction::ExecuteForTask(int tid) const {
LOG(ERROR) << "Application profile can't be applied to a thread"; LOG(ERROR) << "Application profile can't be applied to a thread";
return false; return false;
#else #else
std::string tasks_path = controller_->GetTasksFilePath(path_); std::string tasks_path = controller()->GetTasksFilePath(path_);
unique_fd tmp_fd(TEMP_FAILURE_RETRY(open(tasks_path.c_str(), O_WRONLY | O_CLOEXEC))); unique_fd tmp_fd(TEMP_FAILURE_RETRY(open(tasks_path.c_str(), O_WRONLY | O_CLOEXEC)));
if (tmp_fd < 0) { if (tmp_fd < 0) {
// no permissions to access the file, ignore // no permissions to access the file, ignore
@ -326,8 +327,8 @@ bool TaskProfiles::Load(const CgroupMap& cg_map, const std::string& file_name) {
std::string file_attr = attr[i]["File"].asString(); std::string file_attr = attr[i]["File"].asString();
if (attributes_.find(name) == attributes_.end()) { if (attributes_.find(name) == attributes_.end()) {
const CgroupController* controller = cg_map.FindController(controller_name); auto controller = cg_map.FindController(controller_name);
if (controller) { if (controller.HasValue()) {
attributes_[name] = std::make_unique<ProfileAttribute>(controller, file_attr); attributes_[name] = std::make_unique<ProfileAttribute>(controller, file_attr);
} else { } else {
LOG(WARNING) << "Controller " << controller_name << " is not found"; LOG(WARNING) << "Controller " << controller_name << " is not found";
@ -355,8 +356,8 @@ bool TaskProfiles::Load(const CgroupMap& cg_map, const std::string& file_name) {
std::string controller_name = params_val["Controller"].asString(); std::string controller_name = params_val["Controller"].asString();
std::string path = params_val["Path"].asString(); std::string path = params_val["Path"].asString();
const CgroupController* controller = cg_map.FindController(controller_name); auto controller = cg_map.FindController(controller_name);
if (controller) { if (controller.HasValue()) {
profile->Add(std::make_unique<SetCgroupAction>(controller, path)); profile->Add(std::make_unique<SetCgroupAction>(controller, path));
} else { } else {
LOG(WARNING) << "JoinCgroup: controller " << controller_name << " is not found"; LOG(WARNING) << "JoinCgroup: controller " << controller_name << " is not found";

12
libprocessgroup/task_profiles.h
View file

@ -27,16 +27,16 @@
class ProfileAttribute { class ProfileAttribute {
public: public:
ProfileAttribute(const CgroupController* controller, const std::string& file_name) ProfileAttribute(const CgroupController& controller, const std::string& file_name)
: controller_(controller), file_name_(file_name) {} : controller_(controller), file_name_(file_name) {}
const CgroupController* controller() const { return controller_; } const CgroupController* controller() const { return &controller_; }
const std::string& file_name() const { return file_name_; } const std::string& file_name() const { return file_name_; }
bool GetPathForTask(int tid, std::string* path) const; bool GetPathForTask(int tid, std::string* path) const;
private: private:
const CgroupController* controller_; CgroupController controller_;
std::string file_name_; std::string file_name_;
}; };
@ -106,16 +106,16 @@ class SetAttributeAction : public ProfileAction {
// Set cgroup profile element // Set cgroup profile element
class SetCgroupAction : public ProfileAction { class SetCgroupAction : public ProfileAction {
public: public:
SetCgroupAction(const CgroupController* c, const std::string& p); SetCgroupAction(const CgroupController& c, const std::string& p);
virtual bool ExecuteForProcess(uid_t uid, pid_t pid) const; virtual bool ExecuteForProcess(uid_t uid, pid_t pid) const;
virtual bool ExecuteForTask(int tid) const; virtual bool ExecuteForTask(int tid) const;
const CgroupController* controller() const { return controller_; } const CgroupController* controller() const { return &controller_; }
std::string path() const { return path_; } std::string path() const { return path_; }
private: private:
const CgroupController* controller_; CgroupController controller_;
std::string path_; std::string path_;
#ifdef CACHE_FILE_DESCRIPTORS #ifdef CACHE_FILE_DESCRIPTORS
android::base::unique_fd fd_; android::base::unique_fd fd_;

2
rootdir/etc/ld.config.legacy.txt
View file

@ -100,6 +100,7 @@ namespace.media.links = default
namespace.media.link.default.shared_libs = libandroid.so namespace.media.link.default.shared_libs = libandroid.so
namespace.media.link.default.shared_libs += libbinder_ndk.so namespace.media.link.default.shared_libs += libbinder_ndk.so
namespace.media.link.default.shared_libs += libc.so namespace.media.link.default.shared_libs += libc.so
namespace.media.link.default.shared_libs += libcgrouprc.so
namespace.media.link.default.shared_libs += libdl.so namespace.media.link.default.shared_libs += libdl.so
namespace.media.link.default.shared_libs += liblog.so namespace.media.link.default.shared_libs += liblog.so
namespace.media.link.default.shared_libs += libmediametrics.so namespace.media.link.default.shared_libs += libmediametrics.so
@ -143,6 +144,7 @@ namespace.resolv.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB} namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.links = default namespace.resolv.links = default
namespace.resolv.link.default.shared_libs = libc.so namespace.resolv.link.default.shared_libs = libc.so
namespace.resolv.link.default.shared_libs += libcgrouprc.so
namespace.resolv.link.default.shared_libs += libm.so namespace.resolv.link.default.shared_libs += libm.so
namespace.resolv.link.default.shared_libs += libdl.so namespace.resolv.link.default.shared_libs += libdl.so
namespace.resolv.link.default.shared_libs += libbinder_ndk.so namespace.resolv.link.default.shared_libs += libbinder_ndk.so

1
rootdir/etc/ld.config.txt
View file

@ -212,6 +212,7 @@ namespace.resolv.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB} namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.links = default namespace.resolv.links = default
namespace.resolv.link.default.shared_libs = libc.so namespace.resolv.link.default.shared_libs = libc.so
namespace.resolv.link.default.shared_libs += libcgrouprc.so
namespace.resolv.link.default.shared_libs += libm.so namespace.resolv.link.default.shared_libs += libm.so
namespace.resolv.link.default.shared_libs += libdl.so namespace.resolv.link.default.shared_libs += libdl.so
namespace.resolv.link.default.shared_libs += libbinder_ndk.so namespace.resolv.link.default.shared_libs += libbinder_ndk.so

2
rootdir/etc/ld.config.vndk_lite.txt
View file

@ -154,6 +154,7 @@ namespace.resolv.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB} namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.links = default namespace.resolv.links = default
namespace.resolv.link.default.shared_libs = libc.so namespace.resolv.link.default.shared_libs = libc.so
namespace.resolv.link.default.shared_libs += libcgrouprc.so
namespace.resolv.link.default.shared_libs += libm.so namespace.resolv.link.default.shared_libs += libm.so
namespace.resolv.link.default.shared_libs += libdl.so namespace.resolv.link.default.shared_libs += libdl.so
namespace.resolv.link.default.shared_libs += libbinder_ndk.so namespace.resolv.link.default.shared_libs += libbinder_ndk.so
@ -476,6 +477,7 @@ namespace.resolv.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB} namespace.resolv.asan.search.paths = /apex/com.android.resolv/${LIB}
namespace.resolv.links = default namespace.resolv.links = default
namespace.resolv.link.default.shared_libs = libc.so namespace.resolv.link.default.shared_libs = libc.so
namespace.resolv.link.default.shared_libs += libcgrouprc.so
namespace.resolv.link.default.shared_libs += libm.so namespace.resolv.link.default.shared_libs += libm.so
namespace.resolv.link.default.shared_libs += libdl.so namespace.resolv.link.default.shared_libs += libdl.so
namespace.resolv.link.default.shared_libs += libbinder_ndk.so namespace.resolv.link.default.shared_libs += libbinder_ndk.so