d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

jail(8): reset to root cpuset before attaching to run commands

Browse Source 
Recent changes have made it such that attaching to a jail will augment
the attaching process' cpu mask with the jail's cpuset. While this is
convenient for allowing the administrator to cpuset arbitrary programs
that will attach to a jail, this is decidedly not convenient for
executing long-running daemons during jail creation.

This change inserts a reset of the process cpuset to the root cpuset
between the fork and attach to execute a command. This allows commands
executed to have the widest mask possible, and the administrator can
cpuset(1) it back down inside the jail as needed.

With this applied, one should be able to change a jail's cpuset at
exec.poststart in addition to exec.created.  The former was made
difficult if jail(8) itself was running with a constrained set, as then
some processes may have been spawned inside the jail with a non-root
set.  The latter is the preferred option so that processes starting in
the jail are constrained appropriately up front.

Note that all system commands are still run with the process' initial
cpuset applied.

PR:		253724
MFC after:	3 days
Reviewed by:	jamie
Differential Revision:	https://reviews.freebsd.org/D29008
This commit is contained in:
Kyle Evans 2021-03-04 13:28:53 -06:00
parent 6019514b0b
commit 466df976ba
1 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
usr.sbin/jail/command.c
View File

@ -30,6 +30,7 @@
__FBSDID("$FreeBSD$");
#include <sys/types.h>
#include <sys/cpuset.h>
#include <sys/event.h>
#include <sys/mount.h>
#include <sys/stat.h>
@ -84,6 +85,20 @@ static struct cfstring dummystring = { .len = 1 };
static struct phhead phash[PHASH_SIZE];
static int kq;
static cpusetid_t
root_cpuset_id(void)
{
static cpusetid_t setid = CPUSET_INVALID;
static int error;
/* Only try to get the cpuset once. */
if (error == 0 && setid == CPUSET_INVALID)
error = cpuset_getid(CPU_LEVEL_ROOT, CPU_WHICH_PID, -1, &setid);
if (error != 0)
return (CPUSET_INVALID);
return (setid);
}
/*
* Run the next command associated with a jail.
*/
@ -283,6 +298,7 @@ run_command(struct cfjail *j)
enum intparam comparam;
size_t comlen;
pid_t pid;
cpusetid_t setid;
int argc, bg, clean, consfd, down, fib, i, injail, sjuser, timeout;
#if defined(INET) || defined(INET6)
char *addr, *extrap, *p, *val;
@ -632,6 +648,10 @@ run_command(struct cfjail *j)
injail = comparam == IP_EXEC_START || comparam == IP_COMMAND ||
comparam == IP_EXEC_STOP;
if (injail)
setid = root_cpuset_id();
else
setid = CPUSET_INVALID;
clean = bool_param(j->intparams[IP_EXEC_CLEAN]);
username = string_param(j->intparams[injail
? IP_EXEC_JAIL_USER : IP_EXEC_SYSTEM_USER]);
@ -700,6 +720,19 @@ run_command(struct cfjail *j)
jail_warnx(j, "setfib: %s", strerror(errno));
exit(1);
}
/*
* We wouldn't have specialized our affinity, so just setid to
* root. We do this prior to attaching to avoid the kernel
* having to create a transient cpuset that we'll promptly
* free up with a reset to the jail's cpuset.
*
* This is just a best-effort to use as wide of mask as
* possible.
*/
if (setid != CPUSET_INVALID)
(void)cpuset_setid(CPU_WHICH_PID, -1, setid);
if (jail_attach(j->jid) < 0) {
jail_warnx(j, "jail_attach: %s", strerror(errno));
exit(1);