diff options
| author | Lennart Poettering <lennart@poettering.net> | 2018-11-16 20:19:07 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2018-11-26 18:43:23 +0100 |
| commit | 78f93209fc7f61f15b12d7a5f74d712bd020b249 (patch) | |
| tree | 4fd7ad08a0398f12d899af94641fe7b48a6068b8 /src/core/execute.h | |
| parent | a0ee3d93bbac50e5076e666bf17ab9939d57d047 (diff) | |
| download | systemd-78f93209fc7f61f15b12d7a5f74d712bd020b249.tar.gz | |
core: when Delegate=yes is set for a unit, run ExecStartPre= and friends in a subcgroup of the unit
Otherwise we might conflict with the "no-processes-in-inner-cgroup" rule
of cgroupsv2. Consider nspawn starting up and initializing its cgroup
hierarchy with "supervisor/" and "payload/" as subcgroup, with itself
moved into the former and the payload into the latter. Now, if an
ExecStartPre= is run right after it cannot be placed in the main cgroup,
because that is now in inner cgroup with populated children.
Hence, let's run these helpers in another sub-cgroup .control/ below it.
This is somewhat ugly since it weakens the clear separation of
ownership, but given that this is an explicit contract, and double opt-in should be acceptable.
Fixes: #10482
Diffstat (limited to 'src/core/execute.h')
| -rw-r--r-- | src/core/execute.h | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/src/core/execute.h b/src/core/execute.h index 11a9b45dcc..16124cf28c 100644 --- a/src/core/execute.h +++ b/src/core/execute.h @@ -294,12 +294,13 @@ typedef enum ExecFlags { EXEC_CHOWN_DIRECTORIES = 1 << 5, /* chown() the runtime/state/cache/log directories to the user we run as, under all conditions */ EXEC_NSS_BYPASS_BUS = 1 << 6, /* Set the SYSTEMD_NSS_BYPASS_BUS environment variable, to disable nss-systemd for dbus */ EXEC_CGROUP_DELEGATE = 1 << 7, + EXEC_IS_CONTROL = 1 << 8, + EXEC_CONTROL_CGROUP = 1 << 9, /* Place the process not in the indicated cgroup but in a subcgroup '/.control', but only EXEC_CGROUP_DELEGATE and EXEC_IS_CONTROL is set, too */ /* The following are not used by execute.c, but by consumers internally */ - EXEC_PASS_FDS = 1 << 8, - EXEC_IS_CONTROL = 1 << 9, - EXEC_SETENV_RESULT = 1 << 10, - EXEC_SET_WATCHDOG = 1 << 11, + EXEC_PASS_FDS = 1 << 10, + EXEC_SETENV_RESULT = 1 << 11, + EXEC_SET_WATCHDOG = 1 << 12, } ExecFlags; /* Parameters for a specific invocation of a command. This structure is put together right before a command is |