clearlinux/rkt
2
0
Fork 0
mirror of https://github.com/clearlinux/rkt.git synced 2026-09-03 20:31:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1013 from endocode/alban/systemd_v219_refresh_patches

Browse Source 
stage1: refresh systemd patches for v219
This commit is contained in:
Alban Crequy
2015-06-08 22:41:02 +02:00
parent 1960c9f3e0 ae9cdf168e
commit 196da8915b
7 changed files with 107 additions and 133 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stage1/init/init.go
+3 -2
View File
@@ -253,13 +253,14 @@ func getArgsEnv(p *Pod, flavor string, systemdStage1Version string, debug bool)
switch systemdStage1Version {
case "v215":
fallthrough
case "v219":
lfd, err := common.GetRktLockFD()
if err != nil {
return nil, nil, err
}
args = append(args, fmt.Sprintf("--keep-fd=%v", lfd))
case "v219":
// --keep-fd is not needed thanks to
// stage1/rootfs/usr_from_src/patches/v219/0005-nspawn-close-extra-fds-before-execing-init.patch
default:
// since systemd-nspawn v220 (commit 6b7d2e, "nspawn: close extra fds
// before execing init"), fds remain open, so --keep-fd is not needed.
stage1/rootfs/usr_from_src/patches/v219/0001-nspawn-add-keep-fd-support.patch
-112
View File
@@ -1,112 +0,0 @@
From c3e51f4a921cab122c148245c89ea1b6af1e986c Mon Sep 17 00:00:00 2001
From: Vito Caputo <vito.caputo@coreos.com>
Date: Mon, 16 Mar 2015 15:10:15 -0700
Subject: [PATCH 1/4] nspawn: add --keep-fd support
This enables inheriting a file from the executing process which persists
for the duration of the nspawn parent process. Useful in implementing a
robust lifecycle reference tied to the nspawn container, which when
combined with advisory locking can also provide a simple event mechanism
triggered at container exit.
[patch ported to v219 -alban]
---
src/nspawn/nspawn.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 44 insertions(+)
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index fb67251..b7c9da5 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -178,6 +178,7 @@ static bool arg_quiet = false;
static bool arg_share_system = false;
static bool arg_register = true;
static bool arg_keep_unit = false;
+static int arg_keep_fd = -1;
static char **arg_network_interfaces = NULL;
static char **arg_network_macvlan = NULL;
static char **arg_network_ipvlan = NULL;
@@ -246,6 +247,7 @@ static void help(void) {
" --keep-unit Do not register a scope for the machine, reuse\n"
" the service unit nspawn is running in\n"
" --volatile[=MODE] Run the system in volatile mode\n"
+ " --keep-fd=FDNUM Do not close the specified file descriptor\n"
, program_invocation_short_name);
}
@@ -287,6 +289,7 @@ static int parse_argv(int argc, char *argv[]) {
ARG_SHARE_SYSTEM,
ARG_REGISTER,
ARG_KEEP_UNIT,
+ ARG_KEEP_FD,
ARG_NETWORK_INTERFACE,
ARG_NETWORK_MACVLAN,
ARG_NETWORK_IPVLAN,
@@ -322,6 +325,7 @@ static int parse_argv(int argc, char *argv[]) {
{ "share-system", no_argument, NULL, ARG_SHARE_SYSTEM },
{ "register", required_argument, NULL, ARG_REGISTER },
{ "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
+ { "keep-fd", required_argument, NULL, ARG_KEEP_FD },
{ "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE },
{ "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN },
{ "network-ipvlan", required_argument, NULL, ARG_NETWORK_IPVLAN },
@@ -643,6 +647,14 @@ static int parse_argv(int argc, char *argv[]) {
arg_keep_unit = true;
break;
+ case ARG_KEEP_FD:
+ r = safe_atoi(optarg, &arg_keep_fd);
+ if (r < 0) {
+ log_error("Failed to parse --keep-fd= argument: %s", optarg);
+ return r;
+ }
+ break;
+
case ARG_PERSONALITY:
arg_personality = personality_from_string(optarg);
@@ -3614,9 +3626,41 @@ int main(int argc, char *argv[]) {
goto finish;
}
}
+
+ /* if we're keeping an fd open add it to the listen fds set temporarily across fdset_close_others() */
+ if (arg_keep_fd >= 0) {
+ if (!fds) {
+ fds = fdset_new();
+ if (!fds) {
+ r = log_oom();
+ goto finish;
+ }
+ }
+ r = fdset_put(fds, arg_keep_fd);
+ if (r < 0) {
+ log_error_errno(r, "Failed to add kept fd: %m");
+ goto finish;
+ }
+ }
+
fdset_close_others(fds);
log_open();
+ if (arg_keep_fd >= 0) {
+ r = fdset_remove(fds, arg_keep_fd);
+ if (r < 0) {
+ log_error_errno(r, "Failed to remove kept fd: %m");
+ goto finish;
+ }
+
+ /* ensure the kept fd is closed in the child, only the parent keeps it around. */
+ r = fd_cloexec(arg_keep_fd, true);
+ if (r < 0) {
+ log_error_errno(r, "Failed to set cloexec on kept fd: %m");
+ goto finish;
+ }
+ }
+
if (arg_directory) {
assert(!arg_image);
--
2.1.4
stage1/rootfs/usr_from_src/patches/v219/0003-nspawn-drop-sd_booted-check.patch → stage1/rootfs/usr_from_src/patches/v219/0001-nspawn-drop-sd_booted-check.patch
+6 -4
View File
@@ -1,7 +1,7 @@
From ac144a4dd0406c929a7e85d357a269dedac61780 Mon Sep 17 00:00:00 2001
From ba166d0fa6c6e7a022cfc2508120658a6e7bae97 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Tue, 31 Mar 2015 15:34:01 +0200
Subject: [PATCH 3/4] nspawn: drop sd_booted() check
Subject: [PATCH 1/5] nspawn: drop sd_booted() check
We have no such check in any of the other tools, hence don't have one in
nspawn either.
@@ -11,15 +11,17 @@ nspawn either.
Note: removing this check does not mean that we support running nspawn
on non-systemd. We explicitly don't. It just means that we remove the
check for running it like that. You are still on your own if you do...
Origin: upstream, https://github.com/systemd/systemd/commit/4f923a1984476de3441922ee5bf7102ebdd250ef
---
src/nspawn/nspawn.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 5ea07c4..5a30bdd 100644
index fb67251..b5b535c 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -3626,12 +3626,6 @@ int main(int argc, char *argv[]) {
@@ -3599,12 +3599,6 @@ int main(int argc, char *argv[]) {
goto finish;
}
stage1/rootfs/usr_from_src/patches/v219/0004-unit-don-t-add-automatic-dependencies-on-device-unit.patch → stage1/rootfs/usr_from_src/patches/v219/0002-unit-don-t-add-automatic-dependencies-on-device-unit.patch
+4 -2
View File
@@ -1,10 +1,12 @@
From 5bc5f0724a1df0458bd4b9f2d757cb46f5b0d27c Mon Sep 17 00:00:00 2001
From d0ec6449100ebbabe7586da53bc0a29fdf97caf3 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Fri, 24 Apr 2015 17:28:06 +0200
Subject: [PATCH 4/4] unit: don't add automatic dependencies on device units if
Subject: [PATCH 2/5] unit: don't add automatic dependencies on device units if
they aren't supported
http://lists.freedesktop.org/archives/systemd-devel/2015-April/031187.html
Origin: upstream, https://github.com/systemd/systemd/commit/47bc12e1ba35d38edda737dae232088d6d3ae688
---
src/core/unit.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
stage1/rootfs/usr_from_src/patches/v219/0005-nspawn-only-mount-the-cgroup-root-if-it-s-not-alread.patch → stage1/rootfs/usr_from_src/patches/v219/0003-nspawn-only-mount-the-cgroup-root-if-it-s-not-alread.patch
+9 -7
View File
@@ -1,19 +1,21 @@
From 3e0ab7a3c7ffbb03a249f89bb5b0532deecd714d Mon Sep 17 00:00:00 2001
From eb078b430caf7aa8fb8e9ee5c60c77b9a090e946 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Iago=20L=C3=B3pez=20Galeiras?= <iago@endocode.com>
Date: Wed, 13 May 2015 15:45:48 +0200
Subject: [PATCH 5/6] nspawn: only mount the cgroup root if it's not already
Subject: [PATCH 3/5] nspawn: only mount the cgroup root if it's not already
mounted
This allows the user to set the cgroups manually before calling nspawn.
Origin: upstream, https://github.com/systemd/systemd/commit/54b4755f15438c86991d5a4eaadc47150f7e5a84
---
src/nspawn/nspawn.c | 27 +++++++++++++--------------
1 file changed, 13 insertions(+), 14 deletions(-)
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 5a30bdd..f179dcb 100644
index b5b535c..af70f21 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -828,18 +828,19 @@ static int mount_all(const char *dest) {
@@ -808,18 +808,19 @@ static int mount_all(const char *dest) {
} MountPoint;
static const MountPoint mount_table[] = {
@@ -44,7 +46,7 @@ index 5a30bdd..f179dcb 100644
#endif
};
@@ -1024,9 +1025,6 @@ static int mount_cgroup(const char *dest) {
@@ -1004,9 +1005,6 @@ static int mount_cgroup(const char *dest) {
if (r < 0)
return log_error_errno(r, "Failed to determine our own cgroup path: %m");
@@ -54,7 +56,7 @@ index 5a30bdd..f179dcb 100644
for (;;) {
_cleanup_free_ char *controller = NULL, *origin = NULL, *combined = NULL;
@@ -1086,6 +1084,7 @@ static int mount_cgroup(const char *dest) {
@@ -1066,6 +1064,7 @@ static int mount_cgroup(const char *dest) {
if (mount(NULL, systemd_root, NULL, MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, NULL) < 0)
return log_error_errno(errno, "Failed to mount cgroup root read-only: %m");
@@ -63,5 +65,5 @@ index 5a30bdd..f179dcb 100644
return log_error_errno(errno, "Failed to remount %s read-only: %m", cgroup_root);
--
2.4.1
2.1.4
stage1/rootfs/usr_from_src/patches/v219/0006-nspawn-skip-symlink-to-a-combined-cgroup-hierarchy-i.patch → stage1/rootfs/usr_from_src/patches/v219/0004-nspawn-skip-symlink-to-a-combined-cgroup-hierarchy-i.patch
+8 -6
View File
@@ -1,12 +1,14 @@
From 4f30798831619a2ca7b56ef94d7601fe0238f04d Mon Sep 17 00:00:00 2001
From 9caa3733cb49cd88f1c03f6abfb005ad264bc535 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Iago=20L=C3=B3pez=20Galeiras?= <iago@endocode.com>
Date: Wed, 13 May 2015 15:45:49 +0200
Subject: [PATCH 6/6] nspawn: skip symlink to a combined cgroup hierarchy if it
Subject: [PATCH 4/5] nspawn: skip symlink to a combined cgroup hierarchy if it
already exists
If a symlink to a combined cgroup hierarchy already exists and points to
the right path, skip it. This avoids an error when the cgroups are set
manually before calling nspawn.
Origin: upstream, https://github.com/systemd/systemd/commit/875e1014dd9d55cd0692dcce843598cffb2d09b0
---
src/nspawn/nspawn.c | 10 +++++++---
src/shared/util.c | 22 ++++++++++++++++++++++
@@ -14,10 +16,10 @@ manually before calling nspawn.
3 files changed, 31 insertions(+), 3 deletions(-)
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index f179dcb..df912a1 100644
index af70f21..a4e5419 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -1025,7 +1025,6 @@ static int mount_cgroup(const char *dest) {
@@ -1005,7 +1005,6 @@ static int mount_cgroup(const char *dest) {
if (r < 0)
return log_error_errno(r, "Failed to determine our own cgroup path: %m");
@@ -25,7 +27,7 @@ index f179dcb..df912a1 100644
for (;;) {
_cleanup_free_ char *controller = NULL, *origin = NULL, *combined = NULL;
@@ -1065,8 +1064,13 @@ static int mount_cgroup(const char *dest) {
@@ -1045,8 +1044,13 @@ static int mount_cgroup(const char *dest) {
if (r < 0)
return r;
@@ -88,5 +90,5 @@ index a83b588..874e2dc 100644
int mknod_atomic(const char *path, mode_t mode, dev_t dev);
int mkfifo_atomic(const char *path, mode_t mode);
--
2.4.1
2.1.4
stage1/rootfs/usr_from_src/patches/v219/0005-nspawn-close-extra-fds-before-execing-init.patch
+77
View File
@@ -0,0 +1,77 @@
From ad645a63c3e85a6f0efbd4f3655a10b50117318c Mon Sep 17 00:00:00 2001
From: Alban Crequy <alban@endocode.com>
Date: Mon, 18 May 2015 16:45:30 +0200
Subject: [PATCH 5/5] nspawn: close extra fds before execing init
When systemd-nspawn gets exec*()ed, it inherits the followings file
descriptors:
- 0, 1, 2: stdin, stdout, stderr
- SD_LISTEN_FDS_START, ... SD_LISTEN_FDS_START+LISTEN_FDS: file
descriptors passed by the system manager (useful for socket
activation). They are passed to the child process (process leader).
- extra lock fd: rkt passes a locked directory as an extra fd, so the
directory remains locked as long as the container is alive.
systemd-nspawn used to close all open fds except 0, 1, 2 and the
SD_LISTEN_FDS_START..SD_LISTEN_FDS_START+LISTEN_FDS. This patch delays
the close just before the exec so the nspawn process (parent) keeps the
extra fds open.
This patch supersedes the previous attempt ("cloexec extraneous fds"):
http://lists.freedesktop.org/archives/systemd-devel/2015-May/031608.html
Origin: upstream, https://github.com/systemd/systemd/commit/6b7d2e9ea4cdb4cfa1512d37548a1a967623d7f2
---
src/nspawn/nspawn.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index a4e5419..50e576c 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -3602,7 +3602,6 @@ int main(int argc, char *argv[]) {
goto finish;
}
- log_close();
n_fd_passed = sd_listen_fds(false);
if (n_fd_passed > 0) {
r = fdset_new_listen_fds(&fds, false);
@@ -3611,8 +3610,6 @@ int main(int argc, char *argv[]) {
goto finish;
}
}
- fdset_close_others(fds);
- log_open();
if (arg_directory) {
assert(!arg_image);
@@ -4100,6 +4097,17 @@ int main(int argc, char *argv[]) {
if (!barrier_place_and_sync(&barrier))
_exit(EXIT_FAILURE);
+ /* Now, explicitly close the log, so that we
+ * then can close all remaining fds. Closing
+ * the log explicitly first has the benefit
+ * that the logging subsystem knows about it,
+ * and is thus ready to be reopened should we
+ * need it again. Note that the other fds
+ * closed here are at least the locking and
+ * barrier fds. */
+ log_close();
+ (void) fdset_close_others(fds);
+
if (arg_boot) {
char **a;
size_t l;
@@ -4126,6 +4134,7 @@ int main(int argc, char *argv[]) {
execle("/bin/sh", "-sh", NULL, env_use);
}
+ (void) log_open();
log_error_errno(errno, "execv() failed: %m");
_exit(EXIT_FAILURE);
}
--
2.1.4