diff --git a/stage1/init/init.go b/stage1/init/init.go index 57553a3..da114c2 100644 --- a/stage1/init/init.go +++ b/stage1/init/init.go @@ -253,13 +253,14 @@ func getArgsEnv(p *Pod, flavor string, systemdStage1Version string, debug bool) switch systemdStage1Version { case "v215": - fallthrough - case "v219": lfd, err := common.GetRktLockFD() if err != nil { return nil, nil, err } args = append(args, fmt.Sprintf("--keep-fd=%v", lfd)) + case "v219": + // --keep-fd is not needed thanks to + // stage1/rootfs/usr_from_src/patches/v219/0005-nspawn-close-extra-fds-before-execing-init.patch default: // since systemd-nspawn v220 (commit 6b7d2e, "nspawn: close extra fds // before execing init"), fds remain open, so --keep-fd is not needed. diff --git a/stage1/rootfs/usr_from_src/patches/v219/0001-nspawn-add-keep-fd-support.patch b/stage1/rootfs/usr_from_src/patches/v219/0001-nspawn-add-keep-fd-support.patch deleted file mode 100644 index c545248..0000000 --- a/stage1/rootfs/usr_from_src/patches/v219/0001-nspawn-add-keep-fd-support.patch +++ /dev/null @@ -1,112 +0,0 @@ -From c3e51f4a921cab122c148245c89ea1b6af1e986c Mon Sep 17 00:00:00 2001 -From: Vito Caputo -Date: Mon, 16 Mar 2015 15:10:15 -0700 -Subject: [PATCH 1/4] nspawn: add --keep-fd support - -This enables inheriting a file from the executing process which persists -for the duration of the nspawn parent process. Useful in implementing a -robust lifecycle reference tied to the nspawn container, which when -combined with advisory locking can also provide a simple event mechanism -triggered at container exit. - -[patch ported to v219 -alban] ---- - src/nspawn/nspawn.c | 44 ++++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 44 insertions(+) - -diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c -index fb67251..b7c9da5 100644 ---- a/src/nspawn/nspawn.c -+++ b/src/nspawn/nspawn.c -@@ -178,6 +178,7 @@ static bool arg_quiet = false; - static bool arg_share_system = false; - static bool arg_register = true; - static bool arg_keep_unit = false; -+static int arg_keep_fd = -1; - static char **arg_network_interfaces = NULL; - static char **arg_network_macvlan = NULL; - static char **arg_network_ipvlan = NULL; -@@ -246,6 +247,7 @@ static void help(void) { - " --keep-unit Do not register a scope for the machine, reuse\n" - " the service unit nspawn is running in\n" - " --volatile[=MODE] Run the system in volatile mode\n" -+ " --keep-fd=FDNUM Do not close the specified file descriptor\n" - , program_invocation_short_name); - } - -@@ -287,6 +289,7 @@ static int parse_argv(int argc, char *argv[]) { - ARG_SHARE_SYSTEM, - ARG_REGISTER, - ARG_KEEP_UNIT, -+ ARG_KEEP_FD, - ARG_NETWORK_INTERFACE, - ARG_NETWORK_MACVLAN, - ARG_NETWORK_IPVLAN, -@@ -322,6 +325,7 @@ static int parse_argv(int argc, char *argv[]) { - { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM }, - { "register", required_argument, NULL, ARG_REGISTER }, - { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT }, -+ { "keep-fd", required_argument, NULL, ARG_KEEP_FD }, - { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE }, - { "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN }, - { "network-ipvlan", required_argument, NULL, ARG_NETWORK_IPVLAN }, -@@ -643,6 +647,14 @@ static int parse_argv(int argc, char *argv[]) { - arg_keep_unit = true; - break; - -+ case ARG_KEEP_FD: -+ r = safe_atoi(optarg, &arg_keep_fd); -+ if (r < 0) { -+ log_error("Failed to parse --keep-fd= argument: %s", optarg); -+ return r; -+ } -+ break; -+ - case ARG_PERSONALITY: - - arg_personality = personality_from_string(optarg); -@@ -3614,9 +3626,41 @@ int main(int argc, char *argv[]) { - goto finish; - } - } -+ -+ /* if we're keeping an fd open add it to the listen fds set temporarily across fdset_close_others() */ -+ if (arg_keep_fd >= 0) { -+ if (!fds) { -+ fds = fdset_new(); -+ if (!fds) { -+ r = log_oom(); -+ goto finish; -+ } -+ } -+ r = fdset_put(fds, arg_keep_fd); -+ if (r < 0) { -+ log_error_errno(r, "Failed to add kept fd: %m"); -+ goto finish; -+ } -+ } -+ - fdset_close_others(fds); - log_open(); - -+ if (arg_keep_fd >= 0) { -+ r = fdset_remove(fds, arg_keep_fd); -+ if (r < 0) { -+ log_error_errno(r, "Failed to remove kept fd: %m"); -+ goto finish; -+ } -+ -+ /* ensure the kept fd is closed in the child, only the parent keeps it around. */ -+ r = fd_cloexec(arg_keep_fd, true); -+ if (r < 0) { -+ log_error_errno(r, "Failed to set cloexec on kept fd: %m"); -+ goto finish; -+ } -+ } -+ - if (arg_directory) { - assert(!arg_image); - --- -2.1.4 - diff --git a/stage1/rootfs/usr_from_src/patches/v219/0003-nspawn-drop-sd_booted-check.patch b/stage1/rootfs/usr_from_src/patches/v219/0001-nspawn-drop-sd_booted-check.patch similarity index 75% rename from stage1/rootfs/usr_from_src/patches/v219/0003-nspawn-drop-sd_booted-check.patch rename to stage1/rootfs/usr_from_src/patches/v219/0001-nspawn-drop-sd_booted-check.patch index cdb7a4b..df630a3 100644 --- a/stage1/rootfs/usr_from_src/patches/v219/0003-nspawn-drop-sd_booted-check.patch +++ b/stage1/rootfs/usr_from_src/patches/v219/0001-nspawn-drop-sd_booted-check.patch @@ -1,7 +1,7 @@ -From ac144a4dd0406c929a7e85d357a269dedac61780 Mon Sep 17 00:00:00 2001 +From ba166d0fa6c6e7a022cfc2508120658a6e7bae97 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 31 Mar 2015 15:34:01 +0200 -Subject: [PATCH 3/4] nspawn: drop sd_booted() check +Subject: [PATCH 1/5] nspawn: drop sd_booted() check We have no such check in any of the other tools, hence don't have one in nspawn either. @@ -11,15 +11,17 @@ nspawn either. Note: removing this check does not mean that we support running nspawn on non-systemd. We explicitly don't. It just means that we remove the check for running it like that. You are still on your own if you do... + +Origin: upstream, https://github.com/systemd/systemd/commit/4f923a1984476de3441922ee5bf7102ebdd250ef --- src/nspawn/nspawn.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c -index 5ea07c4..5a30bdd 100644 +index fb67251..b5b535c 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c -@@ -3626,12 +3626,6 @@ int main(int argc, char *argv[]) { +@@ -3599,12 +3599,6 @@ int main(int argc, char *argv[]) { goto finish; } diff --git a/stage1/rootfs/usr_from_src/patches/v219/0004-unit-don-t-add-automatic-dependencies-on-device-unit.patch b/stage1/rootfs/usr_from_src/patches/v219/0002-unit-don-t-add-automatic-dependencies-on-device-unit.patch similarity index 83% rename from stage1/rootfs/usr_from_src/patches/v219/0004-unit-don-t-add-automatic-dependencies-on-device-unit.patch rename to stage1/rootfs/usr_from_src/patches/v219/0002-unit-don-t-add-automatic-dependencies-on-device-unit.patch index 8fd25d9..a6fed45 100644 --- a/stage1/rootfs/usr_from_src/patches/v219/0004-unit-don-t-add-automatic-dependencies-on-device-unit.patch +++ b/stage1/rootfs/usr_from_src/patches/v219/0002-unit-don-t-add-automatic-dependencies-on-device-unit.patch @@ -1,10 +1,12 @@ -From 5bc5f0724a1df0458bd4b9f2d757cb46f5b0d27c Mon Sep 17 00:00:00 2001 +From d0ec6449100ebbabe7586da53bc0a29fdf97caf3 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 24 Apr 2015 17:28:06 +0200 -Subject: [PATCH 4/4] unit: don't add automatic dependencies on device units if +Subject: [PATCH 2/5] unit: don't add automatic dependencies on device units if they aren't supported http://lists.freedesktop.org/archives/systemd-devel/2015-April/031187.html + +Origin: upstream, https://github.com/systemd/systemd/commit/47bc12e1ba35d38edda737dae232088d6d3ae688 --- src/core/unit.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/stage1/rootfs/usr_from_src/patches/v219/0005-nspawn-only-mount-the-cgroup-root-if-it-s-not-alread.patch b/stage1/rootfs/usr_from_src/patches/v219/0003-nspawn-only-mount-the-cgroup-root-if-it-s-not-alread.patch similarity index 90% rename from stage1/rootfs/usr_from_src/patches/v219/0005-nspawn-only-mount-the-cgroup-root-if-it-s-not-alread.patch rename to stage1/rootfs/usr_from_src/patches/v219/0003-nspawn-only-mount-the-cgroup-root-if-it-s-not-alread.patch index 917f1b0..6753beb 100644 --- a/stage1/rootfs/usr_from_src/patches/v219/0005-nspawn-only-mount-the-cgroup-root-if-it-s-not-alread.patch +++ b/stage1/rootfs/usr_from_src/patches/v219/0003-nspawn-only-mount-the-cgroup-root-if-it-s-not-alread.patch @@ -1,19 +1,21 @@ -From 3e0ab7a3c7ffbb03a249f89bb5b0532deecd714d Mon Sep 17 00:00:00 2001 +From eb078b430caf7aa8fb8e9ee5c60c77b9a090e946 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Iago=20L=C3=B3pez=20Galeiras?= Date: Wed, 13 May 2015 15:45:48 +0200 -Subject: [PATCH 5/6] nspawn: only mount the cgroup root if it's not already +Subject: [PATCH 3/5] nspawn: only mount the cgroup root if it's not already mounted This allows the user to set the cgroups manually before calling nspawn. + +Origin: upstream, https://github.com/systemd/systemd/commit/54b4755f15438c86991d5a4eaadc47150f7e5a84 --- src/nspawn/nspawn.c | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c -index 5a30bdd..f179dcb 100644 +index b5b535c..af70f21 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c -@@ -828,18 +828,19 @@ static int mount_all(const char *dest) { +@@ -808,18 +808,19 @@ static int mount_all(const char *dest) { } MountPoint; static const MountPoint mount_table[] = { @@ -44,7 +46,7 @@ index 5a30bdd..f179dcb 100644 #endif }; -@@ -1024,9 +1025,6 @@ static int mount_cgroup(const char *dest) { +@@ -1004,9 +1005,6 @@ static int mount_cgroup(const char *dest) { if (r < 0) return log_error_errno(r, "Failed to determine our own cgroup path: %m"); @@ -54,7 +56,7 @@ index 5a30bdd..f179dcb 100644 for (;;) { _cleanup_free_ char *controller = NULL, *origin = NULL, *combined = NULL; -@@ -1086,6 +1084,7 @@ static int mount_cgroup(const char *dest) { +@@ -1066,6 +1064,7 @@ static int mount_cgroup(const char *dest) { if (mount(NULL, systemd_root, NULL, MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, NULL) < 0) return log_error_errno(errno, "Failed to mount cgroup root read-only: %m"); @@ -63,5 +65,5 @@ index 5a30bdd..f179dcb 100644 return log_error_errno(errno, "Failed to remount %s read-only: %m", cgroup_root); -- -2.4.1 +2.1.4 diff --git a/stage1/rootfs/usr_from_src/patches/v219/0006-nspawn-skip-symlink-to-a-combined-cgroup-hierarchy-i.patch b/stage1/rootfs/usr_from_src/patches/v219/0004-nspawn-skip-symlink-to-a-combined-cgroup-hierarchy-i.patch similarity index 87% rename from stage1/rootfs/usr_from_src/patches/v219/0006-nspawn-skip-symlink-to-a-combined-cgroup-hierarchy-i.patch rename to stage1/rootfs/usr_from_src/patches/v219/0004-nspawn-skip-symlink-to-a-combined-cgroup-hierarchy-i.patch index 0f3ee9d..2d70561 100644 --- a/stage1/rootfs/usr_from_src/patches/v219/0006-nspawn-skip-symlink-to-a-combined-cgroup-hierarchy-i.patch +++ b/stage1/rootfs/usr_from_src/patches/v219/0004-nspawn-skip-symlink-to-a-combined-cgroup-hierarchy-i.patch @@ -1,12 +1,14 @@ -From 4f30798831619a2ca7b56ef94d7601fe0238f04d Mon Sep 17 00:00:00 2001 +From 9caa3733cb49cd88f1c03f6abfb005ad264bc535 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Iago=20L=C3=B3pez=20Galeiras?= Date: Wed, 13 May 2015 15:45:49 +0200 -Subject: [PATCH 6/6] nspawn: skip symlink to a combined cgroup hierarchy if it +Subject: [PATCH 4/5] nspawn: skip symlink to a combined cgroup hierarchy if it already exists If a symlink to a combined cgroup hierarchy already exists and points to the right path, skip it. This avoids an error when the cgroups are set manually before calling nspawn. + +Origin: upstream, https://github.com/systemd/systemd/commit/875e1014dd9d55cd0692dcce843598cffb2d09b0 --- src/nspawn/nspawn.c | 10 +++++++--- src/shared/util.c | 22 ++++++++++++++++++++++ @@ -14,10 +16,10 @@ manually before calling nspawn. 3 files changed, 31 insertions(+), 3 deletions(-) diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c -index f179dcb..df912a1 100644 +index af70f21..a4e5419 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c -@@ -1025,7 +1025,6 @@ static int mount_cgroup(const char *dest) { +@@ -1005,7 +1005,6 @@ static int mount_cgroup(const char *dest) { if (r < 0) return log_error_errno(r, "Failed to determine our own cgroup path: %m"); @@ -25,7 +27,7 @@ index f179dcb..df912a1 100644 for (;;) { _cleanup_free_ char *controller = NULL, *origin = NULL, *combined = NULL; -@@ -1065,8 +1064,13 @@ static int mount_cgroup(const char *dest) { +@@ -1045,8 +1044,13 @@ static int mount_cgroup(const char *dest) { if (r < 0) return r; @@ -88,5 +90,5 @@ index a83b588..874e2dc 100644 int mknod_atomic(const char *path, mode_t mode, dev_t dev); int mkfifo_atomic(const char *path, mode_t mode); -- -2.4.1 +2.1.4 diff --git a/stage1/rootfs/usr_from_src/patches/v219/0005-nspawn-close-extra-fds-before-execing-init.patch b/stage1/rootfs/usr_from_src/patches/v219/0005-nspawn-close-extra-fds-before-execing-init.patch new file mode 100644 index 0000000..492ee53 --- /dev/null +++ b/stage1/rootfs/usr_from_src/patches/v219/0005-nspawn-close-extra-fds-before-execing-init.patch @@ -0,0 +1,77 @@ +From ad645a63c3e85a6f0efbd4f3655a10b50117318c Mon Sep 17 00:00:00 2001 +From: Alban Crequy +Date: Mon, 18 May 2015 16:45:30 +0200 +Subject: [PATCH 5/5] nspawn: close extra fds before execing init + +When systemd-nspawn gets exec*()ed, it inherits the followings file +descriptors: +- 0, 1, 2: stdin, stdout, stderr +- SD_LISTEN_FDS_START, ... SD_LISTEN_FDS_START+LISTEN_FDS: file + descriptors passed by the system manager (useful for socket + activation). They are passed to the child process (process leader). +- extra lock fd: rkt passes a locked directory as an extra fd, so the + directory remains locked as long as the container is alive. + +systemd-nspawn used to close all open fds except 0, 1, 2 and the +SD_LISTEN_FDS_START..SD_LISTEN_FDS_START+LISTEN_FDS. This patch delays +the close just before the exec so the nspawn process (parent) keeps the +extra fds open. + +This patch supersedes the previous attempt ("cloexec extraneous fds"): +http://lists.freedesktop.org/archives/systemd-devel/2015-May/031608.html + +Origin: upstream, https://github.com/systemd/systemd/commit/6b7d2e9ea4cdb4cfa1512d37548a1a967623d7f2 +--- + src/nspawn/nspawn.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c +index a4e5419..50e576c 100644 +--- a/src/nspawn/nspawn.c ++++ b/src/nspawn/nspawn.c +@@ -3602,7 +3602,6 @@ int main(int argc, char *argv[]) { + goto finish; + } + +- log_close(); + n_fd_passed = sd_listen_fds(false); + if (n_fd_passed > 0) { + r = fdset_new_listen_fds(&fds, false); +@@ -3611,8 +3610,6 @@ int main(int argc, char *argv[]) { + goto finish; + } + } +- fdset_close_others(fds); +- log_open(); + + if (arg_directory) { + assert(!arg_image); +@@ -4100,6 +4097,17 @@ int main(int argc, char *argv[]) { + if (!barrier_place_and_sync(&barrier)) + _exit(EXIT_FAILURE); + ++ /* Now, explicitly close the log, so that we ++ * then can close all remaining fds. Closing ++ * the log explicitly first has the benefit ++ * that the logging subsystem knows about it, ++ * and is thus ready to be reopened should we ++ * need it again. Note that the other fds ++ * closed here are at least the locking and ++ * barrier fds. */ ++ log_close(); ++ (void) fdset_close_others(fds); ++ + if (arg_boot) { + char **a; + size_t l; +@@ -4126,6 +4134,7 @@ int main(int argc, char *argv[]) { + execle("/bin/sh", "-sh", NULL, env_use); + } + ++ (void) log_open(); + log_error_errno(errno, "execv() failed: %m"); + _exit(EXIT_FAILURE); + } +-- +2.1.4 +