Skip to content

libct/cg/sd/v1: fix freezeBeforeSet (alt)#3151

Closed
kolyshkin wants to merge 2 commits intoopencontainers:masterfrom
kolyshkin:fix-freeze-before-set-alt
Closed

libct/cg/sd/v1: fix freezeBeforeSet (alt)#3151
kolyshkin wants to merge 2 commits intoopencontainers:masterfrom
kolyshkin:fix-freeze-before-set-alt

Conversation

@kolyshkin
Copy link
Copy Markdown
Contributor

@kolyshkin kolyshkin commented Aug 12, 2021

This is an alternative to #3148/#3143, switching to a faster/easier check in freezeBeforeSet.

Commit f2db879 (PR #3082) was not working:

  1. It did not do the right job getting unit properties;
  2. The check that deviceAllow is empty was not working.

While there is a way to fix both issues, let's employ a simpler check --
if r.SkipDevices is set, and devices.list only contains "allow all" rule,
we can safely skip freezing.

The only issue with the patch, in case we call freezeBeforeSet before
Apply(), the m.paths are not yet initialized, so we have to manually
figure the path to devices subsystem in haveDeviceRules. This is being
fixed elsewhere (currently in #3131 but I will split it out).

The test case added by #3082 was not adequate either -- it only checked
that the freeze is performed if necessary, but did not check that the freeze
is avoided if possible.

Add a test case specific to freezeBeforeSet.

Fixes: f2db879
Co-authored-by: Odin Ugedal odin@uged.al
Signed-off-by: Kir Kolyshkin kolyshkin@gmail.com

@kolyshkin kolyshkin force-pushed the fix-freeze-before-set-alt branch from 90393eb to f378ef1 Compare August 12, 2021 02:47
@kolyshkin kolyshkin added area/systemd backport/1.0-todo A PR in main branch which needs to be backported to release-1.0 labels Aug 12, 2021
@kolyshkin kolyshkin changed the title libct/cg/sd/v1: fix freezeBeforeSet libct/cg/sd/v1: fix freezeBeforeSet (alt) Aug 12, 2021
Commit f2db879 was not working as expected:

1. It did not do the right job getting unit properties;
2. The check that deviceAllow is empty was not working.

While there is a way to fix both issues, let's employ a simpler check --
if r.SkipDevices is set, and devices.list only contains "allow all" rule,
we can safely skip freezing.

The only issue with the patch, in case we call freezeBeforeSet before
Apply(), the m.paths are not yet initialized, so we have to manually
figure the path to devices subsystem in haveDeviceRules. This is being
fixed elsewhere.

Fixes: f2db879
Reported-by: Odin Ugedal <odin@uged.al>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Add a test for freezeBeforeSet, checking various scenarios including
those that were failing before the fix in the previous commit.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
@kolyshkin kolyshkin force-pushed the fix-freeze-before-set-alt branch from f378ef1 to d13950c Compare August 12, 2021 05:06
@kolyshkin
Copy link
Copy Markdown
Contributor Author

cirrus-ci failure on centos-stream-8 is a flake:

yum install -y -q epel-release
Error: Failed to download metadata for repo 'appstream': Yum repo downloading error: Downloading error(s): repodata/b90651eed1e1de7698def2538c508b142db41a174016665c7bffaa24e1fa0785-primary.xml.gz - Cannot download, all mirrors were already tried without success; repodata/256a38c4e18cce032edb33bba6fff7a239af1e130e2f6f0c572857748aa47ae8-filelists.xml.gz - Cannot download, all mirrors were already tried without success; repodata/86483bcfc6d853140a71ad58a16fa260b16e10334ae48153aa3e9acf96be6c46-modules.yaml.xz - Cannot download, all mirrors were already tried without success

CI restarted. If this will happen frequently, we need a workaround (something similar to e.g. commit c27b8e7)

@mrunalp
Copy link
Copy Markdown
Contributor

mrunalp commented Aug 12, 2021

@odinuge @AkihiroSuda ptal

@kolyshkin
Copy link
Copy Markdown
Contributor Author

Some performance analysis: #3143 (comment)

@odinuge
Copy link
Copy Markdown
Member

odinuge commented Aug 13, 2021

Still wrapping my head around this, and if this is the correct way to do it; both for k8s and for the runc binary.

It is possible that a container has a parent without full device access. In that case, the scope/slice for the container will have DevicesPolicy=auto, DeviceAllow=, without devices.list containing a *:* rwm\n. In that case, systemd will not do the "device dance", while with this PR will still freeze.

As is now, I am not 110% comfortable with backporting this to old k8s releases, as this will potentially have a bigger impact. (Again, a simple flag would be best for k8s; both for performance and for safety). I am more comfortable with back porting #3143, as that does not have the potential issue from above..

@kolyshkin
Copy link
Copy Markdown
Contributor Author

kolyshkin commented Aug 13, 2021

Right, this one is not good enough. Querying unit properties seems too expensive to me. I can't think of any other option right now...

Heck, let's do a flag (as long as other maintainers agree) as a stop-gap measure.

Long term solution is for k8s to stop using libcontainer/cgroups (kubernetes/kubernetes#104325).

@kolyshkin
Copy link
Copy Markdown
Contributor Author

Closing in favor of #3161.

@kolyshkin kolyshkin closed this Aug 13, 2021
@kolyshkin kolyshkin removed the backport/1.0-todo A PR in main branch which needs to be backported to release-1.0 label Aug 23, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants