[PATCH RFC v3 56/90] cgroup: let a cell make cgroups below its budget

[Josef Bacik]

An init that manages cgroups moves itself out of the root of its
hierarchy, enables controllers there, and creates one cgroup per service.
In a cell with a block of ids this fails at the first mkdir, with
EOVERFLOW. cgroupfs is a filesystem of the host, so it cannot hold the ids
of a cell. The init therefore never leaves the budget, and it can never
enable a controller, because a cgroup that distributes a controller cannot
contain tasks. The builder cannot create the cgroups and hand them over
either, because nobody can name the ids of a cell.

cgroupfs meets the conditions for holding those ids:

  - cgroup_cell_budget_put() removes everything below the budget when the
    cell is gone. If that fails, the block is never lent again.
  - cgroup_may_change() stops a task of a cell from creating or changing
    anything outside of its budget.
  - The seal already stores an id of the cell on the budget itself.

So set SB_I_LENT_IDS on the superblock of the default hierarchy.

The alternative would be to make cgroupfs idmappable. The ids that are
stored would then be 0 to 65535. The limits of the budget, which belong to
root on the host, would appear to belong to the root user of the cell. And
uid 1000 on the host would own what uid 1000 of the cell created.

Legacy hierarchies do not get the flag, because none of their cgroups is
within a budget.

Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
---
 kernel/cgroup/cgroup.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index a0836b115c79..3f439ae0e3b7 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -2331,6 +2331,9 @@ static int cgroup_get_tree(struct fs_context *fc)
 	ret = cgroup_do_get_tree(fc);
 	if (!ret)
 		apply_cgroup_root_flags(ctx->flags);
+	/* See cgroup_may_change() for where, cgroup_cell_budget_put() for how. */
+	if (!ret)
+		fc->root->d_sb->s_iflags |= SB_I_LENT_IDS;
 	return ret;
 }
 

-- 
2.55.0