Skip to content

Commit 6b0ba2a

Browse files
fajsakpm00
authored andcommitted
memcg v1: provide read access to memory.pressure_level
cgroups v1 has a unique way of setting up memory pressure notifications: the user opens "memory.pressure_level" of the cgroup they want to monitor for pressure, then open "cgroup.event_control" and write the fd (among other things) to that file. memory.pressure_level has no other use, specifically it does not support any read or write operations. Consequently, no handlers are provided, and cgroup_file_mode() sets the permissions to 000. However, to actually use the mechanism, the subscribing user must have read access to the file and open the fd for reading, see memcg_write_event_control(). This is all fine as long as the subscribing process runs as root and is otherwise unconfined by further restrictions. However, if you add strict access controls such as selinux, the permission bits will be enforced, and opening memory.pressure_level for reading will fail, preventing the process from subscribing, even as root. To work around this issue, introduce a dummy read handler. When memory.pressure_level is created, cgroup_file_mode() will notice the existence of a handler, and therefore add read permissions to the file. Link: https://lkml.kernel.org/r/[email protected] Signed-off-by: Florian Schmidt <[email protected]> Acked-by: Michal Hocko <[email protected]> Cc: Johannes Weiner <[email protected]> Cc: Muchun Song <[email protected]> Cc: Roman Gushchin <[email protected]> Cc: Shakeel Butt <[email protected]> Signed-off-by: Andrew Morton <[email protected]>
1 parent a2e17cc commit 6b0ba2a

File tree

1 file changed

+11
-0
lines changed

1 file changed

+11
-0
lines changed

mm/memcontrol.c

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3779,6 +3779,16 @@ static u64 mem_cgroup_read_u64(struct cgroup_subsys_state *css,
37793779
}
37803780
}
37813781

3782+
/*
3783+
* This function doesn't do anything useful. Its only job is to provide a read
3784+
* handler for a file so that cgroup_file_mode() will add read permissions.
3785+
*/
3786+
static int mem_cgroup_dummy_seq_show(__always_unused struct seq_file *m,
3787+
__always_unused void *v)
3788+
{
3789+
return -EINVAL;
3790+
}
3791+
37823792
#ifdef CONFIG_MEMCG_KMEM
37833793
static int memcg_online_kmem(struct mem_cgroup *memcg)
37843794
{
@@ -5113,6 +5123,7 @@ static struct cftype mem_cgroup_legacy_files[] = {
51135123
},
51145124
{
51155125
.name = "pressure_level",
5126+
.seq_show = mem_cgroup_dummy_seq_show,
51165127
},
51175128
#ifdef CONFIG_NUMA
51185129
{

0 commit comments

Comments
 (0)