From: Andrew Wock <ajwock@gmail.com>
To: linux-man@vger.kernel.org, alx.manpages@gmail.com,
mtk.manpages@gmail.com
Cc: christian@brauner.io, linux-kernel@vger.kernel.org
Subject: [patch] clone.2: Add EACCES with CLONE_INTO_CGROUP + clone3 to ERRORS
Date: Sun, 29 Aug 2021 15:57:06 -0400 [thread overview]
Message-ID: <CAACtx1b_v3nbv8EkAQ1f7ee=yt3ECm_a6kb1KNdBPZ5F20ndFw@mail.gmail.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 669 bytes --]
Resending because it's my first time mailing the lkml and I used html.
Reattempting w/ gmail's plaintext mode. I apologise if this is
reaching you twice.
I noticed that clone3 can send the EACCES errno after I wrote a
program that used clone3 with the CLONE_INTO_CGROUP flag. To me, it's
important to know what kind of failure occurred if the clone3 fails,
so I was glad that a unique errno is set for this case, but it wasn't
documented on the clone man page.
I've attached a patch and a test program.
Test program is attached as clone3_doc.c. Create
/sys/fs/cgroup/not-allowed as root, then run the program. It should
set errno to EACCES.
Thanks,
Andrew Wock
[-- Attachment #2: clone3_doc.c --]
[-- Type: text/plain, Size: 1276 bytes --]
#include <stdio.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <signal.h>
#include <fcntl.h>
#include <linux/sched.h> /* Definition of struct clone_args */
#include <sched.h> /* Definition of CLONE_* constants */
#include <sys/syscall.h> /* Definition of SYS_* constants */
#include <unistd.h>
/*
* Preconditions:
* - /sys/fs/cgroup/not-allowed is a real cgroup.
* - You are not root and do not have write permissions to
* /sys/fs/cgroup/not-allowed/cgroup.procs
*/
int main() {
pid_t pid;
int fd;
struct clone_args cl_args = {0};
char *cgPath = "/sys/fs/cgroup/not-allowed";
fd = open(cgPath, O_RDONLY);
if (fd == -1) {
fprintf(stderr, "Could not open cgroup %s: %s\n", cgPath, strerror(errno));
exit(1);
}
cl_args.exit_signal = SIGCHLD;
cl_args.flags = CLONE_INTO_CGROUP;
cl_args.cgroup = fd;
pid = syscall(SYS_clone3, &cl_args, sizeof(cl_args));
if (pid == -1) {
if (errno == EACCES) {
printf("EACCES detected\n");
exit(0);
}
fprintf(stderr, "Could not clone into cgroup: %s\n", strerror(errno));
} else if (pid == 0) {
fprintf(stderr, "Are you root, or do you have write access to %s?\n", cgPath);
}
exit(1);
}
[-- Attachment #3: clone.2.diff --]
[-- Type: application/octet-stream, Size: 592 bytes --]
diff --git a/man2/clone.2 b/man2/clone.2
index e381da165..8f65d9fec 100644
--- a/man2/clone.2
+++ b/man2/clone.2
@@ -1209,6 +1209,16 @@ in the caller's context, no child process is created, and
is set to indicate the error.
.SH ERRORS
.TP
+.BR EACCES " (" clone3 "() only)"
+.B CLONE_INTO_CGROUP
+was specified in
+.IR cl_args.flags ,
+but the restrictions (described in
+.BR cgroups (7))
+on placing the child process into the version 2 cgroup referred to by
+.IR cl_args.cgroup
+are not met.
+.TP
.B EAGAIN
Too many processes are already running; see
.BR fork (2).
next reply other threads:[~2021-08-29 19:57 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-29 19:57 Andrew Wock [this message]
2021-08-30 7:38 ` [patch] clone.2: Add EACCES with CLONE_INTO_CGROUP + clone3 to ERRORS Christian Brauner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAACtx1b_v3nbv8EkAQ1f7ee=yt3ECm_a6kb1KNdBPZ5F20ndFw@mail.gmail.com' \
--to=ajwock@gmail.com \
--cc=alx.manpages@gmail.com \
--cc=christian@brauner.io \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-man@vger.kernel.org \
--cc=mtk.manpages@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).