[patch] clone.2: Add EACCES with CLONE_INTO_CGROUP + clone3 to ERRORS

[patch] clone.2: Add EACCES with CLONE_INTO_CGROUP + clone3 to ERRORS

[Andrew Wock]

[-- Attachment #1: Type: text/plain, Size: 669 bytes --]

Resending because it's my first time mailing the lkml and I used html.
Reattempting w/ gmail's plaintext mode.  I apologise if this is
reaching you twice.

I noticed that clone3 can send the EACCES errno after I wrote a
program that used clone3 with the CLONE_INTO_CGROUP flag.  To me, it's
important to know what kind of failure occurred if the clone3 fails,
so I was glad that a unique errno is set for this case, but it wasn't
documented on the clone man page.

I've attached a patch and a test program.

Test program is attached as clone3_doc.c.  Create
/sys/fs/cgroup/not-allowed as root, then run the program.  It should
set errno to EACCES.

Thanks,
Andrew Wock

[-- Attachment #2: clone3_doc.c --]
[-- Type: text/plain, Size: 1276 bytes --]

#include <stdio.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <signal.h>
#include <fcntl.h>

#include <linux/sched.h>    /* Definition of struct clone_args */
#include <sched.h>          /* Definition of CLONE_* constants */
#include <sys/syscall.h>    /* Definition of SYS_* constants */
#include <unistd.h>

/*
 * Preconditions:
 * - /sys/fs/cgroup/not-allowed is a real cgroup.
 * - You are not root and do not have write permissions to
 *   /sys/fs/cgroup/not-allowed/cgroup.procs
 */
int main() {
  pid_t pid;
  int fd;
  struct clone_args cl_args = {0};
  char *cgPath = "/sys/fs/cgroup/not-allowed";

  fd = open(cgPath, O_RDONLY);
  if (fd == -1) {
    fprintf(stderr, "Could not open cgroup %s: %s\n", cgPath, strerror(errno));
    exit(1);
  }

  cl_args.exit_signal = SIGCHLD;
  cl_args.flags = CLONE_INTO_CGROUP;
  cl_args.cgroup = fd;
  pid = syscall(SYS_clone3, &cl_args, sizeof(cl_args));
  if (pid == -1) {
    if (errno == EACCES) {
      printf("EACCES detected\n");
      exit(0);
    }
    fprintf(stderr, "Could not clone into cgroup: %s\n", strerror(errno));
  } else if (pid == 0) {
    fprintf(stderr, "Are you root, or do you have write access to %s?\n", cgPath);
  }
  exit(1);
}

[-- Attachment #3: clone.2.diff --]
[-- Type: application/octet-stream, Size: 592 bytes --]

diff --git a/man2/clone.2 b/man2/clone.2
index e381da165..8f65d9fec 100644
--- a/man2/clone.2
+++ b/man2/clone.2
@@ -1209,6 +1209,16 @@ in the caller's context, no child process is created, and
 is set to indicate the error.
 .SH ERRORS
 .TP
+.BR EACCES " (" clone3 "() only)"
+.B CLONE_INTO_CGROUP
+was specified in
+.IR cl_args.flags ,
+but the restrictions (described in
+.BR cgroups (7))
+on placing the child process into the version 2 cgroup referred to by
+.IR cl_args.cgroup
+are not met.
+.TP
 .B EAGAIN
 Too many processes are already running; see
 .BR fork (2).

Re: [patch] clone.2: Add EACCES with CLONE_INTO_CGROUP + clone3 to ERRORS

[Christian Brauner]

On Sun, Aug 29, 2021 at 03:57:06PM -0400, Andrew Wock wrote:
> Resending because it's my first time mailing the lkml and I used html.
> Reattempting w/ gmail's plaintext mode.  I apologise if this is
> reaching you twice.
> 
> I noticed that clone3 can send the EACCES errno after I wrote a
> program that used clone3 with the CLONE_INTO_CGROUP flag.  To me, it's
> important to know what kind of failure occurred if the clone3 fails,
> so I was glad that a unique errno is set for this case, but it wasn't
> documented on the clone man page.

In essence, any error that could occur during regular fs-based migration
at write-time can also occur during CLONE_INTO_CGROUP. The clone3()
manpage just has the inverse of that above statement:

"Note that all of the usual restrictions (described in cgroups(7)) on
placing a process into a version 2 cgroup apply."

> 
> I've attached a patch and a test program.
> 
> Test program is attached as clone3_doc.c.  Create
> /sys/fs/cgroup/not-allowed as root, then run the program.  It should
> set errno to EACCES.

This is a manpage update, right? In that case it's not necessarily
needed to Cc lkml aka linux-kernel@... itself.

For the content:
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>

(I have no idea what patch format Michael will accept so I can't really
ack that. :))

> 
> Thanks,
> Andrew Wock

> #include <stdio.h>
> #include <errno.h>
> #include <stdlib.h>
> #include <string.h>
> #include <signal.h>
> #include <fcntl.h>
> 
> #include <linux/sched.h>    /* Definition of struct clone_args */
> #include <sched.h>          /* Definition of CLONE_* constants */
> #include <sys/syscall.h>    /* Definition of SYS_* constants */
> #include <unistd.h>
> 
> /*
>  * Preconditions:
>  * - /sys/fs/cgroup/not-allowed is a real cgroup.
>  * - You are not root and do not have write permissions to
>  *   /sys/fs/cgroup/not-allowed/cgroup.procs
>  */
> int main() {
>   pid_t pid;
>   int fd;
>   struct clone_args cl_args = {0};
>   char *cgPath = "/sys/fs/cgroup/not-allowed";
> 
>   fd = open(cgPath, O_RDONLY);
>   if (fd == -1) {
>     fprintf(stderr, "Could not open cgroup %s: %s\n", cgPath, strerror(errno));
>     exit(1);
>   }
> 
>   cl_args.exit_signal = SIGCHLD;
>   cl_args.flags = CLONE_INTO_CGROUP;
>   cl_args.cgroup = fd;
>   pid = syscall(SYS_clone3, &cl_args, sizeof(cl_args));
>   if (pid == -1) {
>     if (errno == EACCES) {
>       printf("EACCES detected\n");
>       exit(0);
>     }
>     fprintf(stderr, "Could not clone into cgroup: %s\n", strerror(errno));
>   } else if (pid == 0) {
>     fprintf(stderr, "Are you root, or do you have write access to %s?\n", cgPath);
>   }
>   exit(1);
> }