diff --git a/glide.lock b/glide.lock index 049f573dc4cc..1108e0d2b868 100644 --- a/glide.lock +++ b/glide.lock @@ -1,5 +1,5 @@ -hash: 43fae334249fe7affafcbdb84cd49cfb0027e7bdb5d09565bce318233cccb195 -updated: 2019-09-23T12:01:56.433081+02:00 +hash: a3b7357c903eb619615a029fa91c27edc7312a5c870ee50dca3895e675d6d4b0 +updated: 2019-09-26T11:48:24.491287968-05:00 imports: - name: bitbucket.org/ww/goautoneg version: 2ae31c8b6b30d2f4c8100c20d527b571e9c433bb @@ -773,7 +773,8 @@ imports: - specs-go - specs-go/v1 - name: github.com/opencontainers/runc - version: 6cc515888830787a93d82138821f0309ad970640 + version: b942ff4cc6f8f16ca177cf09c34896bddd000b16 + repo: https://github.com/openshift/opencontainers-runc subpackages: - libcontainer - libcontainer/apparmor diff --git a/glide.yaml b/glide.yaml index 630e2fac8466..eea36a53c705 100644 --- a/glide.yaml +++ b/glide.yaml @@ -163,3 +163,8 @@ import: - package: github.com/lestrrat/go-structinfo repo: https://github.com/lestrrat/go-structinfo.git version: 8204d40bbcd79eb7603cd4c2c998e60eb2479ded + +# runc for delegation fix BZ#1755991 +- package: github.com/opencontainers/runc + repo: https://github.com/openshift/opencontainers-runc + version: release-4.3 diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/apply_systemd.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/apply_systemd.go index 3bf723bf9646..3f86d52420dd 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/apply_systemd.go +++ b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/apply_systemd.go @@ -72,11 +72,8 @@ const ( ) var ( - connLock sync.Mutex - theConn *systemdDbus.Conn - hasStartTransientUnit bool - hasStartTransientSliceUnit bool - hasDelegateSlice bool + connLock sync.Mutex + theConn *systemdDbus.Conn ) func newProp(name string, units interface{}) systemdDbus.Property { @@ -100,67 +97,8 @@ func UseSystemd() bool { if err != nil { return false } - - // Assume we have StartTransientUnit - hasStartTransientUnit = true - - // But if we get UnknownMethod error we don't - if _, err := theConn.StartTransientUnit("test.scope", "invalid", nil, nil); err != nil { - if dbusError, ok := err.(dbus.Error); ok { - if dbusError.Name == "org.freedesktop.DBus.Error.UnknownMethod" { - hasStartTransientUnit = false - return hasStartTransientUnit - } - } - } - - // Assume we have the ability to start a transient unit as a slice - // This was broken until systemd v229, but has been back-ported on RHEL environments >= 219 - // For details, see: https://bugzilla.redhat.com/show_bug.cgi?id=1370299 - hasStartTransientSliceUnit = true - - // To ensure simple clean-up, we create a slice off the root with no hierarchy - slice := fmt.Sprintf("libcontainer_%d_systemd_test_default.slice", os.Getpid()) - if _, err := theConn.StartTransientUnit(slice, "replace", nil, nil); err != nil { - if _, ok := err.(dbus.Error); ok { - hasStartTransientSliceUnit = false - } - } - - for i := 0; i <= testSliceWait; i++ { - if _, err := theConn.StopUnit(slice, "replace", nil); err != nil { - if dbusError, ok := err.(dbus.Error); ok { - if strings.Contains(dbusError.Name, "org.freedesktop.systemd1.NoSuchUnit") { - hasStartTransientSliceUnit = false - break - } - } - } else { - break - } - time.Sleep(time.Millisecond) - } - - // Not critical because of the stop unit logic above. - theConn.StopUnit(slice, "replace", nil) - - // Assume StartTransientUnit on a slice allows Delegate - hasDelegateSlice = true - dlSlice := newProp("Delegate", true) - if _, err := theConn.StartTransientUnit(slice, "replace", []systemdDbus.Property{dlSlice}, nil); err != nil { - if dbusError, ok := err.(dbus.Error); ok { - // Starting with systemd v237, Delegate is not even a property of slices anymore, - // so the D-Bus call fails with "InvalidArgs" error. - if strings.Contains(dbusError.Name, "org.freedesktop.DBus.Error.PropertyReadOnly") || strings.Contains(dbusError.Name, "org.freedesktop.DBus.Error.InvalidArgs") { - hasDelegateSlice = false - } - } - } - - // Not critical because of the stop unit logic above. - theConn.StopUnit(slice, "replace", nil) } - return hasStartTransientUnit + return true } func NewSystemdCgroupsManager() (func(config *configs.Cgroup, paths map[string]string) cgroups.Manager, error) { @@ -208,10 +146,6 @@ func (m *Manager) Apply(pid int) error { // if we create a slice, the parent is defined via a Wants= if strings.HasSuffix(unitName, ".slice") { - // This was broken until systemd v229, but has been back-ported on RHEL environments >= 219 - if !hasStartTransientSliceUnit { - return fmt.Errorf("systemd version does not support ability to start a slice as transient unit") - } properties = append(properties, systemdDbus.PropWants(slice)) } else { // otherwise, we use Slice= @@ -224,12 +158,7 @@ func (m *Manager) Apply(pid int) error { } // Check if we can delegate. This is only supported on systemd versions 218 and above. - if strings.HasSuffix(unitName, ".slice") { - if hasDelegateSlice { - // systemd 237 and above no longer allows delegation on a slice - properties = append(properties, newProp("Delegate", true)) - } - } else { + if !strings.HasSuffix(unitName, ".slice") { // Assume scopes always support delegation. properties = append(properties, newProp("Delegate", true)) }