[systemd-devel] Delegate v1 cgroup controller permissions

[Lennart Poettering]

On Mi, 19.06.19 17:33, John Lane (systemd at jelmail.com) wrote:

>
> I have a service which runs as an unprivileged user (User=foo) with
> delegated cgroup (Delegate=true) that wants to use the "memory" and
> "cpu" controllers. Systemd is using the hybrid mode with both v1 and v2
> cgroups, and the controllers are assigned to the v1 groups.
>
> Before I can use the "cpu" or "memory" cgroups I have to force the
> permissions of them because the delegated permissions are only applied
> in the unified hierarchy.
>
> Doing this requires root which is a problem because we don't want to
> give this service root permissions.
>
> I have read https://systemd.io/CGROUP_DELEGATION and note that the
> hybrid mode "is a stopgap" and "has no future" but I am forced to use it
> because the distros that we have to use (fedora) are set up that way (I
> have yet to see any system use the unified v2 mode exclusively). So I'm
> having to bother with hybrid mode even though I don't have enough free
> time ;)
>
> I have read in the same article that delegation "won’t pass ownership of
> the legacy controller hierarchies" and "think twice before delegating
> cgroup v1 controllers to less privileged containers."
>
> I get that it isn't the preferred mechanism with systemd but we just
> want to manage access to resources (cpu and memory) allocated to
> subtasks from within our application.
>
> So is there a way to tell systemd (or some other way) to set the v1
> cgroup permissions so they are usable by the delegated user without
> having to give the user process root privileges ?

Sorry, but there is not, it's not safe, as documented. You are of
course welcome to ignore that it's not safe, and chmod away anyway,
but you are on your own if you do, we don't provide any functionality
to do that for you, sorry!

(And this not going to change anymore, cgroupsv1 is on its way out,
and in cgroupsv2 all this is safe and you get access to the
controllers as much as you want already)

Sorry,

Lennart

--
Lennart Poettering, Berlin