feat(cgroup2fs): support extended attributes on cgroup directories#13655
feat(cgroup2fs): support extended attributes on cgroup directories#13655a7i wants to merge 1 commit into
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
Implement kernfs.InodeWithXattrs on cgroup2 directories using in-memory xattr storage. Allow trusted, security, and user namespaces to match Linux kernfs/cgroup2 behavior used by systemd. Fixes google#13639 Signed-off-by: Amir Alavi <amiralavi7@gmail.com>
shailend-g
left a comment
shailend-g
left a comment
There was a problem hiding this comment.
Please add a happy path syscall test to cgroup2.cc for set+get+list+remove.
In addition to the happy path, please consider adding a second test that checks for the fact that without CAP_SYS_ADMIN, the "trusted" xattr cannot be applied and that it cannot be retrieved.
Linux cgroup2 fs allows xattrs on all files, not just dirs. But thats okay: systemd does not apply xattrs on control files, so we can leave that be.
| // +checklocks:fs.tasksMu | ||
| killSeq uint64 | ||
|
|
||
| // xattrs stores extended attributes on this cgroup directory. Protected by memxattr.SimpleExtendedAttributes.mu. |
There was a problem hiding this comment.
Drop the "Protected by memxattr.SimpleExtendedAttributes.mu." because that is a detail this package doesn't need to know.
| "gvisor.dev/gvisor/pkg/sentry/vfs" | ||
| "gvisor.dev/gvisor/pkg/sentry/vfs/memxattr" | ||
| ) | ||
|
|
There was a problem hiding this comment.
Please consider adding a var _ kernfs.InodeWithXattrs = (*cgroup)(nil)
2 participants
Summary
kernfs.InodeWithXattrson cgroup2 directory inodes using in-memory xattr storage.trusted.*,security.*, anduser.*namespaces to match Linux kernfs/cgroup2 behavior.Test plan
bazel test //pkg/sentry/fsimpl/cgroup2fs/...trusted.delegate).Made with Cursor