|
 |
2aacef |
From 6135d6239a40edb260dde80e5662d3e062dde0bd Mon Sep 17 00:00:00 2001
|
|
|
2aacef |
From: Nick Rosbrook <nick.rosbrook@canonical.com>
|
|
|
2aacef |
Date: Tue, 22 Nov 2022 10:33:55 -0500
|
|
|
2aacef |
Subject: [PATCH] oomd: always allow root-owned cgroups to set
|
|
|
2aacef |
ManagedOOMPreference
|
|
|
2aacef |
|
|
|
2aacef |
Commit 652a4efb66a ("oomd: loosen the restriction on ManagedOOMPreference")
|
|
|
2aacef |
made the change to allow ManagedOOMPreference on a cgroup candidate when
|
|
|
2aacef |
the monitored cgroup and cgroup candidate are owned by the same user.
|
|
|
2aacef |
|
|
|
2aacef |
The commit assumed that this check was sufficient to continue allowing
|
|
|
2aacef |
ManagedOOMPreference on all cgroups owned by root. However, it caused a
|
|
|
2aacef |
regression for unprivileged LXD containers where e.g. /sys/fs/cgroup is
|
|
|
2aacef |
owned by nobody (uid=65534).
|
|
|
2aacef |
|
|
|
2aacef |
Fix this by explicitly allowing the ManagedOOMPreference if uid == 0 in
|
|
|
2aacef |
oomd_fetch_cgroup_oom_preference().
|
|
|
2aacef |
|
|
|
2aacef |
(cherry picked from commit 89186093485b52ca957d17842fc1f7c87958454a)
|
|
|
2aacef |
|
|
|
2aacef |
Related: #2138081
|
|
|
2aacef |
---
|
|
|
2aacef |
src/oom/oomd-util.c | 2 +-
|
|
|
2aacef |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
2aacef |
|
|
|
2aacef |
diff --git a/src/oom/oomd-util.c b/src/oom/oomd-util.c
|
|
|
2aacef |
index 1fc81d1843..70a1dc941e 100644
|
|
|
2aacef |
--- a/src/oom/oomd-util.c
|
|
|
2aacef |
+++ b/src/oom/oomd-util.c
|
|
|
2aacef |
@@ -164,7 +164,7 @@ int oomd_fetch_cgroup_oom_preference(OomdCGroupContext *ctx, const char *prefix)
|
|
|
2aacef |
if (r < 0)
|
|
|
2aacef |
return log_debug_errno(r, "Failed to get owner/group from %s: %m", ctx->path);
|
|
|
2aacef |
|
|
|
2aacef |
- if (uid == prefix_uid) {
|
|
|
2aacef |
+ if (uid == prefix_uid || uid == 0) {
|
|
|
2aacef |
/* Ignore most errors when reading the xattr since it is usually unset and cgroup xattrs are only used
|
|
|
2aacef |
* as an optional feature of systemd-oomd (and the system might not even support them). */
|
|
|
2aacef |
r = cg_get_xattr_bool(SYSTEMD_CGROUP_CONTROLLER, ctx->path, "user.oomd_avoid");
|