From 394c8695f22731938994fdc5d7db678762119481 Mon Sep 17 00:00:00 2001 From: Wentao Zhang Date: Tue, 20 Dec 2016 06:21:10 -0500 Subject: [PATCH 59/94] Fix setup cgroup before prestart hook * User Case: User could use prestart hook to add block devices to container. so the hook should have a way to set the permissions of the devices. Just move cgroup config operation before prestart hook will work. Conflicts: libcontainer/process_linux.go Change-Id: I991138f4e686c4268e0629204ce1eae6452fdecf Signed-off-by: Wentao Zhang --- libcontainer/process_linux.go | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/libcontainer/process_linux.go b/libcontainer/process_linux.go index 9064c0e..70e93de 100644 --- a/libcontainer/process_linux.go +++ b/libcontainer/process_linux.go @@ -286,9 +286,6 @@ func (p *initProcess) start() error { ierr := parseSync(p.parentPipe, func(sync *syncT) error { switch sync.Type { case procReady: - if err := p.manager.Set(p.config.Config); err != nil { - return newSystemErrorWithCause(err, "setting cgroup config for ready process") - } // set rlimits, this has to be done here because we lose permissions // to raise the limits once we enter a user-namespace if err := setupRlimits(p.config.Rlimits, p.pid()); err != nil { @@ -296,6 +293,11 @@ func (p *initProcess) start() error { } // call prestart hooks if !p.config.Config.Namespaces.Contains(configs.NEWNS) { + // Setup cgroup before prestart hook, so that the prestart hook could apply cgroup permissions. + if err := p.manager.Set(p.config.Config); err != nil { + return newSystemErrorWithCause(err, "setting cgroup config for ready process") + } + if p.config.Config.Hooks != nil { s := configs.HookState{ SpecState: configs.SpecState{ @@ -321,6 +323,10 @@ func (p *initProcess) start() error { } sentRun = true case procHooks: + // Setup cgroup before prestart hook, so that the prestart hook could apply cgroup permissions. + if err := p.manager.Set(p.config.Config); err != nil { + return newSystemErrorWithCause(err, "setting cgroup config for ready process") + } if p.config.Config.Hooks != nil { s := configs.HookState{ SpecState: configs.SpecState{ -- 2.7.4.3