21214: Prevent filter groups from matching other/same filter groups.

[arvados.git] / lib / crunchrun / cgroup.go

diff --git a/lib/crunchrun/cgroup.go b/lib/crunchrun/cgroup.go
index 0b254f5bd7870dcaa188df80ad9552fa1eda83ed..a722e5f1423b715ebc8f65e9cc1afb1cdb847f2e 100644 (file)
--- a/lib/crunchrun/cgroup.go
+++ b/lib/crunchrun/cgroup.go
@@ -6,28 +6,43 @@ package crunchrun
 
 import (
        "bytes"
-       "io/ioutil"
-       "log"
+       "fmt"
+       "io/fs"
 )
 
 // Return the current process's cgroup for the given subsystem.
-func findCgroup(subsystem string) string {
+//
+// If the host has cgroups v2 and not v1 (i.e., unified mode), return
+// the current process's cgroup.
+func findCgroup(fsys fs.FS, subsystem string) (string, error) {
        subsys := []byte(subsystem)
-       cgroups, err := ioutil.ReadFile("/proc/self/cgroup")
+       cgroups, err := fs.ReadFile(fsys, "proc/self/cgroup")
        if err != nil {
-               log.Fatal(err)
+               return "", err
        }
        for _, line := range bytes.Split(cgroups, []byte("\n")) {
                toks := bytes.SplitN(line, []byte(":"), 4)
                if len(toks) < 3 {
                        continue
                }
+               if len(toks[1]) == 0 && string(toks[0]) == "0" {
+                       // cgroups v2: "0::$PATH"
+                       //
+                       // In "hybrid" mode, this entry is last, so we
+                       // use it when the specified subsystem doesn't
+                       // match a cgroups v1 entry.
+                       //
+                       // In "unified" mode, this is the only entry,
+                       // so we use it regardless of which subsystem
+                       // was specified.
+                       return string(toks[2]), nil
+               }
                for _, s := range bytes.Split(toks[1], []byte(",")) {
+                       // cgroups v1: "7:cpu,cpuacct:/user.slice"
                        if bytes.Compare(s, subsys) == 0 {
-                               return string(toks[2])
+                               return string(toks[2]), nil
                        }
                }
        }
-       log.Fatalf("subsystem %q not found in /proc/self/cgroup", subsystem)
-       return ""
+       return "", fmt.Errorf("subsystem %q not found in /proc/self/cgroup", subsystem)
 }