diff --git a/libprocessgroup/include/processgroup/processgroup.h b/libprocessgroup/include/processgroup/processgroup.h index 45a723f74..f3cd421dd 100644 --- a/libprocessgroup/include/processgroup/processgroup.h +++ b/libprocessgroup/include/processgroup/processgroup.h @@ -35,6 +35,7 @@ bool CgroupGetAttributePathForTask(const std::string& attr_name, int tid, std::s bool SetTaskProfiles(int tid, const std::vector& profiles, bool use_fd_cache = false); bool SetProcessProfiles(uid_t uid, pid_t pid, const std::vector& profiles); +bool SetUserProfiles(uid_t uid, const std::vector& profiles); __END_DECLS diff --git a/libprocessgroup/processgroup.cpp b/libprocessgroup/processgroup.cpp index bdda1020c..393936ca7 100644 --- a/libprocessgroup/processgroup.cpp +++ b/libprocessgroup/processgroup.cpp @@ -195,6 +195,11 @@ extern "C" bool android_set_process_profiles(uid_t uid, pid_t pid, size_t num_pr return SetProcessProfiles(uid, pid, std::span(profiles_)); } +bool SetUserProfiles(uid_t uid, const std::vector& profiles) { + return TaskProfiles::GetInstance().SetUserProfiles(uid, std::span(profiles), + false); +} + static std::string ConvertUidToPath(const char* cgroup, uid_t uid) { return StringPrintf("%s/uid_%d", cgroup, uid); } diff --git a/libprocessgroup/task_profiles.cpp b/libprocessgroup/task_profiles.cpp index 744710f3b..0fbfc8c07 100644 --- a/libprocessgroup/task_profiles.cpp +++ b/libprocessgroup/task_profiles.cpp @@ -139,6 +139,17 @@ bool ProfileAttribute::GetPathForTask(int tid, std::string* path) const { return true; } +bool ProfileAttribute::GetPathForUID(uid_t uid, std::string* path) const { + if (path == nullptr) { + return true; + } + + const std::string& file_name = + controller()->version() == 2 && !file_v2_name_.empty() ? file_v2_name_ : file_name_; + *path = StringPrintf("%s/uid_%d/%s", controller()->path(), uid, file_name.c_str()); + return true; +} + bool SetClampsAction::ExecuteForProcess(uid_t, pid_t) const { // TODO: add support when kernel supports util_clamp LOG(WARNING) << "SetClampsAction::ExecuteForProcess is not supported"; @@ -225,6 +236,29 @@ bool SetAttributeAction::ExecuteForTask(int tid) const { return true; } +bool SetAttributeAction::ExecuteForUID(uid_t uid) const { + std::string path; + + if (!attribute_->GetPathForUID(uid, &path)) { + LOG(ERROR) << "Failed to find cgroup for uid " << uid; + return false; + } + + if (!WriteStringToFile(value_, path)) { + if (access(path.c_str(), F_OK) < 0) { + if (optional_) { + return true; + } else { + LOG(ERROR) << "No such cgroup attribute: " << path; + return false; + } + } + PLOG(ERROR) << "Failed to write '" << value_ << "' to " << path; + return false; + } + return true; +} + SetCgroupAction::SetCgroupAction(const CgroupController& c, const std::string& p) : controller_(c), path_(p) { FdCacheHelper::Init(controller_.GetTasksFilePath(path_), fd_[ProfileAction::RCT_TASK]); @@ -552,6 +586,16 @@ bool TaskProfile::ExecuteForTask(int tid) const { return true; } +bool TaskProfile::ExecuteForUID(uid_t uid) const { + for (const auto& element : elements_) { + if (!element->ExecuteForUID(uid)) { + LOG(VERBOSE) << "Applying profile action " << element->Name() << " failed"; + return false; + } + } + return true; +} + void TaskProfile::EnableResourceCaching(ProfileAction::ResourceCacheType cache_type) { if (res_cached_) { return; @@ -804,6 +848,24 @@ const IProfileAttribute* TaskProfiles::GetAttribute(std::string_view name) const return nullptr; } +template +bool TaskProfiles::SetUserProfiles(uid_t uid, std::span profiles, bool use_fd_cache) { + for (const auto& name : profiles) { + TaskProfile* profile = GetProfile(name); + if (profile != nullptr) { + if (use_fd_cache) { + profile->EnableResourceCaching(ProfileAction::RCT_PROCESS); + } + if (!profile->ExecuteForUID(uid)) { + PLOG(WARNING) << "Failed to apply " << name << " process profile"; + } + } else { + PLOG(WARNING) << "Failed to find " << name << "process profile"; + } + } + return true; +} + template bool TaskProfiles::SetProcessProfiles(uid_t uid, pid_t pid, std::span profiles, bool use_fd_cache) { @@ -857,3 +919,5 @@ template bool TaskProfiles::SetTaskProfiles(int tid, std::span profiles, bool use_fd_cache); +template bool TaskProfiles::SetUserProfiles(uid_t uid, std::span profiles, + bool use_fd_cache); diff --git a/libprocessgroup/task_profiles.h b/libprocessgroup/task_profiles.h index 85b3f9162..a8ecb873d 100644 --- a/libprocessgroup/task_profiles.h +++ b/libprocessgroup/task_profiles.h @@ -36,6 +36,7 @@ class IProfileAttribute { virtual const CgroupController* controller() const = 0; virtual const std::string& file_name() const = 0; virtual bool GetPathForTask(int tid, std::string* path) const = 0; + virtual bool GetPathForUID(uid_t uid, std::string* path) const = 0; }; class ProfileAttribute : public IProfileAttribute { @@ -53,6 +54,7 @@ class ProfileAttribute : public IProfileAttribute { void Reset(const CgroupController& controller, const std::string& file_name) override; bool GetPathForTask(int tid, std::string* path) const override; + bool GetPathForUID(uid_t uid, std::string* path) const override; private: CgroupController controller_; @@ -72,6 +74,7 @@ class ProfileAction { // Default implementations will fail virtual bool ExecuteForProcess(uid_t, pid_t) const { return false; }; virtual bool ExecuteForTask(int) const { return false; }; + virtual bool ExecuteForUID(uid_t) const { return false; }; virtual void EnableResourceCaching(ResourceCacheType) {} virtual void DropResourceCaching(ResourceCacheType) {} @@ -116,6 +119,7 @@ class SetAttributeAction : public ProfileAction { const char* Name() const override { return "SetAttribute"; } bool ExecuteForProcess(uid_t uid, pid_t pid) const override; bool ExecuteForTask(int tid) const override; + bool ExecuteForUID(uid_t uid) const override; private: const IProfileAttribute* attribute_; @@ -179,6 +183,7 @@ class TaskProfile { bool ExecuteForProcess(uid_t uid, pid_t pid) const; bool ExecuteForTask(int tid) const; + bool ExecuteForUID(uid_t uid) const; void EnableResourceCaching(ProfileAction::ResourceCacheType cache_type); void DropResourceCaching(ProfileAction::ResourceCacheType cache_type); @@ -216,6 +221,8 @@ class TaskProfiles { bool SetProcessProfiles(uid_t uid, pid_t pid, std::span profiles, bool use_fd_cache); template bool SetTaskProfiles(int tid, std::span profiles, bool use_fd_cache); + template + bool SetUserProfiles(uid_t uid, std::span profiles, bool use_fd_cache); private: TaskProfiles(); diff --git a/libprocessgroup/task_profiles_test.cpp b/libprocessgroup/task_profiles_test.cpp index 09ac44c6b..aa74f9d25 100644 --- a/libprocessgroup/task_profiles_test.cpp +++ b/libprocessgroup/task_profiles_test.cpp @@ -121,6 +121,10 @@ class ProfileAttributeMock : public IProfileAttribute { return true; }; + bool GetPathForUID(uid_t, std::string*) const override { + return false; + } + private: const std::string file_name_; };