libprocessgroup checks whether it can use memory
cgroups for keeping track of forked processes by
seeing whether /dev/memcg/apps is writable. However,
on systems with memory cgroups disabled, SELinux
(correctly) no longer classifies this directory as a cgroup,
and starts denying zygote access. To fix this,
first check whether /dev/memcg/apps/tasks exists to
see if the cgroup is mounted; only then check whether
we can write to the directory.
Bug: 27046965
Change-Id: I6e44cd62d8c396e20ceb162c50606b3e86f2cb3e
It turns out we were using the CPU accounting
cgroups for keeping track of processes that were
forked by an app without the framework's knowledge,
so we could kill all of them reliably (see b/15313911
for context).
Since we want to use memory cgroups for other purposes,
we might as well use memory cgroups for tracking forked
PIDs if they're enabled. This also gets us automatic cleanup
of empty mem cgroups.
Also, removed old mem cgroup mount point that is no
longer used, as well as cgroup release agent code that
we're not using.
Change-Id: I69d5cc31c162ffa49ef6945755f41381e306cc8b
to make the function faster on average. Since killing a process
takes about 40-60ms on a recent device, the previous logic tends
to sleep too long. This CL does not significantly change the total
timeout (old code: 204ms, new code: 200ms).
Bug: 21813611
Change-Id: Ica44b2437ccccaebadcf585d7a09d993ce71a499
Make a format string match the type of the parameter it represents
Change-Id: I0af88636448084b56450996ea9dafdba3c1fd2a3
Signed-off-by: Bernhard Rosenkränzer <Bernhard.Rosenkranzer@linaro.org
Currently, mkdirAndChown takes parameters for mode, uid and gid, but
ignores them and hardcodes 0750, AID_SYSTEM, AID_SYSTEM instead.
This doesn't matter much because so far its only invocation passes
exactly those values as parameters -- but clang complains about unused
parameters.
Might as well make the function do what it claims to do.
Change-Id: I5a8056be3278a0c5d0a576dbc061288aa0956a35
Signed-off-by: Bernhard Rosenkränzer <Bernhard.Rosenkranzer@linaro.org>
It looks like there were a couple problems in the code:
- It would not 0-terminate the string it read, to make sure we didn't
see garbage at the end.
- It didn't reduce buf_len as it processes data in the buffer, so if
we need to read more we will increase the buffer length to be longer
than the actual available data.
Also put in some logs about every thing we kill, so we can see what
is going on when debugging. And add a special check for us trying
to kill pid 0 for any reason, since doing so seem to be terminal to
the caller.
Change-Id: I2fe29bfef08938b8a2eb182475c0705c14d8d84f
removeAllProcessGroups and removeUidProcessGroups were calling
opendir, but never called closedir. This would leave a leaked
file descriptor for every /acct/uid_* directory that existed
at boot.
Change-Id: Ia08eccd42d6ad7a6c1c78402519ac2e53b4fc83a
libprocessgroup will allow Zygote to place processes
in a cgroup, and then kill the process and all forked processes
later. lmkd will also kill all forked processes.
Bug: 15313911
Change-Id: I20404d0dbe448f1c475d2f4c61cccca462f9e544
