369 lines
10 KiB
C++
369 lines
10 KiB
C++
/*
|
|
* Copyright 2014 Google, Inc
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
//#define LOG_NDEBUG 0
|
|
#define LOG_TAG "libprocessgroup"
|
|
|
|
#include <assert.h>
|
|
#include <dirent.h>
|
|
#include <errno.h>
|
|
#include <fcntl.h>
|
|
#include <inttypes.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <sys/stat.h>
|
|
#include <sys/types.h>
|
|
|
|
#include <chrono>
|
|
#include <memory>
|
|
#include <mutex>
|
|
|
|
#include <android-base/logging.h>
|
|
#include <private/android_filesystem_config.h>
|
|
|
|
#include <processgroup/processgroup.h>
|
|
|
|
// Uncomment line below use memory cgroups for keeping track of (forked) PIDs
|
|
// #define USE_MEMCG 1
|
|
|
|
#define MEM_CGROUP_PATH "/dev/memcg/apps"
|
|
#define MEM_CGROUP_TASKS "/dev/memcg/apps/tasks"
|
|
#define ACCT_CGROUP_PATH "/acct"
|
|
|
|
#define PROCESSGROUP_UID_PREFIX "uid_"
|
|
#define PROCESSGROUP_PID_PREFIX "pid_"
|
|
#define PROCESSGROUP_CGROUP_PROCS_FILE "/cgroup.procs"
|
|
#define PROCESSGROUP_MAX_UID_LEN 11
|
|
#define PROCESSGROUP_MAX_PID_LEN 11
|
|
#define PROCESSGROUP_MAX_PATH_LEN \
|
|
((sizeof(MEM_CGROUP_PATH) > sizeof(ACCT_CGROUP_PATH) ? \
|
|
sizeof(MEM_CGROUP_PATH) : sizeof(ACCT_CGROUP_PATH)) + \
|
|
sizeof(PROCESSGROUP_UID_PREFIX) + 1 + \
|
|
PROCESSGROUP_MAX_UID_LEN + \
|
|
sizeof(PROCESSGROUP_PID_PREFIX) + 1 + \
|
|
PROCESSGROUP_MAX_PID_LEN + \
|
|
sizeof(PROCESSGROUP_CGROUP_PROCS_FILE) + \
|
|
1)
|
|
|
|
std::once_flag init_path_flag;
|
|
|
|
struct ctx {
|
|
bool initialized;
|
|
int fd;
|
|
char buf[128];
|
|
char *buf_ptr;
|
|
size_t buf_len;
|
|
};
|
|
|
|
static const char* getCgroupRootPath() {
|
|
#ifdef USE_MEMCG
|
|
static const char* cgroup_root_path = NULL;
|
|
std::call_once(init_path_flag, [&]() {
|
|
// Check if mem cgroup is mounted, only then check for write-access to avoid
|
|
// SELinux denials
|
|
cgroup_root_path = access(MEM_CGROUP_TASKS, F_OK) || access(MEM_CGROUP_PATH, W_OK) ?
|
|
ACCT_CGROUP_PATH : MEM_CGROUP_PATH;
|
|
});
|
|
return cgroup_root_path;
|
|
#else
|
|
return ACCT_CGROUP_PATH;
|
|
#endif
|
|
}
|
|
|
|
static int convertUidToPath(char *path, size_t size, uid_t uid)
|
|
{
|
|
return snprintf(path, size, "%s/%s%d",
|
|
getCgroupRootPath(),
|
|
PROCESSGROUP_UID_PREFIX,
|
|
uid);
|
|
}
|
|
|
|
static int convertUidPidToPath(char *path, size_t size, uid_t uid, int pid)
|
|
{
|
|
return snprintf(path, size, "%s/%s%d/%s%d",
|
|
getCgroupRootPath(),
|
|
PROCESSGROUP_UID_PREFIX,
|
|
uid,
|
|
PROCESSGROUP_PID_PREFIX,
|
|
pid);
|
|
}
|
|
|
|
static int initCtx(uid_t uid, int pid, struct ctx *ctx)
|
|
{
|
|
int ret;
|
|
char path[PROCESSGROUP_MAX_PATH_LEN] = {0};
|
|
convertUidPidToPath(path, sizeof(path), uid, pid);
|
|
strlcat(path, PROCESSGROUP_CGROUP_PROCS_FILE, sizeof(path));
|
|
|
|
int fd = open(path, O_RDONLY);
|
|
if (fd < 0) {
|
|
ret = -errno;
|
|
PLOG(WARNING) << "failed to open " << path;
|
|
return ret;
|
|
}
|
|
|
|
ctx->fd = fd;
|
|
ctx->buf_ptr = ctx->buf;
|
|
ctx->buf_len = 0;
|
|
ctx->initialized = true;
|
|
|
|
LOG(VERBOSE) << "Initialized context for " << path;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int refillBuffer(struct ctx *ctx)
|
|
{
|
|
memmove(ctx->buf, ctx->buf_ptr, ctx->buf_len);
|
|
ctx->buf_ptr = ctx->buf;
|
|
|
|
ssize_t ret = read(ctx->fd, ctx->buf_ptr + ctx->buf_len,
|
|
sizeof(ctx->buf) - ctx->buf_len - 1);
|
|
if (ret < 0) {
|
|
return -errno;
|
|
} else if (ret == 0) {
|
|
return 0;
|
|
}
|
|
|
|
ctx->buf_len += ret;
|
|
ctx->buf[ctx->buf_len] = 0;
|
|
LOG(VERBOSE) << "Read " << ret << " to buffer: " << ctx->buf;
|
|
|
|
assert(ctx->buf_len <= sizeof(ctx->buf));
|
|
|
|
return ret;
|
|
}
|
|
|
|
static pid_t getOneAppProcess(uid_t uid, int appProcessPid, struct ctx *ctx)
|
|
{
|
|
if (!ctx->initialized) {
|
|
int ret = initCtx(uid, appProcessPid, ctx);
|
|
if (ret < 0) {
|
|
return ret;
|
|
}
|
|
}
|
|
|
|
char *eptr;
|
|
while ((eptr = (char *)memchr(ctx->buf_ptr, '\n', ctx->buf_len)) == NULL) {
|
|
int ret = refillBuffer(ctx);
|
|
if (ret == 0) {
|
|
return -ERANGE;
|
|
}
|
|
if (ret < 0) {
|
|
return ret;
|
|
}
|
|
}
|
|
|
|
*eptr = '\0';
|
|
char *pid_eptr = NULL;
|
|
errno = 0;
|
|
long pid = strtol(ctx->buf_ptr, &pid_eptr, 10);
|
|
if (errno != 0) {
|
|
return -errno;
|
|
}
|
|
if (pid_eptr != eptr) {
|
|
return -EINVAL;
|
|
}
|
|
|
|
ctx->buf_len -= (eptr - ctx->buf_ptr) + 1;
|
|
ctx->buf_ptr = eptr + 1;
|
|
|
|
return (pid_t)pid;
|
|
}
|
|
|
|
static int removeProcessGroup(uid_t uid, int pid)
|
|
{
|
|
int ret;
|
|
char path[PROCESSGROUP_MAX_PATH_LEN] = {0};
|
|
|
|
convertUidPidToPath(path, sizeof(path), uid, pid);
|
|
ret = rmdir(path);
|
|
|
|
convertUidToPath(path, sizeof(path), uid);
|
|
rmdir(path);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static void removeUidProcessGroups(const char *uid_path)
|
|
{
|
|
std::unique_ptr<DIR, decltype(&closedir)> uid(opendir(uid_path), closedir);
|
|
if (uid != NULL) {
|
|
struct dirent cur;
|
|
struct dirent *dir;
|
|
while ((readdir_r(uid.get(), &cur, &dir) == 0) && dir) {
|
|
char path[PROCESSGROUP_MAX_PATH_LEN];
|
|
|
|
if (dir->d_type != DT_DIR) {
|
|
continue;
|
|
}
|
|
|
|
if (strncmp(dir->d_name, PROCESSGROUP_PID_PREFIX, strlen(PROCESSGROUP_PID_PREFIX))) {
|
|
continue;
|
|
}
|
|
|
|
snprintf(path, sizeof(path), "%s/%s", uid_path, dir->d_name);
|
|
LOG(VERBOSE) << "removing " << path;
|
|
if (rmdir(path) == -1) PLOG(WARNING) << "failed to remove " << path;
|
|
}
|
|
}
|
|
}
|
|
|
|
void removeAllProcessGroups()
|
|
{
|
|
LOG(VERBOSE) << "removeAllProcessGroups()";
|
|
const char* cgroup_root_path = getCgroupRootPath();
|
|
std::unique_ptr<DIR, decltype(&closedir)> root(opendir(cgroup_root_path), closedir);
|
|
if (root == NULL) {
|
|
PLOG(ERROR) << "failed to open " << cgroup_root_path;
|
|
} else {
|
|
struct dirent cur;
|
|
struct dirent *dir;
|
|
while ((readdir_r(root.get(), &cur, &dir) == 0) && dir) {
|
|
char path[PROCESSGROUP_MAX_PATH_LEN];
|
|
|
|
if (dir->d_type != DT_DIR) {
|
|
continue;
|
|
}
|
|
if (strncmp(dir->d_name, PROCESSGROUP_UID_PREFIX, strlen(PROCESSGROUP_UID_PREFIX))) {
|
|
continue;
|
|
}
|
|
|
|
snprintf(path, sizeof(path), "%s/%s", cgroup_root_path, dir->d_name);
|
|
removeUidProcessGroups(path);
|
|
LOG(VERBOSE) << "removing " << path;
|
|
if (rmdir(path) == -1) PLOG(WARNING) << "failed to remove " << path;
|
|
}
|
|
}
|
|
}
|
|
|
|
static int killProcessGroupOnce(uid_t uid, int initialPid, int signal)
|
|
{
|
|
int processes = 0;
|
|
struct ctx ctx;
|
|
pid_t pid;
|
|
|
|
ctx.initialized = false;
|
|
|
|
while ((pid = getOneAppProcess(uid, initialPid, &ctx)) >= 0) {
|
|
processes++;
|
|
if (pid == 0) {
|
|
// Should never happen... but if it does, trying to kill this
|
|
// will boomerang right back and kill us! Let's not let that happen.
|
|
LOG(WARNING) << "Yikes, we've been told to kill pid 0! How about we don't do that?";
|
|
continue;
|
|
}
|
|
LOG(VERBOSE) << "Killing pid " << pid << " in uid " << uid
|
|
<< " as part of process group " << initialPid;
|
|
if (kill(pid, signal) == -1) {
|
|
PLOG(WARNING) << "kill(" << pid << ", " << signal << ") failed";
|
|
}
|
|
}
|
|
|
|
if (ctx.initialized) {
|
|
close(ctx.fd);
|
|
}
|
|
|
|
return processes;
|
|
}
|
|
|
|
int killProcessGroup(uid_t uid, int initialPid, int signal)
|
|
{
|
|
std::chrono::steady_clock::time_point start = std::chrono::steady_clock::now();
|
|
|
|
int retry = 40;
|
|
int processes;
|
|
while ((processes = killProcessGroupOnce(uid, initialPid, signal)) > 0) {
|
|
LOG(VERBOSE) << "killed " << processes << " processes for processgroup " << initialPid;
|
|
if (retry > 0) {
|
|
usleep(5 * 1000); // 5ms
|
|
--retry;
|
|
} else {
|
|
LOG(ERROR) << "failed to kill " << processes << " processes for processgroup "
|
|
<< initialPid;
|
|
break;
|
|
}
|
|
}
|
|
|
|
std::chrono::steady_clock::time_point end = std::chrono::steady_clock::now();
|
|
|
|
auto ms = std::chrono::duration_cast<std::chrono::milliseconds>(end - start).count();
|
|
LOG(VERBOSE) << "Killed process group uid " << uid << " pid " << initialPid << " in "
|
|
<< static_cast<int>(ms) << "ms, " << processes << " procs remain";
|
|
|
|
if (processes == 0) {
|
|
return removeProcessGroup(uid, initialPid);
|
|
} else {
|
|
return -1;
|
|
}
|
|
}
|
|
|
|
static bool mkdirAndChown(const char *path, mode_t mode, uid_t uid, gid_t gid)
|
|
{
|
|
if (mkdir(path, mode) == -1 && errno != EEXIST) {
|
|
return false;
|
|
}
|
|
|
|
if (chown(path, uid, gid) == -1) {
|
|
int saved_errno = errno;
|
|
rmdir(path);
|
|
errno = saved_errno;
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
int createProcessGroup(uid_t uid, int initialPid)
|
|
{
|
|
char path[PROCESSGROUP_MAX_PATH_LEN] = {0};
|
|
|
|
convertUidToPath(path, sizeof(path), uid);
|
|
|
|
if (!mkdirAndChown(path, 0750, AID_SYSTEM, AID_SYSTEM)) {
|
|
PLOG(ERROR) << "failed to make and chown " << path;
|
|
return -errno;
|
|
}
|
|
|
|
convertUidPidToPath(path, sizeof(path), uid, initialPid);
|
|
|
|
if (!mkdirAndChown(path, 0750, AID_SYSTEM, AID_SYSTEM)) {
|
|
PLOG(ERROR) << "failed to make and chown " << path;
|
|
return -errno;
|
|
}
|
|
|
|
strlcat(path, PROCESSGROUP_CGROUP_PROCS_FILE, sizeof(path));
|
|
|
|
int fd = open(path, O_WRONLY);
|
|
if (fd == -1) {
|
|
int ret = -errno;
|
|
PLOG(ERROR) << "failed to open " << path;
|
|
return ret;
|
|
}
|
|
|
|
char pid[PROCESSGROUP_MAX_PID_LEN + 1] = {0};
|
|
int len = snprintf(pid, sizeof(pid), "%d", initialPid);
|
|
|
|
int ret = 0;
|
|
if (write(fd, pid, len) < 0) {
|
|
ret = -errno;
|
|
PLOG(ERROR) << "failed to write '" << pid << "' to " << path;
|
|
}
|
|
|
|
close(fd);
|
|
return ret;
|
|
}
|