linux-kernel - cpusets in non-unified hierarchy broken?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150212214950.GB10662@ubuntumail>
Date:	Thu, 12 Feb 2015 21:49:51 +0000
From:	Serge Hallyn <serge.hallyn@...ntu.com>
To:	linux-kernel@...r.kernel.org, tj@...nel.org, lizefan@...wei.com
Cc:	Stéphane Graber <stgraber@...ntu.com>,
	christianvanbrauner@...il.com
Subject: cpusets in non-unified hierarchy broken?

Hi,

as of some point in 3.18, cpuset.cpus doesn't seem to be
enforced any more.  I don't see an obvious reason in the
code, but it seems likely to be related to the effective_cpus.

If I mount -t cgroup -o cpuset cpuset /mnt and then mkdir /mnt/lxc,
then /mnt/lxc has:

====================================================
ubuntu@...set1:~$ cat /mnt/lxc/cpuset.effective_cpus

ubuntu@...set1:~$ cat /mnt/lxc/cpuset.cpus
0-3
====================================================

while

====================================================
ubuntu@...set1:~$ cat /mnt/cpuset.effective_cpus
0-3
ubuntu@...set1:~$ cat /mnt/cpuset.cpus
0-3
====================================================

My understanding is that effective_cpus in /lxc should be
the /cpuset.effective_cpus & /lxc/cpuset.cpus.  But that
doesn't seem to be the case.  So then, when I start a
container confined to a single cpu (which will use cgroup
/lxc/c1, for instance) then it looks like:

====================================================
ubuntu@...set1:~$ cat /mnt/lxc/v1/cpuset.effective_cpus

ubuntu@...set1:~$ cat /mnt/lxc/v1/cpuset.cpus
1
====================================================

While the /proc/self/status inside that container and cgroup
shows:

====================================================
root@v1:~# grep -i cpu /proc/self/status
Cpus_allowed:   f
Cpus_allowed_list:      0-3
====================================================

Christian, who originally found this and reported it at
https://github.com/lxc/lxc/issues/427 , also tested that in fact
the tasks are not confined (so it's not just an issue of
improper reporting, it seems)

thanks,
-serge
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/