Page MenuHomeFreeBSD

jail(8): reset to root cpuset before attaching to run commands
ClosedPublic

Authored by kevans on Mar 2 2021, 3:26 AM.
Tags
None
Referenced Files
F80227570: D29008.diff
Fri, Mar 29, 10:38 AM
Unknown Object (File)
Tue, Mar 12, 1:01 AM
Unknown Object (File)
Tue, Mar 12, 1:01 AM
Unknown Object (File)
Tue, Mar 12, 1:01 AM
Unknown Object (File)
Fri, Mar 8, 4:18 AM
Unknown Object (File)
Feb 27 2024, 6:54 PM
Unknown Object (File)
Feb 8 2024, 8:52 PM
Unknown Object (File)
Jan 7 2024, 9:12 PM
Subscribers

Details

Summary

Recent changes have made it such that attaching to a jail will augment
the attaching process' cpu mask with the jail's cpuset. While this is
convenient for allowing the administrator to cpuset arbitrary programs
that will attach to a jail, this is decidedly not convenient for
executing long-running daemons during jail creation.

This change inserts a reset of the process cpuset to the root cpuset
between the fork and attach to execute a command. This allows commands
executed to have the widest mask possible, and the administrator can
cpuset(1) it back down inside the jail as needed.

With this applied, one should be able to change a jail's cpuset at
exec.poststart in addition to exec.created. The former was made
difficult if jail(8) itself was running with a constrained set, as then
some processes may have been spawned inside the jail with a non-root
set. The latter is the preferred option so that processes starting in
the jail are constrained appropriately up front.

Note that all system commands are still run with the process' initial
cpuset applied.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable