This class is essentially libcriu in python(yet for now it
has only some basic functions such as check/dump/restore).
It is needed to make life for python users even more easier,
i.e. hiding some nasty connection stuff. It is also using
criu swrk(COMM_BIN) communication method, instead of an old
system service, as we no longer recommend it.
Signed-off-by: Ruslan Kuprieiev <rkuprieiev@cloudlinux.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
1. As pointed out by Coverity (CID 114629), mnt_ns_fd is closed,
but then the function calls try_clean_remaps(mnt_ns_fd)
which tries to close the file descriptor which is already closed.
To address this, let's use safe_close() which sets closed fd to -1.
As it also checks its argument, there's no need for explicit check
so let's remove "if" check before close().
2. As Pavel pointed out, "calling the whole try_clean_remaps()
is not required once we've passed the cleanup_mnt_ns() point".
This could be addressed by introducing yet another label, but
it's cleaner to just use a flag variable.
Note that since the second issue is being addressed, the first one
goes away, but let's keep the fix for it anyway, it might help in
the future.
Signed-off-by: Kir Kolyshkin <kir@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
When running tests, there are a lot of errors like this:
(00.000053) Error (sysctl.c:367): Can't open sysctl net/ipv4/tcp_rmem: No such file or directory
As Andrew explained, tests are running in a netns that lacks
this sysctl. Use CTL_FLAGS_OPTIONAL flag to hide the error message.
Since with this flag sysctl_op() will most probably return 0,
add an additional check for vect[0] == 0 to detect that the file
was not read and show an appropriate warning, i.e.
"TCP mem sysctls are not available. Using defaults."
Signed-off-by: Kir Kolyshkin <kir@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
I spent some time trying to figure out why vect array
is declared as [2][3], also why vect[0] is not used.
The answer is commit 4bca68b that removed code using it.
Let's save a few bytes, and make the code more readable.
Signed-off-by: Kir Kolyshkin <kir@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
As our tests serve as an example for people on how to preferably
use criu, we need to also switch to swrk.
Signed-off-by: Ruslan Kuprieiev <rkuprieiev@cloudlinux.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Not sure if it is okay, but this patch breaks backward compatibility,
as we now discourage people from using criu as a system service by default.
But it is better to be done rather sooner than later, considering criu service
is not widely used.
On a patch side, we just need to daemonize swrk if self-dump is requested.
Signed-off-by: Ruslan Kuprieiev <rkuprieiev@cloudlinux.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
As we've deleted them in previous two patches.
Signed-off-by: Ruslan Kuprieiev <rkuprieiev@cloudlinux.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
We don't need it without systemd configs.
Signed-off-by: Ruslan Kuprieiev <rkuprieiev@cloudlinux.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
As it is not recomended to run criu as a root system service, lets
remove service file to stop encouraging people to do it.
Signed-off-by: Ruslan Kuprieiev <rkuprieiev@cloudlinux.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
This patch change the build chain to not use pie objects in the crtools
executable.
This done by building the shared source files twice:
1. for parasite/restorer as '<file>-pie-build.o'
2. for crtools as '<file>.o'
Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
Reviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
The kernel prior 4.3 is exporting FS_EVENT_ON_CHILD
bit via procfs fdinfo interface. This bit is kernel's
internal and should not be passed in inotify_add_watch
call. Thus simply filter it out when obtain from old
images for backward compatibility reason.
More details here https://lkml.org/lkml/2015/9/21/680
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
open_mountpoint helper is called when mount namespace are
already restored so we have to use local paths.
This is a continuation to patch a082f27b -- we keep mount
point id in fsnotify, thus we should use the namespace's
path for open.
https://jira.sw.ru/browse/PSBM-39957
Signed-off-by: Andrew Vagin <avagin@openvz.org>
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
If criu restore failed, criu should wait all processes because they
hold files, namespaces and other stuff that caller might want to
have released (in our case it was ploop device).
Here we do this only for cases when processes are restored in a pid
namespace. We'd like to do the same for non-ns case, but there's
no simple way to wait for a bunch of unconnected processes.
Another good side effect is that "Restoring FAILED." will be printed
at the end of the log (now after we kill init tasks still have time
to do smth and write log messages).
Cc: Nikita Spiridonov <nspiridonov@odin.com>
Reported-by: Nikita Spiridonov <nspiridonov@odin.com>
Signed-off-by: Andrew Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
We need to use SIG_SETMASK instead of SIG_BLOCK.
SIG_SETMASK
The set of blocked signals is set to the argument set.
Signed-off-by: Andrew Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Otherwise it's impossible to understand from which namespace
this path should be opened.
Signed-off-by: Andrew Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
For slave mount we need to make sure that all childrent
mountpoints of the master peer is mounted before we can
proceed otherwise there gonna be duplicated mountpoints
after the restore.
https://jira.sw.ru/browse/PSBM-39957
Signed-off-by: Andrew Vagin <avagin@odin.com>
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
This flag means that there's lib/ directory where a plugin is.
Currently rtc test is such. The wait_pid_die timeout is risen
since this test dies for more than 6 seconds :)
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
I constantly have binfmt_misc off on my set ups :) Looks like this fs is
far from being default for systems, so to make the test work (we plan to
rewrite it anyway) let's make this fs being optional.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Hand-made list of tests is not great. As Christopher suggested we can find
all executables in a directory and treat them as tests. This idea is good,
but requires a little bit more trickery.
First, some executables in directory are not tests, e.g. these are per-test
scripts, which should be skipped. Next, not all tests in zdtm can be right
now run in continuous manner (they fail), but we want to run them manually.
To fix that such tests are marked with 'noauto' flag in the description.
So we have the test test descriptor file, which states in which file to
look for tests (executable) and which of them to exclude. Maybe more, can
be added on demand.
And, finally, the per-test description goes in a ${test}.desc file in native
python eval/repr-able format. If the file is absent a default description
is used.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
The main difficulty here is that restored test becomes zdtm.py's kid
and after killing one we should wait() the test's zombie. W/o the
--restore-sibling test gets restored under existing init and gets
wait()-ed automagically.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
When test is run in pseudo-container (--parallel execution) the new namespace's
init is the python script itself. Thus all dying tests get reparent-ed to it and
sit as zombies forever.
Create pseudo-init for such containers ripping all the children.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
pr_perror() is special, it adds \n at the end so there is
no need to supply one.
Signed-off-by: Kir Kolyshkin <kir@openvz.org>
Acked-by: Andrew Vagin <avagin@odin.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
In places where we have errno value set, such as after calling ptrace(),
it makes sense to use pr_perror as it appends the errno string. This
also fixes missing '\n' at the end (as pr_perror() adds it).
In places where we keep using pr_err(), don't forget to have '\n'.
Cc: Laurent Dufour <ldufour@linux.vnet.ibm.com>
Signed-off-by: Kir Kolyshkin <kir@openvz.org>
Reviewed-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
Acked-by: Andrew Vagin <avagin@odin.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Don't forget '\n' when using pr_err()
Signed-off-by: Kir Kolyshkin <kir@openvz.org>
Acked-by: Andrew Vagin <avagin@odin.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
As ptrace() sets errno, it makes sense to use pr_perror().
This also fixes the bug of missing '\n'.
Signed-off-by: Kir Kolyshkin <kir@openvz.org>
Acked-by: Andrew Vagin <avagin@odin.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
When we don't use userns, __userns_sysctl_op is called
in context of the current process. A mount namespaces is restored
the last one, so when we restore namespaces, we see /proc from the
host pid namespace. In this case we can't use virtual pid to access
/proc/pid.
Let's open /proc/self/ns and use this descriptor to switch namespaces.
Cc: Tycho Andersen <tycho.andersen@canonical.com>
Fixes: f79f4546cf ("sysctl: move sysctl calls to usernsd")
Signed-off-by: Andrew Vagin <avagin@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
There are still systems which do not support dirty memory tracking.
This offers an interface to query the dirty memory tracking availability
via the new feature check RPC.
This is in preparation of a p.haul change which will use this RPC
interface to automatically detect if pre-dumps should be executed
or not.
This change introduces an additional optional field in the
criu_request and criu_response message (features) which is a
'criu_features' message.
Right now only the check for the memory tracking feature is supported
in the message 'criu_features':
optional bool mem_track = 1;
v2: Instead of checking for memory tracking only, provide a generic
interface to check for arbitrary features.
v3: Do not use bitfields for feature encoding but protobuf optional
message parameters.
Signed-off-by: Adrian Reber <areber@redhat.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
This allows the user to perform actions before dumping or restoration
occurs.
Signed-off-by: Matthew Krafczyk <krafczyk.matthew@gmail.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Chris Lamb <lamby@debian.org> reported in Debian that criu is not
building reproducible while working on the "reproducible builds" effort
[0].
[0] https://wiki.debian.org/ReproducibleBuilds
[1] https://bugs.debian.org/801211
Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
Acked-by: Andrew Vagin <avagin@odin.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
sys_sigaction() returns an error code
Reported-by: Kir Kolyshkin <kir@openvz.org>
Signed-off-by: Andrew Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Namespace roots might be slave ones from another
namespace roots, so we should not treat them as
"always ready" for mounting but rely on general
logic in can_mount_now which tests slaves relations.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Andrew Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
When we restore sockets with relative names we change
current working directory into the one provided by
socket image data. This actually affects current
criu state because the rest of code doesn't know
about such tricks and may rely on working dir
consistency.
So remember the current working dir and restore it
back once socket cwd operations are complete.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
377763e5 is incorrect since we can't always chop off the last element in
the buffer:
Execute static/cgroup00
./cgroup00 --pidfile=cgroup00.pid --outfile=cgroup00.out --dirname=cgroup00.test
Dump 12819
(00.003514) Error (files-reg.c:624): Can't create link remap for /dev/nul. Use link-remap option.
(00.003523) Error (cr-dump.c:1257): Dump files (pid: 12819) failed with -1
(00.004042) Error (cr-dump.c:1619): Dumping FAILED.
WARNING: cgroup00 returned 1 and left running for debug needs
Test: zdtm/live/static/cgroup00, Result: FAIL
==================================== ERROR ====================================
Test: zdtm/live/static/cgroup00, Namespace:
================================= ERROR OVER =================================
Hopefully the >= will appease coverity (instead of just a ==).
Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
