From 62dd4d25a2bc5ee33ed22728dc79a5da99906748 Mon Sep 17 00:00:00 2001
From: Pavel Hrdina <phrdina@redhat.com>
Date: Thu, 27 Jun 2019 14:54:54 +0200
Subject: [PATCH] util: vircgroupv2: stop enabling missing controllers with
 systemd
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Because of a systemd delegation policy [1] we should not write to any
cgroups files owned by systemd which in case of cgroups v2 includes
'cgroups.subtree_control'.

systemd will enable controllers automatically for us to have them
available for VM cgroups.

[1] <https://github.com/systemd/systemd/blob/master/docs/CGROUP_DELEGATION.md>

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
---
 src/util/vircgroup.c        | 2 +-
 src/util/vircgroupbackend.h | 3 +++
 src/util/vircgroupv2.c      | 5 +++++
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c
index e4675a09777..268e4013e39 100644
--- a/src/util/vircgroup.c
+++ b/src/util/vircgroup.c
@@ -1082,7 +1082,7 @@ virCgroupEnableMissingControllers(char *path,
                          &tmp) < 0)
             goto cleanup;
 
-        if (virCgroupMakeGroup(parent, tmp, true, VIR_CGROUP_NONE) < 0) {
+        if (virCgroupMakeGroup(parent, tmp, true, VIR_CGROUP_SYSTEMD) < 0) {
             virCgroupFree(&tmp);
             goto cleanup;
         }
diff --git a/src/util/vircgroupbackend.h b/src/util/vircgroupbackend.h
index e58e327c687..a91719f89df 100644
--- a/src/util/vircgroupbackend.h
+++ b/src/util/vircgroupbackend.h
@@ -34,6 +34,9 @@ typedef enum {
                                        * attaching tasks
                                        */
     VIR_CGROUP_THREAD = 1 << 1, /* cgroup v2 handles threads differently */
+    VIR_CGROUP_SYSTEMD = 1 << 2, /* with systemd and cgroups v2 we cannot
+                                  * manually enable controllers that systemd
+                                  * doesn't know how to delegate */
 } virCgroupBackendFlags;
 
 typedef enum {
diff --git a/src/util/vircgroupv2.c b/src/util/vircgroupv2.c
index b3297dbb132..9d8a38925ad 100644
--- a/src/util/vircgroupv2.c
+++ b/src/util/vircgroupv2.c
@@ -395,6 +395,11 @@ virCgroupV2MakeGroup(virCgroupPtr parent ATTRIBUTE_UNUSED,
     VIR_AUTOFREE(char *) path = NULL;
     int controller;
 
+    if (flags & VIR_CGROUP_SYSTEMD) {
+        VIR_DEBUG("Running with systemd so we should not create cgroups ourselves.");
+        return 0;
+    }
+
     VIR_DEBUG("Make group %s", group->path);
 
     controller = virCgroupV2GetAnyController(group);