Skip to content
Permalink
Browse files

cgroups: remove legacy cgfs cgroup driver

The time has come to remove the cgfs cgroup driver as well. I'm doing this for
mainly two reasons:
- potential security issue:
  The cgfs cgroup driver has been unmaintained for a long time now. It did not
  receive new functionality apart from bugfixes. Now that cgroup2 is a thing
  the internal logic how to deal with cgroups has been substantially reworked
  for the cgfsng driver. Given that we won't do the same work for the cgfs
  driver I smell bugs all over the place in the near future. I don't want to
  wake up to a security issue where someone forces LXC to fallback to the cgfs
  driver to exploit bugs when e.g. running in a pure unified cgroup layout.
- code complexity:
  The cgfs cgroup driver is massively complex since it tried to figure out
  where the mountpoint for each legacy cgroup hierarchy is, i.e. it didn't make
  simplyfing assumptions like cgfsng does about where the cgroup hierarchies -
  legacy or unified - would be mounted. This was appropriate before cgroup
  mounting has been standardized. Nowadays, anyone who mounts cgroups not under
  /sys/fs/cgroup is on their own. Furthermore, with unified hierarchy cgroup
  layouts there will only be a single hierarchy mounted at /sys/fs/cgroup so
  there's even less need to drag the complex parsing in cgfs into the future.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
  • Loading branch information...
brauner committed Feb 19, 2018
1 parent 6812d83 commit 1a8848b371cf2c86400f58fc64bf7ecc2cf5b261
Showing with 1 addition and 2,728 deletions.
  1. +0 −1 src/lxc/Makefile.am
  2. +0 −2,718 src/lxc/cgroups/cgfs.c
  3. +1 −9 src/lxc/cgroups/cgroup.c
@@ -92,7 +92,6 @@ liblxc_la_SOURCES = \
storage/rsync.c storage/rsync.h \
storage/zfs.c storage/zfs.h \
storage/storage_utils.c storage/storage_utils.h \
cgroups/cgfs.c \
cgroups/cgfsng.c \
cgroups/cgroup_utils.c cgroups/cgroup_utils.h \
cgroups/cgroup.c cgroups/cgroup.h \

0 comments on commit 1a8848b

Please sign in to comment.
You can’t perform that action at this time.