1 /*
2  *  Copyright 2014 Google, Inc
3  *
4  *  Licensed under the Apache License, Version 2.0 (the "License");
5  *  you may not use this file except in compliance with the License.
6  *  You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  *  Unless required by applicable law or agreed to in writing, software
11  *  distributed under the License is distributed on an "AS IS" BASIS,
12  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  *  See the License for the specific language governing permissions and
14  *  limitations under the License.
15  */
16 
17 //#define LOG_NDEBUG 0
18 #define LOG_TAG "libprocessgroup"
19 
20 #include <assert.h>
21 #include <dirent.h>
22 #include <errno.h>
23 #include <fcntl.h>
24 #include <inttypes.h>
25 #include <signal.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <sys/stat.h>
29 #include <sys/types.h>
30 #include <unistd.h>
31 
32 #include <chrono>
33 #include <map>
34 #include <memory>
35 #include <mutex>
36 #include <set>
37 #include <string>
38 #include <thread>
39 
40 #include <android-base/file.h>
41 #include <android-base/logging.h>
42 #include <android-base/properties.h>
43 #include <android-base/stringprintf.h>
44 #include <android-base/strings.h>
45 #include <cutils/android_filesystem_config.h>
46 #include <processgroup/processgroup.h>
47 #include <task_profiles.h>
48 
49 using android::base::GetBoolProperty;
50 using android::base::StartsWith;
51 using android::base::StringPrintf;
52 using android::base::WriteStringToFile;
53 
54 using namespace std::chrono_literals;
55 
56 #define PROCESSGROUP_CGROUP_PROCS_FILE "/cgroup.procs"
57 
CgroupGetControllerPath(const std::string & cgroup_name,std::string * path)58 bool CgroupGetControllerPath(const std::string& cgroup_name, std::string* path) {
59     auto controller = CgroupMap::GetInstance().FindController(cgroup_name);
60 
61     if (!controller.HasValue()) {
62         return false;
63     }
64 
65     if (path) {
66         *path = controller.path();
67     }
68 
69     return true;
70 }
71 
CgroupGetAttributePath(const std::string & attr_name,std::string * path)72 bool CgroupGetAttributePath(const std::string& attr_name, std::string* path) {
73     const TaskProfiles& tp = TaskProfiles::GetInstance();
74     const ProfileAttribute* attr = tp.GetAttribute(attr_name);
75 
76     if (attr == nullptr) {
77         return false;
78     }
79 
80     if (path) {
81         *path = StringPrintf("%s/%s", attr->controller()->path(), attr->file_name().c_str());
82     }
83 
84     return true;
85 }
86 
CgroupGetAttributePathForTask(const std::string & attr_name,int tid,std::string * path)87 bool CgroupGetAttributePathForTask(const std::string& attr_name, int tid, std::string* path) {
88     const TaskProfiles& tp = TaskProfiles::GetInstance();
89     const ProfileAttribute* attr = tp.GetAttribute(attr_name);
90 
91     if (attr == nullptr) {
92         return false;
93     }
94 
95     if (!attr->GetPathForTask(tid, path)) {
96         PLOG(ERROR) << "Failed to find cgroup for tid " << tid;
97         return false;
98     }
99 
100     return true;
101 }
102 
UsePerAppMemcg()103 bool UsePerAppMemcg() {
104     bool low_ram_device = GetBoolProperty("ro.config.low_ram", false);
105     return GetBoolProperty("ro.config.per_app_memcg", low_ram_device);
106 }
107 
isMemoryCgroupSupported()108 static bool isMemoryCgroupSupported() {
109     static bool memcg_supported = CgroupMap::GetInstance().FindController("memory").IsUsable();
110 
111     return memcg_supported;
112 }
113 
SetProcessProfiles(uid_t uid,pid_t pid,const std::vector<std::string> & profiles,bool use_fd_cache)114 bool SetProcessProfiles(uid_t uid, pid_t pid, const std::vector<std::string>& profiles,
115                         bool use_fd_cache) {
116     const TaskProfiles& tp = TaskProfiles::GetInstance();
117 
118     for (const auto& name : profiles) {
119         TaskProfile* profile = tp.GetProfile(name);
120         if (profile != nullptr) {
121             if (use_fd_cache) {
122                 profile->EnableResourceCaching();
123             }
124             if (!profile->ExecuteForProcess(uid, pid)) {
125                 PLOG(WARNING) << "Failed to apply " << name << " process profile";
126             }
127         } else {
128             PLOG(WARNING) << "Failed to find " << name << "process profile";
129         }
130     }
131 
132     return true;
133 }
134 
SetTaskProfiles(int tid,const std::vector<std::string> & profiles,bool use_fd_cache)135 bool SetTaskProfiles(int tid, const std::vector<std::string>& profiles, bool use_fd_cache) {
136     const TaskProfiles& tp = TaskProfiles::GetInstance();
137 
138     for (const auto& name : profiles) {
139         TaskProfile* profile = tp.GetProfile(name);
140         if (profile != nullptr) {
141             if (use_fd_cache) {
142                 profile->EnableResourceCaching();
143             }
144             if (!profile->ExecuteForTask(tid)) {
145                 PLOG(WARNING) << "Failed to apply " << name << " task profile";
146             }
147         } else {
148             PLOG(WARNING) << "Failed to find " << name << "task profile";
149         }
150     }
151 
152     return true;
153 }
154 
ConvertUidToPath(const char * cgroup,uid_t uid)155 static std::string ConvertUidToPath(const char* cgroup, uid_t uid) {
156     return StringPrintf("%s/uid_%d", cgroup, uid);
157 }
158 
ConvertUidPidToPath(const char * cgroup,uid_t uid,int pid)159 static std::string ConvertUidPidToPath(const char* cgroup, uid_t uid, int pid) {
160     return StringPrintf("%s/uid_%d/pid_%d", cgroup, uid, pid);
161 }
162 
RemoveProcessGroup(const char * cgroup,uid_t uid,int pid)163 static int RemoveProcessGroup(const char* cgroup, uid_t uid, int pid) {
164     int ret;
165 
166     auto uid_pid_path = ConvertUidPidToPath(cgroup, uid, pid);
167     ret = rmdir(uid_pid_path.c_str());
168 
169     auto uid_path = ConvertUidToPath(cgroup, uid);
170     rmdir(uid_path.c_str());
171 
172     return ret;
173 }
174 
RemoveUidProcessGroups(const std::string & uid_path)175 static bool RemoveUidProcessGroups(const std::string& uid_path) {
176     std::unique_ptr<DIR, decltype(&closedir)> uid(opendir(uid_path.c_str()), closedir);
177     bool empty = true;
178     if (uid != NULL) {
179         dirent* dir;
180         while ((dir = readdir(uid.get())) != nullptr) {
181             if (dir->d_type != DT_DIR) {
182                 continue;
183             }
184 
185             if (!StartsWith(dir->d_name, "pid_")) {
186                 continue;
187             }
188 
189             auto path = StringPrintf("%s/%s", uid_path.c_str(), dir->d_name);
190             LOG(VERBOSE) << "Removing " << path;
191             if (rmdir(path.c_str()) == -1) {
192                 if (errno != EBUSY) {
193                     PLOG(WARNING) << "Failed to remove " << path;
194                 }
195                 empty = false;
196             }
197         }
198     }
199     return empty;
200 }
201 
removeAllProcessGroups()202 void removeAllProcessGroups() {
203     LOG(VERBOSE) << "removeAllProcessGroups()";
204 
205     std::vector<std::string> cgroups;
206     std::string path;
207 
208     if (CgroupGetControllerPath("cpuacct", &path)) {
209         cgroups.push_back(path);
210     }
211     if (CgroupGetControllerPath("memory", &path)) {
212         cgroups.push_back(path + "/apps");
213     }
214 
215     for (std::string cgroup_root_path : cgroups) {
216         std::unique_ptr<DIR, decltype(&closedir)> root(opendir(cgroup_root_path.c_str()), closedir);
217         if (root == NULL) {
218             PLOG(ERROR) << "Failed to open " << cgroup_root_path;
219         } else {
220             dirent* dir;
221             while ((dir = readdir(root.get())) != nullptr) {
222                 if (dir->d_type != DT_DIR) {
223                     continue;
224                 }
225 
226                 if (!StartsWith(dir->d_name, "uid_")) {
227                     continue;
228                 }
229 
230                 auto path = StringPrintf("%s/%s", cgroup_root_path.c_str(), dir->d_name);
231                 if (!RemoveUidProcessGroups(path)) {
232                     LOG(VERBOSE) << "Skip removing " << path;
233                     continue;
234                 }
235                 LOG(VERBOSE) << "Removing " << path;
236                 if (rmdir(path.c_str()) == -1 && errno != EBUSY) {
237                     PLOG(WARNING) << "Failed to remove " << path;
238                 }
239             }
240         }
241     }
242 }
243 
MkdirAndChown(const std::string & path,mode_t mode,uid_t uid,gid_t gid)244 static bool MkdirAndChown(const std::string& path, mode_t mode, uid_t uid, gid_t gid) {
245     if (mkdir(path.c_str(), mode) == -1 && errno != EEXIST) {
246         return false;
247     }
248 
249     if (chown(path.c_str(), uid, gid) == -1) {
250         int saved_errno = errno;
251         rmdir(path.c_str());
252         errno = saved_errno;
253         return false;
254     }
255 
256     return true;
257 }
258 
259 // Returns number of processes killed on success
260 // Returns 0 if there are no processes in the process cgroup left to kill
261 // Returns -1 on error
DoKillProcessGroupOnce(const char * cgroup,uid_t uid,int initialPid,int signal)262 static int DoKillProcessGroupOnce(const char* cgroup, uid_t uid, int initialPid, int signal) {
263     auto path = ConvertUidPidToPath(cgroup, uid, initialPid) + PROCESSGROUP_CGROUP_PROCS_FILE;
264     std::unique_ptr<FILE, decltype(&fclose)> fd(fopen(path.c_str(), "re"), fclose);
265     if (!fd) {
266         if (errno == ENOENT) {
267             // This happens when process is already dead
268             return 0;
269         }
270         PLOG(WARNING) << "Failed to open process cgroup uid " << uid << " pid " << initialPid;
271         return -1;
272     }
273 
274     // We separate all of the pids in the cgroup into those pids that are also the leaders of
275     // process groups (stored in the pgids set) and those that are not (stored in the pids set).
276     std::set<pid_t> pgids;
277     pgids.emplace(initialPid);
278     std::set<pid_t> pids;
279 
280     pid_t pid;
281     int processes = 0;
282     while (fscanf(fd.get(), "%d\n", &pid) == 1 && pid >= 0) {
283         processes++;
284         if (pid == 0) {
285             // Should never happen...  but if it does, trying to kill this
286             // will boomerang right back and kill us!  Let's not let that happen.
287             LOG(WARNING) << "Yikes, we've been told to kill pid 0!  How about we don't do that?";
288             continue;
289         }
290         pid_t pgid = getpgid(pid);
291         if (pgid == -1) PLOG(ERROR) << "getpgid(" << pid << ") failed";
292         if (pgid == pid) {
293             pgids.emplace(pid);
294         } else {
295             pids.emplace(pid);
296         }
297     }
298 
299     // Erase all pids that will be killed when we kill the process groups.
300     for (auto it = pids.begin(); it != pids.end();) {
301         pid_t pgid = getpgid(*it);
302         if (pgids.count(pgid) == 1) {
303             it = pids.erase(it);
304         } else {
305             ++it;
306         }
307     }
308 
309     // Kill all process groups.
310     for (const auto pgid : pgids) {
311         LOG(VERBOSE) << "Killing process group " << -pgid << " in uid " << uid
312                      << " as part of process cgroup " << initialPid;
313 
314         if (kill(-pgid, signal) == -1 && errno != ESRCH) {
315             PLOG(WARNING) << "kill(" << -pgid << ", " << signal << ") failed";
316         }
317     }
318 
319     // Kill remaining pids.
320     for (const auto pid : pids) {
321         LOG(VERBOSE) << "Killing pid " << pid << " in uid " << uid << " as part of process cgroup "
322                      << initialPid;
323 
324         if (kill(pid, signal) == -1 && errno != ESRCH) {
325             PLOG(WARNING) << "kill(" << pid << ", " << signal << ") failed";
326         }
327     }
328 
329     return feof(fd.get()) ? processes : -1;
330 }
331 
KillProcessGroup(uid_t uid,int initialPid,int signal,int retries)332 static int KillProcessGroup(uid_t uid, int initialPid, int signal, int retries) {
333     std::string cpuacct_path;
334     std::string memory_path;
335 
336     CgroupGetControllerPath("cpuacct", &cpuacct_path);
337     CgroupGetControllerPath("memory", &memory_path);
338     memory_path += "/apps";
339 
340     const char* cgroup =
341             (!access(ConvertUidPidToPath(cpuacct_path.c_str(), uid, initialPid).c_str(), F_OK))
342                     ? cpuacct_path.c_str()
343                     : memory_path.c_str();
344 
345     std::chrono::steady_clock::time_point start = std::chrono::steady_clock::now();
346 
347     int retry = retries;
348     int processes;
349     while ((processes = DoKillProcessGroupOnce(cgroup, uid, initialPid, signal)) > 0) {
350         LOG(VERBOSE) << "Killed " << processes << " processes for processgroup " << initialPid;
351         if (retry > 0) {
352             std::this_thread::sleep_for(5ms);
353             --retry;
354         } else {
355             break;
356         }
357     }
358 
359     if (processes < 0) {
360         PLOG(ERROR) << "Error encountered killing process cgroup uid " << uid << " pid "
361                     << initialPid;
362         return -1;
363     }
364 
365     std::chrono::steady_clock::time_point end = std::chrono::steady_clock::now();
366     auto ms = std::chrono::duration_cast<std::chrono::milliseconds>(end - start).count();
367 
368     // We only calculate the number of 'processes' when killing the processes.
369     // In the retries == 0 case, we only kill the processes once and therefore
370     // will not have waited then recalculated how many processes are remaining
371     // after the first signals have been sent.
372     // Logging anything regarding the number of 'processes' here does not make sense.
373 
374     if (processes == 0) {
375         if (retries > 0) {
376             LOG(INFO) << "Successfully killed process cgroup uid " << uid << " pid " << initialPid
377                       << " in " << static_cast<int>(ms) << "ms";
378         }
379         return RemoveProcessGroup(cgroup, uid, initialPid);
380     } else {
381         if (retries > 0) {
382             LOG(ERROR) << "Failed to kill process cgroup uid " << uid << " pid " << initialPid
383                        << " in " << static_cast<int>(ms) << "ms, " << processes
384                        << " processes remain";
385         }
386         return -1;
387     }
388 }
389 
killProcessGroup(uid_t uid,int initialPid,int signal)390 int killProcessGroup(uid_t uid, int initialPid, int signal) {
391     return KillProcessGroup(uid, initialPid, signal, 40 /*retries*/);
392 }
393 
killProcessGroupOnce(uid_t uid,int initialPid,int signal)394 int killProcessGroupOnce(uid_t uid, int initialPid, int signal) {
395     return KillProcessGroup(uid, initialPid, signal, 0 /*retries*/);
396 }
397 
createProcessGroup(uid_t uid,int initialPid,bool memControl)398 int createProcessGroup(uid_t uid, int initialPid, bool memControl) {
399     std::string cgroup;
400     if (isMemoryCgroupSupported() && (memControl || UsePerAppMemcg())) {
401         CgroupGetControllerPath("memory", &cgroup);
402         cgroup += "/apps";
403     } else {
404         CgroupGetControllerPath("cpuacct", &cgroup);
405     }
406 
407     auto uid_path = ConvertUidToPath(cgroup.c_str(), uid);
408 
409     if (!MkdirAndChown(uid_path, 0750, AID_SYSTEM, AID_SYSTEM)) {
410         PLOG(ERROR) << "Failed to make and chown " << uid_path;
411         return -errno;
412     }
413 
414     auto uid_pid_path = ConvertUidPidToPath(cgroup.c_str(), uid, initialPid);
415 
416     if (!MkdirAndChown(uid_pid_path, 0750, AID_SYSTEM, AID_SYSTEM)) {
417         PLOG(ERROR) << "Failed to make and chown " << uid_pid_path;
418         return -errno;
419     }
420 
421     auto uid_pid_procs_file = uid_pid_path + PROCESSGROUP_CGROUP_PROCS_FILE;
422 
423     int ret = 0;
424     if (!WriteStringToFile(std::to_string(initialPid), uid_pid_procs_file)) {
425         ret = -errno;
426         PLOG(ERROR) << "Failed to write '" << initialPid << "' to " << uid_pid_procs_file;
427     }
428 
429     return ret;
430 }
431 
SetProcessGroupValue(int tid,const std::string & attr_name,int64_t value)432 static bool SetProcessGroupValue(int tid, const std::string& attr_name, int64_t value) {
433     if (!isMemoryCgroupSupported()) {
434         PLOG(ERROR) << "Memcg is not mounted.";
435         return false;
436     }
437 
438     std::string path;
439     if (!CgroupGetAttributePathForTask(attr_name, tid, &path)) {
440         PLOG(ERROR) << "Failed to find attribute '" << attr_name << "'";
441         return false;
442     }
443 
444     if (!WriteStringToFile(std::to_string(value), path)) {
445         PLOG(ERROR) << "Failed to write '" << value << "' to " << path;
446         return false;
447     }
448     return true;
449 }
450 
setProcessGroupSwappiness(uid_t,int pid,int swappiness)451 bool setProcessGroupSwappiness(uid_t, int pid, int swappiness) {
452     return SetProcessGroupValue(pid, "MemSwappiness", swappiness);
453 }
454 
setProcessGroupSoftLimit(uid_t,int pid,int64_t soft_limit_in_bytes)455 bool setProcessGroupSoftLimit(uid_t, int pid, int64_t soft_limit_in_bytes) {
456     return SetProcessGroupValue(pid, "MemSoftLimit", soft_limit_in_bytes);
457 }
458 
setProcessGroupLimit(uid_t,int pid,int64_t limit_in_bytes)459 bool setProcessGroupLimit(uid_t, int pid, int64_t limit_in_bytes) {
460     return SetProcessGroupValue(pid, "MemLimit", limit_in_bytes);
461 }
462