main: remove cgroup support in favour of systemd resource controls

Native cgroup placement is removed. Delegating resource enforcement
to systemd eliminates the privileged /sys/fs/cgroup writes from
the main process and simplifies the code.

Administrators who previously relied on the 'cgroup' option should use
the [Service] section of the ocserv unit file instead; see
systemd.resource-control(5) for details.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

NEWS

@@ -1,4 +1,7 @@
 * Version 1.5.0 (unreleased)
+- Removed the 'cgroup' configuration option (used for cgroups v1).
+  Administrators should use systemd resource controls instead; see
+  systemd.resource-control(5).
 - Added 'service' sub-option to the 'auth = pam[...]' directive to allow
   configurable PAM service names, enabling per-vhost PAM stacks (#718)
 - ocserv-fw-nftables: dropped runtime dependency on ipcalc/ipcalc-ng (#709)

doc/sample.config

@@ -567,10 +567,9 @@ log-level = 2
 # [scope: vhost user]
 #net-priority = 3
 
-# Set the VPN worker process into a specific cgroup. This is Linux
-# specific and can be set per user/group or globally.
-# [scope: vhost user]
-#cgroup = "cpuset,cpu:test"
+# The 'cgroup' option (previously 'cpu,memory:name' for cgroups v1) has been
+# removed. Use systemd to place the ocserv service and its worker processes
+# into a cgroup instead. See systemd.resource-control(5) for the full set of knobs.
 
 #
 # Network settings
@@ -768,7 +767,7 @@ no-route = 192.168.5.0/255.255.255.0
 #  ipv?-network, ipv4-netmask, rx/tx-data-per-sec, iroute, route, no-route,
 #  explicit-ipv4, explicit-ipv6, net-priority, deny-roaming, no-udp,
 #  keepalive, dpd, mobile-dpd, max-same-clients, tunnel-all-dns,
-#  restrict-user-to-routes, cgroup, stats-report-time,
+#  restrict-user-to-routes, stats-report-time,
 #  mtu, idle-timeout, mobile-idle-timeout, restrict-user-to-ports,
 #  split-dns and session-timeout.
 #

src/cfg.proto

@@ -141,7 +141,7 @@ message ReloadableConfig {
   optional string connect_script     = 111; /* [scope: global] */
   optional string host_update_script = 112; /* [scope: global] */
   optional string disconnect_script  = 113; /* [scope: global] */
-  optional string cgroup             = 114; /* [scope: vhost user] */
+
   optional string proxy_url          = 115; /* [scope: vhost] */
   optional string xml_config_file    = 116; /* [scope: vhost user] ANYCONNECT_CLIENT_COMPAT only */
   optional string xml_config_hash    = 117; /* [scope: vhost user] ANYCONNECT_CLIENT_COMPAT only */

src/config.c

@@ -1373,8 +1373,6 @@ static int cfg_ini_handler(void *_ctx, const char *section, const char *name,
 		if (error_on_vhost(vhost->name, "device"))
 			return 0;
 		PREAD_STRING(config->network, config->network->name);
-	} else if (strcmp(name, "cgroup") == 0) {
-		READ_STRING(config->cgroup);
 	} else if (strcmp(name, "proxy-url") == 0) {
 		READ_STRING(config->proxy_url);
 	} else if (strcmp(name, "ipv4-network") == 0) {

src/ipc.proto

@@ -43,7 +43,7 @@ message group_cfg_st
 	optional string ipv4_netmask = 18;
 	optional string ipv6_net = 19;
 	optional uint32 ipv6_prefix = 20;
-	optional string cgroup = 21;
+
 	optional string xml_config_file = 22;
 	optional uint32 rx_per_sec = 23;
 	optional uint32 tx_per_sec = 24;

src/main-auth.c

@@ -45,60 +45,6 @@
 #include <ccan/list/list.h>
 #include <common.h>
 
-/* Puts the provided PIN into the config's cgroup */
-void put_into_cgroup(main_server_st *s, const char *_cgroup, pid_t pid)
-{
-#ifdef __linux__
-	char *name, *p, *savep;
-	char cgroup[128];
-	char file[_POSIX_PATH_MAX];
-	FILE *fd;
-
-	if (_cgroup == NULL)
-		return;
-
-	/* format: cpu,memory:cgroup-name */
-	strlcpy(cgroup, _cgroup, sizeof(cgroup));
-
-	name = strchr(cgroup, ':');
-	if (name == NULL) {
-		mslog(s, NULL, LOG_ERR, "error parsing cgroup name: %s",
-		      cgroup);
-		return;
-	}
-	name[0] = 0;
-	name++;
-
-	p = strtok_r(cgroup, ",", &savep);
-	while (p != NULL) {
-		mslog(s, NULL, LOG_DEBUG,
-		      "putting process %u to cgroup '%s:%s'", (unsigned int)pid,
-		      p, name);
-
-		snprintf(file, sizeof(file), "/sys/fs/cgroup/%s/%s/tasks", p,
-			 name);
-
-		fd = fopen(file, "w");
-		if (fd == NULL) {
-			mslog(s, NULL, LOG_ERR, "cannot open: %s", file);
-			return;
-		}
-
-		if (fprintf(fd, "%u", (unsigned int)pid) <= 0) {
-			mslog(s, NULL, LOG_ERR, "could not write to: %s", file);
-		}
-		fclose(fd);
-		p = strtok_r(NULL, ",", &savep);
-	}
-
-	return;
-#else
-	if (_cgroup != NULL)
-		mslog(s, NULL, LOG_WARNING,
-		      "Ignoring cgroup option as it is not supported on this system");
-#endif
-}
-
 int send_cookie_auth_reply(main_server_st *s, struct proc_st *proc, AUTHREP r)
 {
 	AuthCookieReplyMsg msg = AUTH_COOKIE_REPLY_MSG__INIT;
@@ -214,11 +160,6 @@ int handle_auth_cookie_req(sec_mod_instance_st *sec_mod_instance,
 		return -1;
 	}
 
-	/* Put into right cgroup */
-	if (proc->config->cgroup != NULL) {
-		put_into_cgroup(s, proc->config->cgroup, proc->pid);
-	}
-
 	/* disconnect and reuse previous session's IPs*/
 	if (old_proc != NULL) {
 		if (strcmp(proc->username, old_proc->username) != 0) {

src/main-proc.c

@@ -82,10 +82,6 @@ struct proc_st *new_proc(main_server_st *s, pid_t pid, int cmd_fd,
 
 	list_add(&s->proc_list.head, &(ctmp->list));
 
-	/* initially we put into the "default" vhost cgroup. We
-	 * will change cgroup once it is known which vhost this
-	 * proc belongs to */
-	put_into_cgroup(s, GETRCONFIG(s)->cgroup, pid);
 	s->stats.active_clients++;
 
 	return ctmp;

src/main-sec-mod-cmd.c

@@ -408,10 +408,6 @@ static void apply_default_config(sec_mod_instance_st *sec_mod_instance,
 		gc->has_ipv6_subnet_prefix = 1;
 	}
 
-	if (!gc->cgroup) {
-		gc->cgroup = vhost->config->cgroup;
-	}
-
 #ifdef ANYCONNECT_CLIENT_COMPAT
 	if (!gc->xml_config_file) {
 		gc->xml_config_file = vhost->config->xml_config_file;

src/main.h

@@ -379,8 +379,6 @@ inline static void disconnect_proc(main_server_st *s, proc_st *proc)
 	}
 }
 
-void put_into_cgroup(main_server_st *s, const char *cgroup, pid_t pid);
-
 inline static int send_msg_to_worker(main_server_st *s, struct proc_st *proc,
 				     uint8_t cmd, const void *msg,
 				     pack_size_func get_size, pack_func pack)

src/sup-config/file.c

@@ -142,8 +142,6 @@ static int group_cfg_ini_handler(void *_ctx, const char *section,
 		READ_RAW_MULTI_LINE(msg->config->nbns, msg->config->n_nbns);
 	} else if (strcmp(name, "ipv6-nbns") == 0) {
 		READ_RAW_MULTI_LINE(msg->config->nbns, msg->config->n_nbns);
-	} else if (strcmp(name, "cgroup") == 0) {
-		READ_RAW_STRING(msg->config->cgroup);
 	} else if (strcmp(name, "ipv4-network") == 0) {
 		READ_RAW_STRING(msg->config->ipv4_net);
 		prefix4 = extract_prefix(msg->config->ipv4_net);