From bb9bcd74610df13bbad48a8ba443ba86d5e0acd5 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sun, 3 May 2026 14:12:01 +0200 Subject: [PATCH] main: remove cgroup support in favour of systemd resource controls Native cgroup placement is removed. Delegating resource enforcement to systemd eliminates the privileged /sys/fs/cgroup writes from the main process and simplifies the code. Administrators who previously relied on the 'cgroup' option should use the [Service] section of the ocserv unit file instead; see systemd.resource-control(5) for details. Signed-off-by: Nikos Mavrogiannopoulos --- NEWS | 3 +++ doc/sample.config | 9 +++---- src/cfg.proto | 2 +- src/config.c | 2 -- src/ipc.proto | 2 +- src/main-auth.c | 59 ------------------------------------------ src/main-proc.c | 4 --- src/main-sec-mod-cmd.c | 4 --- src/main.h | 2 -- src/sup-config/file.c | 2 -- 10 files changed, 9 insertions(+), 80 deletions(-) diff --git a/NEWS b/NEWS index a49d087a..049fbbc1 100644 --- a/NEWS +++ b/NEWS @@ -1,4 +1,7 @@ * Version 1.5.0 (unreleased) +- Removed the 'cgroup' configuration option (used for cgroups v1). + Administrators should use systemd resource controls instead; see + systemd.resource-control(5). - Added 'service' sub-option to the 'auth = pam[...]' directive to allow configurable PAM service names, enabling per-vhost PAM stacks (#718) - ocserv-fw-nftables: dropped runtime dependency on ipcalc/ipcalc-ng (#709) diff --git a/doc/sample.config b/doc/sample.config index 1e56bbe6..b37b17c2 100644 --- a/doc/sample.config +++ b/doc/sample.config @@ -567,10 +567,9 @@ log-level = 2 # [scope: vhost user] #net-priority = 3 -# Set the VPN worker process into a specific cgroup. This is Linux -# specific and can be set per user/group or globally. -# [scope: vhost user] -#cgroup = "cpuset,cpu:test" +# The 'cgroup' option (previously 'cpu,memory:name' for cgroups v1) has been +# removed. Use systemd to place the ocserv service and its worker processes +# into a cgroup instead. See systemd.resource-control(5) for the full set of knobs. # # Network settings @@ -768,7 +767,7 @@ no-route = 192.168.5.0/255.255.255.0 # ipv?-network, ipv4-netmask, rx/tx-data-per-sec, iroute, route, no-route, # explicit-ipv4, explicit-ipv6, net-priority, deny-roaming, no-udp, # keepalive, dpd, mobile-dpd, max-same-clients, tunnel-all-dns, -# restrict-user-to-routes, cgroup, stats-report-time, +# restrict-user-to-routes, stats-report-time, # mtu, idle-timeout, mobile-idle-timeout, restrict-user-to-ports, # split-dns and session-timeout. # diff --git a/src/cfg.proto b/src/cfg.proto index 08503f7e..74a8b3b2 100644 --- a/src/cfg.proto +++ b/src/cfg.proto @@ -141,7 +141,7 @@ message ReloadableConfig { optional string connect_script = 111; /* [scope: global] */ optional string host_update_script = 112; /* [scope: global] */ optional string disconnect_script = 113; /* [scope: global] */ - optional string cgroup = 114; /* [scope: vhost user] */ + optional string proxy_url = 115; /* [scope: vhost] */ optional string xml_config_file = 116; /* [scope: vhost user] ANYCONNECT_CLIENT_COMPAT only */ optional string xml_config_hash = 117; /* [scope: vhost user] ANYCONNECT_CLIENT_COMPAT only */ diff --git a/src/config.c b/src/config.c index 741971fc..83650866 100644 --- a/src/config.c +++ b/src/config.c @@ -1373,8 +1373,6 @@ static int cfg_ini_handler(void *_ctx, const char *section, const char *name, if (error_on_vhost(vhost->name, "device")) return 0; PREAD_STRING(config->network, config->network->name); - } else if (strcmp(name, "cgroup") == 0) { - READ_STRING(config->cgroup); } else if (strcmp(name, "proxy-url") == 0) { READ_STRING(config->proxy_url); } else if (strcmp(name, "ipv4-network") == 0) { diff --git a/src/ipc.proto b/src/ipc.proto index d6da5d09..8e17d746 100644 --- a/src/ipc.proto +++ b/src/ipc.proto @@ -43,7 +43,7 @@ message group_cfg_st optional string ipv4_netmask = 18; optional string ipv6_net = 19; optional uint32 ipv6_prefix = 20; - optional string cgroup = 21; + optional string xml_config_file = 22; optional uint32 rx_per_sec = 23; optional uint32 tx_per_sec = 24; diff --git a/src/main-auth.c b/src/main-auth.c index 1e0cbf6b..21286eb7 100644 --- a/src/main-auth.c +++ b/src/main-auth.c @@ -45,60 +45,6 @@ #include #include -/* Puts the provided PIN into the config's cgroup */ -void put_into_cgroup(main_server_st *s, const char *_cgroup, pid_t pid) -{ -#ifdef __linux__ - char *name, *p, *savep; - char cgroup[128]; - char file[_POSIX_PATH_MAX]; - FILE *fd; - - if (_cgroup == NULL) - return; - - /* format: cpu,memory:cgroup-name */ - strlcpy(cgroup, _cgroup, sizeof(cgroup)); - - name = strchr(cgroup, ':'); - if (name == NULL) { - mslog(s, NULL, LOG_ERR, "error parsing cgroup name: %s", - cgroup); - return; - } - name[0] = 0; - name++; - - p = strtok_r(cgroup, ",", &savep); - while (p != NULL) { - mslog(s, NULL, LOG_DEBUG, - "putting process %u to cgroup '%s:%s'", (unsigned int)pid, - p, name); - - snprintf(file, sizeof(file), "/sys/fs/cgroup/%s/%s/tasks", p, - name); - - fd = fopen(file, "w"); - if (fd == NULL) { - mslog(s, NULL, LOG_ERR, "cannot open: %s", file); - return; - } - - if (fprintf(fd, "%u", (unsigned int)pid) <= 0) { - mslog(s, NULL, LOG_ERR, "could not write to: %s", file); - } - fclose(fd); - p = strtok_r(NULL, ",", &savep); - } - - return; -#else - if (_cgroup != NULL) - mslog(s, NULL, LOG_WARNING, - "Ignoring cgroup option as it is not supported on this system"); -#endif -} - int send_cookie_auth_reply(main_server_st *s, struct proc_st *proc, AUTHREP r) { AuthCookieReplyMsg msg = AUTH_COOKIE_REPLY_MSG__INIT; @@ -214,11 +160,6 @@ int handle_auth_cookie_req(sec_mod_instance_st *sec_mod_instance, return -1; } - /* Put into right cgroup */ - if (proc->config->cgroup != NULL) { - put_into_cgroup(s, proc->config->cgroup, proc->pid); - } - /* disconnect and reuse previous session's IPs*/ if (old_proc != NULL) { if (strcmp(proc->username, old_proc->username) != 0) { diff --git a/src/main-proc.c b/src/main-proc.c index a62de8c2..fd05eb80 100644 --- a/src/main-proc.c +++ b/src/main-proc.c @@ -82,10 +82,6 @@ struct proc_st *new_proc(main_server_st *s, pid_t pid, int cmd_fd, list_add(&s->proc_list.head, &(ctmp->list)); - /* initially we put into the "default" vhost cgroup. We - * will change cgroup once it is known which vhost this - * proc belongs to */ - put_into_cgroup(s, GETRCONFIG(s)->cgroup, pid); s->stats.active_clients++; return ctmp; diff --git a/src/main-sec-mod-cmd.c b/src/main-sec-mod-cmd.c index a12a6b98..c135e467 100644 --- a/src/main-sec-mod-cmd.c +++ b/src/main-sec-mod-cmd.c @@ -408,10 +408,6 @@ static void apply_default_config(sec_mod_instance_st *sec_mod_instance, gc->has_ipv6_subnet_prefix = 1; } - if (!gc->cgroup) { - gc->cgroup = vhost->config->cgroup; - } - #ifdef ANYCONNECT_CLIENT_COMPAT if (!gc->xml_config_file) { gc->xml_config_file = vhost->config->xml_config_file; diff --git a/src/main.h b/src/main.h index 808c8355..4f0be09d 100644 --- a/src/main.h +++ b/src/main.h @@ -379,8 +379,6 @@ inline static void disconnect_proc(main_server_st *s, proc_st *proc) } } -void put_into_cgroup(main_server_st *s, const char *cgroup, pid_t pid); - inline static int send_msg_to_worker(main_server_st *s, struct proc_st *proc, uint8_t cmd, const void *msg, pack_size_func get_size, pack_func pack) diff --git a/src/sup-config/file.c b/src/sup-config/file.c index 3e0d956b..88a08c1f 100644 --- a/src/sup-config/file.c +++ b/src/sup-config/file.c @@ -142,8 +142,6 @@ static int group_cfg_ini_handler(void *_ctx, const char *section, READ_RAW_MULTI_LINE(msg->config->nbns, msg->config->n_nbns); } else if (strcmp(name, "ipv6-nbns") == 0) { READ_RAW_MULTI_LINE(msg->config->nbns, msg->config->n_nbns); - } else if (strcmp(name, "cgroup") == 0) { - READ_RAW_STRING(msg->config->cgroup); } else if (strcmp(name, "ipv4-network") == 0) { READ_RAW_STRING(msg->config->ipv4_net); prefix4 = extract_prefix(msg->config->ipv4_net);