From 3d8e7a68cf2ee34402b60012d5ca03a0a82dc2d1 Mon Sep 17 00:00:00 2001 From: Nicolas Vollmar Date: Sun, 9 Jun 2024 22:59:26 +0200 Subject: [PATCH] T6219: align with system sysctl and limit parameters to supported (cherry picked from commit f030464952168b553b5b3e29b461d437c2642a9b) --- interface-definitions/container.xml.in | 31 ++++++++++++------- smoketest/config-tests/container-simple | 2 +- smoketest/configs/container-simple | 6 ++-- smoketest/scripts/cli/test_container.py | 5 +++ .../list_container_sysctl_parameters.sh | 20 ++++++++++++ src/conf_mode/container.py | 14 +++++---- 6 files changed, 58 insertions(+), 20 deletions(-) create mode 100755 src/completion/list_container_sysctl_parameters.sh diff --git a/interface-definitions/container.xml.in b/interface-definitions/container.xml.in index cd970591ba..6ea44a6d46 100644 --- a/interface-definitions/container.xml.in +++ b/interface-definitions/container.xml.in @@ -71,26 +71,35 @@ - + - Add custom kernel parameters (sysctl) - - [._a-z*]+ - - Kernel parameter name must be alphanumeric and can contain periods, asterisks and underscores + Configure namespaced kernel parameters of the container - + - Set kernel parameter option value + Sysctl key name + + + txt - Set kernel parameter option value + Sysctl key name + + + - + + + + Sysctl configuration value + + + + - + #include diff --git a/smoketest/config-tests/container-simple b/smoketest/config-tests/container-simple index ced770421c..5af365cf93 100644 --- a/smoketest/config-tests/container-simple +++ b/smoketest/config-tests/container-simple @@ -11,4 +11,4 @@ set container name c02 allow-host-networks set container name c02 allow-host-pid set container name c02 capability 'sys-time' set container name c02 image 'busybox:stable' -set container name c02 kernel-parameter 'net.ipv4.conf.all.forwarding' value '1' \ No newline at end of file +set container name c02 sysctl parameter kernel.msgmax value '8192' \ No newline at end of file diff --git a/smoketest/configs/container-simple b/smoketest/configs/container-simple index 0585fed29f..b98a440b50 100644 --- a/smoketest/configs/container-simple +++ b/smoketest/configs/container-simple @@ -10,8 +10,10 @@ container { allow-host-pid cap-add sys-time image busybox:stable - kernel-parameter "net.ipv4.ip_forward" { - value "1" + sysctl { + parameter kernel.msgmax { + value "8192" + } } } } diff --git a/smoketest/scripts/cli/test_container.py b/smoketest/scripts/cli/test_container.py index 90f821c607..3dd97a1751 100755 --- a/smoketest/scripts/cli/test_container.py +++ b/smoketest/scripts/cli/test_container.py @@ -80,6 +80,7 @@ def test_basic(self): self.cli_set(base_path + ['name', cont_name, 'image', cont_image]) self.cli_set(base_path + ['name', cont_name, 'allow-host-networks']) + self.cli_set(base_path + ['name', cont_name, 'sysctl', 'parameter', 'kernel.msgmax', 'value', '4096']) # commit changes self.cli_commit() @@ -91,6 +92,10 @@ def test_basic(self): # Check for running process self.assertEqual(process_named_running(PROCESS_NAME), pid) + # verify + tmp = cmd(f'sudo podman exec -it {cont_name} sysctl kernel.msgmax') + self.assertEqual(tmp, 'kernel.msgmax = 4096') + def test_cpu_limit(self): cont_name = 'c2' diff --git a/src/completion/list_container_sysctl_parameters.sh b/src/completion/list_container_sysctl_parameters.sh new file mode 100755 index 0000000000..cf8d006e5a --- /dev/null +++ b/src/completion/list_container_sysctl_parameters.sh @@ -0,0 +1,20 @@ +#!/bin/sh +# +# Copyright (C) 2024 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +declare -a vals +eval "vals=($(/sbin/sysctl -N -a|grep -E '^(fs.mqueue|net)\.|^(kernel.msgmax|kernel.msgmnb|kernel.msgmni|kernel.sem|kernel.shmall|kernel.shmmax|kernel.shmmni|kernel.shm_rmid_forced)$'))" +echo ${vals[@]} +exit 0 diff --git a/src/conf_mode/container.py b/src/conf_mode/container.py index 91eb17756c..ded370a7ac 100755 --- a/src/conf_mode/container.py +++ b/src/conf_mode/container.py @@ -191,10 +191,12 @@ def verify(container): if not os.path.exists(source): raise ConfigError(f'Device "{dev}" source path "{source}" does not exist!') - if 'kernel-parameter' in container_config: - for var, cfg in container_config['kernel-parameter'].items(): + if 'sysctl' in container_config and 'parameter' in container_config['sysctl']: + for var, cfg in container_config['sysctl']['parameter'].items(): if 'value' not in cfg: - raise ConfigError(f'Kernel parameter {var} has no value assigned!') + raise ConfigError(f'sysctl parameter {var} has no value assigned!') + if var.startswith('net.') and 'allow_host_networks' in container_config: + raise ConfigError(f'sysctl parameter {var} cannot be set when using host networking!') if 'environment' in container_config: for var, cfg in container_config['environment'].items(): @@ -285,9 +287,9 @@ def generate_run_arguments(name, container_config): # Add sysctl options sysctl_opt = '' - if 'kernel-parameter' in container_config: - for k, v in container_config['kernel-parameter'].items(): - sysctl_opt += f" --sysctl={k}={v['value']}" + if 'sysctl' in container_config and 'parameter' in container_config['sysctl']: + for k, v in container_config['sysctl']['parameter'].items(): + sysctl_opt += f" --sysctl {k}={v['value']}" # Add capability options. Should be in uppercase capabilities = ''