libct: Signal: honor RootlessCgroups

`signalAllProcesses()` depends on the cgroup and is expected to fail
when runc is running in rootless without an access to the cgroup.

When `RootlessCgroups` is set to `true`, runc just ignores the error
from `signalAllProcesses` and may leak some processes running.
(See the comments in PR 4395)
In the future, runc should walk the process tree to avoid such a leak.

Note that `RootlessCgroups` is a misnomer; it is set to `false` despite
the name when cgroup v2 delegation is configured.
This is expected to be renamed in a separate commit.

Fix issue 4394

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
This commit is contained in:
Akihiro Suda
2024-09-05 05:05:24 +09:00
parent 961b8031f6
commit 429e06a518
4 changed files with 37 additions and 0 deletions

View File

@@ -695,6 +695,8 @@ func setupPersonality(config *configs.Config) error {
// signalAllProcesses freezes then iterates over all the processes inside the
// manager's cgroups sending the signal s to them.
//
// signalAllProcesses returns ErrNotRunning when the cgroup does not exist.
func signalAllProcesses(m cgroups.Manager, s unix.Signal) error {
if !m.Exists() {
return ErrNotRunning