8 from argparse import ArgumentParser
10 drop_capabilities='cap_sys_admin,cap_sys_boot,cap_sys_module'
15 output = os.popen('readelf -h %s 2>&1'%f).readlines()
16 if debug: print "readelf output %s lines"%len(output)
17 classlines = [x for x in output if ('Class' in x.split(':')[0])]
19 c = line.split(':')[1]
25 raise Exception('Could not determine architecture')
28 output = os.popen('/bin/umount %s 2>&1'%fs_dir).read()
29 return ('device is busy' not in fs_dir)
32 parser = ArgumentParser()
33 parser.add_argument("-n", "--nonet",
34 action="store_true", dest="netns", default=False,
35 help="Don't enter network namespace")
36 parser.add_argument("-m", "--nomnt",
37 action="store_true", dest="mntns", default=False,
38 help="Don't enter mount namespace")
39 parser.add_argument("-p", "--nopid",
40 action="store_true", dest="pidns", default=False,
41 help="Don't enter pid namespace")
42 parser.add_argument("-r", "--root",
43 action="store_true", dest="root", default=False,
44 help="Enter as root: be careful")
45 parser.add_argument("-d","--debug",
46 action='store_true', dest='debug', default=False,
48 parser.add_argument ("slice_name")
49 parser.add_argument ("command_to_run",nargs="*")
51 options = parser.parse_args()
52 slice_name=options.slice_name
57 cmd = 'grep %s /proc/*/cgroup | grep freezer'%slice_name
58 output = os.popen(cmd).readlines()
59 if debug: print "output of grep freezer has %s lines"%len(output)
61 print "Error finding slice %s"%slice_name
66 # provide a default as this is not always properly computed
72 path = l.split(':')[0]
73 comp = l.rsplit(':')[-1]
74 slice_name_check = comp.rsplit('/')[-1]
75 if debug: print "dealing with >%s<"%slice_name_check
77 if (slice_name_check == slice_name):
78 if debug: print "found %s"%slice_name
80 pid = slice_path.split('/')[2]
81 cmdline = open('/proc/%s/cmdline'%pid).read().rstrip('\n\x00')
82 if (cmdline == '/sbin/init'):
83 slice_spec = slice_path
84 arch = getarch('/proc/%s/exe'%pid)
85 if debug: print "setting arch",arch
90 print "BEG lxcsu - ignoring exception"
92 print "END lxcsu - ignoring exception"
95 if (not slice_spec or not pid):
96 print "Not started: %s"%slice_name
101 if debug: print "WARNING: setting arch to default x86_64"
105 for subsystem in ['cpuset','memory','blkio']:
106 open('/sys/fs/cgroup/%s/libvirt/lxc/%s/tasks'%(subsystem,slice_name),'w').write(str(os.getpid()))
109 print "Error assigning resources: %s"%slice_name
113 open('/sys/fs/cgroup/cpuacct/system/libvirtd.service/libvirt/lxc/%s/tasks'%slice_name,'w').write(str(os.getpid()))
115 print "Error assigning cpuacct: %s" % slice_name
118 # If the slice is frozen, then we'll get an EBUSY when trying to write to the task
119 # list for the freezer cgroup. Since the user couldn't do anything anyway, it's best
120 # in this case to error out the shell. (an alternative would be to un-freeze it,
121 # add the task, and re-freeze it)
123 f=open('/sys/fs/cgroup/freezer/libvirt/lxc/%s/tasks'%(slice_name),'w')
124 f.write(str(os.getpid()))
125 # note: we need to call f.close() explicitly, or we'll get an exception in
126 # the object destructor, which will not be caught
129 print "Error adding task to freezer cgroup. Slice is probably frozen: %s" % slice_name
132 setns.chcontext('/proc/%s/ns/uts'%pid)
133 setns.chcontext('/proc/%s/ns/ipc'%pid)
135 if (not options.netns):
136 setns.chcontext('/proc/%s/ns/net'%pid)
138 if (not options.mntns):
139 setns.chcontext('/proc/%s/ns/mnt'%pid)
141 if (not options.pidns):
142 setns.chcontext('/proc/%s/ns/pid'%pid)
144 if (not os.access('/proc/self',0)):
147 # cgroups is not yet LXC-safe, so we need to use the course grained access control
148 # strategy of unmounting the filesystem
151 for subsystem in ['cpuset','cpu,cpuacct','memory','devices','freezer','net_cls','blkio','perf_event']:
152 fs_path = '/sys/fs/cgroup/%s'%subsystem
153 if (not umount(fs_path)):
154 print "Error disabling cgroup access"
157 if (not umount('/sys/fs/cgroup')):
158 print "Error disabling cgroup access"
164 cap_arg = '--drop='+drop_capabilities
166 if (not options.root):
167 exec_args = [arch,'/usr/sbin/capsh',cap_arg,'--','--login']+options.command_to_run
169 exec_args = [arch,'/usr/sbin/capsh','--','--login']+options.command_to_run
173 for arg in exec_args: print ">%s<"%arg
174 os.environ['SHELL'] = '/bin/sh'
175 os.execv('/usr/bin/setarch',exec_args)
177 _,status = os.waitpid(pid,0)
178 exit(os.WEXITSTATUS(status))
180 if __name__ == '__main__':