Merge pull request containers#573 from giuseppe/fix-regression-cgroup

cgroup: fix regression when setting limits

src/libcrun/cgroup.c

@@ -1620,7 +1620,11 @@ libcrun_cgroup_enter (struct libcrun_cgroup_args *args, libcrun_error_t *err)
   if (LIKELY (ret >= 0))
     {
       if (cgroup_mode == CGROUP_MODE_UNIFIED && (root_uid != (uid_t) -1 || root_gid != (gid_t) -1))
-        return chown_cgroups (*path, root_uid, root_gid, err);
+        {
+          ret = chown_cgroups (*path, root_uid, root_gid, err);
+          if (UNLIKELY (ret < 0))
+              return ret;
+        }
 
       if (args->resources)
         return libcrun_update_cgroup_resources (args->cgroup_mode, args->resources, *path, err);

tests/test_resources.py

@@ -46,6 +46,43 @@ def test_resources_pid_limit():
         return -1
     return 0
 
+def test_resources_pid_limit_userns():
+    if os.getuid() != 0:
+        return 77
+
+    conf = base_config()
+    conf['linux']['resources'] = {"pids" : {"limit" : 1024}}
+    add_all_namespaces(conf)
+
+    mappings = [
+        {
+            "containerID": 0,
+            "hostID": 1,
+            "size": 1,
+        },
+        {
+            "containerID": 1,
+            "hostID": 0,
+            "size": 1,
+        }
+    ]
+
+    conf['linux']['namespaces'].append({"type" : "user"})
+    conf['linux']['uidMappings'] = mappings
+    conf['linux']['gidMappings'] = mappings
+
+    fn = "/sys/fs/cgroup/pids/pids.max"
+    if not os.path.exists("/sys/fs/cgroup/pids"):
+        fn = "/sys/fs/cgroup/pids.max"
+        conf['linux']['namespaces'].append({"type" : "cgroup"})
+
+    conf['process']['args'] = ['/init', 'cat', fn]
+
+    out, _ = run_and_get_output(conf)
+    if "1024" not in out:
+        return -1
+    return 0
+
 def test_resources_unified_invalid_controller():
     if not is_cgroup_v2_unified() or os.geteuid() != 0:
         return 77
@@ -125,6 +162,7 @@ def test_resources_unified():
 
 all_tests = {
     "resources-pid-limit" : test_resources_pid_limit,
+    "resources-pid-limit-userns" : test_resources_pid_limit_userns,
     "resources-unified" : test_resources_unified,
     "resources-unified-invalid-controller" : test_resources_unified_invalid_controller,
     "resources-unified-invalid-key" : test_resources_unified_invalid_key,