Add support for CRIU unprivileged mode #20683

ymanton · 2022-04-01T16:18:22Z

This PR adds support for CRIU unprivileged mode to the checkpoint feature and the server script.

Regarding the checkpoint feature implementation:

If the io.openliberty.checkpoint.criu.unprivileged property is set to
to true, set unprivileged mode to true before invoking CRIU dump.

If NoSuchMethodError is thrown it means that the JVM does not support
unprivileged mode, in which case throw an exception to that effect.

Regarding the server script implementation:

Introduce the CRIU_EXTRA_ARGS env var to allow the user to
pass extra arguments to criu restore.

Introduce the CRIU_UNPRIVILEGED env var to allow the user to
control/override whether CRIU is invoked in privileged or unprivileged
mode.

Check whether CRIU supports unprivileged mode by looking for
"--unprivileged" in the output of criu --help.

If the script is invoked as root or CRIU doesn't support unprivileged
mode or CRIU_UNPRIVILEGED is false, invoke CRIU in privileged mode.

If the script is invoked as non-root and CRIU supports unprivileged
mode, or CRIU_UNPRIVILEGED is true, invoke CRIU in unprivileged mode.

If the io.openliberty.checkpoint.criu.unprivileged property is set to to true, set unprivileged mode to true before invoking CRIU dump. If NoSuchMethodError is thrown it means that the JVM does not support unprivileged mode, in which case throw an exception to that effect. Signed-off-by: Younes Manton <[email protected]>

LibbyBot · 2022-04-01T16:18:29Z

Please code review, @OpenLiberty/reviewer

ymanton · 2022-04-01T16:19:50Z

FYI @tjwatson @tajila

The corresponding OpenJ9 is eclipse-openj9/openj9#14836

tjwatson · 2022-04-01T17:01:53Z

#build

LibbyBot · 2022-04-01T17:02:00Z

I cannot process this build request due to one or both of the following:

The comment author is not a member of the organization.
The pull request creator did not send a signed CLA.

tjwatson · 2022-04-01T18:40:38Z

#build

LibbyBot · 2022-04-01T18:40:47Z

Your personal build request is at https://wasrtc.hursley.ibm.com:9443/jazz/resource/itemOid/com.ibm.team.build.BuildResult/_3Kcm8LHiEeyG_Ki6n8QKXg

Target locations of links might be accessible only to IBM employees.

LibbyBot · 2022-04-02T09:42:31Z

The build ymanton-20683-20220401-1149
https://wasrtc.hursley.ibm.com:9443/jazz/resource/itemOid/com.ibm.team.build.BuildResult/_3Kcm8LHiEeyG_Ki6n8QKXg
completed and has errors or failures.

For help analyzing your personal build, go to https://cognitive.hursley.ibm.com/buildAnalysis.html?uuid=_3Kcm8LHiEeyG_Ki6n8QKXg

tjwatson · 2022-04-07T19:31:41Z

#build

LibbyBot · 2022-04-07T19:32:47Z

Your personal build request is at https://wasrtc.hursley.ibm.com:9443/jazz/resource/itemOid/com.ibm.team.build.BuildResult/_HuM3gLahEey_l6cwP43xMA

Target locations of links might be accessible only to IBM employees.

ymanton · 2022-04-07T21:50:02Z

dev/com.ibm.ws.kernel.boot.ws-server/publish/bin/server

+  DO_CRIU_UNPRIVILEGED=false
+  if [ "$(id -u)" != 0 ]; then
+    # Not root, unprivileged by default if CRIU supports it
+    if [ $CRIU_SUPPORTS_UNPRIVILEGED = true -a "${CRIU_UNPRIVILEGED}" != "false" -a "${CRIU_UNPRIVILEGED}" != "1" -a "${CRIU_UNPRIVILEGED}" != "FALSE" -a "${CRIU_UNPRIVILEGED}" != "False" ]; then


Just noticed the "${CRIU_UNPRIVILEGED}" != "1" part should be "${CRIU_UNPRIVILEGED}" != "0".

My latest commit removes the false check altogether. If not set to one of the "true" values then it just sets DO_CRIU_UNPRIVILEGED to false.

I also moved the check for the CRIU_UNPRIVILEGED variable to be first and if set then it never does a check for support in a criu help check. @ymanton let me know if you see an issue with that. I figured if someone sets the variable then just take what they specified and there is no need to run a criu to see if it is supported.

Looks good, it reads clearly to me. I updated the comment as a suggestion.

Introduce the CRIU_EXTRA_ARGS env var to allow the user to pass extra arguments to `criu restore`. Introduce the CRIU_UNPRIVILEGED env var to allow the user to control/override whether CRIU is invoked in privileged or unprivileged mode. Check whether CRIU supports unprivileged mode by looking for "--unprivileged" in the output of `criu --help`. If the script is invoked as root or CRIU doesn't support unprivileged mode or CRIU_UNPRIVILEGED is false, invoke CRIU in privileged mode. If the script is invoked as non-root and CRIU supports unprivileged mode, or CRIU_UNPRIVILEGED is true, invoke CRIU in unprivileged mode. Signed-off-by: Younes Manton <[email protected]>

LibbyBot · 2022-04-08T09:51:56Z

The build ymanton-20683-20220407-1244
https://wasrtc.hursley.ibm.com:9443/jazz/resource/itemOid/com.ibm.team.build.BuildResult/_HuM3gLahEey_l6cwP43xMA
completed and has errors or failures.

For help analyzing your personal build, go to https://cognitive.hursley.ibm.com/buildAnalysis.html?uuid=_HuM3gLahEey_l6cwP43xMA

tjwatson · 2022-04-08T16:52:00Z

#build

LibbyBot · 2022-04-08T16:52:08Z

Your personal build request is at https://wasrtc.hursley.ibm.com:9443/jazz/resource/itemOid/com.ibm.team.build.BuildResult/_2IAskLdTEey_l6cwP43xMA

Target locations of links might be accessible only to IBM employees.

dev/com.ibm.ws.kernel.boot.ws-server/publish/bin/server

ymanton · 2022-04-08T18:08:17Z

For completeness, here are the results of various combinations of support amongst the relevant components:

uid	open-liberty	openj9	criu	resulting criu mode	result
root	-	-	-	privileged	works, baseline case
non-root	-	-	-	privileged	fails (expected, no privileges), baseline case
non-root + caps	-	-	-	privileged	works, baseline case
root	supports unpriv	supports unpriv	supports unpriv	privileged	works
non-root	supports unpriv	supports unpriv	supports unpriv	unprivileged	works
non-root + caps	any	any	supports unpriv	undefined	fails, unprivileged mode PR breaks this case
non-root	supports unpriv	supports unpriv	-	privileged	fails (expected, no privileges)
non-root	supports unpriv	-	supports unpriv	-	fails, liberty catches `NoSuchMethodError` from openj9, throws `CheckpointFailedException`
non-root	-	supports unpriv	supports unpriv	privileged	fails (no privileges, unprivileged mode needs to be explicitly requested by liberty)

Co-authored-by: Younes Manton <[email protected]>

LibbyBot · 2022-04-09T11:43:06Z

The build ymanton-20683-20220408-1103
https://wasrtc.hursley.ibm.com:9443/jazz/resource/itemOid/com.ibm.team.build.BuildResult/_2IAskLdTEey_l6cwP43xMA
completed and has errors or failures.

For help analyzing your personal build, go to https://cognitive.hursley.ibm.com/buildAnalysis.html?uuid=_2IAskLdTEey_l6cwP43xMA

tjwatson · 2022-04-09T13:59:19Z

#libby

LibbyBot · 2022-04-09T13:59:27Z

Code analysis and actions

DO NOT DELETE THIS COMMENT.

6 product code files were changed.
Please describe in a separate comment how you tested your changes.

LibbyBot added the CLA Needed label Apr 1, 2022

ymanton mentioned this pull request Apr 1, 2022

Do unprivileged CRIU dump if requested+supported eclipse-openj9/openj9#14836

Merged

tjwatson added CRIU Issues related to enable CRIU for Liberty CLA Signed and removed CLA Needed labels Apr 1, 2022

ymanton commented Apr 7, 2022

View reviewed changes

ymanton force-pushed the criu-unprivileged branch from 358830d to e13f8f8 Compare April 7, 2022 21:51

ymanton force-pushed the criu-unprivileged branch from e13f8f8 to 2433ee5 Compare April 7, 2022 21:58

tjwatson added 2 commits April 8, 2022 09:37

Fix unit tests for unprivileged parameter

b63eec3

Check CRIU_UNPRIVILEGED before probing criu for support

32f9904

ymanton commented Apr 8, 2022

View reviewed changes

dev/com.ibm.ws.kernel.boot.ws-server/publish/bin/server Outdated Show resolved Hide resolved

Update comment in server

b3fd8ee

Co-authored-by: Younes Manton <[email protected]>

tjwatson approved these changes Apr 9, 2022

View reviewed changes

tjwatson merged commit 4f5ef32 into OpenLiberty:integration Apr 9, 2022

rst0git mentioned this pull request Apr 12, 2022

Allow CRIU to be used as non-root with CAP_CHECKPOINT_RESTORE or CAP_SYS_ADMIN checkpoint-restore/criu#1155

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for CRIU unprivileged mode #20683

Add support for CRIU unprivileged mode #20683

ymanton commented Apr 1, 2022

LibbyBot commented Apr 1, 2022

ymanton commented Apr 1, 2022

tjwatson commented Apr 1, 2022

LibbyBot commented Apr 1, 2022

tjwatson commented Apr 1, 2022

LibbyBot commented Apr 1, 2022

LibbyBot commented Apr 2, 2022

tjwatson commented Apr 7, 2022

LibbyBot commented Apr 7, 2022

ymanton Apr 7, 2022

ymanton Apr 7, 2022

tjwatson Apr 8, 2022

ymanton Apr 8, 2022

LibbyBot commented Apr 8, 2022

tjwatson commented Apr 8, 2022

LibbyBot commented Apr 8, 2022

ymanton commented Apr 8, 2022

LibbyBot commented Apr 9, 2022

tjwatson commented Apr 9, 2022

LibbyBot commented Apr 9, 2022

Add support for CRIU unprivileged mode #20683

Add support for CRIU unprivileged mode #20683

Conversation

ymanton commented Apr 1, 2022

LibbyBot commented Apr 1, 2022

ymanton commented Apr 1, 2022

tjwatson commented Apr 1, 2022

LibbyBot commented Apr 1, 2022

tjwatson commented Apr 1, 2022

LibbyBot commented Apr 1, 2022

LibbyBot commented Apr 2, 2022

tjwatson commented Apr 7, 2022

LibbyBot commented Apr 7, 2022

ymanton Apr 7, 2022

Choose a reason for hiding this comment

ymanton Apr 7, 2022

Choose a reason for hiding this comment

tjwatson Apr 8, 2022

Choose a reason for hiding this comment

ymanton Apr 8, 2022

Choose a reason for hiding this comment

LibbyBot commented Apr 8, 2022

tjwatson commented Apr 8, 2022

LibbyBot commented Apr 8, 2022

ymanton commented Apr 8, 2022

LibbyBot commented Apr 9, 2022

tjwatson commented Apr 9, 2022

LibbyBot commented Apr 9, 2022

Code analysis and actions