CRIU: rootless checkpoint and restore on non docker environment

[tajila]

Requirements:

• Install rootless criu patch
• Criu dump in unprivileged mode
  This is only possible via commandline option

So we need to patch criu to enable it via the API

• add a function to do the same to the criu C api and add a line to J9 to call it
• make another change to the criu to set the dumpable process control flag on itself when called via the C api

[tajila]

@ymanton can you please provide a link to your CRIU and J9 commits

[ymanton]

There are two ways to run as non-root. The first is to give criu as many caps as it requires:

setcap cap_sys_time,cap_dac_override,cap_chown,cap_setpcap,cap_setgid,cap_audit_control,cap_dac_read_search,cap_net_admin,cap_sys_chroot,cap_sys_ptrace,cap_fowner,cap_kill,cap_fsetid,cap_sys_resource,cap_setuid,cap_sys_admin=eip /usr/sbin/criu

The second is to use just cap_checkpoint_restore (which is a new cap tailored to saving and restoring processes), but it requires:

• kernel >= 5.9 (backported to the 4.18 kernel on RHEL 8.5, best to check on a live kernel, instructions below)
• libcap >= 2.43 (Ubuntu >= 21.04, not available on RHEL 8). If the kernel supports it but libcap doesn't you can probably still use it by referring to its numeric value 40 rather than by name.
• criu patches for non-root: Allow CRIU to be used as non-root with CAP_CHECKPOINT_RESTORE or CAP_SYS_ADMIN checkpoint-restore/criu#1155
• further criu patches for non-root for self-dumping: ymanton/criu@9c23ce1, ymanton/criu@41467ba
• all of the criu stuff is available in this tree for convenience: https://github.com/ymanton/criu/tree/test-rootless
• patch for openj9 to use criu non-root mode: ymanton@9aea8d4
• when restoring, specify non-root mode via criu restore --unprivileged ...

In order to check if the kernel and/or libcap supports it, do as follows:

capsh --supports=40 should print nothing and return 0 if the kernel supports it, otherwise cap[40=40] not supported by kernel
capsh --supports=cap_checkpoint_restore should print nothing and return 0 if both the kernel and libcap supports it, otherwise cap[cap_checkpoint_restore] not recognized by library if libcap doesn't, in which case you'll have to check via the numeric value to see if the kernel supports it or not.

[tajila]

@AdamBrousseau FYI

[fwp20033191]

when I use criu in non-root mode: criu restore --unprivileged -vvvv --shell-job, I don't know why?

Error (criu/tty.c:832): tty: Can't set tty params on 0x7: Operation not permitted

[tajila]

@fwp20033191 Was the criu dump performed with --unprivileged

[ymanton]

Try redirecting your std in/out/err to files. Some functionality related to terminals still requires root or CAP_SYS_ADMIN.