From 91eba84a24fe8bd5e40878fcf39d1f9cc19eba60 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Mon, 11 Jan 2021 11:46:11 -0800 Subject: [PATCH 1/5] script/check-config.sh: support for cgroupv2 Before: > Generally Necessary: > - cgroup hierarchy: nonexistent?? > (see https://github.com/tianon/cgroupfs-mount) After: > Generally Necessary: > - cgroup hierarchy: cgroupv2 Signed-off-by: Kir Kolyshkin --- script/check-config.sh | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/script/check-config.sh b/script/check-config.sh index b261f1358..858ada75b 100755 --- a/script/check-config.sh +++ b/script/check-config.sh @@ -164,17 +164,21 @@ echo echo 'Generally Necessary:' echo -n '- ' -cgroupSubsystemDir="$(awk '/[, ](cpu|cpuacct|cpuset|devices|freezer|memory)[, ]/ && $3 == "cgroup" { print $2 }' /proc/mounts | head -n1)" -cgroupDir="$(dirname "$cgroupSubsystemDir")" -if [ -d "$cgroupDir/cpu" -o -d "$cgroupDir/cpuacct" -o -d "$cgroupDir/cpuset" -o -d "$cgroupDir/devices" -o -d "$cgroupDir/freezer" -o -d "$cgroupDir/memory" ]; then - echo "$(wrap_good 'cgroup hierarchy' 'properly mounted') [$cgroupDir]" +if [ "$(stat -f -c %t /sys/fs/cgroup 2>/dev/null)" = "63677270" ]; then + echo "$(wrap_good 'cgroup hierarchy' 'cgroupv2')" else - if [ "$cgroupSubsystemDir" ]; then - echo "$(wrap_bad 'cgroup hierarchy' 'single mountpoint!') [$cgroupSubsystemDir]" + cgroupSubsystemDir="$(awk '/[, ](cpu|cpuacct|cpuset|devices|freezer|memory)[, ]/ && $3 == "cgroup" { print $2 }' /proc/mounts | head -n1)" + cgroupDir="$(dirname "$cgroupSubsystemDir")" + if [ -d "$cgroupDir/cpu" -o -d "$cgroupDir/cpuacct" -o -d "$cgroupDir/cpuset" -o -d "$cgroupDir/devices" -o -d "$cgroupDir/freezer" -o -d "$cgroupDir/memory" ]; then + echo "$(wrap_good 'cgroup hierarchy' 'properly mounted') [$cgroupDir]" else - echo "$(wrap_bad 'cgroup hierarchy' 'nonexistent??')" + if [ "$cgroupSubsystemDir" ]; then + echo "$(wrap_bad 'cgroup hierarchy' 'single mountpoint!') [$cgroupSubsystemDir]" + else + echo "$(wrap_bad 'cgroup hierarchy' 'nonexistent??')" + fi + echo " $(wrap_color '(see https://github.com/tianon/cgroupfs-mount)' yellow)" fi - echo " $(wrap_color '(see https://github.com/tianon/cgroupfs-mount)' yellow)" fi if [ "$(cat /sys/module/apparmor/parameters/enabled 2>/dev/null)" = 'Y' ]; then From 483abaac2dc582e4039bfd42ea5cb4a5604e7736 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Mon, 11 Jan 2021 11:55:48 -0800 Subject: [PATCH 2/5] script/check-config.sh: fix NF_NAT_IPV4 CONFIG_NF_NAT_IPV4 was removed in kernel commit 3bf195ae6037e310, which made its way into v5.1-rc1. The functionality is now under NF_NAT which we already check for. Make the check for NF_NAT_IPV4 conditional. Signed-off-by: Kir Kolyshkin --- script/check-config.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/script/check-config.sh b/script/check-config.sh index 858ada75b..a47740766 100755 --- a/script/check-config.sh +++ b/script/check-config.sh @@ -203,7 +203,7 @@ flags=( CGROUPS CGROUP_CPUACCT CGROUP_DEVICE CGROUP_FREEZER CGROUP_SCHED CPUSETS MEMCG KEYS VETH BRIDGE BRIDGE_NETFILTER - NF_NAT_IPV4 IP_NF_FILTER IP_NF_TARGET_MASQUERADE + IP_NF_FILTER IP_NF_TARGET_MASQUERADE NETFILTER_XT_MATCH_{ADDRTYPE,CONNTRACK,IPVS} IP_NF_NAT NF_NAT NF_NAT_NEEDED @@ -211,6 +211,11 @@ flags=( POSIX_MQUEUE ) check_flags "${flags[@]}" + +if [ "$kernelMajor" -lt 5 ] || [ "$kernelMajor" -eq 5 -a "$kernelMinor" -le 1 ]; then + check_flags NF_NAT_IPV4 +fi + echo echo 'Optional Features:' From ecb9d73c89b53adbe89c13b10f0533ba07a81b60 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Mon, 11 Jan 2021 12:00:32 -0800 Subject: [PATCH 3/5] script/check-config.sh: fix NF_NAT_NEEDED CONFIG_NF_NAT_NEEDED was removed in kernel commit 4806e975729f99c7, which made its way into v5.2-rc1. The functionality is now under NF_NAT which we already check for. Make the check for NF_NAT_NEEDED conditional. Signed-off-by: Kir Kolyshkin --- script/check-config.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/script/check-config.sh b/script/check-config.sh index a47740766..69616694e 100755 --- a/script/check-config.sh +++ b/script/check-config.sh @@ -205,7 +205,7 @@ flags=( VETH BRIDGE BRIDGE_NETFILTER IP_NF_FILTER IP_NF_TARGET_MASQUERADE NETFILTER_XT_MATCH_{ADDRTYPE,CONNTRACK,IPVS} - IP_NF_NAT NF_NAT NF_NAT_NEEDED + IP_NF_NAT NF_NAT # required for bind-mounting /dev/mqueue into containers POSIX_MQUEUE @@ -216,6 +216,10 @@ if [ "$kernelMajor" -lt 5 ] || [ "$kernelMajor" -eq 5 -a "$kernelMinor" -le 1 ]; check_flags NF_NAT_IPV4 fi +if [ "$kernelMajor" -lt 5 ] || [ "$kernelMajor" -eq 5 -a "$kernelMinor" -le 2 ]; then + check_flags NF_NAT_NEEDED +fi + echo echo 'Optional Features:' From 1a00cd8f5db6e3505a55d9edb0bd859123552f20 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Mon, 11 Jan 2021 12:05:47 -0800 Subject: [PATCH 4/5] script/check-config.sh: fix MEMCG_SWAP_ENABLED Kernel commit 2d1c498072de69e (which made its way into kernel v5.8-rc1) removed CONFIG_MEMCG_SWAP_ENABLED Kconfig option, making swap accounting always enabled (unless swapaccount=0 boot option is provided). Make the check conditional. Signed-off-by: Kir Kolyshkin --- script/check-config.sh | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/script/check-config.sh b/script/check-config.sh index 69616694e..bd2762962 100755 --- a/script/check-config.sh +++ b/script/check-config.sh @@ -230,9 +230,13 @@ echo 'Optional Features:' check_flags SECCOMP check_flags CGROUP_PIDS - check_flags MEMCG_SWAP MEMCG_SWAP_ENABLED - if is_set MEMCG_SWAP && ! is_set MEMCG_SWAP_ENABLED; then - echo " $(wrap_color '(note that cgroup swap accounting is not enabled in your kernel config, you can enable it by setting boot option "swapaccount=1")' bold black)" + check_flags MEMCG_SWAP + + if [ "$kernelMajor" -lt 5 ] || [ "$kernelMajor" -eq 5 -a "$kernelMinor" -le 8 ]; then + check_flags MEMCG_SWAP_ENABLED + if is_set MEMCG_SWAP && ! is_set MEMCG_SWAP_ENABLED; then + echo " $(wrap_color '(note that cgroup swap accounting is not enabled in your kernel config, you can enable it by setting boot option "swapaccount=1")' bold black)" + fi fi } From b3cf4831ee2faeeb18e0af1c15d3e58770f17cb8 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Mon, 11 Jan 2021 12:13:29 -0800 Subject: [PATCH 5/5] script/check-config.sh: fix IOSCHED_CFQ CFQ_GROUP_IOSCHED These config options are removed by kernel commit f382fb0bcef4, which made its way into kernel v5.0-rc1. Make the check conditional. Signed-off-by: Kir Kolyshkin --- script/check-config.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/script/check-config.sh b/script/check-config.sh index bd2762962..bf13cd1bf 100755 --- a/script/check-config.sh +++ b/script/check-config.sh @@ -254,8 +254,12 @@ else netprio=CGROUP_NET_PRIO fi +if [ "$kernelMajor" -lt 5 ]; then + check_flags IOSCHED_CFQ CFQ_GROUP_IOSCHED +fi + flags=( - BLK_CGROUP BLK_DEV_THROTTLING IOSCHED_CFQ CFQ_GROUP_IOSCHED + BLK_CGROUP BLK_DEV_THROTTLING CGROUP_PERF CGROUP_HUGETLB NET_CLS_CGROUP $netprio