[Devel] [PATCH RH8] ve/cgroup: hide ve and ub cgroups in CT

[Andrey Zhadchenko]

From: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>

Reasons:
1) We don't need to show these cgroups in CT, they are vz specific,
and nobody should use them inside.
2) Docker from v17.11 checks that all cgroups are mounted, but we
don't mount beancounter and ve, thus docker fails.

Still show ve and ub for pseudosuper, so that these change does not
influence criu. I checked that with these patch c/r of container works
fine and values in ve cgroup files persist.

Docker ct starts fine after these change.

https://jira.sw.ru/browse/PSBM-80421

Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
Reviewed-by: Cyrill Gorcunov <gorcunov at openvz.org>

Rebased to vz8:
 - Deleted beancounter
 - Added #ifdef CONFIG_VE

(cherry picked from d1580bf6a02ab7d2bedf4b6ecd506a2c6a44d59e)
Signed-off-by: Andrey Zhadchenko <andrey.zhadchenko at virtuozzo.com>
---
 kernel/cgroup/cgroup.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 779a71b..bb04943 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -5984,6 +5984,21 @@ void cgroup_path_from_kernfs_id(const union kernfs_node_id *id,
 	kernfs_put(kn);
 }
 
+#ifdef CONFIG_VE
+static int ve_hide_cgroups(struct cgroup_root *root)
+{
+	struct ve_struct *ve = get_exec_env();
+	unsigned long hidden_mask = (1UL << ve_cgrp_id);
+
+	/*
+	 * Hide ve cgroup in CT for docker,
+	 * still showing it to pseudosuper (criu)
+	 */
+	return !ve_is_super(ve) && !ve->is_pseudosuper
+		&& (root->subsys_mask & hidden_mask);
+}
+#endif
+
 /*
  * proc_cgroup_show()
  *  - Print task's cgroup paths into seq_file, one line for each hierarchy
@@ -6012,6 +6027,11 @@ int proc_cgroup_show(struct seq_file *m, struct pid_namespace *ns,
 		if (root == &cgrp_dfl_root && !cgrp_dfl_visible)
 			continue;
 
+#ifdef CONFIG_VE
+		if (ve_hide_cgroups(root))
+			continue;
+#endif
+
 		seq_printf(m, "%d:", root->hierarchy_id);
 		if (root != &cgrp_dfl_root)
 			for_each_subsys(ss, ssid)
-- 
1.8.3.1