Skip to content

Commit

Permalink
YARN-9561. Add C changes for the new RuncContainerRuntime. Contribute…
Browse files Browse the repository at this point in the history 
…d by Eric Badger
  • Loading branch information
@ericbadger
ericbadger committed Dec 6, 2019
1 parent 705b172 commit 76bb297
Show file tree
Hide file tree
Showing 11 changed files with 858 additions and 155 deletions.
23 changes: 23 additions & 0 deletions LICENSE.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -256,3 +256,26 @@ hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/resources/webapps/st
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/resources/webapps/static/jquery
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/resources/webapps/static/jt/jquery.jstree.js
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/resources/TERMINAL

=======
For hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/native/container-executor/impl/utils/cJSON.[ch]:

Copyright (c) 2009-2017 Dave Gamble and cJSON contributors

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
31 changes: 27 additions & 4 deletions ...-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/CMakeLists.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,15 @@

cmake_minimum_required(VERSION 3.1 FATAL_ERROR)

list(APPEND CMAKE_MODULE_PATH ${CMAKE_SOURCE_DIR}/../../../../../hadoop-common-project/hadoop-common)
set(HADOOP_COMMON_PATH ${CMAKE_SOURCE_DIR}/../../../../../hadoop-common-project/hadoop-common)
list(APPEND CMAKE_MODULE_PATH ${HADOOP_COMMON_PATH})
include(HadoopCommon)

# Set gtest path
set(GTEST_SRC_DIR ${CMAKE_SOURCE_DIR}/../../../../../hadoop-common-project/hadoop-common/src/main/native/gtest)

set(HADOOP_COMMON_SEC_PATH ${HADOOP_COMMON_PATH}/src/main/native/src/org/apache/hadoop/security)

# determine if container-executor.conf.dir is an absolute
# path in case the OS we're compiling on doesn't have
# a hook in get_executable. We'll use this define
Expand Down Expand Up @@ -115,6 +118,7 @@ include_directories(
main/native/container-executor
main/native/container-executor/impl
main/native/oom-listener/impl
${HADOOP_COMMON_SEC_PATH}
)
# add gtest as system library to suppress gcc warnings
include_directories(SYSTEM ${GTEST_SRC_DIR}/include)
Expand All @@ -129,6 +133,7 @@ add_library(container
main/native/container-executor/impl/configuration.c
main/native/container-executor/impl/container-executor.c
main/native/container-executor/impl/get_executable.c
main/native/container-executor/impl/utils/file-utils.c
main/native/container-executor/impl/utils/string-utils.c
main/native/container-executor/impl/utils/path-utils.c
main/native/container-executor/impl/modules/cgroups/cgroups-operations.c
Expand All @@ -138,6 +143,14 @@ add_library(container
main/native/container-executor/impl/modules/devices/devices-module.c
main/native/container-executor/impl/utils/docker-util.c
main/native/container-executor/impl/utils/mount-utils.c
main/native/container-executor/impl/utils/cJSON/cJSON.c
main/native/container-executor/impl/runc/runc.c
main/native/container-executor/impl/runc/runc_base_ctx.c
main/native/container-executor/impl/runc/runc_launch_cmd.c
main/native/container-executor/impl/runc/runc_reap.c
main/native/container-executor/impl/runc/runc_write_config.c
${HADOOP_COMMON_SEC_PATH}/hadoop_user_info.c
${HADOOP_COMMON_SEC_PATH}/hadoop_group_info.c
)

add_executable(container-executor
Expand All @@ -146,6 +159,7 @@ add_executable(container-executor

target_link_libraries(container-executor
container
crypto
)

output_directory(container-executor target/usr/local/bin)
Expand All @@ -155,7 +169,9 @@ add_executable(test-container-executor
main/native/container-executor/test/test-container-executor.c
)
target_link_libraries(test-container-executor
container ${EXTRA_LIBS}
container
${EXTRA_LIBS}
crypto
)

output_directory(test-container-executor target/usr/local/bin)
Expand All @@ -173,8 +189,15 @@ add_executable(cetest
main/native/container-executor/test/modules/fpga/test-fpga-module.cc
main/native/container-executor/test/modules/devices/test-devices-module.cc
main/native/container-executor/test/test_util.cc
main/native/container-executor/test/utils/test_docker_util.cc)
target_link_libraries(cetest gtest container)
main/native/container-executor/test/utils/test_docker_util.cc
main/native/container-executor/test/utils/test_runc_util.cc
)
target_link_libraries(cetest
gtest
container
crypto
)

output_directory(cetest test)

# CGroup OOM listener
Expand Down
157 changes: 151 additions & 6 deletions ...doop-yarn-server-nodemanager/src/main/native/container-executor/impl/container-executor.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
#include "utils/docker-util.h"
#include "utils/path-utils.h"
#include "utils/string-utils.h"
#include "runc/runc.h"
#include "util.h"
#include "config.h"

Expand Down Expand Up @@ -78,6 +79,7 @@ static const int DEFAULT_DOCKER_SUPPORT_ENABLED = 0;
static const int DEFAULT_TC_SUPPORT_ENABLED = 0;
static const int DEFAULT_MOUNT_CGROUP_SUPPORT_ENABLED = 0;
static const int DEFAULT_YARN_SYSFS_SUPPORT_ENABLED = 0;
static const int DEFAULT_RUNC_SUPPORT_ENABLED = 0;

static const char* PROC_PATH = "/proc";

Expand Down Expand Up @@ -191,7 +193,7 @@ int check_executor_permissions(char *executable_file) {
/**
* Change the effective user id to limit damage.
*/
static int change_effective_user(uid_t user, gid_t group) {
int change_effective_user(uid_t user, gid_t group) {
if (geteuid() == user) {
return 0;
}
Expand All @@ -211,6 +213,10 @@ static int change_effective_user(uid_t user, gid_t group) {
return 0;
}

int change_effective_user_to_nm() {
return change_effective_user(nm_uid, nm_gid);
}

#ifdef __linux
/**
* Write the pid of the current process to the cgroup file.
Expand Down Expand Up @@ -408,7 +414,7 @@ static int wait_and_get_exit_code(pid_t pid) {
* the exit code file.
* Returns the exit code of the container process.
*/
static int wait_and_write_exit_code(pid_t pid, const char* exit_code_file) {
int wait_and_write_exit_code(pid_t pid, const char* exit_code_file) {
int exit_code = -1;

exit_code = wait_and_get_exit_code(pid);
Expand Down Expand Up @@ -510,6 +516,12 @@ int is_yarn_sysfs_support_enabled() {
DEFAULT_YARN_SYSFS_SUPPORT_ENABLED, &executor_cfg);
}

int is_runc_support_enabled() {
return is_feature_enabled(RUNC_SUPPORT_ENABLED_KEY,
DEFAULT_RUNC_SUPPORT_ENABLED, &executor_cfg)
|| runc_module_enabled(&CFG);
}

/**
* Utility function to concatenate argB to argA using the concat_pattern.
*/
Expand Down Expand Up @@ -642,6 +654,20 @@ char *get_tmp_directory(const char *work_dir) {
return concatenate("%s/%s", "tmp dir", 2, work_dir, TMP_DIR);
}

/**
* Get the private /tmp directory under the working directory
*/
char *get_privatetmp_directory(const char *work_dir) {
return concatenate("%s/%s", "private /tmp dir", 2, work_dir, ROOT_TMP_DIR);
}

/**
* Get the private /tmp directory under the working directory
*/
char *get_private_var_tmp_directory(const char *work_dir) {
return concatenate("%s/%s", "private /var/tmp dir", 2, work_dir, ROOT_VAR_TMP_DIR);
}

/**
* Ensure that the given path and all of the parent directories are created
* with the desired permissions.
Expand Down Expand Up @@ -810,17 +836,51 @@ static int create_container_directories(const char* user, const char *app_id,
return result;
}

result = COULD_NOT_CREATE_TMP_DIRECTORIES;
// also make the tmp directory
char *tmp_dir = get_tmp_directory(work_dir);
char *private_tmp_dir = get_privatetmp_directory(work_dir);
char *private_var_tmp_dir = get_private_var_tmp_directory(work_dir);

if (tmp_dir == NULL) {
if (tmp_dir == NULL || private_tmp_dir == NULL || private_var_tmp_dir == NULL) {
return OUT_OF_MEMORY;
}
if (mkdirs(tmp_dir, perms) == 0) {
result = 0;

if (mkdirs(tmp_dir, perms) != 0) {
fprintf(ERRORFILE, "Could not create tmp_dir: %s\n", tmp_dir);
result = COULD_NOT_CREATE_TMP_DIRECTORIES;
goto cleanup;
}

if (mkdirs(private_tmp_dir, perms) != 0) {
fprintf(ERRORFILE, "Could not create private_tmp_dir: %s\n", private_tmp_dir);
result = COULD_NOT_CREATE_TMP_DIRECTORIES;
goto cleanup;
}

// clear group sticky bit on private_tmp_dir
if (chmod(private_tmp_dir, perms) != 0) {
fprintf(ERRORFILE, "Could not chmod private_tmp_dir: %s\n", private_tmp_dir);
result = COULD_NOT_CREATE_TMP_DIRECTORIES;
goto cleanup;
}

if (mkdirs(private_var_tmp_dir, perms) != 0) {
fprintf(ERRORFILE, "Could not create private_var_tmp_dir: %s\n", private_var_tmp_dir);
result = COULD_NOT_CREATE_TMP_DIRECTORIES;
goto cleanup;
}

// clear group sticky bit on private_tmp_dir
if (chmod(private_var_tmp_dir, perms) != 0) {
fprintf(ERRORFILE, "Could not chmod private_var_tmp_dir: %s\n", private_var_tmp_dir);
result = COULD_NOT_CREATE_TMP_DIRECTORIES;
goto cleanup;
}

cleanup:
free(tmp_dir);
free(private_tmp_dir);
free(private_var_tmp_dir);

return result;
}
Expand Down Expand Up @@ -1051,6 +1111,36 @@ static int open_file_as_nm(const char* filename) {
return result;
}

/**
* Check the pidfile as the node manager. File should not exist.
* Returns 0 on file doesn't exist and -1 on file does exist.
*/
int check_pidfile_as_nm(const char* pidfile) {
int result = 0;
uid_t user = geteuid();
gid_t group = getegid();
if (change_effective_user(nm_uid, nm_gid) != 0) {
return -1;
}

struct stat statbuf;
if (stat(pidfile, &statbuf) == 0) {
fprintf(ERRORFILE, "pid file already exists: %s\n", pidfile);
result = -1;
}

if (errno != ENOENT) {
fprintf(ERRORFILE, "Error accessing %s : %s\n", pidfile,
strerror(errno));
result = -1;
}

if (change_effective_user(user, group)) {
result = -1;
}
return result;
}

/**
* Copy a file from a fd to a given filename.
* The new file must not exist and it is created with permissions perm.
Expand Down Expand Up @@ -1863,6 +1953,61 @@ int create_yarn_sysfs(const char* user, const char *app_id,
return result;
}

int setup_container_paths(const char* user, const char* app_id,
const char *container_id, const char *work_dir, const char *script_name,
const char *cred_file, int https, const char *keystore_file, const char *truststore_file,
char* const* local_dirs, char* const* log_dirs) {
char *script_file_dest = NULL;
char *cred_file_dest = NULL;
char *keystore_file_dest = NULL;
char *truststore_file_dest = NULL;
int container_file_source = -1;
int cred_file_source = -1;
int keystore_file_source = -1;
int truststore_file_source = -1;

int result = initialize_user(user, local_dirs);
if (result != 0) {
return result;
}

int rc = create_script_paths(
work_dir, script_name, cred_file, https, keystore_file, truststore_file, &script_file_dest, &cred_file_dest,
&keystore_file_dest, &truststore_file_dest, &container_file_source, &cred_file_source, &keystore_file_source, &truststore_file_source);

if (rc != 0) {
fputs("Could not create script path\n", ERRORFILE);
goto cleanup;
}

rc = create_log_dirs(app_id, log_dirs);
if (rc != 0) {
fputs("Could not create log files and directories\n", ERRORFILE);
goto cleanup;
}

rc = create_local_dirs(user, app_id, container_id,
work_dir, script_name, cred_file, https, keystore_file, truststore_file, local_dirs, log_dirs,
1, script_file_dest, cred_file_dest, keystore_file_dest, truststore_file_dest,
container_file_source, cred_file_source, keystore_file_source, truststore_file_source);

if (rc != 0) {
fputs("Could not create local files and directories\n", ERRORFILE);
goto cleanup;
}

rc = create_yarn_sysfs(user, app_id, container_id, work_dir, local_dirs);
if (rc != 0) {
fputs("Could not create user yarn sysfs directory\n", ERRORFILE);
goto cleanup;
}

cleanup:
free(script_file_dest);
free(cred_file_dest);
return rc;
}

int launch_docker_container_as_user(const char * user, const char *app_id,
const char *container_id, const char *work_dir,
const char *script_name, const char *cred_file,
Expand Down
Loading

0 comments on commit 76bb297

Please sign in to comment.