Make cgroups a configure option (default enabled if available).

Author: eldering

configure.ac

@@ -125,7 +125,7 @@ fi
 
 # }}}
 
-# {{{ runguard user
+# {{{ runguard
 AC_MSG_CHECKING([runuser])
 AC_ARG_WITH([runuser], [AS_HELP_STRING([--with-runuser=USER],
 [Unprivileged user under which to run submissions (default: domjudge-run).])], [], [])
@@ -137,6 +137,32 @@ else
 	AC_SUBST(RUNUSER,$with_runuser)
 	AC_MSG_RESULT($RUNUSER)
 fi
+
+# Check for using Linux cgroups for memory control
+AC_CHECK_LIB(cgroup, cgroup_init, AC_SUBST(LIBCGROUP,[-lcgroup]))
+
+if test "x$LIBCGROUP" != x; then
+	use_cgroups=yes
+else
+	use_cgroups=no
+fi
+AC_ARG_ENABLE(cgroups,AS_HELP_STRING([--enable-cgroups],
+[Use Linux cgroups for memory control (default: $use_cgroups).]), [], [])
+
+if test "x$enable_cgroups" = xno; then
+	use_cgroups=no
+elif test "x$enable_cgroups" != x; then
+	use_cgroups=yes
+fi
+
+# Finally define an export variable that can be substituted into
+# etc/runguard-config.h.in:
+if test "x$use_cgroups" = xyes; then
+	AC_SUBST(USE_CGROUPS,1)
+else
+	AC_SUBST(USE_CGROUPS,0)
+fi
+
 # }}}
 
 # {{{ FHS directory structure
@@ -225,9 +251,6 @@ AC_PROG_MKDIR_P
 # check for htpasswd/htpasswd2
 AC_CHECK_PROGS(HTPASSWD,[htpasswd htpasswd2],[no htpasswd binary found])
 
-# Check for including optional libcgroup
-AC_CHECK_LIB(cgroup, cgroup_init, AC_SUBST(LIBCGROUP,[-lcgroup]))
-
 # Check for including optional libmagic.
 AC_CHECK_LIB(magic,magic_open,AC_SUBST(LIBMAGIC,[-lmagic]))
 
@@ -315,6 +338,14 @@ echo " * default user........: $DOMJUDGE_USER"
 echo " * runguard user.......: $RUNUSER"
 echo " * webserver group.....: $WEBSERVER_GROUP"
 echo ""
+echo " * use Linux cgroups...: $use_cgroups"
+echo ""
+if test "x$CHECKTESTDATA_ENABLED" = xyes ; then
+   echo " * checktestdata.......: enabled"
+else
+   echo " * checktestdata.......: disabled"
+fi
+echo ""
 if test $SUBMIT_DEFAULT -eq 0 ; then # {{{
 	echo " * submitclient........: disabled"
 else

etc/runguard-config.h.in

@@ -7,4 +7,6 @@
 
 #define CHROOT_PREFIX "@judgehost_judgedir@"
 
+#define USE_CGROUPS @USE_CGROUPS@
+
 #endif /* _RUNGUARD_CONFIG_ */

judge/runguard.c

@@ -1,6 +1,7 @@
 /*
    runguard -- run command with restrictions.
-   Copyright (C) 2004-2012 Jaap Eldering (eldering@a-eskwadraat.nl).
+   Copyright (C) 2004-2013 Jaap Eldering (eldering@a-eskwadraat.nl)
+   Copyright (C) 2013      Keith Johnson
 
    Multiple minor improvements ported from the DOMjudge-ETH tree.
 
@@ -39,6 +40,9 @@
 
 #include "config.h"
 
+/* Some system/site specific config: VALID_USERS, CHROOT_PREFIX */
+#include "runguard-config.h"
+
 /* For chroot(), which is not POSIX. */
 #define _BSD_SOURCE
 
@@ -64,14 +68,13 @@
 #include <time.h>
 #include <math.h>
 #include <limits.h>
-#ifdef HAVE_LIBCGROUP_H
+#if ( USE_CGROUPS == 1 )
 #include <inttypes.h>
 #include <libcgroup.h>
+#else
+#undef USE_CGROUPS
 #endif
 
-/* Some system/site specific config: VALID_USERS, CHROOT_PREFIX */
-#include "runguard-config.h"
-
 #define PROGRAM "runguard"
 #define VERSION DOMJUDGE_VERSION "/" REVISION
 #define AUTHORS "Jaap Eldering"
@@ -103,7 +106,7 @@ char  *stdoutfilename;
 char  *stderrfilename;
 char  *exitfilename;
 char  *timefilename;
-#ifdef HAVE_LIBCGROUP_H
+#ifdef USE_CGROUPS
 char  *cgroupname;
 #endif
 
@@ -126,7 +129,7 @@ int show_help;
 int show_version;
 
 double runtime, cputime; /* in seconds */
-#ifdef HAVE_LIBCGROUP_H
+#ifdef USE_CGROUPS
 int64_t memsize;
 #else
 rlim_t memsize;
@@ -316,8 +319,10 @@ void output_exit_time(int exitcode, double timediff)
 		}
 	}
 }
-#ifdef HAVE_LIBCGROUP_H
-void output_cgroup_stats() {
+
+#ifdef USE_CGROUPS
+void output_cgroup_stats()
+{
 	int ret;
 	int64_t max_usage;
 	struct cgroup *cg;
@@ -448,7 +453,7 @@ void setrestrictions()
 	}
 
 	/* Memory limits may be handled by cgroups now */
-#ifndef HAVE_LIBCGROUP_H
+#ifndef USE_CGROUPS
 	if ( memsize!=RLIM_INFINITY ) {
 		verbose("setting memory limits to %d bytes",(int)memsize);
 		lim.rlim_cur = lim.rlim_max = memsize;
@@ -533,8 +538,9 @@ void setrestrictions()
 	if ( geteuid()==0 || getuid()==0 ) error(0,"root privileges not dropped. Do not run judgedaemon as root.");
 }
 
-#ifdef HAVE_LIBCGROUP_H
-void cgroup_create() {
+#ifdef USE_CGROUPS
+void cgroup_create()
+{
 	int ret;
 	struct cgroup *cg;
 	struct cgroup_controller *cg_controller;
@@ -558,7 +564,9 @@ void cgroup_create() {
 
 	cgroup_free(&cg);
 }
-void cgroup_attach() {
+
+void cgroup_attach()
+{
 	int ret;
 	struct cgroup *cg;
 
@@ -579,7 +587,9 @@ void cgroup_attach() {
 
 	cgroup_free(&cg);
 }
-void cgroup_delete() {
+
+void cgroup_delete()
+{
 	int ret;
 	struct cgroup *cg;
 
@@ -606,7 +616,7 @@ int main(int argc, char **argv)
 	fd_set readfds;
 	pid_t pid;
 	int   i, r, nfds;
-#ifdef HAVE_LIBCGROUP_H
+#ifdef USE_CGROUPS
 	int   ret;
 #endif
 	int   status;
@@ -772,7 +782,7 @@ int main(int argc, char **argv)
 		error(errno,"installing signal handler");
 	}
 
-#ifdef HAVE_LIBCGROUP_H
+#ifdef USE_CGROUPS
 	/* Make libcgroup ready for use */
 	ret = cgroup_init();
 	if ( ret!=0 ) {
@@ -808,7 +818,7 @@ int main(int argc, char **argv)
 		   and all its children can be killed off with one signal. */
 		if ( setsid()==-1 ) error(errno,"setsid failed");
 
-#ifdef HAVE_LIBCGROUP_H
+#ifdef USE_CGROUPS
 		/* Put the child process in the cgroup */
 		cgroup_attach();
 #endif
@@ -968,7 +978,7 @@ int main(int argc, char **argv)
 			exitcode = WEXITSTATUS(status);
 		}
 
-#ifdef HAVE_LIBCGROUP_H
+#ifdef USE_CGROUPS
 		output_cgroup_stats();
 		cgroup_delete();
 #endif

paths.mk.in

@@ -38,6 +38,9 @@ INSTALL = @INSTALL@
 # Build checktestdata program?
 CHECKTESTDATA_ENABLED = @CHECKTESTDATA_ENABLED@
 
+# Use Linux cgroups?
+USE_CGROUPS = @USE_CGROUPS@
+
 # Submit protocols
 SUBMIT_DEFAULT    = @SUBMIT_DEFAULT@
 SUBMIT_ENABLE_CMD = @SUBMIT_ENABLE_CMD@
@@ -167,6 +170,7 @@ define substconfigvars
 	-e 's,@WEBSERVER_GROUP[@],@WEBSERVER_GROUP@,g' \
 	-e 's,@BEEP[@],@BEEP@,g' \
 	-e 's,@RUNUSER[@],@RUNUSER@,g' \
+	-e 's,@USE_CGROUPS[@],@USE_CGROUPS@,g' \
 	-e 's,@SUBMIT_DEFAULT[@],@SUBMIT_DEFAULT@,g' \
 	-e 's,@SUBMIT_ENABLE_CMD[@],@SUBMIT_ENABLE_CMD@,g' \
 	-e 's,@SUBMIT_ENABLE_WEB[@],@SUBMIT_ENABLE_WEB@,g' \