Question

1

How to run cgexec without sudo as current user on Ubuntu 22.04 with cgroups v2, failing with "cgroup change of group failed"?

rated 0 times [ 1] [ 0] / answers: 1 / hits: 2281 / 3 Years ago, sat, may 8, 2021, 7:34:01

I've tried the procedures from:

Cgroups error: cgroup change of group failed

How to use cgroup in ubuntu 13.04

https://unix.stackexchange.com/questions/197718/does-managing-cgroups-require-root-access

but they don't work on Ubuntu 22.04, presumably because of the update to cgroups v2:

sudo cgcreate -a $USER:$USER -g memory:myGroup -t $USER:$USER

sudo cgset -r memory.max=500M myGroup

sudo cgset -r memory.swap.max=0 myGroup

cgexec -g memory:myGroup id

fails with:

cgroup change of group failed

It works if I run with sudo

sudo cgexec -g memory:myGroup id

but then the command runs as root, and I want it to run as the current user instead.

Answers

Only authorized users can answer the question. Please sign in first, or register a free account.

oreera

Add To Favorites

Follow

Total Points: 472

Total Questions: 121

Total Answers: 116

Location: Mayotte

Member since Thu, Dec 17, 2020

3 Years ago

oreera questions

1 What disadvantages are there to encrypting an entire hard drive or a home directory?

Wed, Aug 24, 22, 01:36, 2 Years ago

1 Netplan DNS nameserver setting not being applied

Thu, Jan 12, 23, 07:08, 1 Year ago

1 Ubuntu 20.04 when I tried to install RabbitMQ it showing this error

Wed, Dec 7, 22, 10:30, 1 Year ago

1 ImageMagick convert on a multiple files

Mon, Sep 5, 22, 00:56, 2 Years ago

1 How to activate scrolling for the Kensington Slimblade Trackball?

Tue, Aug 30, 22, 21:10, 2 Years ago

View All

answered 3 Years ago homerurhyth · Accepted Answer

I read the Linux Kernel documentation and find the following (emphasis mine):

cgroup.procs

A read-write new-line separated values file which exists on all cgroups.

...

A PID can be written to migrate the process associated with the PID to the cgroup. The writer should match all of the following conditions.

It must have write access to the “cgroup.procs” file.

It must have write access to the “cgroup.procs” file of the common ancestor of the source and destination cgroups.

...

In this scenario, the common ancestor is /. So I make cgroup.procs of the root group writable:

sudo chmod o+w /sys/fs/cgroup/cgroup.procs

And now I can use cgexec as any non-root user. Not knowing if there is any security implication though.