# man > cgconfig.conf(5)

---
type: CommandReference
command: cgconfig.conf
mode: man
section: 5
source: man-pages
---

## Quick Reference

- `mount { <controller> = <path>; ... }` — mount control group hierarchies
- `group <name> { [perm] <controller> { <param> = <value>; } }` — define control groups and parameters
- `default { perm { ... } }` — set default permissions for all groups
- `template <name> { ... }` — define template for use with `cgrules.conf` destination tags
- Named hierarchy: `"name=<somename>"` — specify a named hierarchy
- Mount options: `"<controller>,<options>"` — e.g. `"cpu,nodev,nosuid,noexec"`
- Permissions: `perm { task { uid = ...; gid = ...; fperm = ...; } admin { uid = ...; gid = ...; dperm = ...; fperm = ...; } }`
- Root group: use `.` as group name to set permissions on root group
- Subgroups: use `/` delimiter in group name

## Name

`cgconfig.conf` — libcgroup configuration file

## Synopsis

`cgconfig.conf` is a configuration file used by **libcgroup** to define control groups, their parameters, and their mount points. The file consists of optional `mount`, `group`, `default` and `template` sections. Lines starting with `#` are comments.

## Options (Sections)

### `mount` section
mount {
    <controller> = <path>;
    ...
}
- **controller** — Name of kernel subsystem (see `/proc/cgroups`). Named hierarchy: `"name=<somename>"`. Mount options: `"<controller>,<options>"` (options: `nosuid`, `noexec`, `nodev`).
- **path** — Directory path for the hierarchy. Created automatically on service startup, deleted on shutdown. Multiple subsystems mounted to same path are merged.

### `group` section
group <name> {
    [permissions]
    <controller> {
        <param name> = <param value>;
        ...
    }
    ...
}
- **name** — Name of control group (valid directory characters). Use `/` for subgroups. Root group is `.`. Parent groups are created automatically if not specified.
- **permissions** — Optional `perm` block:
  
  perm {
      task {
          uid = <task user>;
          gid = <task group>;
          fperm = <file permissions>;
      }
      admin {
          uid = <admin name>;
          gid = <admin group>;
          dperm = <directory permissions>;
          fperm = <file permissions>;
      }
  }
  
  - `task` — user/group owning the `tasks` file. `fperm` is masked by owner permissions.
  - `admin` — user/group owning all other files. `fperm` and `dperm` control file/directory permissions, masked by owner permissions.
  - Default: `root:root` with default permissions if not specified.
- **controller** — Kernel subsystem. Empty section uses default kernel parameters. A group must be controlled by at least one subsystem.
- **param name/value** — File to write; value can be quoted for spaces.

### `default` section
default {
    perm {
        task { uid = ...; gid = ...; fperm = ...; }
        admin { uid = ...; gid = ...; dperm = ...; fperm = ...; }
    }
}
- Sets default permissions for all groups that do not have explicit `perm` section.

### `template` section
Same structure as `group`. Used for rules in `cgrules.conf` with matching destination tag. Does not inherit `default` settings. Additional templates can be placed in `/etc/cgconfig.d/`.

## Examples

### Example 1 — Basic mount
shell
mount {
    cpu = /sys/fs/cgroup/cpu;
    cpuacct = /sys/fs/cgroup/cpu;
}
Corresponds to:
shell
mkdir /sys/fs/cgroup/cpu
mount -t cgroup -o cpu,cpuacct cpu /sys/fs/cgroup/cpu
### Example 2 — Named hierarchies and groups
shell
mount {
    cpu = /sys/fs/cgroup/cpu;
    "name=scheduler" = /sys/fs/cgroup/cpu;
    "name=noctrl" = /sys/fs/cgroup/noctrl;
}
group daemons {
    cpu {
        cpu.shares = "1000";
    }
}
group test {
    "name=noctrl" {
    }
}
Corresponds to:
shell
mkdir /sys/fs/cgroup/cpu
mount -t cgroup -o cpu,name=scheduler cpu /sys/fs/cgroup/cpu
mount -t cgroup -o none,name=noctrl none /sys/fs/cgroup/noctrl
mkdir /sys/fs/cgroup/cpu/daemons
echo 1000 > /sys/fs/cgroup/cpu/daemons/www/cpu.shares
mkdir /sys/fs/cgroup/noctrl/tests
Note: `daemons` group is created automatically when its first subgroup is created.

### Example 3 — Permissions and subgroups
shell
mount {
    cpu = /sys/fs/cgroup/cpu;
    cpuacct = /sys/fs/cgroup/cpu;
}
group daemons/www {
    perm {
        task { uid = root; gid = webmaster; fperm = 770; }
        admin { uid = root; gid = root; dperm = 775; fperm = 744; }
    }
    cpu {
        cpu.shares = "1000";
    }
}
group daemons/ftp {
    perm {
        task { uid = root; gid = ftpmaster; fperm = 774; }
        admin { uid = root; gid = root; dperm = 755; fperm = 700; }
    }
    cpu {
        cpu.shares = "500";
    }
}
Corresponds to:
shell
mkdir /sys/fs/cgroup/cpu
mount -t cgroup -o cpu,cpuacct cpu /sys/fs/cgroup/cpu
mkdir /sys/fs/cgroup/cpu/daemons
mkdir /sys/fs/cgroup/cpu/daemons/www
chown root:root /sys/fs/cgroup/cpu/daemons/www/*
chown root:webmaster /sys/fs/cgroup/cpu/daemons/www/tasks
echo 1000 > /sys/fs/cgroup/cpu/daemons/www/cpu.shares
# ... plus chmod to achieve desired permissions
mkdir /sys/fs/cgroup/cpu/daemons/ftp
chown root:root /sys/fs/cgroup/cpu/daemons/ftp/*
chown root:ftpmaster /sys/fs/cgroup/cpu/daemons/ftp/tasks
echo 500 > /sys/fs/cgroup/cpu/daemons/ftp/cpu.shares
### Example 4 — Separate hierarchies, single group in both
shell
mount {
    cpu = /sys/fs/cgroup/cpu;
    cpuacct = /sys/fs/cgroup/cpuacct;
}
group daemons {
    cpuacct { }
    cpu { }
}
Corresponds to:
shell
mkdir /sys/fs/cgroup/cpu
mkdir /sys/fs/cgroup/cpuacct
mount -t cgroup -o cpu cpu /sys/fs/cgroup/cpu
mount -t cgroup -o cpuacct cpuacct /sys/fs/cgroup/cpuacct
mkdir /sys/fs/cgroup/cpu/daemons
mkdir /sys/fs/cgroup/cpuacct/daemons
### Example 5 — Separate hierarchies, subgroups in one
shell
mount {
    cpu = /sys/fs/cgroup/cpu;
    cpuacct = /sys/fs/cgroup/cpuacct;
}
group daemons {
    cpuacct { }
}
group daemons/www {
    cpu { cpu.shares = "1000"; }
}
group daemons/ftp {
    cpu { cpu.shares = "500"; }
}
Corresponds to:
shell
mkdir /sys/fs/cgroup/cpu
mkdir /sys/fs/cgroup/cpuacct
mount -t cgroup -o cpu cpu /sys/fs/cgroup/cpu
mount -t cgroup -o cpuacct cpuacct /sys/fs/cgroup/cpuacct
mkdir /sys/fs/cgroup/cpuacct/daemons
mkdir /sys/fs/cgroup/cpu/daemons
mkdir /sys/fs/cgroup/cpu/daemons/www
echo 1000 > /sys/fs/cgroup/cpu/daemons/www/cpu.shares
mkdir /sys/fs/cgroup/cpu/daemons/ftp
echo 500 > /sys/fs/cgroup/cpu/daemons/ftp/cpu.shares
### Example 6 — Root group permissions
shell
mount {
    cpu = /sys/fs/cgroup/cpu;
    cpuacct = /sys/fs/cgroup/cpu;
}
group . {
    perm {
        task { uid = root; gid = operator; }
        admin { uid = root; gid = operator; }
    }
    cpu { }
}
group daemons {
    perm {
        task { uid = root; gid = daemonmaster; }
        admin { uid = root; gid = operator; }
    }
    cpu { }
}
Corresponds to:
shell
mkdir /sys/fs/cgroup/cpu
mount -t cgroup -o cpu,cpuacct cpu /sys/fs/cgroup/cpu
chown root:operator /sys/fs/cgroup/cpu/*
chown root:operator /sys/fs/cgroup/cpu/tasks
mkdir /sys/fs/cgroup/cpu/daemons
chown root:operator /sys/fs/cgroup/cpu/daemons/*
chown root:daemonmaster /sys/fs/cgroup/cpu/daemons/tasks
Members of `operator` group can administer control groups; `daemonmaster` can move processes into `daemons` but not out.

### Example 7 — Template
shell
mount {
    cpu = /sys/fs/cgroup/cpu;
    cpuacct = /sys/fs/cgroup/cpuacct;
}
group students {
    cpuacct { }
    cpu { }
}
template students/%u {
    cpuacct { }
    cpu { }
}
This is similar to Example 4, but the template is used when a rule specifies `/students/%u` as destination.

### Example 8 — Mount options
shell
mount {
    "cpu,nodev,nosuid,noexec" = /mnt/cgroups/cpu;
}
Equivalent to:
shell
mount -t cgroup -o nodev,nosuid,noexec,cpu /mnt/cgroups/cpu
## Files

- `/etc/cgconfig.conf` — default libcgroup configuration file
- `/etc/cgconfig.d/` — directory for additional configuration files (templates)

## See Also

- `cgconfigparser(8)` — parse and apply cgconfig.conf
- `cgrules.conf(5)` — rules for assigning processes to control groups

## Recommendations

- **Keep hierarchies separated** — Avoid creating one group in multiple hierarchies (see Examples 4, 5).
- **Explicit is better than implicit** — Explicitly specify all groups and controllers, especially with multiple hierarchies.

## Bugs

Parameter values must be single strings without spaces; parsing of quoted strings is not implemented.