{ "content": [ { "type": "text", "text": "# cgconfig.conf (man)\n\n## NAME\n\ncgconfig.conf - libcgroup configuration file\n\n## DESCRIPTION\n\ncgconfig.conf is a configuration file used by libcgroup to define control groups, their para‐\nmeters and their mount points. The file consists of mount , group and default sections.\nThese sections can be in arbitrary order and all of them are optional. Any line starting with\n'#' is considered a comment line and is ignored.\n\n## Sections\n\n- **NAME**\n- **DESCRIPTION** (3 subsections)\n- **EXAMPLES** (8 subsections)\n- **RECOMMENDATIONS** (2 subsections)\n- **FILES** (2 subsections)\n- **SEE ALSO**\n- **BUGS**\n\nUse structuredContent.sections for detailed options, examples, and full documentation.\n" } ], "structuredContent": { "command": "cgconfig.conf", "section": "", "mode": "man", "summary": "cgconfig.conf - libcgroup configuration file", "synopsis": null, "tldr_summary": null, "tldr_examples": [], "tldr_source": null, "flags": [], "examples": [ "The configuration file:", "mount {", "cpu = /sys/fs/cgroup/cpu;", "cpuacct = /sys/fs/cgroup/cpu;", "creates the hierarchy controlled by two subsystems with no groups inside. It corresponds to", "the following operations:", "mkdir /sys/fs/cgroup/cpu", "mount -t cgroup -o cpu,cpuacct cpu /sys/fs/cgroup/cpu", "The configuration file:", "mount {", "cpu = /sys/fs/cgroup/cpu;", "\"name=scheduler\" = /sys/fs/cgroup/cpu;", "\"name=noctrl\" = /sys/fs/cgroup/noctrl;", "group daemons {", "cpu {", "cpu.shares = \"1000\";", "group test {", "\"name=noctrl\" {", "creates two hierarchies. One hierarchy named scheduler controlled by cpu subsystem, with", "group daemons inside. Second hierarchy is named noctrl without any controller, with group", "test. It corresponds to following operations:", "mkdir /sys/fs/cgroup/cpu", "mount -t cgroup -o cpu,name=scheduler cpu /sys/fs/cgroup/cpu", "mount -t cgroup -o none,name=noctrl none /sys/fs/cgroup/noctrl", "mkdir /sys/fs/cgroup/cpu/daemons", "echo 1000 > /sys/fs/cgroup/cpu/daemons/www/cpu.shares", "mkdir /sys/fs/cgroup/noctrl/tests", "The daemons group is created automatically when its first subgroup is created. All its para‐", "meters have the default value and only root can access group's files.", "Since both cpuacct and cpu subsystems are mounted to the same directory, all groups are im‐", "plicitly controlled also by cpuacct subsystem, even if there is no cpuacct section in any of", "the groups.", "The configuration file:", "mount {", "cpu = /sys/fs/cgroup/cpu;", "cpuacct = /sys/fs/cgroup/cpu;", "group daemons/www {", "perm {", "task {", "uid = root;", "gid = webmaster;", "fperm = 770;", "admin {", "uid = root;", "gid = root;", "dperm = 775;", "fperm = 744;", "cpu {", "cpu.shares = \"1000\";", "group daemons/ftp {", "perm {", "task {", "uid = root;", "gid = ftpmaster;", "fperm = 774;", "admin {", "uid = root;", "gid = root;", "dperm = 755;", "fperm = 700;", "cpu {", "cpu.shares = \"500\";", "creates the hierarchy controlled by two subsystems with one group and two subgroups inside,", "setting one parameter. It corresponds to the following operations (except for file permis‐", "sions which are little bit trickier to emulate via chmod):", "mkdir /sys/fs/cgroup/cpu", "mount -t cgroup -o cpu,cpuacct cpu /sys/fs/cgroup/cpu", "mkdir /sys/fs/cgroup/cpu/daemons", "mkdir /sys/fs/cgroup/cpu/daemons/www", "chown root:root /sys/fs/cgroup/cpu/daemons/www/*", "chown root:webmaster /sys/fs/cgroup/cpu/daemons/www/tasks", "echo 1000 > /sys/fs/cgroup/cpu/daemons/www/cpu.shares", "# + chmod the files so the result looks like:", "# ls -la /sys/fs/cgroup/cpu/daemons/www/", "# admin.dperm = 755:", "# drwxr-xr-x. 2 root webmaster 0 Jun 16 11:51 .", "# admin.fperm = 744:", "# --w-------. 1 root webmaster 0 Jun 16 11:51 cgroup.eventcontrol", "# -r--r--r--. 1 root webmaster 0 Jun 16 11:51 cgroup.procs", "# -r--r--r--. 1 root webmaster 0 Jun 16 11:51 cpuacct.stat", "# -rw-r--r--. 1 root webmaster 0 Jun 16 11:51 cpuacct.usage", "# -r--r--r--. 1 root webmaster 0 Jun 16 11:51 cpuacct.usagepercpu", "# -rw-r--r--. 1 root webmaster 0 Jun 16 11:51 cpu.rtperiodus", "# -rw-r--r--. 1 root webmaster 0 Jun 16 11:51 cpu.rtruntimeus", "# -rw-r--r--. 1 root webmaster 0 Jun 16 11:51 cpu.shares", "# -rw-r--r--. 1 root webmaster 0 Jun 16 11:51 notifyonrelease", "# tasks.fperm = 770", "# -rw-rw----. 1 root webmaster 0 Jun 16 11:51 tasks", "mkdir /sys/fs/cgroup/cpu/daemons/ftp", "chown root:root /sys/fs/cgroup/cpu/daemons/ftp/*", "chown root:ftpmaster /sys/fs/cgroup/cpu/daemons/ftp/tasks", "echo 500 > /sys/fs/cgroup/cpu/daemons/ftp/cpu.shares", "# + chmod the files so the result looks like:", "# ls -la /sys/fs/cgroup/cpu/daemons/ftp/", "# admin.dperm = 755:", "# drwxr-xr-x. 2 root ftpmaster 0 Jun 16 11:51 .", "# admin.fperm = 700:", "# --w-------. 1 root ftpmaster 0 Jun 16 11:51 cgroup.eventcontrol", "# -r--------. 1 root ftpmaster 0 Jun 16 11:51 cgroup.procs", "# -r--------. 1 root ftpmaster 0 Jun 16 11:51 cpuacct.stat", "# -rw-------. 1 root ftpmaster 0 Jun 16 11:51 cpuacct.usage", "# -r--------. 1 root ftpmaster 0 Jun 16 11:51 cpuacct.usagepercpu", "# -rw-------. 1 root ftpmaster 0 Jun 16 11:51 cpu.rtperiodus", "# -rw-------. 1 root ftpmaster 0 Jun 16 11:51 cpu.rtruntimeus", "# -rw-------. 1 root ftpmaster 0 Jun 16 11:51 cpu.shares", "# -rw-------. 1 root ftpmaster 0 Jun 16 11:51 notifyonrelease", "# tasks.fperm = 774:", "# -rw-rw-r--. 1 root ftpmaster 0 Jun 16 11:51 tasks", "The daemons group is created automatically when its first subgroup is created. All its para‐", "meters have the default value and only root can access the group's files.", "Since both cpuacct and cpu subsystems are mounted to the same directory, all groups are im‐", "plicitly also controlled by the cpuacct subsystem, even if there is no cpuacct section in any", "of the groups.", "The configuration file:", "mount {", "cpu = /sys/fs/cgroup/cpu;", "cpuacct = /sys/fs/cgroup/cpuacct;", "group daemons {", "cpuacct{", "cpu {", "creates two hierarchies and one common group in both of them. It corresponds to the follow‐", "ing operations:", "mkdir /sys/fs/cgroup/cpu", "mkdir /sys/fs/cgroup/cpuacct", "mount -t cgroup -o cpu cpu /sys/fs/cgroup/cpu", "mount -t cgroup -o cpuacct cpuacct /sys/fs/cgroup/cpuacct", "mkdir /sys/fs/cgroup/cpu/daemons", "mkdir /sys/fs/cgroup/cpuacct/daemons", "In fact there are two groups created. One in the cpuacct hierarchy, the second in the cpu hi‐", "erarchy. These two groups have nothing in common and can contain different subgroups and dif‐", "ferent tasks.", "The configuration file:", "mount {", "cpu = /sys/fs/cgroup/cpu;", "cpuacct = /sys/fs/cgroup/cpuacct;", "group daemons {", "cpuacct{", "group daemons/www {", "cpu {", "cpu.shares = \"1000\";", "group daemons/ftp {", "cpu {", "cpu.shares = \"500\";", "creates two hierarchies with few groups inside. One of the groups is created in both hierar‐", "chies.", "It corresponds to the following operations:", "mkdir /sys/fs/cgroup/cpu", "mkdir /sys/fs/cgroup/cpuacct", "mount -t cgroup -o cpu cpu /sys/fs/cgroup/cpu", "mount -t cgroup -o cpuacct cpuacct /sys/fs/cgroup/cpuacct", "mkdir /sys/fs/cgroup/cpuacct/daemons", "mkdir /sys/fs/cgroup/cpu/daemons", "mkdir /sys/fs/cgroup/cpu/daemons/www", "echo 1000 > /sys/fs/cgroup/cpu/daemons/www/cpu.shares", "mkdir /sys/fs/cgroup/cpu/daemons/ftp", "echo 500 > /sys/fs/cgroup/cpu/daemons/ftp/cpu.shares", "Group daemons is created in both hierarchies. In the cpuacct hierarchy the group is explic‐", "itly mentioned in the configuration file. In the cpu hierarchy the group is created implic‐", "itly when www is created there. These two groups have nothing in common, for example they do", "not share processes and subgroups. Groups www and ftp are created only in the cpu hierarchy", "and are not controlled by the cpuacct subsystem.", "The configuration file:", "mount {", "cpu = /sys/fs/cgroup/cpu;", "cpuacct = /sys/fs/cgroup/cpu;", "group . {", "perm {", "task {", "uid = root;", "gid = operator;", "admin {", "uid = root;", "gid = operator;", "cpu {", "group daemons {", "perm {", "task {", "uid = root;", "gid = daemonmaster;", "admin {", "uid = root;", "gid = operator;", "cpu {", "creates the hierarchy controlled by two subsystems with one group having some special permis‐", "sions. It corresponds to the following operations:", "mkdir /sys/fs/cgroup/cpu", "mount -t cgroup -o cpu,cpuacct cpu /sys/fs/cgroup/cpu", "chown root:operator /sys/fs/cgroup/cpu/*", "chown root:operator /sys/fs/cgroup/cpu/tasks", "mkdir /sys/fs/cgroup/cpu/daemons", "chown root:operator /sys/fs/cgroup/cpu/daemons/*", "chown root:daemonmaster /sys/fs/cgroup/cpu/daemons/tasks", "Users which are members of the operator group are allowed to administer the control groups,", "i.e. create new control groups and move processes between these groups without having root", "privileges.", "Members of the daemonmaster group can move processes to the daemons control group, but they", "can not move the process out of the group. Only the operator or root can do that.", "The configuration file:", "mount {", "cpu = /sys/fs/cgroup/cpu;", "cpuacct = /sys/fs/cgroup/cpuacct;", "group students {", "cpuacct{", "cpu {", "template students/%u {", "cpuacct{", "cpu {", "mkdir /sys/fs/cgroup/cpu/daemons", "mkdir /sys/fs/cgroup/cpuacct/daemons", "The situation is the similar as in Example 4. The only difference is template, which is used", "if some rule uses \"/students/%u\" as a destination.", "The configuration file:", "mount {", "\"cpu,nodev,nosuid,noexec\" = /mnt/cgroups/cpu;", "This is the same as mount -t cgroup cgroup -o nodev,nosuid,noexec,cpu /mnt/cgroups/cpu It", "mounts the cpu controller with MSNODEV, MSNOSUID and MSNOEXEC options passed." ], "see_also": [], "section_outline": [ { "name": "NAME", "lines": 2, "subsections": [] }, { "name": "DESCRIPTION", "lines": 13, "subsections": [ { "name": "controller", "lines": 42 }, { "name": "permissions", "lines": 34 }, { "name": "controller", "lines": 51 } ] }, { "name": "EXAMPLES", "lines": 1, "subsections": [ { "name": "Example 1", "lines": 14 }, { "name": "Example 2", "lines": 38 }, { "name": "Example 3", "lines": 112 }, { "name": "Example 4", "lines": 30 }, { "name": "Example 5", "lines": 47 }, { "name": "Example 6", "lines": 57 }, { "name": "Example 7", "lines": 29 }, { "name": "Example 8", "lines": 13 } ] }, { "name": "RECOMMENDATIONS", "lines": 1, "subsections": [ { "name": "Keep hierarchies separated", "lines": 6 }, { "name": "Explicit is better than implicit", "lines": 6 } ] }, { "name": "FILES", "lines": 1, "subsections": [ { "name": "/etc/cgconfig.conf", "lines": 2 }, { "name": "/etc/cgconfig.d/", "lines": 3 } ] }, { "name": "SEE ALSO", "lines": 3, "subsections": [] }, { "name": "BUGS", "lines": 8, "subsections": [] } ], "sections": { "NAME": { "content": "cgconfig.conf - libcgroup configuration file\n", "subsections": [] }, "DESCRIPTION": { "content": "cgconfig.conf is a configuration file used by libcgroup to define control groups, their para‐\nmeters and their mount points. The file consists of mount , group and default sections.\nThese sections can be in arbitrary order and all of them are optional. Any line starting with\n'#' is considered a comment line and is ignored.\n\nmount section has this form:\n\nmount {\n = ;\n...\n}\n\n", "subsections": [ { "name": "controller", "content": "Name of the kernel subsystem. The list of subsystems supported by the kernel can be\nfound in /proc/cgroups file. Named hierarchy can be specified as controller\n\"name=\". Do not forget to use double quotes around this controller name (see\nexamples below). Apart from named hierarchy, additional mount options may be specified\nby putting the controller and the options in quotes. Options supported are nosuid,\nnoexec and nodev.\n\nLibcgroup merges all subsystems mounted to the same directory (see Example 1) and the\ndirectory is mounted only once.\n\n\npath The directory path where the group hierarchy associated to a given controller shall be\nmounted. The directory is created automatically on cgconfig service startup if it does\nnot exist and is deleted on service shutdown.\n\nIf no mount section is specified, no controllers are mounted.\n\ngroup section has this form:\n\ngroup {\n[permissions]\n {\n = ;\n...\n}\n...\n}\n\n\nname Name of the control group. It can contain only characters, which are allowed for di‐\nrectory names. The groups form a tree, i.e. a control group can contain zero or more\nsubgroups. Subgroups can be specified using '/' delimiter.\n\nThe root control group is always created automatically in all hierarchies and it is\nthe base of the group hierarchy. It can be explicitly specified in cgconfig.conf by\nusing '.' as group name. This can be used e.g. to set its permissions, as shown in Ex‐\nample 6.\n\nWhen the parent control group of a subgroup is not specified it is created automati‐\ncally.\n\n" }, { "name": "permissions", "content": "Permissions of the given control group on mounted filesystem. root has always permis‐\nsion to do anything with the control group. Permissions have the following syntax:\nperm {\ntask {\nuid = ;\ngid = ;\nfperm = \n}\nadmin {\nuid = ;\ngid = ;\ndperm = \nfperm = \n}\n}\n\n\ntask user/group Name of the user and the group, which own the tasks file of the con‐\ntrol group. Given fperm then specify the file permissions. Please\nnote that the given value is not used as was specified. Instead, cur‐\nrent file owner permissions are used as a \"umask\" for group and oth‐\ners permissions. For example if fperm = 777 then both group and oth‐\ners will get the same permissions as the file owner.\n\nadmin user/group Name of the user and the group which own the rest of control group's\nfiles. Given fperm and dperm control file and directory permissions.\nAgain, the given value is masked by the file/directory owner permis‐\nsions.\n\nPermissions are only apply to the enclosing control group and are not inherited by\nsubgroups. If there is no perm section in the control group definition, root:root is\nthe owner of all files and default file permissions are preserved if fperm resp. dperm\nare not specified.\n" }, { "name": "controller", "content": "Name of the kernel subsystem. The section can be empty, default kernel parameters\nwill be used in this case. By specifying controller the control group and all its par‐\nents are controlled by the specific subsystem. One control group can be controlled by\nmultiple subsystems, even if the subsystems are mounted on different directories. Each\ncontrol group must be controlled by at least one subsystem, so that libcgroup knows in\nwhich hierarchies the control group should be created.\n\nThe parameters of the given controller can be modified in the following section en‐\nclosed in brackets.\n\nparam name\nName of the file to set. Each controller can have zero or more parameters.\n\nparam value\nValue which should be written to the file when the control group is created. If\nit is enclosed in double quotes `\"', it can contain spaces and other special\ncharacters.\n\nIf no group section is specified, no groups are created.\n\ndefault section has this form:\n\ndefault {\nperm {\ntask {\nuid = ;\ngid = ;\nfperm = \n}\nadmin {\nuid = ;\ngid = ;\ndperm = \nfperm = \n}\n}\n}\n\nContent of the perm section has the same form as in group section. The permissions defined\nhere specify owner and permissions of groups and files of all groups, which do not have ex‐\nplicitly specified their permissions in their group section.\n\ntemplate section has the same structure as group section. Template name uses the same tem‐\nplates string as cgrules.conf destination tag (see (cgrules.conf (5)). Template definition\nis used as a control group definition for rules in cgrules.conf (5) with the same destination\nname. Templates does not use default section settings.\n\n/etc/cgconfig.d/ directory can be used for additional configuration files. cgrulesengd\nsearches this directory for additional templates.\n\n" } ] }, "EXAMPLES": { "content": "", "subsections": [ { "name": "Example 1", "content": "The configuration file:\n\nmount {\ncpu = /sys/fs/cgroup/cpu;\ncpuacct = /sys/fs/cgroup/cpu;\n}\n\ncreates the hierarchy controlled by two subsystems with no groups inside. It corresponds to\nthe following operations:\n\nmkdir /sys/fs/cgroup/cpu\nmount -t cgroup -o cpu,cpuacct cpu /sys/fs/cgroup/cpu\n\n" }, { "name": "Example 2", "content": "The configuration file:\n\nmount {\ncpu = /sys/fs/cgroup/cpu;\n\"name=scheduler\" = /sys/fs/cgroup/cpu;\n\"name=noctrl\" = /sys/fs/cgroup/noctrl;\n}\n\ngroup daemons {\ncpu {\ncpu.shares = \"1000\";\n}\n}\ngroup test {\n\"name=noctrl\" {\n}\n}\ncreates two hierarchies. One hierarchy named scheduler controlled by cpu subsystem, with\ngroup daemons inside. Second hierarchy is named noctrl without any controller, with group\ntest. It corresponds to following operations:\n\nmkdir /sys/fs/cgroup/cpu\nmount -t cgroup -o cpu,name=scheduler cpu /sys/fs/cgroup/cpu\nmount -t cgroup -o none,name=noctrl none /sys/fs/cgroup/noctrl\n\nmkdir /sys/fs/cgroup/cpu/daemons\necho 1000 > /sys/fs/cgroup/cpu/daemons/www/cpu.shares\n\nmkdir /sys/fs/cgroup/noctrl/tests\n\nThe daemons group is created automatically when its first subgroup is created. All its para‐\nmeters have the default value and only root can access group's files.\n\nSince both cpuacct and cpu subsystems are mounted to the same directory, all groups are im‐\nplicitly controlled also by cpuacct subsystem, even if there is no cpuacct section in any of\nthe groups.\n\n" }, { "name": "Example 3", "content": "The configuration file:\n\nmount {\ncpu = /sys/fs/cgroup/cpu;\ncpuacct = /sys/fs/cgroup/cpu;\n}\n\ngroup daemons/www {\nperm {\ntask {\nuid = root;\ngid = webmaster;\nfperm = 770;\n}\nadmin {\nuid = root;\ngid = root;\ndperm = 775;\nfperm = 744;\n}\n}\ncpu {\ncpu.shares = \"1000\";\n}\n}\n\ngroup daemons/ftp {\nperm {\ntask {\nuid = root;\ngid = ftpmaster;\nfperm = 774;\n}\nadmin {\nuid = root;\ngid = root;\ndperm = 755;\nfperm = 700;\n}\n}\ncpu {\ncpu.shares = \"500\";\n}\n}\ncreates the hierarchy controlled by two subsystems with one group and two subgroups inside,\nsetting one parameter. It corresponds to the following operations (except for file permis‐\nsions which are little bit trickier to emulate via chmod):\n\n\nmkdir /sys/fs/cgroup/cpu\nmount -t cgroup -o cpu,cpuacct cpu /sys/fs/cgroup/cpu\n\nmkdir /sys/fs/cgroup/cpu/daemons\n\nmkdir /sys/fs/cgroup/cpu/daemons/www\nchown root:root /sys/fs/cgroup/cpu/daemons/www/*\nchown root:webmaster /sys/fs/cgroup/cpu/daemons/www/tasks\necho 1000 > /sys/fs/cgroup/cpu/daemons/www/cpu.shares\n\n# + chmod the files so the result looks like:\n# ls -la /sys/fs/cgroup/cpu/daemons/www/\n# admin.dperm = 755:\n# drwxr-xr-x. 2 root webmaster 0 Jun 16 11:51 .\n#\n# admin.fperm = 744:\n# --w-------. 1 root webmaster 0 Jun 16 11:51 cgroup.eventcontrol\n# -r--r--r--. 1 root webmaster 0 Jun 16 11:51 cgroup.procs\n# -r--r--r--. 1 root webmaster 0 Jun 16 11:51 cpuacct.stat\n# -rw-r--r--. 1 root webmaster 0 Jun 16 11:51 cpuacct.usage\n# -r--r--r--. 1 root webmaster 0 Jun 16 11:51 cpuacct.usagepercpu\n# -rw-r--r--. 1 root webmaster 0 Jun 16 11:51 cpu.rtperiodus\n# -rw-r--r--. 1 root webmaster 0 Jun 16 11:51 cpu.rtruntimeus\n# -rw-r--r--. 1 root webmaster 0 Jun 16 11:51 cpu.shares\n# -rw-r--r--. 1 root webmaster 0 Jun 16 11:51 notifyonrelease\n#\n# tasks.fperm = 770\n# -rw-rw----. 1 root webmaster 0 Jun 16 11:51 tasks\n\n\nmkdir /sys/fs/cgroup/cpu/daemons/ftp\nchown root:root /sys/fs/cgroup/cpu/daemons/ftp/*\nchown root:ftpmaster /sys/fs/cgroup/cpu/daemons/ftp/tasks\necho 500 > /sys/fs/cgroup/cpu/daemons/ftp/cpu.shares\n\n# + chmod the files so the result looks like:\n# ls -la /sys/fs/cgroup/cpu/daemons/ftp/\n# admin.dperm = 755:\n# drwxr-xr-x. 2 root ftpmaster 0 Jun 16 11:51 .\n#\n# admin.fperm = 700:\n# --w-------. 1 root ftpmaster 0 Jun 16 11:51 cgroup.eventcontrol\n# -r--------. 1 root ftpmaster 0 Jun 16 11:51 cgroup.procs\n# -r--------. 1 root ftpmaster 0 Jun 16 11:51 cpuacct.stat\n# -rw-------. 1 root ftpmaster 0 Jun 16 11:51 cpuacct.usage\n# -r--------. 1 root ftpmaster 0 Jun 16 11:51 cpuacct.usagepercpu\n# -rw-------. 1 root ftpmaster 0 Jun 16 11:51 cpu.rtperiodus\n# -rw-------. 1 root ftpmaster 0 Jun 16 11:51 cpu.rtruntimeus\n# -rw-------. 1 root ftpmaster 0 Jun 16 11:51 cpu.shares\n# -rw-------. 1 root ftpmaster 0 Jun 16 11:51 notifyonrelease\n#\n# tasks.fperm = 774:\n# -rw-rw-r--. 1 root ftpmaster 0 Jun 16 11:51 tasks\n\n\nThe daemons group is created automatically when its first subgroup is created. All its para‐\nmeters have the default value and only root can access the group's files.\n\nSince both cpuacct and cpu subsystems are mounted to the same directory, all groups are im‐\nplicitly also controlled by the cpuacct subsystem, even if there is no cpuacct section in any\nof the groups.\n\n" }, { "name": "Example 4", "content": "The configuration file:\n\n\nmount {\ncpu = /sys/fs/cgroup/cpu;\ncpuacct = /sys/fs/cgroup/cpuacct;\n}\n\ngroup daemons {\ncpuacct{\n}\ncpu {\n}\n}\ncreates two hierarchies and one common group in both of them. It corresponds to the follow‐\ning operations:\n\nmkdir /sys/fs/cgroup/cpu\nmkdir /sys/fs/cgroup/cpuacct\nmount -t cgroup -o cpu cpu /sys/fs/cgroup/cpu\nmount -t cgroup -o cpuacct cpuacct /sys/fs/cgroup/cpuacct\n\nmkdir /sys/fs/cgroup/cpu/daemons\nmkdir /sys/fs/cgroup/cpuacct/daemons\n\nIn fact there are two groups created. One in the cpuacct hierarchy, the second in the cpu hi‐\nerarchy. These two groups have nothing in common and can contain different subgroups and dif‐\nferent tasks.\n\n" }, { "name": "Example 5", "content": "The configuration file:\n\n\nmount {\ncpu = /sys/fs/cgroup/cpu;\ncpuacct = /sys/fs/cgroup/cpuacct;\n}\n\ngroup daemons {\ncpuacct{\n}\n}\n\ngroup daemons/www {\ncpu {\ncpu.shares = \"1000\";\n}\n}\n\ngroup daemons/ftp {\ncpu {\ncpu.shares = \"500\";\n}\n}\ncreates two hierarchies with few groups inside. One of the groups is created in both hierar‐\nchies.\n\nIt corresponds to the following operations:\n\nmkdir /sys/fs/cgroup/cpu\nmkdir /sys/fs/cgroup/cpuacct\nmount -t cgroup -o cpu cpu /sys/fs/cgroup/cpu\nmount -t cgroup -o cpuacct cpuacct /sys/fs/cgroup/cpuacct\n\nmkdir /sys/fs/cgroup/cpuacct/daemons\nmkdir /sys/fs/cgroup/cpu/daemons\nmkdir /sys/fs/cgroup/cpu/daemons/www\necho 1000 > /sys/fs/cgroup/cpu/daemons/www/cpu.shares\nmkdir /sys/fs/cgroup/cpu/daemons/ftp\necho 500 > /sys/fs/cgroup/cpu/daemons/ftp/cpu.shares\nGroup daemons is created in both hierarchies. In the cpuacct hierarchy the group is explic‐\nitly mentioned in the configuration file. In the cpu hierarchy the group is created implic‐\nitly when www is created there. These two groups have nothing in common, for example they do\nnot share processes and subgroups. Groups www and ftp are created only in the cpu hierarchy\nand are not controlled by the cpuacct subsystem.\n\n" }, { "name": "Example 6", "content": "The configuration file:\n\nmount {\ncpu = /sys/fs/cgroup/cpu;\ncpuacct = /sys/fs/cgroup/cpu;\n}\n\ngroup . {\nperm {\ntask {\nuid = root;\ngid = operator;\n}\nadmin {\nuid = root;\ngid = operator;\n}\n}\ncpu {\n}\n}\n\ngroup daemons {\nperm {\ntask {\nuid = root;\ngid = daemonmaster;\n}\nadmin {\nuid = root;\ngid = operator;\n}\n}\ncpu {\n}\n}\ncreates the hierarchy controlled by two subsystems with one group having some special permis‐\nsions. It corresponds to the following operations:\n\nmkdir /sys/fs/cgroup/cpu\nmount -t cgroup -o cpu,cpuacct cpu /sys/fs/cgroup/cpu\n\nchown root:operator /sys/fs/cgroup/cpu/*\nchown root:operator /sys/fs/cgroup/cpu/tasks\n\nmkdir /sys/fs/cgroup/cpu/daemons\nchown root:operator /sys/fs/cgroup/cpu/daemons/*\nchown root:daemonmaster /sys/fs/cgroup/cpu/daemons/tasks\n\nUsers which are members of the operator group are allowed to administer the control groups,\ni.e. create new control groups and move processes between these groups without having root\nprivileges.\n\nMembers of the daemonmaster group can move processes to the daemons control group, but they\ncan not move the process out of the group. Only the operator or root can do that.\n\n" }, { "name": "Example 7", "content": "The configuration file:\n\n\nmount {\ncpu = /sys/fs/cgroup/cpu;\ncpuacct = /sys/fs/cgroup/cpuacct;\n}\n\ngroup students {\ncpuacct{\n}\ncpu {\n}\n}\n\ntemplate students/%u {\ncpuacct{\n}\ncpu {\n}\n}\n\nmkdir /sys/fs/cgroup/cpu/daemons\nmkdir /sys/fs/cgroup/cpuacct/daemons\n\nThe situation is the similar as in Example 4. The only difference is template, which is used\nif some rule uses \"/students/%u\" as a destination.\n\n" }, { "name": "Example 8", "content": "The configuration file:\n\n\nmount {\n\"cpu,nodev,nosuid,noexec\" = /mnt/cgroups/cpu;\n}\n\n\nThis is the same as mount -t cgroup cgroup -o nodev,nosuid,noexec,cpu /mnt/cgroups/cpu It\nmounts the cpu controller with MSNODEV, MSNOSUID and MSNOEXEC options passed.\n\n\n" } ] }, "RECOMMENDATIONS": { "content": "", "subsections": [ { "name": "Keep hierarchies separated", "content": "Having multiple hierarchies is perfectly valid and can be useful in various scenarios. To\nkeeps things clean, do not create one group in multiple hierarchies. Examples 4 and 5 show\nhow unreadable and confusing it can be, especially when reading somebody elses configuration\nfile.\n\n" }, { "name": "Explicit is better than implicit", "content": "libcgroup can implicitly create groups which are needed for the creation of configured sub‐\ngroups. This may be useful and save some typing in simple scenarios. When it comes to multi‐\nple hierarchies, it's better to explicitly specify all groups and all controllers related to\nthem.\n\n" } ] }, "FILES": { "content": "", "subsections": [ { "name": "/etc/cgconfig.conf", "content": "default libcgroup configuration file\n" }, { "name": "/etc/cgconfig.d/", "content": "default libcgroup configuration files directory\n\n" } ] }, "SEE ALSO": { "content": "cgconfigparser (8)\n\n", "subsections": [] }, "BUGS": { "content": "Parameter values must be single strings without spaces. Parsing of quoted strings is not im‐\nplemented.\n\n\n\n\n\nCGCONFIG.CONF(5)", "subsections": [] } } } }