CHCGS(8)

NAME
chcgs - modify cgroup state and optionally execute a program inside of it

SYNOPSIS
chcgs [-p | -x] [-U] [-o ctr.knob=val] [-o ctr.knob=val] [-o ...] cgroup [prog...]

DESCRIPTION
chcgs creates, delegates and sets limits in the Linux kernel control group cgroup. If absolute, cgroup is interpreted relative to /sys/fs/cgroup; if relative, it is interpreted relative to the current process's cgroup.

If the -p option is given, chcgs will create the cgroup' s parents as well. If the -x option is given, chcgs will not create any cgroups, and will consider the absence of cgroup an operating system error.

If the -U option is given, chcgs will change ownership of cgroup' s cgroup.procs, cgroup.subtree_control and cgroup.threads files to the user and group stored in the UID and GID environment variables ( as defined by a previous envuidgid(8) invocation) delegating cgroup to that user.

If any -o options are given, the contents after the ‘=’ character are written to the ctr.knob file under the chosen cgroup; the controller ctr is automatically add to both cgroup' s and its parents' cgroup.subtree_control file, if needed.

If prog... is given, chcgs will add its own PID to cgroup' s cgroup.procs file and exec(3) prog....

ENVIRONMENT

UID Delegate cgroup to user UID if the -U option is given.

GID Delegate cgroup to group GID if the -U option is given.

EXIT STATUS

•   If chcgs finds any user errors, such as invalid command line options, it exits 100.

•   If chcgs encounters an operating system error, it exits 111.

•   Otherwise, chcgs will either exec(3) prog... if it is given, or exit 0.

•   If prog... fails to execute, chcgs exits 127 (if it was not found) or 126 (if another error occured).

EXAMPLES

    chcgs -o pids.max=5 /antifb sh -c 'a() { a | a; }; a'

Create the cgroup ‘antifb’, restrict it to a maximum of 5 simultaneous processes, and try to run the classic sh(1) fork bomb under it.

    chcgs -o cgroup.freeze=1 .

Freeze the current control group.

SEE ALSO
cgroup(7), cgpoll(8)

HISTORY
chcgs is inspired by nosh(1)' s create-control-group(1), move-to-control-group(1), and set-control-group-knob(1).

chcgs has a very different interface in an attempt to enable more concise scripts and ad-hoc usage in the command line; the default nosh bundles for Debian show a nearly 1:1 relationship between calls to move-to-control-group(1) and to set-control-group-knob(1) in ‘start’ scripts and calls to mkdir(1) and to echo(1) in hypothetical shell scripts without these utilities.

Depending on the depth of the cgroup hierachy and the number of controllers used, the -o option can obviate dozens of calls to these utilities.

The contents of the -o options are also written a by process in the root control group, which allows chcgs to work better with extremely restrictive settings (such as ‘pids.max’ set to 1).

In addition, chcgs is a chainloader, which can save a call to foreground(1).

AUTHORS
Carlos Pezotte <carana2099@gmail.com>

CAVEATS

•   chcgs only supports the version 2 cgroups(7) interface.

•   Control groups created due to the -p option will not be delegated, even if -U is given.

•   -o' s automatic handling of parent cgroup controllers make it relatively easy for chcgs to trigger the "no internal processes" rule (documented in cgroup(7) ) and die.

•   chcgs will not go out of its way to clean up earlier -o settings if one of them fails along the way.

SECURITY CONSIDERATIONS

•   chcgs hasn't been real-world tested in its ability to resist cgroup being abused to open files outside the cgroupfs, and the -o option being abused to write to arbitrary filepaths.