linux-kernel - cgroups v2: issues faced attempting to setup cpu limiting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <55434cbd-7672-3a09-446c-57b37c5c48a5@gmail.com>
Date:   Tue, 16 Jul 2019 18:05:23 +0530
From:   Kaiwan N Billimoria <kaiwan.billimoria@...il.com>
To:     linux-kernel@...r.kernel.org
Subject: cgroups v2: issues faced attempting to setup cpu limiting

Hi,

Am facing some issues getting CPU limiting working with cgroups v2. Pl read on for the details;
a solution is much appreciated!

Env: custom 5.0.0 Linux kernel on x86_64 Fedora 29

When attempting to setup CPU limiting using cgroups v2, I effectively disabled cgroups v1 by passing

cgroup_no_v1=all

as a kernel cmdline option. That seems fine and now various controllers (cpu, io, memory, ...)
show up under /sys/fs/cgroup/unified/cgroup.controllers.

However, doing:

# mkdir /sys/fs/cgroup/unified/test1
# echo "+cpu " > /sys/fs/cgroup/unified/test1/cgroup.subtree_control
bash: echo: write error: No such file or directory
#

I understand that this is expected, as the man page on cgroups(7) mentions:

"... As at Linux 4.15, the cgroups v2 cpu controller does not support
control of realtime processes, and the controller can be enabled in the
root cgroup only if all realtime threads are in the root cgroup. (If there
are realtime processes in nonroot cgroups, then a write(2) of the string
"+cpu" to the cgroup.subtree_control file fails with the error EINVAL.
However, on some systems, systemd(1) places certain realtime processes in
nonroot cgroups in the v2 hierarchy. On such systems, these processes must
first be moved to the root cgroup before the cpu controller can be
enabled. ..."

My questions are: how exactly does one 'move realtime processes to the root cgroup'?
What are the commands?

Next, how does one identify which processes? The ones that have sched policy SCHED_FIFO
or SCHED_RR? Would using a utility wrapper make this simpler? (libcgroup, cgmanager,
etc) - do they play well with cgroups2?

TIA!

Regards,
Kaiwan.

amazon author page: https://www.amazon.com/-/e/B07KNJSRJX