Forum Debian Users Gang

cgroup on /sys/fs/cgroup type tmpfs (rw,relatime,size=12k

root:~# mount | grep cgr
cgroup on /sys/fs/cgroup type tmpfs (rw,relatime,size=12k)
cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,relatime,cpuset,release_agent=/run/cgmanager/agents/cgm-release-agent.cpuset,clone_children)
cgroup on /sys/fs/cgroup/cpu type cgroup (rw,relatime,cpu,release_agent=/run/cgmanager/agents/cgm-release-agent.cpu)
cgroup on /sys/fs/cgroup/cpuacct type cgroup (rw,relatime,cpuacct,release_agent=/run/cgmanager/agents/cgm-release-agent.cpuacct)
cgroup on /sys/fs/cgroup/memory type cgroup (rw,relatime,memory,release_agent=/run/cgmanager/agents/cgm-release-agent.memory)
cgroup on /sys/fs/cgroup/devices type cgroup (rw,relatime,devices,release_agent=/run/cgmanager/agents/cgm-release-agent.devices)
cgroup on /sys/fs/cgroup/freezer type cgroup (rw,relatime,freezer,release_agent=/run/cgmanager/agents/cgm-release-agent.freezer)
cgroup on /sys/fs/cgroup/net_cls type cgroup (rw,relatime,net_cls,release_agent=/run/cgmanager/agents/cgm-release-agent.net_cls)
cgroup on /sys/fs/cgroup/blkio type cgroup (rw,relatime,blkio,release_agent=/run/cgmanager/agents/cgm-release-agent.blkio)
cgroup on /sys/fs/cgroup/perf_event type cgroup (rw,relatime,perf_event,release_agent=/run/cgmanager/agents/cgm-release-agent.perf_event)
cgroup on /sys/fs/cgroup/net_prio type cgroup (rw,relatime,net_prio,release_agent=/run/cgmanager/agents/cgm-release-agent.net_prio)

root:~# tree /sys/fs/cgroup/
/sys/fs/cgroup/
├── blkio
│   ├── blkio.io_merged
│   ├── blkio.io_merged_recursive
│   ├── blkio.io_queued
│   ├── blkio.io_queued_recursive
│   ├── blkio.io_service_bytes
│   ├── blkio.io_service_bytes_recursive
│   ├── blkio.io_service_time
│   ├── blkio.io_service_time_recursive
│   ├── blkio.io_serviced
│   ├── blkio.io_serviced_recursive
│   ├── blkio.io_wait_time
│   ├── blkio.io_wait_time_recursive
│   ├── blkio.leaf_weight
│   ├── blkio.leaf_weight_device
│   ├── blkio.reset_stats
│   ├── blkio.sectors
│   ├── blkio.sectors_recursive
│   ├── blkio.throttle.io_service_bytes
│   ├── blkio.throttle.io_serviced
│   ├── blkio.throttle.read_bps_device
│   ├── blkio.throttle.read_iops_device
│   ├── blkio.throttle.write_bps_device
│   ├── blkio.throttle.write_iops_device
│   ├── blkio.time
│   ├── blkio.time_recursive
│   ├── blkio.weight
│   ├── blkio.weight_device
│   ├── cgroup.clone_children
│   ├── cgroup.procs
│   ├── cgroup.sane_behavior
│   ├── notify_on_release
│   ├── release_agent
│   └── tasks
├── cgmanager
│   └── sock
├── cpu
│   ├── cgroup.clone_children
│   ├── cgroup.procs
│   ├── cgroup.sane_behavior
│   ├── cpu.shares
│   ├── notify_on_release
│   ├── release_agent
│   └── tasks
├── cpuacct
│   ├── cgroup.clone_children
│   ├── cgroup.procs
│   ├── cgroup.sane_behavior
│   ├── cpuacct.stat
│   ├── cpuacct.usage
│   ├── cpuacct.usage_percpu
│   ├── notify_on_release
│   ├── release_agent
│   └── tasks
├── cpuset
│   ├── cgroup.clone_children
│   ├── cgroup.procs
│   ├── cgroup.sane_behavior
│   ├── cpuset.cpu_exclusive
│   ├── cpuset.cpus
│   ├── cpuset.mem_exclusive
│   ├── cpuset.mem_hardwall
│   ├── cpuset.memory_migrate
│   ├── cpuset.memory_pressure
│   ├── cpuset.memory_pressure_enabled
│   ├── cpuset.memory_spread_page
│   ├── cpuset.memory_spread_slab
│   ├── cpuset.mems
│   ├── cpuset.sched_load_balance
│   ├── cpuset.sched_relax_domain_level
│   ├── notify_on_release
│   ├── release_agent
│   └── tasks
├── devices
│   ├── cgroup.clone_children
│   ├── cgroup.procs
│   ├── cgroup.sane_behavior
│   ├── devices.allow
│   ├── devices.deny
│   ├── devices.list
│   ├── notify_on_release
│   ├── release_agent
│   └── tasks
├── freezer
│   ├── cgroup.clone_children
│   ├── cgroup.procs
│   ├── cgroup.sane_behavior
│   ├── notify_on_release
│   ├── release_agent
│   └── tasks
├── memory
│   ├── cgroup.clone_children
│   ├── cgroup.event_control
│   ├── cgroup.procs
│   ├── cgroup.sane_behavior
│   ├── memory.failcnt
│   ├── memory.force_empty
│   ├── memory.limit_in_bytes
│   ├── memory.max_usage_in_bytes
│   ├── memory.move_charge_at_immigrate
│   ├── memory.numa_stat
│   ├── memory.oom_control
│   ├── memory.pressure_level
│   ├── memory.soft_limit_in_bytes
│   ├── memory.stat
│   ├── memory.swappiness
│   ├── memory.usage_in_bytes
│   ├── memory.use_hierarchy
│   ├── notify_on_release
│   ├── release_agent
│   └── tasks
├── net_cls
│   ├── cgroup.clone_children
│   ├── cgroup.procs
│   ├── cgroup.sane_behavior
│   ├── net_cls.classid
│   ├── notify_on_release
│   ├── release_agent
│   └── tasks
├── net_prio
│   ├── cgroup.clone_children
│   ├── cgroup.procs
│   ├── cgroup.sane_behavior
│   ├── net_prio.ifpriomap
│   ├── net_prio.prioidx
│   ├── notify_on_release
│   ├── release_agent
│   └── tasks
└── perf_event
    ├── cgroup.clone_children
    ├── cgroup.procs
    ├── cgroup.sane_behavior
    ├── notify_on_release
    ├── release_agent
    └── tasks

11 directories, 124 files

# cat /proc/cgroups
#subsys_name    hierarchy       num_cgroups     enabled
cpuset  4       1       1
cpu     2       1       1
cpuacct 3       1       1
memory  7       1       1
devices 5       1       1
freezer 6       1       1
net_cls 8       1       1
blkio   1       1       1
perf_event      10      1       1
net_prio        9       1       1

├── net_prio
│   ├── cgroup.clone_children
│   ├── cgroup.procs
│   ├── cgroup.sane_behavior
│   ├── lxc
│   │   ├── cgroup.clone_children
│   │   ├── cgroup.procs
│   │   ├── net_prio.ifpriomap
│   │   ├── net_prio.prioidx
│   │   ├── notify_on_release
│   │   ├── server_www
│   │   │   ├── cgroup.clone_children
│   │   │   ├── cgroup.procs
│   │   │   ├── net_prio.ifpriomap
│   │   │   ├── net_prio.prioidx
│   │   │   ├── notify_on_release
│   │   │   └── tasks
│   │   └── tasks
│   ├── net_prio.ifpriomap
│   ├── net_prio.prioidx
│   ├── notify_on_release
│   ├── release_agent
│   └── tasks

root:~# mkdir /sys/fs/cgroup/net_filter
root:~# mount -t cgroup -o net_filter net_filter /sys/fs/cgroup/net_filter
mount: special device net_filter does not exist

root:~# lsmod | grep -i cgr
cls_cgroup             12761  0 
xt_cgroup              12465  0 
x_tables               27111  22 xt_cgroup,ip6table_filter,xt_mark,xt_CT,xt_comment,xt_recent,ip_tables,xt_tcpudp,xt_limit,xt_owner,xt_conntrack,xt_LOG,xt_nat,xt_set,xt_multiport,iptable_filter,xt_connmark,ipt_REJECT,iptable_mangle,ip6_tables,iptable_raw,ip6t_REJECT

#! /bin/sh
### BEGIN INIT INFO
# Provides:          cgrulesengd
# Required-Start:    $local_fs $syslog
# Required-Stop:     $local_fs $syslog
# Should-Start:      cgmanager cgroupfs-mount cgproxy 
# Should-Stop:       cgmanager cgroupfs-mount cgproxy 
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: start and stop the cgroups rules engine daemon
# Description:         CGroup Rules Engine is a tool for automatically using \
#                     cgroups to classify processes
### END INIT INFO

# Author: Mikhail Morfikov <morfikov@gmail.com>

# Do NOT "set -e"

PATH=/sbin:/usr/sbin:/bin:/usr/bin

NAME="cgrulesengd"
DESC="CGroup Rules Engine Daemon"
SCRIPTNAME="/etc/init.d/$NAME"
PIDFILE="/var/run/$NAME.pid"
LOCKFILE="/run/lock/$NAME.lock"
DAEMON="/usr/sbin/$NAME"
DAEMON_ARGS="-n --nolog"

# Exit if the package is not installed
[ -x "$DAEMON" ] || exit 1

. /lib/init/vars.sh
. /lib/lsb/init-functions

do_start()
{
    if [ -f "$LOCKFILE" ]; then
        log_warning_msg "$NAME is already running with PID `cat ${PIDFILE}`"
        exit 0
    fi

    log_daemon_msg "Starting $DESC" "$NAME"
    start-stop-daemon --start --quiet --make-pidfile --pidfile $PIDFILE --background --name $NAME --exec $DAEMON -- $DAEMON_ARGS
    RETVAL="$?"

    if [ "$RETVAL" -eq "0" ]; then
        log_end_msg 0
        touch "$LOCKFILE"
    else
        log_end_msg 1
    fi
}

do_stop()
{
    if [ ! -f "$LOCKFILE" ]; then
        log_warning_msg "$NAME is not running, so it can't be stopped"
        exit 0
    fi
    
    log_daemon_msg "Stopping $DESC" "$NAME"
    start-stop-daemon --stop --quiet --pidfile $PIDFILE --name $NAME
    RETVAL="$?"

    if [ "$RETVAL" -eq "0" ]; then
        log_end_msg 0
        rm -f $PIDFILE $LOCKFILE
    else
        log_end_msg 1
    fi
}


case "$1" in
    start)
        do_start
    ;;
    stop)
        do_stop
    ;;
    restart)
        do_stop
        do_start
    ;;
    status)
        status_of_proc "$DAEMON" "$NAME"
        exit 0
    ;;
    *)
        echo "Usage: $SCRIPTNAME {start|stop|status|restart}" >&2
        exit 0
    ;;
esac

exit 0

root:~# iptables -m cgroup --help |tail -n2
iptables v1.4.21: Couldn't load match `cgroup':No such file or directory

Try `iptables -h' or 'iptables --help' for more information.

# dpkg -L iptables | grep cgr
/lib/xtables/libxt_cgroup.so
# iptables -m cgroup --help |tail -n2
cgroup match options:
[!] --cgroup fwid  Match cgroup fwid

echo '0x00010005' > $CGDIR/net_cls/users/firefox/net_cls.classid

echo '5'' > $CGDIR/net_cls/users/firefox/net_cls.classid