Why can't I remove a cgroup?

Aug. 9, 2022

      Hi folks,

I wrote a small program to start a new process (a shell), create a
cgroup and add the process to it. This all works fine - the process ID
of the shell ends up in the cgroup.procs file and when my program
exits, cgroup.procs ends up empty as expected. If I try and remove the
cgroup directory, though, I get a load of "Operation not permitted"
errors and I'm not sure why. I'm running on openSUSE (kernel 5.3.18)
with cgroups v2.

My program looks like:

#define _GNU_SOURCE
#include <sched.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <unistd.h>

int startShell(void *argument) {
    char* arguments[] = {"bash", NULL};
    char* environment[] = {NULL};
    execve("/bin/bash", arguments, environment);

    return 0;
}

int main() {
    mkdir(
        "/sys/fs/cgroup/my_group",
        S_IRWXO | S_IRGRP | S_IROTH
    );

    int stackSizeBytes = 65536;
    char *stackStart = malloc(stackSizeBytes);
    char *stackEnd = stackStart + stackSizeBytes;

    pid_t childPid = clone(
        startShell,
        stackEnd,
        SIGCHLD,
        NULL
    );

    FILE* procsFile = fopen(
        "/sys/fs/cgroup/my_group/cgroup.procs",
        "w"
    );

    fprintf(procsFile, "%d\n", childPid);
    fclose(procsFile);

    waitpid(childPid, NULL, 0);

    return 0;
}

and output looks like:

$ su -c ./run
Password:

# echo $$
4382
# cat /sys/fs/cgroup/my_group/cgroup.procs
4382
4522
# exit
$ cat /sys/fs/cgroup/my_group/cgroup.procs
$ su -c "rm -rf /sys/fs/cgroup/my_group"
Password:
rm: cannot remove '/sys/fs/cgroup/my_group/cgroup.events': Operation
not permitted
rm: cannot remove '/sys/fs/cgroup/my_group/memory.events': Operation
not permitted
... other lines omitted for brevity

Could someone please help me understand what's going on here?

Thanks!

Nicky Chorley

Valentin Vidić

Nicky Chorley

Jack Wang

tags

participants (3)