CGRULES.CONF(5)

🎀 CGRULES.CONF 💖

okay bestie, welcome to the cgrules.conf page from the libcgroup Manual — yeah she's got a manual name and everything, iconic behavior honestly. pull up a chair, grab a boba, we're learning how libcgroup decides which control group your lil process belongs in. 🫶

---

✨ NAME ✨

cgrules.conf — the libcgroup configuration file. that's it, that's the name, short and slay. 💅

---

🌸 DESCRIPTION 🌸

so here's the tea: the cgrules.conf configuration file is what libcgroup uses to define the control groups that a process belongs to. periodt.

the file is literally just a list of rules, and each rule assigns a control group in a subsystem (or multiple control groups across multiple subsystems, no cap) to a defined group or user. 💖

📝 the two rule formats

rules come in exactly two flavors, and here they are:

<user>                   <controllers>  <destination>  <options>
<user>:<process name>    <controllers>  <destination>  <options>

now let's break down what all those lil placeholders actually mean. 🦋

👑 what <user> can be

• a user name
• a group name, written with the @group syntax
• the wildcard *, which means any user or group — she's for everybody fr fr
• %, which is equivalent to "ditto" (super useful for multi-line rules where you need different cgroups specified for various hierarchies for a single user)

🧚 what <process name> can be

this one's optional, so if you don't need it, skip her. she can be:

• a process name
• a full command path of a process
• and yes, use quotes '"' for names with spaces in them

🎛️ what <controllers> can be

• comma separated controller names (no spaces, bestie, none)
• or * (for all mounted controllers)

🎯 what <destination> can be

• a path relative to the controller hierarchy (ex. pgrp1/gid1/uid1)
• or one of the following strings called "templates", which will get expanded:
  • %u — uid
  • %U — username, uid if name resolving fails
  • %g — gid
  • %G — group name, gid if name resolving fails
  • %p — pid
  • %P — process name, pid if name not available

also:

• '\' can be used to escape %
• quotation marks '"' can be used for names and/or paths with spaces

⚙️ what <options> can be

options is optional (lol) and it can be:

• "ignore" — if a process matches a rule with the "ignore" option, then it will be ignored by cgrulesengd and will not be moved. cgrulesengd processing will stop for this process, and all rules below this rule will not affect this process.
• "ignore_rt" — if a process is scheduled as SCHED_RR or SCHED_FF and matches this rule, it will be ignored by cgrulesengd and will not be moved.

---

💀 the rules of the rules

First rule which matches the criteria will be executed. that's it. the first one wins, she doesn't keep looking. main character energy only. 👑

any text starting with '#' is considered as a start of comment line and is ignored. so go ahead and leave yourself lil notes, bestie. 💜

if the destination contains a template string, the control group can be created on-fly. in time when some process wants to use the template rule which leads to control group (see cgexec (1)) and the control group does not exist, the group is created. the template control group parameters can be specified in cgconfig.conf configuration file. see (cgconfig.conf (5)). if the template definition is not found there, created group have default kernel setting. 🙈

to create a hierarchy of configuration files, use /etc/cgrules.d directory. nesting era fr. 🌈

---

🔥 EXAMPLES 🔥

okay this is the part everyone actually scrolls to. let's go. ✨

student         devices         /usergroup/students

Student's processes in the 'devices' subsystem belong to the control group /usergroup/students. simple, clean, ate.

student:cp       devices         /usergroup/students/cp

When student executes 'cp' command, the processes in the 'devices' subsystem belong to the control group /usergroup/students/cp.

@admin           *              admingroup/

Processes started by anybody from admin group no matter in what subsystem belong to the control group admingroup/. the whole admin crew, no exceptions. 💅

peter           cpu             test1/
%               memory          test2/

The first line says Peter's task for cpu controller belongs to test1 control group. The second one says Peter's tasks for memory controller belong to test2/ control group. that % ditto is doing her lil job, love that for her.

*               *               default/

All processes in any subsystem belong to the control group default/. Since the earliest matched rule is applied, it makes sense to have this line at the end of the list. It will put a task which was not mentioned in the previous rules to default/ control group. it's giving catch-all, and that's the point. 🎀

@students cpu,cpuacct    students/%u

Processes in cpu and cpuacct subsystems started by anybody from students group belong to group students/name. Where "name" is user name of owner of the process.

@students:"Web Browser"       cpu         "/usergroup/students/Internet Apps"

When anyone from the students group launches the "Web Browser" application, the processes in the 'cpu' subsystem belong to the control group "/usergroup/students/Internet Apps". Spaces are permitted in process names and control cgroup paths when enclosed within quotes. yes, spaces! the quotes are carrying this entire rule on their back. 😭

---

🗂️ FILES 🗂️

• /etc/cgrules.conf — default libcgroup configuration file
• /etc/cgrules.d — default libcgroup configuration files directory

---

👀 SEE ALSO 👀

cgconfig.conf (5), cgclassify (1), cgred.conf (5), cgrules.d (5)

iykyk — go read those next, bestie. 🦋

---

💀 BUGS 💀

nothing listed here. literally nothing. she's bug-free (allegedly). 🙈

---

and that's the whole page, bestie — no cap. this was libcgroup Manual, version/date 2009-03-10, and the page goes by CGRULES.CONF(5) on a Linux system. go forth and configure those cgroups, you absolute icon. 💖✨🎀🦋🌸💅🫶👑🌈⭐