<html dir="ltr"><head></head><body style="text-align:left; direction:ltr;"><div>Hi,</div><div><br></div><div>I've been using <font face="monospace" size="3">apache2-mpm-itk</font> with <font face="monospace" size="3">cgrulesengd</font> in cgroupv1 to automatically classify the child processes that <font face="monospace" size="3">apache2-mpm-itk</font> spawns when servicing web requests for different vhosts for about 3 years, and it's been working great, when a vhost starts using up too much CPU/RAM, oom killer takes care of that specific vhost and leaves the others alone, as well as the parent process. </div><div><br></div><div>I'm now preparing to move to Debian 11 as part of my yearly updates, and I'm finding out that I need to use cgroup v2 now. So I'm trying to bring my resource control solution to the new world.</div><div><br></div><div>When I create my e.g. <font face="monospace" size="3">/etc/systemd/system/user-UID.slice.d/override.conf</font> with the resource controls for that user, they don't apply to the forked processes, as <font face="monospace" size="3">cgrulesengd</font> used to be able to do, as I am confirming with <font face="monospace" size="3">systemd-cgls</font>. Instead, the parent and all its children all still belong to the same <font face="monospace" size="3">apache2.service</font> slice. Which makes sense since it wasn't systemd that spawned the child processes.</div><div><br></div><div>Is there a way to automatically classify child processes of a process in a different cgroup than the spawning process with systemd based on the children's new UID? I know <font face="monospace" size="3">apache2-mpm-itk</font> calls setuid() on its children, so we would have to somehow hook on that. </div><div><br></div><div>By default, the processes are now all in :</div><div><br></div><div>system.slice/apache2.service</div><div><br></div><div>I'd like to have the child processes that apache2-mpm-itk spawns go under their respective user, e.g.</div><div><br></div><div>system.slice/apache2.service/vhosts/%UID%</div><div></div><div><br></div><div>And then I would set a memory limit of 1G on system.slice/apache2.service/vhosts</div><div><br></div><div>Then when the sum of the memory usage of the vhosts goes above 1G, oom killer will choose the biggest offending group under system.slice/apache2.service/vhosts/ and terminate that group, without touching the others nor the parent process. I've been able to do this with cgrulesengd and cgconfigparser for 3 years, it's been rock solid. I'm trying to bring that to the new systemd world.</div><div><br></div><div>Would the only solution for me to create a daemon which monitors for setuid() calls of the parent apache process, and classify the children as per the new setuid user? </div><div><br></div><div>Or perhaps, I think root parent processes spawning specific UID children is a common security practise, perhaps there should be something in systemd out of the box for classifying the children under their respective cgroups?</div><div><br></div><div>If my only solution is to create a daemon which monitors for setuid() I'll do it, although I've never done it before, not sure where I'd have to start. Any guidance would be great! </div><div><br></div><div>Thank you so much,</div><div><br></div><div>Wadih Maalouf</div></body></html>