blob: f551b3e41595c3dfd8b1952d8d8b3d4e78060357 (
plain) (
tree)
|
|
title:Using cgroups
keywords:linux,security,cgroups
# Using cgroups
## Requirements
Download package for your distro there is one for. archlinux [cgmanager](https://www.archlinux.org/packages/?name=cgmanager).
So cgroups allows to configure how specific process resources going to be treated. As our days there is alot of bloatware around then its nice to
limit some of the processes at least dont use too much memory or cpu. That
also prevents some processes to hang.
Quite common that chrome freezes whole system when it eats up all cpu and memory especially when opening some optimized pages like YouTube. Out of
fustration about that this notes are created.
Also there is no enought guides how to configure some parts of cgroups,
so spent some time on research.
Cgroups allows to configure this resources:
| Resource | Description |
| --- | --- |
| blkio | this subsystem sets limits on input/output access to and from block devices such as physical drives (disk, solid state, or USB) |
| cpu | this subsystem uses the scheduler to provide cgroup tasks access to the CPU |
| cpuacct | this subsystem generates automatic reports on CPU resources used by tasks in a cgroup |
| cpuset | this subsystem assigns individual CPUs (on a multicore system) and memory nodes to tasks in a cgroup |
| devices | this subsystem allows or denies access to devices by tasks in a cgroup |
| freezer | this subsystem suspends or resumes tasks in a cgroup |
| memory | this subsystem sets limits on memory use by tasks in a cgroup and generates automatic reports on memory resources used by those task |
| net_cls | this subsystem tags network packets with a class identifier (classid) that allows the Linux traffic controller (tc) to identify packets originating from a particular cgroup task |
| net_prio | this subsystem provides a way to dynamically set the priority of network traffic per network interface |
| ns | the namespace subsystem |
| perf_event | this subsystem identifies cgroup membership of tasks and can be used for performance analysis |
## Configure example
As requirement was stop chrome stall system then memory and cpu will be limited
rules are located in _/etc/cgrules.conf_
Set permisions to whome applies
```
perm {
admin {
uid = youruser;
gid = youruser;
}
task {
uid = youruser;
gid = youruser;
}
}
```
Limit cpus where process is going to run, run process on 0-1 CPU's
```
cpuset {
cpuset.mems="0";
cpuset.cpus="0-1";
}
```
Limit cpus load, set CPU usage max to 90%
```
cpu {
cpu.shares = 900;
}
```
Limit process max memory to 4G
```
memory {
memory.limit_in_bytes = "4000000000";
}
```
Final config looks like
```
group chrome {
perm {
admin {
uid = fam;
gid = fam;
}
task {
uid = fam;
gid = fam;
}
}
cpuset {
cpuset.mems="0";
cpuset.cpus="0-1";
}
memory {
memory.limit_in_bytes = "4000000000";
}
cpu {
cpu.shares = 900;
}
net_cls {
net_cls.classid = 11;
}
}
```
Update and run rulles. rulles applied to cgroups and set on launched process
with memory,cpuset,cpu cgroup rulles.
```
cgconfigparser -l /etc/cgconfig.conf
cgexec -g memory,cpuset,cpu:chrome /usr/bin/chromium
```
Now we are safe to run some videos on internet and no system stalling is happening.
## Configuring process to use specific interface
### Set cgroup classid
```
net_cls {
net_cls.classid = 0x10001;
}
```
### Iptables filtering
```
iptables -N CHROME_OUT
iptables -N CHROME_IN
iptables -t filter -A OUTPUT -j CHROME_OUT -m cgroup --cgroup 0x10001
iptables -A CHROME_OUT -j DROP
iptables -A CHROME_OUT -o tun0 -j ACCEPT
iptables -t filter -A INPUT -j CHROME_IN -m cgroup --cgroup 0x10001
iptables -A CHROME_IN -j DROP
iptables -A CHROME_OUT -i tun0 -j ACCEPT
```
So now single/secure interface is avaliable for cgroupe chrome, if secure interface down
then no network connection
### Run
```
cgexec -g memory,cpuset,cpu,net_cls:chrome /usr/bin/chromium
```
## Exploring other configuration options
Cgroups is configured trought sysfs
```
ls /sys/fs/cgroup
blkio cpuacct devices memory net_prio rdma
cgmanager cpu,cpuacct freezer net_cls perf_event systemd
cpu cpuset hugetlb net_cls,net_prio pids unified
```
If we have applied rules from previouse section then we are able to find them in
```
cat /sys/fs/cgroup/cpu/chrome/cpu.shares
900
cat /sys/fs/cgroup/memory/chrome/memory.limit_in_bytes
3999997952
cat /sys/fs/cgroup/cpuset/chrome/cpuset.mems
0
cat /sys/fs/cgroup/cpuset/chrome/cpuset.cpus
0-1
```
More options on each of subsystems can be found with:
```
ls /sys/fs/cgroup/*/
```
Here some extra options for cpu
```
ls /sys/fs/cgroup/cpu/
cgroup.clone_children cpuacct.usage_percpu cpu.shares
cgroup.procs cpuacct.usage_percpu_sys cpu.stat
cgroup.sane_behavior cpuacct.usage_percpu_user notify_on_release
chrome cpuacct.usage_sys release_agent
cpuacct.stat cpuacct.usage_user tasks
cpuacct.usage cpu.cfs_period_us
cpuacct.usage_all cpu.cfs_quota_us
```
## Links
[1] [https://wiki.archlinux.org/index.php/Cgroups](https://wiki.archlinux.org/index.php/Cgroups)
[2] [https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/resource_management_guide/ch01](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/resource_management_guide/ch01)
[3] [https://blog.michael.kuron-germany.de/tag/iptables/](https://blog.michael.kuron-germany.de/tag/iptables/)
[4] [http://main.lv/writeup/using_iptables.md](http://main.lv/writeup/using_iptables.md)
|
