From a35ed8f72ef4915408f0ccbbc951cc1cd87b25ed Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Wed, 12 Aug 2026 06:53:14 +0200 Subject: [PATCH] cgroups: non-root service cannot create child cgroups The kernel delegation docs require write access on the directory so the delegatee can mkdir() children. Signed-off-by: Joachim Wiberg --- src/cgroup.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/cgroup.c b/src/cgroup.c index 58e68875..378d5b90 100644 --- a/src/cgroup.c +++ b/src/cgroup.c @@ -339,6 +339,10 @@ static int cgroup_create(const char *group, const char *name, const char *cfg, NULL }; + /* non-root delegated services needs permission to mkdir() */ + if (chown(path, uid, gid)) + warn("Failed chown %s to %d:%d", path, uid, gid); + for (int i = 0; files[i]; i++) { snprintf(filepath, sizeof(filepath), "%s/%s", path, files[i]); if (chown(filepath, uid, gid))