Search code examples
systemdcgroupslinux-capabilities

What capabilities does systemd daemon require to create cgroups?

In my project I need sometimes to be able to create new control groups as an unprivileged user. I decided to write a systemd daemon for this.

I use libcgroup in the daemon code for cgroup manipulation.

When I try to create a cgroup (cgroup_create_cgroup), I receive a libcgroup error ECGROUPNOTALLOWED (Cgroup, operation not allowed). How to allow my daemon to create new cgroups?

systemd .service file:

[Service]
...
CapabilityBoundingSet=CAP_SYS_ADMIN
PrivateTmp=yes
PrivateDevices=yes
PrivateNetwork=yes
ProtectSystem=yes
ProtectHome=yes
ProtectControlGroups=no
ProtectKernelTunables=no
RestrictRealtime=no
User=root
Group=root
Solution

  • Well, I don't really know which of those protections was odd but just removing them all did the trick.