23s2s

✏️ Editing: lve.slice

[Unit]
Description=LVE cgroup subtree
Documentation=man:systemd.slice(5)
# This slice exists only to own the cgroup subtree kmodlve creates its
# groups in (/sys/fs/cgroup/lve.slice/{lvub,noub,...} on cgroup v2, see the
# lve_cgroup_root module parameter). No unit is ever placed in it, so it
# never holds processes - which is what a cgroup with controllers enabled
# for its children has to be on cgroup v2. It is pulled in and ordered
# before lve.service, which loads the module.
Before=lve.service

[Slice]
# Marks the subtree below this slice as kmodlve's, so that systemd leaves
# the groups it finds inside alone instead of treating them as strays to
# be cleaned up. Only the controllers the module actually enables for
# lvub/noub are listed - Delegate=yes would also turn on io and cpuset in
# the root cgroup, which nothing here needs (kmodlve does its own IO
# throttling, see os/iolimits.c). On cgroup v1 the freezer and
# net_cls,net_prio groups are created by the module itself, systemd does
# not manage those hierarchies.
#
# Delegation is defined in terms of the processes of a unit, and a slice
# has none, so this does not enable anything by itself: systemctl show
# reports Delegate=no for a slice on EL10 (systemd 257). The settings
# below are what gets the controllers enabled.
Delegate=cpu memory pids

# What makes systemd enable cpu, memory and pids in the root cgroup, and
# so makes them available in this slice for the module to turn on for
# lvub/noub. Without them the module's first write, cgroup.subtree_control
# in this slice, fails with -ENOENT during boot, as a controller cannot be
# enabled here before it is enabled in the parent - and nothing else needs
# cpu in the root that early, only user sessions do later on. CPUWeight is
# the default value and changes nothing by itself, but some cpu property
# has to be set for systemd to enable the controller: CPUAccounting alone
# no longer does, now that the kernel exposes cpu.stat without it. memory
# and pids are covered by DefaultMemoryAccounting/DefaultTasksAccounting,
# set here so this does not depend on the host's defaults.
CPUWeight=100
MemoryAccounting=yes
TasksAccounting=yes

Sid Gifari From Gifari Industries - BD Cyber Security Team