Following the advice in my previous question here I currently have a Rust-binary that gets executed by my main-app using std::process::Command.

The executed binary first gets validated by a hash.

The main-app should not have any limitations. But the executed child-binary should not be able to access network or denied files, this I have achieved with AppArmor.

Now I also want to limit the memory usage and cpu usage of the child binary. I have made cgroups with the following commands:

sudo cgcreate -g cpu,memory:rustserver
sudo cgset -r memory.max=150000000 rustserver
sudo cgset -r cpu.max=25000 rustserver

Now I have a issue. I could execute the rust-server with sudo cgexec -g cpu,memory:rustserver target/debug/rust-api but then the child process which is executed with std::process::Command and actually needs to be limited arent included.

I could execute sudo cgexec in my Rust code, but for obvious reasons I do not want to give the child process sudo rights.

I am wondering how I can get all instances of the child-binary into the cgroups?

Maybe this is a approach?

  1. Make a new user.
  2. Give this user permission to write to /sys/fs/cgroups/... without the need of sudo.
  3. So it can write the pid of the child-process to there.

1 Answer 1


This is my current solution:

watch -n 5 'sudo cgclassify $(pgrep -x python-executor | tr "\n" " ")'

Execute cgclassify every 5 seconds to add the python-executor to the correct cgroup based on etc/cgrules.conf.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .