Shailend ChandandgVisor bot 46e35291a0 Support writing to cgroup v2 control files without an open file descriptor ...

Fix a panic when writing to cgroup v2 control files from outside the sandbox
(e.g., via Cgroups.WriteControlFiles / WriteControl), where writes occur
without an open in-sandbox VFS file descriptor (fd == nil). cgroup.procs now
safely falls back to context credentials with unconfined namespace migration,
and checkNSDelegateWrite skips namespace delegation checks. Add an integration
test for runsc cgroup v2 control file writes.

Also:
- Export cgroup2fs.InitHierarchy to initialize sandbox-wide cgroup2 state
  and root controller enablement.
- Plumb CgroupNamespace through sentry lifecycle and task context to derive
  initial container cgroup2 placements.
PiperOrigin-RevId: 978087817

2026-09-08 13:36:37 -07:00

..

base_files.go

Support writing to cgroup v2 control files without an open file descriptor

2026-09-08 13:36:37 -07:00

BUILD

cgroup2fs: Turn the cpuset mu into a lockdep mutex

2026-09-04 16:05:04 -07:00

cgroup.go

Support writing to cgroup v2 control files without an open file descriptor

2026-09-08 13:36:37 -07:00

controllers.go

cgroup2: Support the nsdelegate mount option

2026-07-27 16:30:46 -07:00

cpu.go

cgroup2fs: fix cpu controller accounting

2026-09-01 18:35:58 -07:00

cpuset.go

cgroup2fs: Turn the cpuset mu into a lockdep mutex

2026-09-04 16:05:04 -07:00

event.go

cgroup2: Support the nsdelegate mount option

2026-07-27 16:30:46 -07:00

filesystem.go

Support writing to cgroup v2 control files without an open file descriptor

2026-09-08 13:36:37 -07:00

memory.go

Support cgroup2 queries from outside the sandbox

2026-07-20 12:24:23 -07:00

pids.go

cgroup2fs: charge existing tasks on pids controller enablement

2026-09-01 16:17:01 -07:00

save_restore.go

…

xattr.go

…