Package init

2019-12-25 17:13:03 +08:00 · 2019-12-25 17:13:03 +08:00 · c1223ca9f0
commit c1223ca9f0
parent cd37642fc9
22 changed files with 1097 additions and 75 deletions
--- a/README.en.md
+++ b/README.en.md
@ -1,36 +0,0 @@
 # libcgroup
 #### Description
 {**When you're done, you can delete the content in this README and update the file with details for others getting started with your repository**}
 #### Software Architecture
 Software architecture description
 #### Installation
 1.  xxxx
 2.  xxxx
 3.  xxxx
 #### Instructions
 1.  xxxx
 2.  xxxx
 3.  xxxx
 #### Contribution
 1.  Fork the repository
 2.  Create Feat_xxx branch
 3.  Commit your code
 4.  Create Pull Request
 #### Gitee Feature
 1.  You can use Readme\_XXX.md to support different languages, such as Readme\_en.md, Readme\_zh.md
 2.  Gitee blog [blog.gitee.com](https://blog.gitee.com)
 3.  Explore open source project [https://gitee.com/explore](https://gitee.com/explore)
 4.  The most valuable open source project [GVP](https://gitee.com/gvp)
 5.  The manual of Gitee [https://gitee.com/help](https://gitee.com/help)
 6.  The most popular members  [https://gitee.com/gitee-stars/](https://gitee.com/gitee-stars/)
--- a/README.md
+++ b/README.md
@ -1,39 +0,0 @@
 # libcgroup
 #### 介绍
 {**以下是码云平台说明，您可以替换此简介**
 码云是 OSCHINA 推出的基于 Git 的代码托管平台（同时支持 SVN）。专为开发者提供稳定、高效、安全的云端软件开发协作平台
 无论是个人、团队、或是企业，都能够用码云实现代码托管、项目管理、协作开发。企业项目请看 [https://gitee.com/enterprises](https://gitee.com/enterprises)}
 #### 软件架构
 软件架构说明
 #### 安装教程
 1.  xxxx
 2.  xxxx
 3.  xxxx
 #### 使用说明
 1.  xxxx
 2.  xxxx
 3.  xxxx
 #### 参与贡献
 1.  Fork 本仓库
 2.  新建 Feat_xxx 分支
 3.  提交代码
 4.  新建 Pull Request
 #### 码云特技
 1.  使用 Readme\_XXX.md 来支持不同的语言，例如 Readme\_en.md, Readme\_zh.md
 2.  码云官方博客 [blog.gitee.com](https://blog.gitee.com)
 3.  你可以 [https://gitee.com/explore](https://gitee.com/explore) 这个地址来了解码云上的优秀开源项目
 4.  [GVP](https://gitee.com/gvp) 全称是码云最有价值开源项目，是码云综合评定出的优秀开源项目
 5.  码云官方提供的使用手册 [https://gitee.com/help](https://gitee.com/help)
 6.  码云封面人物是一档用来展示码云会员风采的栏目 [https://gitee.com/gitee-stars/](https://gitee.com/gitee-stars/)
--- a/bugfix-change-parser-match-order-fix-cgconfig-error.patch
+++ b/bugfix-change-parser-match-order-fix-cgconfig-error.patch
@ -0,0 +1,12 @@
 diff -Nur libcgroup-0.41.org/configure libcgroup-0.41/configure
 --- libcgroup-0.41.org/configure	2018-08-23 04:23:34.965000000 -0400
 +++ libcgroup-0.41/configure	2018-08-23 04:24:16.706000000 -0400
@@ -4689,7 +4689,7 @@
 fi
 -for ac_prog in 'bison -y' byacc
 +for ac_prog in byacc 'bison -y' 
 do
   # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
--- a/cgconfig.service
+++ b/cgconfig.service
@ -0,0 +1,18 @@
 [Unit]
 Description=Control Group configuration service
 # The service should be able to start as soon as possible,
 # before any 'normal' services:
 DefaultDependencies=no
 Conflicts=shutdown.target
 Before=basic.target shutdown.target
 [Service]
 Type=oneshot
 RemainAfterExit=yes
 Delegate=yes
 ExecStart=/usr/sbin/cgconfigparser -l /etc/cgconfig.conf -s 1664
 ExecStop=/usr/sbin/cgclear -l /etc/cgconfig.conf -e
 [Install]
 WantedBy=sysinit.target
--- a/config.patch
+++ b/config.patch
@ -0,0 +1,13 @@
 --- libcgroup-0.41/samples/cgconfig.sysconfig.orig	2019-12-19 11:25:25.547000000 +0800
 +++ libcgroup-0.41/samples/cgconfig.sysconfig	2019-12-19 11:26:01.142000000 +0800
@@ -5,8 +5,5 @@
 # controller to limit cpu.shares of this default group and allowing some more
 # important group take most of the CPU.
 #
 -# By default, create these groups:
 -CREATE_DEFAULT=yes
 -
 -# Uncomment following line to disable creation of the default group on startup:
 -# CREATE_DEFAULT=no
 +# By default, do not create these groups:
 +CREATE_DEFAULT=no
--- a/libcgroup-0.37-chmod.patch
+++ b/libcgroup-0.37-chmod.patch
@ -0,0 +1,31 @@
 diff -up libcgroup-0.41/src/api.c.chmod libcgroup-0.41/src/api.c
 --- libcgroup-0.41/src/api.c.chmod	2014-01-13 15:05:56.000000000 +0100
 +++ libcgroup-0.41/src/api.c	2014-01-13 20:41:55.255577622 +0100
@@ -153,6 +153,10 @@ static int cg_chown_file(FTS *fts, FTSEN
 	return ret;
 }
 +int cg_chmod_file(FTS *fts, FTSENT *ent, mode_t dir_mode,
 +	int dirm_change, mode_t file_mode, int filem_change,
 +	int owner_is_umask);
 +
 /*
  * TODO: Need to decide a better place to put this function.
  */
@@ -160,6 +164,8 @@ static int cg_chown_recursive(char **pat
 {
 	int ret = 0;
 	FTS *fts;
 +	/* mode 664 */
 +	mode_t mode = S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH;
 	cgroup_dbg("chown: path is %s\n", *path);
 	fts = fts_open(path, FTS_PHYSICAL | FTS_NOCHDIR |
@@ -177,6 +183,7 @@ static int cg_chown_recursive(char **pat
 			cgroup_warn("Warning: fts_read failed\n");
 			break;
 		}
 +		cg_chmod_file(fts, ent, mode, 0, mode, 1, 1);
 		ret = cg_chown_file(fts, ent, owner, group);
 	}
 	fts_close(fts);
--- a/libcgroup-0.40.rc1-coverity.patch
+++ b/libcgroup-0.40.rc1-coverity.patch
@ -0,0 +1,99 @@
 diff -up libcgroup-0.41/src/api.c.coverity libcgroup-0.41/src/api.c
 --- libcgroup-0.41/src/api.c.coverity	2014-01-13 20:52:49.853838149 +0100
 +++ libcgroup-0.41/src/api.c	2014-01-13 20:52:49.854838142 +0100
@@ -2791,7 +2791,6 @@ static int cgroup_create_template_group(
 	if (group_name == NULL) {
 		ret = ECGOTHER;
 		last_errno = errno;
 -		free(template_name);
 		goto end;
 	}
 diff -up libcgroup-0.41/src/config.c.coverity libcgroup-0.41/src/config.c
 --- libcgroup-0.41/src/config.c.coverity	2014-01-13 15:05:56.000000000 +0100
 +++ libcgroup-0.41/src/config.c	2014-01-13 20:52:49.854838142 +0100
@@ -323,7 +323,7 @@ int config_group_task_perm(char *perm_ty
 	long val = atoi(value);
 	char buffer[CGROUP_BUFFER_LEN];
 	struct cgroup *config_cgroup;
 -	int table_index;
 +	int table_index, ret;
 	switch (flag) {
 	case CGROUP:
@@ -367,10 +367,10 @@ int config_group_task_perm(char *perm_ty
 			if (!group)
 				goto group_task_error;
 -			getgrnam_r(value, group, buffer,
 +			ret = getgrnam_r(value, group, buffer,
 					CGROUP_BUFFER_LEN, &group_buffer);
 -			if (group_buffer == NULL) {
 +			if (ret != 0 || group_buffer == NULL) {
 				free(group);
 				goto group_task_error;
 			}
@@ -436,7 +436,7 @@ int config_group_admin_perm(char *perm_t
 	struct cgroup *config_cgroup;
 	long val = atoi(value);
 	char buffer[CGROUP_BUFFER_LEN];
 -	int table_index;
 +	int table_index, ret;
 	switch (flag) {
 	case CGROUP:
@@ -479,10 +479,10 @@ int config_group_admin_perm(char *perm_t
 			if (!group)
 				goto admin_error;
 -			getgrnam_r(value, group, buffer,
 +			ret = getgrnam_r(value, group, buffer,
 					CGROUP_BUFFER_LEN, &group_buffer);
 -			if (group_buffer == NULL) {
 +			if (ret != 0 || group_buffer == NULL) {
 				free(group);
 				goto admin_error;
 			}
 diff -up libcgroup-0.41/src/daemon/cgrulesengd.c.coverity libcgroup-0.41/src/daemon/cgrulesengd.c
 --- libcgroup-0.41/src/daemon/cgrulesengd.c.coverity	2014-01-13 15:05:56.000000000 +0100
 +++ libcgroup-0.41/src/daemon/cgrulesengd.c	2014-01-13 20:52:49.854838142 +0100
@@ -646,7 +646,7 @@ close:
 static int cgre_create_netlink_socket_process_msg(void)
 {
 -	int sk_nl = 0, sk_unix = 0, sk_max;
 +	int sk_nl = -1, sk_unix = -1, sk_max;
 	struct sockaddr_nl my_nla;
 	char buff[BUFF_SIZE];
 	int rc = -1;
@@ -784,9 +784,9 @@ static int cgre_create_netlink_socket_pr
 	}
 close_and_exit:
 -	if (sk_nl > 0)
 +	if (sk_nl > -1)
 		close(sk_nl);
 -	if (sk_unix > 0)
 +	if (sk_unix > -1)
 		close(sk_unix);
 	return rc;
 }
 diff -upr libcgroup-0.40.rc1.orig/src/tools/lscgroup.c libcgroup-0.40.rc1/src/tools/lscgroup.c
 --- libcgroup-0.40.rc1.orig/src/tools/lscgroup.c	2013-05-21 15:36:04.000000000 +0200
 +++ libcgroup-0.40.rc1/src/tools/lscgroup.c	2013-11-04 14:26:53.400473523 +0100
@@ -97,11 +97,11 @@ static int display_controller_data(char
 	if (ret != 0)
 		return ret;
 -	strncpy(cgroup_dir_path, info.full_path, FILENAME_MAX);
 +	strncpy(cgroup_dir_path, info.full_path, FILENAME_MAX - 1);
 	/* remove problematic  '/' characters from cgroup directory path*/
 	trim_filepath(cgroup_dir_path);
 -	strncpy(input_dir_path, input_path, FILENAME_MAX);
 +	strncpy(input_dir_path, input_path, FILENAME_MAX - 1);
 	/* remove problematic  '/' characters from input directory path*/
 	trim_filepath(input_dir_path);
--- a/libcgroup-0.40.rc1-fread.patch
+++ b/libcgroup-0.40.rc1-fread.patch
@ -0,0 +1,49 @@
 diff -up libcgroup-0.41/src/api.c.fread libcgroup-0.41/src/api.c
 --- libcgroup-0.41/src/api.c.fread	2014-01-13 21:01:32.067067615 +0100
 +++ libcgroup-0.41/src/api.c	2014-01-13 21:01:32.070067594 +0100
@@ -2232,29 +2232,29 @@ static int cg_rd_ctrl_file(const char *s
 					const char *file, char **value)
 {
 	char path[FILENAME_MAX];
 -	FILE *ctrl_file = NULL;
 -	int ret;
 +	int ctrl_file = -1;
 +	ssize_t ret;
 	if (!cg_build_path_locked(cgroup, path, subsys))
 		return ECGFAIL;
 	strncat(path, file, sizeof(path) - strlen(path));
 -	ctrl_file = fopen(path, "re");
 -	if (!ctrl_file)
 +	ctrl_file = open(path, O_RDONLY | O_CLOEXEC);
 +	if (ctrl_file < 0)
 		return ECGROUPVALUENOTEXIST;
 	*value = calloc(CG_VALUE_MAX, 1);
 	if (!*value) {
 -		fclose(ctrl_file);
 +		close(ctrl_file);
 		last_errno = errno;
 		return ECGOTHER;
 	}
 	/*
 -	 * using %as crashes when we try to read from files like
 +	 * using %as or fread crashes when we try to read from files like
 	 * memory.stat
 	 */
 -	ret = fread(*value, 1, CG_VALUE_MAX-1, ctrl_file);
 +	ret = read(ctrl_file, *value, CG_VALUE_MAX-1);
 	if (ret < 0) {
 		free(*value);
 		*value = NULL;
@@ -2264,7 +2264,7 @@ static int cg_rd_ctrl_file(const char *s
 			(*value)[ret-1] = '\0';
 	}
 -	fclose(ctrl_file);
 +	close(ctrl_file);
 	return 0;
 }
--- a/libcgroup-0.40.rc1-templates-fix.patch
+++ b/libcgroup-0.40.rc1-templates-fix.patch
@ -0,0 +1,16 @@
 diff -up libcgroup-0.41/src/api.c.templates-fix libcgroup-0.41/src/api.c
 --- libcgroup-0.41/src/api.c.templates-fix	2014-01-13 21:04:36.933747000 +0100
 +++ libcgroup-0.41/src/api.c	2014-01-13 21:16:44.478580105 +0100
@@ -2974,10 +2974,10 @@ int cgroup_change_cgroup_flags(uid_t uid
 						available, "%d", pid);
 					break;
 				case 'p':
 -					if(procname) {
 +					if(procname && strlen(basename(procname))) {
 						written = snprintf(newdest + j,
 							available, "%s",
 -							procname);
 +							basename(procname));
 					} else {
 						written = snprintf(newdest + j,
 							available, "%d", pid);
--- a/libcgroup-0.41-CVE-2018-14348.patch
+++ b/libcgroup-0.41-CVE-2018-14348.patch
@ -0,0 +1,33 @@
 From 94e9dcead2e8bce00deeef08ea364ec6dc7e1f45 Mon Sep 17 00:00:00 2001
 From: Michal Hocko <mhocko@suse.com>
 Date: Wed, 18 Jul 2018 11:24:29 +0200
 Subject: [PATCH] cgrulesengd: remove umask(0)
 One of our partners has noticed that cgred daemon is creating a log file
 (/var/log/cgred) with too wide permissions (0666) and that is seen as
 a security bug because an untrusted user can write to otherwise
 restricted area. CVE-2018-14348 has been assigned to this issue.
 Signed-off-by: Michal Hocko <mhocko@suse.com>
 Acked-by: Balbir Singh <bsingharora@gmail.com>
 ---
 src/daemon/cgrulesengd.c | 3 ---
 1 file changed, 3 deletions(-)
 diff --git a/src/daemon/cgrulesengd.c b/src/daemon/cgrulesengd.c
 index 170837a..41aadd4 100644
 --- a/src/daemon/cgrulesengd.c
 +++ b/src/daemon/cgrulesengd.c
@@ -885,9 +885,6 @@ int cgre_start_daemon(const char *logp, const int logf,
 		} else if (pid > 0) {
 			exit(EXIT_SUCCESS);
 		}
 -
 -		/* Change the file mode mask. */
 -		umask(0);
 	} else {
 		flog(LOG_DEBUG, "Not using daemon mode\n");
 		pid = getpid();
 -- 
 2.17.1
--- a/libcgroup-0.41-api.c-fix-order-of-memory-subsystem-parameters.patch
+++ b/libcgroup-0.41-api.c-fix-order-of-memory-subsystem-parameters.patch
@ -0,0 +1,66 @@
 From 72a9e0c3d4f8daca9f7dc389edbc1013d7c0d808 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
 Date: Fri, 8 Apr 2016 17:00:19 +0200
 Subject: [PATCH] api.c: fix order of memory subsystem parameters generated by
 cgsnapshot
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Order of parameters usually doesn't matter, but that's not the case with
 memory.limit_in_bytes and memory.memsw.limit_in_bytes. When the latter
 is first in the list of parameters, the resulting configuration is not
 loadable with cgconfigparser.
 This happens because when a cgroup is created, both memory.limit_in_bytes
 and memory.memsw.limit_in_bytes parameters are initialized to highest
 value possible (RESOURCE_MAX). And because memory.memsw.limit_in_bytes
 must be always higher or equal to memory.limit_in_bytes, it's impossible
 to change its value first.
 Make sure that after constructing parameter list of memory subsystem,
 the mentioned parameters are in correct order.
 Signed-off-by: Nikola Forró <nforro@redhat.com>
 ---
 src/api.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 diff --git a/src/api.c b/src/api.c
 index 0bf0615..f5da553 100644
 --- a/src/api.c
 +++ b/src/api.c
@@ -2651,6 +2651,30 @@ int cgroup_get_cgroup(struct cgroup *cgroup)
 			}
 		}
 		closedir(dir);
 +
 +		if (! strcmp(cgc->name, "memory")) {
 +			/*
 +			 * Make sure that memory.limit_in_bytes is placed before
 +			 * memory.memsw.limit_in_bytes in the list of values
 +			 */
 +			int memsw_limit = -1;
 +			int mem_limit = -1;
 +
 +			for (j = 0; j < cgc->index; j++) {
 +				if (! strcmp(cgc->values[j]->name,
 +								"memory.memsw.limit_in_bytes"))
 +					memsw_limit = j;
 +				else if (! strcmp(cgc->values[j]->name,
 +									"memory.limit_in_bytes"))
 +					mem_limit = j;
 +			}
 +
 +			if (memsw_limit >= 0 && memsw_limit < mem_limit) {
 +				struct control_value *val = cgc->values[memsw_limit];
 +				cgc->values[memsw_limit] = cgc->values[mem_limit];
 +				cgc->values[mem_limit] = val;
 +			}
 +		}
 	}
 	/* Check if the group really exists or not */
 -- 
 2.4.11
--- a/libcgroup-0.41-api.c-preserve-dirty-flag.patch
+++ b/libcgroup-0.41-api.c-preserve-dirty-flag.patch
@ -0,0 +1,33 @@
 From ad27a46d8c0e180f71b4606d7b2a3bd3bebd7bbf Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
 Date: Thu, 13 Oct 2016 13:42:30 +0200
 Subject: [PATCH] api.c: preserve dirty flag when copying controller values
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 When setting cgroup parameters with cgset fails, no error is reported.
 This is caused by the fact that cgroup_copy_controller_values is not
 preserving dirty flags of the values, so it's making all errors
 considered non-fatal.
 Signed-off-by: Nikola Forró <nforro@redhat.com>
 ---
 src/api.c | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/src/api.c b/src/api.c
 index 0bf0615..daf4ef0 100644
 --- a/src/api.c
 +++ b/src/api.c
@@ -1687,6 +1687,7 @@ static int cgroup_copy_controller_values(struct cgroup_controller *dst,
 		dst_val = dst->values[i];
 		strncpy(dst_val->value, src_val->value, CG_VALUE_MAX);
 		strncpy(dst_val->name, src_val->name, FILENAME_MAX);
 +		dst_val->dirty = src_val->dirty;
 	}
 err:
 	return ret;
 -- 
 2.7.4
--- a/libcgroup-0.41-api.c-support-for-setting-multiline-values-in-contro.patch
+++ b/libcgroup-0.41-api.c-support-for-setting-multiline-values-in-contro.patch
@ -0,0 +1,150 @@
 From 691430206f1104b752b0e52386f317e639137788 Mon Sep 17 00:00:00 2001
 From: Jan Chaloupka <jchaloup@redhat.com>
 Date: Mon, 15 Sep 2014 13:29:39 +0200
 Subject: [PATCH] api.c: support for setting multiline values in control files
 As of now, libcgroup does not support multiline values setting from configuration files. i.e. values in a form:
 net_prio.ifpriomap="lo 7
 eth0 66
 eth1 5
 eth2 4
 eth3 3";
 Thus, setting of more network interfaces can not be done from configuration file. Or
 devices.allow="a *:* w
 c 8:* r";
 thus setting list of allow devices can not be set as well. The only way is to set it from userspace, e.g.:
 # echo "lo 7" > /sys/fs/cgroup/net_prio/testGroup/net_prio.ifpriomap
 # echo "eth 0" > /sys/fs/cgroup/net_prio/testGroup/net_prio.ifpriomap
 # echo "eth 1" > /sys/fs/cgroup/net_prio/testGroup/net_prio.ifpriomap
 # echo "eth 2" > /sys/fs/cgroup/net_prio/testGroup/net_prio.ifpriomap
 # echo "eth 3" > /sys/fs/cgroup/net_prio/testGroup/net_prio.ifpriomap
 This patch allows setting of multiline variables.
 How this support works:
 Multiline value is broken in lines and each line is set by write (man 2 write) syscall (without bufferring).
 This implies change of fopen with open, fclose with close.
 There is no control on multiline value, thus "eth0\n  \t\n" can be set. However, setting
 of "  \t" will fail as write command returns -1. Thus administrator has to set correct
 multiline values.
 Tested on virtual machine with fedora and rhel with network interface lo, eth0-eth3. Configuration file:
 # cat /etc/cgconfig.conf
 group testGroup {
        net_prio {
                net_prio.ifpriomap="lo 7
 eth0    66
 eth1 5
 eth2 4
 eth3 3";
        }
 }
 net_prio has to be created before:
 # modprobe netprio_cgroup
 # mkdir /sys/fs/cgroup/net_prio
 # mount -t cgroup -onet_prio none /sys/fs/cgroup/net_prio
 Changelog:
 	test of success of strdup call
 	free str_val before return (str_val is changing in while cycle,
 		thus str_start_val points to the start of str_val before while)
 Signed-off-by: Jan Chaloupka <jchaloup@redhat.com>
 ---
 src/api.c | 50 ++++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 44 insertions(+), 6 deletions(-)
 diff --git a/src/api.c b/src/api.c
 index 5751b8f..d6c9d3a 100644
 --- a/src/api.c
 +++ b/src/api.c
@@ -1495,13 +1495,18 @@ static int cg_create_control_group(const char *path)
  */
 static int cg_set_control_value(char *path, const char *val)
 {
 -	FILE *control_file = NULL;
 +	int ctl_file;
 +	char *str_val;
 +	char *str_val_start;
 +	char *pos;
 +	size_t len;
 +
 	if (!cg_test_mounted_fs())
 		return ECGROUPNOTMOUNTED;
 -	control_file = fopen(path, "r+e");
 +	ctl_file = open(path, O_RDWR | O_CLOEXEC);
 -	if (!control_file) {
 +	if (ctl_file == -1) {
 		if (errno == EPERM) {
 			/*
 			 * We need to set the correct error value, does the
@@ -1512,6 +1517,7 @@ static int cg_set_control_value(char *path, const char *val)
 			 */
 			char *path_dir_end;
 			char *tasks_path;
 +			FILE *control_file;
 			path_dir_end = strrchr(path, '/');
 			if (path_dir_end == NULL)
@@ -1543,15 +1549,47 @@ static int cg_set_control_value(char *path, const char *val)
 		return ECGROUPVALUENOTEXIST;
 	}
 -	if (fprintf(control_file, "%s", val) < 0) {
 +	/* Split the multiline value into lines. */
 +	/* One line is a special case of multiline value. */
 +	str_val = strdup(val);
 +	if (str_val == NULL) {
 		last_errno = errno;
 -		fclose(control_file);
 +		close(ctl_file);
 		return ECGOTHER;
 	}
 -	if (fclose(control_file) < 0) {
 +
 +	str_val_start = str_val;
 +	pos = str_val;
 +
 +	do {
 +		str_val = pos;
 +		pos = strchr(str_val, '\n');
 +
 +		if (pos) {
 +			*pos = '\0';
 +			++pos;
 +		}
 +
 +		len = strlen(str_val);
 +		if (len > 0) {
 +			if (write(ctl_file, str_val, len) == -1) {
 +				last_errno = errno;
 +				free(str_val_start);
 +				close(ctl_file);
 +				return ECGOTHER;
 +			}
 +		} else
 +			cgroup_warn("Warning: skipping empty line for %s\n",
 +				path);
 +	} while(pos);
 +
 +	if (close(ctl_file)) {
 		last_errno = errno;
 +		free(str_val_start);
 		return ECGOTHER;
 	}
 +
 +	free(str_val_start);
 	return 0;
 }
 -- 
 1.9.3
--- a/libcgroup-0.41-change-cgroup-of-threads.patch
+++ b/libcgroup-0.41-change-cgroup-of-threads.patch
@ -0,0 +1,63 @@
 From 647274d80d18686a3129a2b50605869ac5178ccf Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
 Date: Tue, 8 Dec 2015 17:09:08 +0100
 Subject: [PATCH 1/6] api.c: change cgroup of every thread of a process
 When changing cgroup of multi-threaded process, only the main threads
 cgroup actually changed. Now all threads of a process are enumerated
 and cgroup is changed for each of them.
 ---
 src/api.c | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)
 diff --git a/src/api.c b/src/api.c
 index 0cc15c6..df90a6f 100644
 --- a/src/api.c
 +++ b/src/api.c
@@ -3177,10 +3177,13 @@ int cgroup_change_all_cgroups(void)
 		return -ECGOTHER;
 	while ((pid_dir = readdir(dir)) != NULL) {
 -		int err, pid;
 +		int err, pid, tid;
 		uid_t euid;
 		gid_t egid;
 		char *procname = NULL;
 +		DIR *tdir;
 +		struct dirent *tid_dir = NULL;
 +		char tpath[FILENAME_MAX] = { '\0' };
 		err = sscanf(pid_dir->d_name, "%i", &pid);
 		if (err < 1)
@@ -3194,11 +3197,24 @@ int cgroup_change_all_cgroups(void)
 		if (err)
 			continue;
 -		err = cgroup_change_cgroup_flags(euid,
 -				egid, procname, pid, CGFLAG_USECACHE);
 -		if (err)
 -			cgroup_dbg("cgroup change pid %i failed\n", pid);
 +		snprintf(tpath, FILENAME_MAX, "%s%d/task/", path, pid);
 +
 +		tdir = opendir(tpath);
 +		if (!tdir)
 +			continue;
 +
 +		while ((tid_dir = readdir(tdir)) != NULL) {
 +			err = sscanf(tid_dir->d_name, "%i", &tid);
 +			if (err < 1)
 +				continue;
 +
 +			err = cgroup_change_cgroup_flags(euid,
 +					egid, procname, tid, CGFLAG_USECACHE);
 +			if (err)
 +				cgroup_dbg("cgroup change tid %i failed\n", tid);
 +		}
 +		closedir(tdir);
 		free(procname);
 	}
 -- 
 2.17.0
--- a/libcgroup-0.41-fix-infinite-loop.patch
+++ b/libcgroup-0.41-fix-infinite-loop.patch
@ -0,0 +1,40 @@
 From 62bab9d121d4fb416205f5ac53ad342184ae42b6 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
 Date: Tue, 8 Dec 2015 16:53:41 +0100
 Subject: [PATCH 2/6] api.c: fix infinite loop
 If getgrnam or getpwuid functions failed, the program entered
 an infinite loop, because the rule pointer was never advanced.
 This is now fixed by updating the pointer before continuing
 to the next iteration.
 ---
 src/api.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)
 diff --git a/src/api.c b/src/api.c
 index df90a6f..217d6c9 100644
 --- a/src/api.c
 +++ b/src/api.c
@@ -2664,13 +2664,17 @@ static struct cgroup_rule *cgroup_find_matching_rule_uid_gid(uid_t uid,
 			/* Get the group data. */
 			sp = &(rule->username[1]);
 			grp = getgrnam(sp);
 -			if (!grp)
 +			if (!grp) {
 +				rule = rule->next;
 				continue;
 +			}
 			/* Get the data for UID. */
 			usr = getpwuid(uid);
 -			if (!usr)
 +			if (!usr) {
 +				rule = rule->next;
 				continue;
 +			}
 			/* If UID is a member of group, we matched. */
 			for (i = 0; grp->gr_mem[i]; i++) {
 -- 
 2.17.0
--- a/libcgroup-0.41-fix-log-level.patch
+++ b/libcgroup-0.41-fix-log-level.patch
@ -0,0 +1,38 @@
 From 7c99c167f41d3f8810808436d2ac58afc3a7d6c7 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
 Date: Tue, 17 Apr 2018 13:33:03 +0200
 Subject: [PATCH 5/6] api.c: Fix level of failed user/group lookup warnings
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Signed-off-by: Nikola Forró <nforro@redhat.com>
 ---
 src/api.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/src/api.c b/src/api.c
 index 51081b4..efde2d1 100644
 --- a/src/api.c
 +++ b/src/api.c
@@ -639,7 +639,7 @@ static int cgroup_parse_rules(bool cache, uid_t muid,
 				uid = CGRULE_INVALID;
 				gid = grp->gr_gid;
 			} else {
 -				cgroup_dbg("Warning: Entry for %s not"
 +				cgroup_warn("Warning: Entry for %s not"
 						"found.  Skipping rule on line"
 						" %d.\n", itr, linenum);
 				skipped = true;
@@ -656,7 +656,7 @@ static int cgroup_parse_rules(bool cache, uid_t muid,
 				uid = pwd->pw_uid;
 				gid = CGRULE_INVALID;
 			} else {
 -				cgroup_dbg("Warning: Entry for %s not"
 +				cgroup_warn("Warning: Entry for %s not"
 						"found.  Skipping rule on line"
 						" %d.\n", user, linenum);
 				skipped = true;
 -- 
 2.17.0
--- a/libcgroup-0.41-lex.patch
+++ b/libcgroup-0.41-lex.patch
@ -0,0 +1,25 @@
 From a8c2e967e74d280cd3b8554af0c95d823647d1c0 Mon Sep 17 00:00:00 2001
 From: Jan Chaloupka <jchaloup@redhat.com>
 Date: Thu, 6 Feb 2014 11:43:18 +0100
 Subject: [PATCH] lex updated, additional '\' char for ID token
 ---
 libcgroup-0.41/src/lex.l | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/libcgroup-0.41/src/lex.l b/libcgroup-0.41/src/lex.l
 index 1b357db..d7bf575 100644
 --- a/libcgroup-0.41/src/lex.l
 +++ b/libcgroup-0.41/src/lex.l
@@ -43,7 +43,7 @@ jmp_buf parser_error_env;
 "namespace"	{return NAMESPACE;}
 "template"	{return TEMPLATE;}
 "default"	{return DEFAULT;}
 -[a-zA-Z0-9_\-\/\.\,\%\@]+ {yylval.name = strdup(yytext); return ID;}
 +[a-zA-Z0-9_\-\/\.\,\%\@\\]+ {yylval.name = strdup(yytext); return ID;}
 \"[^"]*\" {yylval.name = strdup(yytext+1); yylval.name[strlen(yylval.name)-1] = '\0'; return ID; }
 .	{return yytext[0];}
 %%
 -- 
 1.8.5.3
--- a/libcgroup-0.41-prevent-buffer-overflow.patch
+++ b/libcgroup-0.41-prevent-buffer-overflow.patch
@ -0,0 +1,46 @@
 From 9c80e2cb4bca26993a12027c46a274bb43645630 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
 Date: Wed, 22 Jun 2016 14:12:46 +0200
 Subject: [PATCH 3/6] api.c: fix potential buffer overflow
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 It is assumed that arguments read from /proc/<pid>/cmdline don't exceed
 buf_pname buffer size, which is FILENAME_MAX - 1 characters, but that's
 not always the case.
 Add check to prevent buffer overflow and discard the excessive part of
 an argument.
 Signed-off-by: Nikola Forró <nforro@redhat.com>
 ---
 src/api.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
 diff --git a/src/api.c b/src/api.c
 index 217d6c9..4d98081 100644
 --- a/src/api.c
 +++ b/src/api.c
@@ -4065,13 +4065,17 @@ static int cg_get_procname_from_proc_cmdline(pid_t pid,
 	while (c != EOF) {
 		c = fgetc(f);
 -		if ((c != EOF) && (c != '\0')) {
 +		if ((c != EOF) && (c != '\0') && (len < FILENAME_MAX - 1)) {
 			buf_pname[len] = c;
 			len++;
 			continue;
 		}
 		buf_pname[len] = '\0';
 +		if (len == FILENAME_MAX - 1)
 +			while ((c != EOF) && (c != '\0'))
 +				c = fgetc(f);
 +
 		/*
 		 * The taken process name from /proc/<pid>/status is
 		 * shortened to 15 characters if it is over. So the
 -- 
 2.17.0
--- a/libcgroup-0.41-size-of-controller-values.patch
+++ b/libcgroup-0.41-size-of-controller-values.patch
@ -0,0 +1,142 @@
 From 5a64a79144e58a62426a34ef51b14e891f042fa2 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
 Date: Tue, 17 Apr 2018 13:54:38 +0200
 Subject: [PATCH 6/6] Increase maximal size of controller values
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Maximal length of a controller value is determined by CG_VALUE_MAX,
 which is equal to 100. That is not sufficient in some cases.
 Add new constant CG_CONTROL_VALUE_MAX (to prevent breaking current API)
 and set it to 4096, which is usually equal to the amount of bytes that
 can be written to a sysctl file directly.
 Add warning message about exceeding the limit while parsing
 configuration file.
 Signed-off-by: Nikola Forró <nforro@redhat.com>
 ---
 src/api.c                |  6 +++---
 src/libcgroup-internal.h |  5 ++++-
 src/tools/cgset.c        |  4 ++--
 src/wrapper.c            | 17 ++++++++++++-----
 4 files changed, 21 insertions(+), 11 deletions(-)
 diff --git a/src/api.c b/src/api.c
 index efde2d1..1cd30df 100644
 --- a/src/api.c
 +++ b/src/api.c
@@ -1561,7 +1561,7 @@ static int cgroup_copy_controller_values(struct cgroup_controller *dst,
 		}
 		dst_val = dst->values[i];
 -		strncpy(dst_val->value, src_val->value, CG_VALUE_MAX);
 +		strncpy(dst_val->value, src_val->value, CG_CONTROL_VALUE_MAX);
 		strncpy(dst_val->name, src_val->name, FILENAME_MAX);
 		dst_val->dirty = src_val->dirty;
 	}
@@ -2286,7 +2286,7 @@ static int cg_rd_ctrl_file(const char *subsys, const char *cgroup,
 	if (ctrl_file < 0)
 		return ECGROUPVALUENOTEXIST;
 -	*value = calloc(CG_VALUE_MAX, 1);
 +	*value = calloc(CG_CONTROL_VALUE_MAX, 1);
 	if (!*value) {
 		close(ctrl_file);
 		last_errno = errno;
@@ -2297,7 +2297,7 @@ static int cg_rd_ctrl_file(const char *subsys, const char *cgroup,
 	 * using %as or fread crashes when we try to read from files like
 	 * memory.stat
 	 */
 -	ret = read(ctrl_file, *value, CG_VALUE_MAX-1);
 +	ret = read(ctrl_file, *value, CG_CONTROL_VALUE_MAX-1);
 	if (ret < 0) {
 		free(*value);
 		*value = NULL;
 diff --git a/src/libcgroup-internal.h b/src/libcgroup-internal.h
 index 4c0f46c..3a8e336 100644
 --- a/src/libcgroup-internal.h
 +++ b/src/libcgroup-internal.h
@@ -32,6 +32,9 @@ __BEGIN_DECLS
 /* Estimated number of groups created */
 #define MAX_GROUP_ELEMENTS	128
 +/* Maximum length of a value */
 +#define CG_CONTROL_VALUE_MAX 4096
 +
 #define CG_NV_MAX 100
 #define CG_CONTROLLER_MAX 100
 /* Max number of mounted hierarchies. Event if one controller is mounted per
@@ -73,7 +76,7 @@ __BEGIN_DECLS
 struct control_value {
 	char name[FILENAME_MAX];
 -	char value[CG_VALUE_MAX];
 +	char value[CG_CONTROL_VALUE_MAX];
 	bool dirty;
 };
 diff --git a/src/tools/cgset.c b/src/tools/cgset.c
 index ea9f90d..3d3c8cc 100644
 --- a/src/tools/cgset.c
 +++ b/src/tools/cgset.c
@@ -151,8 +151,8 @@ int main(int argc, char *argv[])
 				goto err;
 			}
 -			strncpy(name_value[nv_number].value, buf, CG_VALUE_MAX);
 -			name_value[nv_number].value[CG_VALUE_MAX-1] = '\0';
 +			strncpy(name_value[nv_number].value, buf, CG_CONTROL_VALUE_MAX);
 +			name_value[nv_number].value[CG_CONTROL_VALUE_MAX-1] = '\0';
 			nv_number++;
 			break;
 diff --git a/src/wrapper.c b/src/wrapper.c
 index c03472a..0952823 100644
 --- a/src/wrapper.c
 +++ b/src/wrapper.c
@@ -132,10 +132,10 @@ int cgroup_add_value_string(struct cgroup_controller *controller,
 	if (!controller)
 		return ECGINVAL;
 -	if (controller->index >= CG_VALUE_MAX)
 +	if (controller->index >= CG_NV_MAX)
 		return ECGMAXVALUESEXCEEDED;
 -	for (i = 0; i < controller->index && i < CG_VALUE_MAX; i++) {
 +	for (i = 0; i < controller->index && i < CG_NV_MAX; i++) {
 		if (!strcmp(controller->values[i]->name, name))
 			return ECGVALUEEXISTS;
 	}
@@ -145,8 +145,15 @@ int cgroup_add_value_string(struct cgroup_controller *controller,
 	if (!cntl_value)
 		return ECGCONTROLLERCREATEFAILED;
 -	strncpy(cntl_value->name, name, sizeof(cntl_value->name));
 -	strncpy(cntl_value->value, value, sizeof(cntl_value->value));
 +	if (strlen(value) >= sizeof(cntl_value->value)) {
 +		fprintf(stderr, "value exceeds the maximum of %d characters\n",
 +			sizeof(cntl_value->value));
 +		free(cntl_value);
 +		return ECGCONFIGPARSEFAIL;
 +	}
 +
 +	strncpy(cntl_value->name, name, sizeof(cntl_value->name) - 1);
 +	strncpy(cntl_value->value, value, sizeof(cntl_value->value) - 1);
 	cntl_value->dirty = true;
 	controller->values[controller->index] = cntl_value;
 	controller->index++;
@@ -356,7 +363,7 @@ int cgroup_set_value_string(struct cgroup_controller *controller,
 	for (i = 0; i < controller->index; i++) {
 		struct control_value *val = controller->values[i];
 		if (!strcmp(val->name, name)) {
 -			strncpy(val->value, value, CG_VALUE_MAX);
 +			strncpy(val->value, value, CG_CONTROL_VALUE_MAX - 1);
 			val->dirty = true;
 			return 0;
 		}
 -- 
 2.17.0
--- a/libcgroup-0.41-tasks-file-warning.patch
+++ b/libcgroup-0.41-tasks-file-warning.patch
@ -0,0 +1,49 @@
 From 437b68f34c459d136c806e61dafb5825d2f97170 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
 Date: Tue, 17 Apr 2018 13:32:28 +0200
 Subject: [PATCH 4/6] api.c: Show warning when tasks file can not be opened
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Signed-off-by: Nikola Forró <nforro@redhat.com>
 ---
 src/api.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)
 diff --git a/src/api.c b/src/api.c
 index 4d98081..51081b4 100644
 --- a/src/api.c
 +++ b/src/api.c
@@ -1190,12 +1190,15 @@ static int __cgroup_attach_task_pid(char *path, pid_t tid)
 	if (!tasks) {
 		switch (errno) {
 		case EPERM:
 -			return ECGROUPNOTOWNER;
 +			ret = ECGROUPNOTOWNER;
 +			break;
 		case ENOENT:
 -			return ECGROUPNOTEXIST;
 +			ret = ECGROUPNOTEXIST;
 +			break;
 		default:
 -			return ECGROUPNOTALLOWED;
 +			ret = ECGROUPNOTALLOWED;
 		}
 +		goto err;
 	}
 	ret = fprintf(tasks, "%d", tid);
 	if (ret < 0) {
@@ -1214,7 +1217,8 @@ static int __cgroup_attach_task_pid(char *path, pid_t tid)
 err:
 	cgroup_warn("Warning: cannot write tid %d to %s:%s\n",
 			tid, path, strerror(errno));
 -	fclose(tasks);
 +	if (tasks)
 +		fclose(tasks);
 	return ret;
 }
 -- 
 2.17.0
--- a/libcgroup-0.41.tar.bz2
+++ b/libcgroup-0.41.tar.bz2
--- a/libcgroup.spec
+++ b/libcgroup.spec
@ -0,0 +1,174 @@
 %global soversion_major 1
 %global soversion 1.0.41
 %global _hardened_build 1
 Summary: Libcgroup is a library that abstracts the control group file system in Linux
 Name: libcgroup
 Version: 0.41
 Release: 22
 License: LGPLv2+
 URL: http://libcg.sourceforge.net/
 Source0: http://downloads.sourceforge.net/libcg/%{name}-%{version}.tar.bz2
 Source1: cgconfig.service
 Provides: libcgroup-pam libcgroup-tools
 Obsoletes: libcgroup-pam libcgroup-tools
 Patch0: config.patch
 Patch1: libcgroup-0.37-chmod.patch
 Patch2: libcgroup-0.40.rc1-coverity.patch
 Patch3: libcgroup-0.40.rc1-fread.patch
 Patch4: libcgroup-0.40.rc1-templates-fix.patch
 Patch5: libcgroup-0.41-lex.patch
 Patch6: libcgroup-0.41-api.c-support-for-setting-multiline-values-in-contro.patch
 Patch7: libcgroup-0.41-api.c-fix-order-of-memory-subsystem-parameters.patch
 Patch8: libcgroup-0.41-api.c-preserve-dirty-flag.patch
 Patch9: libcgroup-0.41-change-cgroup-of-threads.patch
 Patch10: libcgroup-0.41-fix-infinite-loop.patch
 Patch11: libcgroup-0.41-prevent-buffer-overflow.patch
 Patch12: libcgroup-0.41-tasks-file-warning.patch
 Patch13: libcgroup-0.41-fix-log-level.patch
 Patch14: libcgroup-0.41-size-of-controller-values.patch
 Patch15: libcgroup-0.41-CVE-2018-14348.patch
 Patch9000: bugfix-change-parser-match-order-fix-cgconfig-error.patch
 BuildRequires: gcc,gcc-c++,byacc
 BuildRequires: systemd-units,pam-devel,flex,coreutils
 Requires: systemd >= 217-0.2
 Requires(pre): shadow-utils
 %description
 Cgroups is a Linux kernel feature that limits, accounts for, and isolates
 the resource usage (CPU, memory, disk I/O, network, etc.) of a collection of processes.
 The library helps manipulte and administrate control groups.
 %package devel
 Summary: Devel helps applications to use cgroups
 Requires: %{name}%{?_isa} = %{version}-%{release}
 %description devel
 Devel provides API for creating,deleting and modifying cgroup nodes.It allows
 the creation of cgroups' configuration and provides scripts for managing it.
 %package help
 Summary: It provides helpful information for libcgroup
 %description help
 It provides helpful information for libcgroup-pam,libcgroup-devel,libcgroup-tools and libcgroup.
 %prep
 %setup  -q  -n %{name}-%{version}
 %patch0 -p1
 %patch1 -p1
 %patch2 -p1
 %patch3 -p1
 %patch4 -p1
 %patch5 -p2
 %patch6 -p1
 %patch7 -p1
 %patch8 -p1
 %patch9 -p1
 %patch10 -p1
 %patch11 -p1
 %patch12 -p1
 %patch13 -p1
 %patch14 -p1
 %patch15 -p1
 %patch9000 -p1
 %build
 %configure --enable-pam-module-dir=%{_libdir}/security --enable-opaque-hierarchy="name=systemd" --disable-daemon
 make %{?_smp_mflags}
 %install
 make DESTDIR=$RPM_BUILD_ROOT install
 # config
 install -d ${RPM_BUILD_ROOT}%{_sysconfdir}
 install -d ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig
 install -m 644 samples/cgconfig.conf $RPM_BUILD_ROOT%{_sysconfdir}/cgconfig.conf
 install -m 644 samples/cgsnapshot_blacklist.conf $RPM_BUILD_ROOT%{_sysconfdir}/cgsnapshot_blacklist.conf
 # Only one pam_cgroup.so is needed
 mv -f $RPM_BUILD_ROOT%{_libdir}/security/pam_cgroup.so.*.*.* $RPM_BUILD_ROOT%{_libdir}/security/pam_cgroup.so
 rm -f $RPM_BUILD_ROOT%{_libdir}/security/pam_cgroup.so.*
 rm -f $RPM_BUILD_ROOT%{_libdir}/security/pam_cgroup.la
 rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
 rm -f $RPM_BUILD_ROOT%{_mandir}/man5/cgred.conf.5*
 rm -f $RPM_BUILD_ROOT%{_mandir}/man5/cgrules.conf.5*
 rm -f $RPM_BUILD_ROOT%{_mandir}/man8/cgrulesengd.8*
 # unit and sysconfig
 install -d ${RPM_BUILD_ROOT}%{_unitdir}
 install -m 644 %SOURCE1 ${RPM_BUILD_ROOT}%{_unitdir}/
 %pre
 getent group cgred >/dev/null || groupadd -r cgred
 %post 
 %systemd_post cgconfig.service
 %preun
 %systemd_preun cgconfig.service
 %postun
 %systemd_postun_with_restart cgconfig.service
 %triggerun -- libcgroup < 0.38
 /usr/bin/systemd-sysv-convert --save cgconfig >/dev/null 2>&1 ||:
 /sbin/chkconfig --del cgconfig >/dev/null 2>&1 || :
 /bin/systemctl try-restart cgconfig.service >/dev/null 2>&1 || :
 %files
 %{!?_licensedir:%global license %%doc}
 %license COPYING
 %{_libdir}/libcgroup.so.*
 %config(noreplace) %{_sysconfdir}/cgsnapshot_blacklist.conf
 %config(noreplace) %{_sysconfdir}/cgconfig.conf
 /usr/bin/cgget
 /usr/bin/cgset
 /usr/bin/cgcreate
 /usr/bin/cgdelete
 /usr/bin/cgsnapshot
 /usr/bin/lscgroup
 /usr/bin/lssubsys
 /usr/sbin/cgclear
 /usr/sbin/cgconfigparser
 %attr(2755, root, cgred) /usr/bin/cgexec
 %attr(2755, root, cgred) /usr/bin/cgclassify
 %attr(0755,root,root) %{_libdir}/security/pam_cgroup.so
 %{_unitdir}/cgconfig.service
 %files devel
 %{!?_licensedir:%global license %%doc}
 %license COPYING
 %{_libdir}/libcgroup.so
 %{_libdir}/pkgconfig/libcgroup.pc
 %{_includedir}/libcgroup.h
 %{_includedir}/libcgroup/*.h
 %files help
 %license COPYING
 %doc README README_systemd
 %attr(0644, root, root) %{_mandir}/man1/*
 %attr(0644, root, root) %{_mandir}/man5/*
 %attr(0644, root, root) %{_mandir}/man8/*
 %changelog
 * Thu Dec 19 2019 openEuler Buildteam <buildteam@openeuler.org> - 0.41-22
 - Type:enhancement
 - Id:NA
 - SUG:NA
 - DESC:modify the config patch
 * Thu Nov 7 2019 openEuler Buildteam <buildteam@openeuler.org> - 0.41-21
 - Type:enhancement
 - Id:NA
 - SUG:NA
 - DESC:modify the release
 * Tue Jan 22 2019 lunankun<lunankun@huawei.com> - 0.41-20.h1
 - Type:bugfix
 - ID:NA
 - SUG:restart
 - DESC:change parser match order fix cgconfig error.