user session: Add membership to the memory cgroup

In order to set cgroup memory limits for systemd user session services
(by setting MemoryLimit and MemorySoftLimit), the systemd user instance
must have write permissions for the toplevel memory cgroup controller
hierarchy, located at /sys/fs/cgroup/memory.

To grant access to this hierarchy, this commits adds "memory:/" to
ControlGroup for the user session service file, which makes the user
instance a member of the memory cgroup and enables writing
/sys/fs/cgroup/memory/user and populating additional cgroups within that
directory.

diff --git a/units/system/user-session@.service.in b/units/system/user-session@.service.in
index dbb0807..1197a7b 100644 (file)
--- a/units/system/user-session@.service.in
+++ b/units/system/user-session@.service.in
@@ -12,7 +12,7 @@ After=systemd-user-sessions.service
 [Service]
 User=%I
 PAMName=login
-ControlGroup=%R/user/%I/shared cpu:/
+ControlGroup=%R/user/%I/shared cpu:/ memory:/
 ControlGroupModify=yes
 Type=notify
 TTYPath=/dev/tty1