Isolation: wired up per-application cgroup support internally.

This commit hooks into the cgroup infrastructure added in the previous
commit to create per-application cgroups.

It does this by adding each "prototype process" into its own cgroup,
then each child process inherits its parents cgroup.

If we fail to create a cgroup we simply fail the process. This behaviour
may get enhanced in the future.

This won't actually do anything yet. Subsequent commits will hook this
up to the build and config systems.

Reviewed-by: Alejandro Colomar <alx@nginx.com>
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>

1 files changed, 12 insertions, 0 deletions

diff --git a/src/nxt_process.c b/src/nxt_process.c
index 738a03bf..d8836ad2 100644
--- a/src/nxt_process.c
+++ b/src/nxt_process.c
@@ -5,6 +5,7 @@
  */
 
 #include <nxt_main.h>
+#include <nxt_cgroup.h>
 
 #if (NXT_HAVE_CLONE)
 #include <nxt_clone.h>
@@ -378,6 +379,17 @@ nxt_process_create(nxt_task_t *task, nxt_process_t *process)
         nxt_runtime_process_add(task, process);
     }
 
+#if (NXT_HAVE_CGROUP)
+    ret = nxt_cgroup_proc_add(task, process);
+    if (nxt_slow_path(ret != NXT_OK)) {
+        nxt_alert(task, "cgroup: failed to add process %s to %s %E",
+                  process->name, process->isolation.cgroup.path, nxt_errno);
+        nxt_cgroup_cleanup(task, process);
+        kill(pid, SIGTERM);
+        return -1;
+    }
+#endif
+
     return pid;
 }