I don't know if it ¡°legal¡± to send the email here £º£©<br>================<br><br>I am playing with libvirt 1.1.1 (lxc)<br>when I was starting a LXC container,&nbsp; the process location of cgroup is pretty ,&nbsp; just the root directory<br>from the process. But I could tune the cgroup in a container as an user that logged, This is not accepted... <br><br>I wonder how to restrict it with apparmor ,so one can not modify files in&nbsp; the cgroup fs, e.g&nbsp; the cpus or mem,<br>if i restrict it with "deny /sys/fs/cgroup/** wrklx,"&nbsp; in apparmor ,the container woulld not start up . <br>"Permission denied", because that a process would mount the cgroup, it seems done by libvirt_lxc, <br>Any way to restrict the cgroup in the container or just not mount cgroup in the container ??&nbsp; <br><br>Any help would be appreciated, thanks .<br><br><div><div style="color:#909090;font-family:Arial Narrow;font-size:12px">------------------</div><div style="font-size:14px;font-family:Verdana;color:#000;"><div>Ö¹Óï</div></div></div>