core: don't migrate PIDs for units that may contain subcgroups, do this only for leaf units

Otherwise a slice or delegation unit might move PIDs around ignoring the
fact that it is attached to a subcgroup.

1 files changed, 14 insertions, 4 deletions

diff --git a/src/core/cgroup.c b/src/core/cgroup.c
index 6815ca907a..83678e6e03 100644
--- a/src/core/cgroup.c
+++ b/src/core/cgroup.c
@@ -606,10 +606,15 @@ static const char *migrate_callback(CGroupControllerMask mask, void *userdata) {
 
 static int unit_create_cgroups(Unit *u, CGroupControllerMask mask) {
         _cleanup_free_ char *path = NULL;
+        CGroupContext *c;
         int r;
 
         assert(u);
 
+        c = unit_get_cgroup_context(u);
+        if (!c)
+                return 0;
+
         path = unit_default_cgroup_path(u);
         if (!path)
                 return log_oom();
@@ -633,10 +638,15 @@ static int unit_create_cgroups(Unit *u, CGroupControllerMask mask) {
         u->cgroup_realized = true;
         u->cgroup_realized_mask = mask;
 
-        /* Then, possibly move things over */
-        r = cg_migrate_everywhere(u->manager->cgroup_supported, u->cgroup_path, u->cgroup_path, migrate_callback, u);
-        if (r < 0)
-                log_warning_errno(r, "Failed to migrate cgroup from to %s: %m", u->cgroup_path);
+        if (u->type != UNIT_SLICE && !c->delegate) {
+
+                /* Then, possibly move things over, but not if
+                 * subgroups may contain processes, which is the case
+                 * for slice and delegation units. */
+                r = cg_migrate_everywhere(u->manager->cgroup_supported, u->cgroup_path, u->cgroup_path, migrate_callback, u);
+                if (r < 0)
+                        log_warning_errno(r, "Failed to migrate cgroup from to %s: %m", u->cgroup_path);
+        }
 
         return 0;
 }