cgroup: clean up swap-only memory cgroups

[sravan27]

Summary

Keep cgroup memory setup and teardown predicates aligned so swap-only limits do not leave persistent cgroups behind.

• Reuse the effective cgroup-v1 memory+swap calculation for both setup and cleanup.
• Reuse the cgroup-v2 controller predicates for both setup and cleanup.
• Preserve existing behavior for memory, PID, and CPU limits.

Impact

With cgroup v2, --cgroup_mem_swap_max 0 creates a per-process NSJAIL.<pid> cgroup, but finishFromParent() previously checked only cgroup_mem_max, cgroup_pids_max, and cgroup_cpu_ms_per_sec. As a result, every completed process left an empty cgroup on the host.

This is especially visible in LISTEN mode: 25 completed TCP connections against an unmodified build left 25 NSJAIL.<pid> directories. Connection limits only bound concurrent children, so they do not bound this cumulative leak. A long-running listener can eventually consume cgroup descendants and kernel memory.

Cgroup v1 had the same predicate mismatch when a positive swap-only limit was configured.

Verification

Built both current master and this branch with the project Dockerfile, then ran each image privileged with the host cgroup-v2 mount.

Unmodified master, after 25 completed listener connections:

leaked_cgroups=25
/sys/fs/cgroup/NSJAIL.10
/sys/fs/cgroup/NSJAIL.11
/sys/fs/cgroup/NSJAIL.12
...

This branch, after the same 25 connections:

remaining_cgroups=0

Focused one-shot checks also leave zero cgroups for each configuration:

swap_only_zero_remaining=0
swap_only_positive_remaining=0
memory_only_remaining=0
memory_memsw_remaining=0
pids_only_remaining=0
cpu_only_remaining=0

Additional checks:

• docker build -t nsjail-research:cgroup-fix .
• git diff --check

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.