Fix: Skip legacy v1 controller lines when parsing cgroup v2 path

[jnovy]

Description

Fixes #650

On systems with mixed cgroup hierarchies (cgroup v2 as primary but with legacy v1 controllers also mounted, e.g. net_cls mounted by PIA VPN), /proc/<pid>/cgroup contains entries like:

1:net_cls:/
0::/user.slice/user-1000.slice/user@1000.service/user.slice/podman-conmon-abc123.scope

When process_cgroup_subsystem_path() was called with cgroup2=true, it iterated through lines looking for a match but did not verify that the line actually belonged to the cgroup v2 unified hierarchy (0::). It would match the first line (1:net_cls:/), extract / as the cgroup path, and construct /sys/fs/cgroup/ as the base path for looking up memory.events.

This caused:

• Continuous warning spam: Failed to open cgroup memory.events file
• OOM monitoring silently broken — conmon could never detect OOM kills
• Affected any system where a v1 controller was mounted alongside the v2 unified hierarchy

Root Cause

In src/cgroup.c, the cgroup2 code path in process_cgroup_subsystem_path() did not validate that the parsed line had hierarchy ID 0 and an empty controller field, which are the defining characteristics of a cgroup v2 unified hierarchy entry per proc(5).

Fix

Added a check to skip lines that don't match the cgroup v2 format (0::<path>). Specifically, lines with a non-zero hierarchy ID or a non-empty controller field are now skipped with continue, ensuring only the actual v2 unified hierarchy entry is used.

Testing

• Built successfully with -Wall -Wextra -Werror
• Added 6 unit tests covering:
  • Mixed cgroups (v1 + v2) — the exact Incorrect parsing of /proc/$pid/cgroup when mixed cgroups are present #650 scenario
  • Pure cgroup v2 system
  • Multiple v1 controllers before v2 entry
  • No v2 entry present (returns NULL gracefully)
  • cgroup v1 memory controller lookup (unchanged behavior)
  • Issue Incorrect parsing of /proc/$pid/cgroup when mixed cgroups are present #650 exact reproduction — verifies path is NOT root cgroup

Impact

Minimal — only affects the cgroup v2 parsing path. The v1 path is completely unchanged. The fix adds a strict check that aligns with the kernel's documented format for /proc/<pid>/cgroup.

[giuseppe]

how will it be reused?

[jnovy]

Good catch — it won't be. The getline() on the next loop iteration completely overwrites the buffer, so restoring the delimiter was unnecessary (and actually buggy: after path++, *path points to the cgroup path's first character, not the original : delimiter).

Removed the line and simplified the if-block to a single-statement continue. Force-pushed.

[giuseppe]

LGTM