cgroup-resources,cgroupv2: allow setting memory.swap.max to 0

src/libcrun/cgroup-resources.c

@@ -720,7 +720,10 @@ write_memory_swap (int dirfd, bool cgroup2, runtime_spec_schema_config_linux_res
     return 0;
 
   swap = memory->swap;
-  if (cgroup2 && memory->swap != -1)
+  // Cgroupv2 apply limit must check if swap > 0, since `0` and `-1` are special case
+  // 0: This means process will not be able to use any swap space.
+  // -1: This means that the process can use as much swap as it needs.
+  if (cgroup2 && memory->swap > 0)
     {
       if (! memory->limit_present)
         return crun_make_error (err, 0, "cannot set swap limit without the memory limit");

tests/test_resources.py

@@ -199,6 +199,29 @@ def test_resources_cpu_weight():
             run_crun_command(["delete", "-f", cid])
     return 0
 
+def test_resources_cgroupv2_swap_0():
+    if not is_cgroup_v2_unified() or is_rootless():
+        return 77
+
+    conf = base_config()
+    add_all_namespaces(conf, cgroupns=True)
+    conf['process']['args'] = ['/init', 'pause']
+
+    conf['linux']['resources'] = {}
+    conf['linux']['resources']['memory'] = {
+            "swap": 0
+    }
+    cid = None
+    try:
+        _, cid = run_and_get_output(conf, command='run', detach=True)
+        out = run_crun_command(["exec", cid, "/init", "cat", "/sys/fs/cgroup/memory.swap.max"])
+        if "0" not in out:
+            return -1
+    finally:
+        if cid is not None:
+            run_crun_command(["delete", "-f", cid])
+    return 0
+
 def test_resources_cpu_quota_minus_one():
     if is_cgroup_v2_unified() or is_rootless():
         return 77
@@ -303,6 +326,7 @@ def test_resources_exec_cgroup():
 
 
 all_tests = {
+    "resources-v2-swap-disabled": test_resources_cgroupv2_swap_0,
     "resources-pid-limit" : test_resources_pid_limit,
     "resources-pid-limit-userns" : test_resources_pid_limit_userns,
     "resources-unified" : test_resources_unified,