cgroup: validate cgroup spec before executing