cgroup permission check