FWIW, we have a snap that attempts to read it’s own cgroup cpu limits in order to automatically determine a reasonable thread pool to allocate for itself (it’s a database application). If there was an interface for just reading cgroups information we would add it to the snap. As it is now it’s harmless and handles the denial properly, but is quite noisy. Example denial we see:
Feb 12 16:24:34 hostname kernel: audit: type=1400 audit(1550010274.725:943): apparmor="DENIED" operation="open" profile="snap.edgexfoundry.security-services" name="/sys/fs/cgroup/cpu,cpuacct/system.slice/snap.edgexfoundry.security-services.service/cpu.cfs_quota_us" pid=5509 comm="java" requested_mask="r" denied_mask="r" fsuid=0 ouid=0