diff --git a/libnativeloader/native_loader.cpp b/libnativeloader/native_loader.cpp
index a4e00bd..5394d7e 100644
--- a/libnativeloader/native_loader.cpp
+++ b/libnativeloader/native_loader.cpp
@@ -118,7 +118,16 @@
 
 static constexpr const char* kRuntimeNamespaceName = "runtime";
 
+// classloader-namespace is a linker namespace that is created for the loaded
+// app. To be specific, it is created for the app classloader. When
+// System.load() is called from a Java class that is loaded from the
+// classloader, the classloader-namespace namespace associated with that
+// classloader is selected for dlopen. The namespace is configured so that its
+// search path is set to the app-local JNI directory and it is linked to the
+// default namespace with the names of libs listed in the public.libraries.txt.
+// This way an app can only load its own JNI libraries along with the public libs.
 static constexpr const char* kClassloaderNamespaceName = "classloader-namespace";
+// Same thing for vendor APKs.
 static constexpr const char* kVendorClassloaderNamespaceName = "vendor-classloader-namespace";
 
 // (http://b/27588281) This is a workaround for apps using custom classloaders and calling
diff --git a/libprocessgroup/cgroup_map.cpp b/libprocessgroup/cgroup_map.cpp
index 12cfb7e..cd8ef94 100644
--- a/libprocessgroup/cgroup_map.cpp
+++ b/libprocessgroup/cgroup_map.cpp
@@ -19,6 +19,7 @@
 
 #include <errno.h>
 #include <fcntl.h>
+#include <grp.h>
 #include <pwd.h>
 #include <sys/mman.h>
 #include <sys/mount.h>
@@ -72,26 +73,28 @@
         }
     }
 
-    passwd* uid_pwd = nullptr;
-    passwd* gid_pwd = nullptr;
-
-    if (!uid.empty()) {
-        uid_pwd = getpwnam(uid.c_str());
-        if (!uid_pwd) {
-            PLOG(ERROR) << "Unable to decode UID for '" << uid << "'";
-            return false;
-        }
-
-        if (!gid.empty()) {
-            gid_pwd = getpwnam(gid.c_str());
-            if (!gid_pwd) {
-                PLOG(ERROR) << "Unable to decode GID for '" << gid << "'";
-                return false;
-            }
-        }
+    if (uid.empty()) {
+        return true;
     }
 
-    if (uid_pwd && lchown(path.c_str(), uid_pwd->pw_uid, gid_pwd ? gid_pwd->pw_uid : -1) < 0) {
+    passwd* uid_pwd = getpwnam(uid.c_str());
+    if (!uid_pwd) {
+        PLOG(ERROR) << "Unable to decode UID for '" << uid << "'";
+        return false;
+    }
+
+    uid_t pw_uid = uid_pwd->pw_uid;
+    gid_t gr_gid = -1;
+    if (!gid.empty()) {
+        group* gid_pwd = getgrnam(gid.c_str());
+        if (!gid_pwd) {
+            PLOG(ERROR) << "Unable to decode GID for '" << gid << "'";
+            return false;
+        }
+        gr_gid = gid_pwd->gr_gid;
+    }
+
+    if (lchown(path.c_str(), pw_uid, gr_gid) < 0) {
         PLOG(ERROR) << "lchown() failed for " << path;
         return false;
     }
@@ -128,7 +131,8 @@
         std::string name = cgroups[i]["Controller"].asString();
         descriptors->emplace(std::make_pair(
                 name,
-                CgroupDescriptor(1, name, cgroups[i]["Path"].asString(), cgroups[i]["Mode"].asInt(),
+                CgroupDescriptor(1, name, cgroups[i]["Path"].asString(),
+                                 std::strtoul(cgroups[i]["Mode"].asString().c_str(), 0, 8),
                                  cgroups[i]["UID"].asString(), cgroups[i]["GID"].asString())));
     }
 
@@ -136,8 +140,8 @@
     descriptors->emplace(std::make_pair(
             CGROUPV2_CONTROLLER_NAME,
             CgroupDescriptor(2, CGROUPV2_CONTROLLER_NAME, cgroups2["Path"].asString(),
-                             cgroups2["Mode"].asInt(), cgroups2["UID"].asString(),
-                             cgroups2["GID"].asString())));
+                             std::strtoul(cgroups2["Mode"].asString().c_str(), 0, 8),
+                             cgroups2["UID"].asString(), cgroups2["GID"].asString())));
 
     return true;
 }
diff --git a/rootdir/cgroups.json b/rootdir/cgroups.json
index 6eb88c9..aa71956 100644
--- a/rootdir/cgroups.json
+++ b/rootdir/cgroups.json
@@ -3,40 +3,40 @@
     {
       "Controller": "cpu",
       "Path": "/dev/cpuctl",
-      "Mode": 0755,
+      "Mode": "0755",
       "UID": "system",
       "GID": "system"
     },
     {
       "Controller": "cpuacct",
       "Path": "/acct",
-      "Mode": 0555
+      "Mode": "0555"
     },
     {
       "Controller": "cpuset",
       "Path": "/dev/cpuset",
-      "Mode": 0755,
+      "Mode": "0755",
       "UID": "system",
       "GID": "system"
     },
     {
       "Controller": "memory",
       "Path": "/dev/memcg",
-      "Mode": 0700,
+      "Mode": "0700",
       "UID": "root",
       "GID": "system"
     },
     {
       "Controller": "schedtune",
       "Path": "/dev/stune",
-      "Mode": 0755,
+      "Mode": "0755",
       "UID": "system",
       "GID": "system"
     }
   ],
   "Cgroups2": {
     "Path": "/dev/cg2_bpf",
-    "Mode": 0600,
+    "Mode": "0600",
     "UID": "root",
     "GID": "root"
   }