Re: [PATCH] Realtime LSM

Jack O'Quin
2004-10-01T00:36:58Z

Lee Revell <rlrevell@joe-job.com> writes:

> Another issue that was raised was that the mlock stuff is also
> unnecessary, because rlimits can do this now. Is this the case?

I don't know. The idea was not explained in enough detail for me to
understand if it would be simple enough to administer. Where can I
find out more?

Does this somehow explain the need for CAP_SYS_RESOURCE when calling
mlockall()? Comments in capability.h seem to imply that only
CAP_IPC_LOCK is required, which is not true. I never found any
explicit CAP_SYS_RESOURCE test in mm/mlock.c, though it does check
`rlim[RLIMIT_MEMLOCK].rlim_cur'.
--
joq