Re: 2.6.11-rc3-mm2

[Matt Mackall <mpm@selenic.com>]

On Fri, Feb 11, 2005 at 08:54:17AM +0100, Ingo Molnar wrote:
> 
> * Matt Mackall <mpm@selenic.com> wrote:
> 
> > Eh? Chris Wright's original rlimits patch was very straightforward
> > [...]
> 
> the problem is that it didnt solve the problem (unprivileged user can
> lock up the system) in any way.

There are two separate but related problems:

a) need a way to give non-root access to SCHED_FIFO without other
privileges

b) would like a way to have RT-like capabilities without risk of DoS

The original rlimits patch solves (a), which is the pressing concern.

The existence of a satisfactory solution to related problem (b) has
yet to be demonstrated. And even if a solution for (b) is found that
is satisfactory for, say, high end audio users, it may not necessarily
be sufficient for everyone who might have wanted SCHED_FIFO for
non-root processes. So we still need a solution for (a).

> So after it became visible that all the
> existing 'dont allow users to lock up' solutions are too invasive, we
> went to recommend the solution that introduces the least architectural
> problems: RT-LSM.

RT-LSM introduces architectural problems in the form of bogus API. And
I claim that if RT-LSM becomes part of the mainline kernel, it -will-
become a default feature on the desktop in short order. The fact that
it's implemented as an LSM is meaningless if Redhat and SuSE ship it
on by default.

So the comparison boils down to putting a magic gid in a sysfs
file/module parameter or setting an rlimit with standard tools (PAM,
etc). I'm really boggled that anyone could prefer the former,
especially since we had almost this exact debate over what became the
mlock rlimit!

Here's Chris' patch for reference:

http://groups-beta.google.com/group/linux.kernel/msg/6408569e13ed6e80

-- 
Mathematics is the supreme nostalgia of our time.