[PATCH] Changing RT priority in kernel 2.6 without CAP_SYS_NICE

[PATCH] Changing RT priority in kernel 2.6 without CAP_SYS_NICE

[Olivier Croquette]

Hello

Here is a patch on the permission scheme when changing RT priorities.

Presently, a process without the capability CAP_SYS_NICE can not change 
its own policy, which is OK.

But it can also not decrease its RT priority (if scheduled with policy 
SCHED_RR or SCHED_FIFO), which is what this patch changes.

The rationale is the same as for the nice value: a process should be 
able to require less priority for itself. Increasing the priority is 
still not allowed.

This is for example useful if you give a multithreaded user process a RT 
priority, and the process would like to organize its internal threads 
using priorities also. Then you can give the process the highest 
priority needed N, and the process starts its threads with lower 
priorities: N-1, N-2...

The POSIX norm says that the permissions are implementation specific, so 
I think we can do that.

In a sense, it makes the permissions consistent whatever the policy is: 
with this patch, process scheduled by SCHED_FIFO, SCHED_RR and 
SCHED_OTHER can all decrease their priority.

Please tell me what you think!

Regards

Olivier





--- linux-2.6.8-24.11/kernel/sched.c    2005-01-14 16:34:00.000000000
+0100
+++ linux-2.6.8-24.11-sched-patch/kernel/sched.c        2005-04-17
09:27:07.000000000 +0200
@@ -3248,12 +3248,19 @@
                 goto out_unlock;

         retval = -EPERM;
-       if ((policy == SCHED_FIFO || policy == SCHED_RR) &&
-           !capable(CAP_SYS_NICE))
-               goto out_unlock;
-       if ((current->euid != p->euid) && (current->euid != p->uid) &&
-           !capable(CAP_SYS_NICE))
-               goto out_unlock;
+       if(!capable(CAP_SYS_NICE)) {
+               /* can't change a policy without cap */
+               if (policy != p->policy)
+                       goto out_unlock;
+               /* can't increase priority without cap */
+               if (policy != SCHED_NORMAL &&
+                   lp.sched_priority > p->rt_priority)
+                       goto out_unlock;
+               /* can't change other processes without cap */
+               if ((current->euid != p->euid) &&
+                   (current->euid != p->uid))
+                       goto out_unlock;
+       }

         retval = security_task_setscheduler(p, policy, &lp);
         if (retval)

Re: [PATCH] Changing RT priority in kernel 2.6 without CAP_SYS_NICE

[Ingo Molnar]

looks fine to me, only minor nits:

- this area of code changed since 2.6.8 so it needed merging.

- whitespace damage: your patch had all tabs as spaces.

- whitespace style: stuff like "if(" should be "if (".

i've reworked and tested the patch (attached below) to apply against the 
latest scheduler queue in -mm.

	Ingo

--
From: Olivier Croquette <ocroquette@free.fr>

Presently, a process without the capability CAP_SYS_NICE can not change 
its own policy, which is OK.

But it can also not decrease its RT priority (if scheduled with policy 
SCHED_RR or SCHED_FIFO), which is what this patch changes.

The rationale is the same as for the nice value: a process should be 
able to require less priority for itself. Increasing the priority is 
still not allowed.

This is for example useful if you give a multithreaded user process a RT 
priority, and the process would like to organize its internal threads 
using priorities also. Then you can give the process the highest 
priority needed N, and the process starts its threads with lower 
priorities: N-1, N-2...

The POSIX norm says that the permissions are implementation specific, so 
I think we can do that.

In a sense, it makes the permissions consistent whatever the policy is: 
with this patch, process scheduled by SCHED_FIFO, SCHED_RR and 
SCHED_OTHER can all decrease their priority.

From: Ingo Molnar <mingo@elte.hu>

cleaned up and merged to -mm.

Signed-off-by: Ingo Molnar <mingo@elte.hu>

--- kernel/sched.c.orig
+++ kernel/sched.c
@@ -3436,12 +3436,22 @@ recheck:
 	if ((policy == SCHED_NORMAL) != (param->sched_priority == 0))
 		return -EINVAL;
 
-	if ((policy == SCHED_FIFO || policy == SCHED_RR) &&
-	    !capable(CAP_SYS_NICE))
-		return -EPERM;
-	if ((current->euid != p->euid) && (current->euid != p->uid) &&
-	    !capable(CAP_SYS_NICE))
-		return -EPERM;
+	/*
+	 * Allow unprivileged RT tasks to decrease priority:
+	 */
+	if (!capable(CAP_SYS_NICE)) {
+		/* can't change policy */
+		if (policy != p->policy)
+			return -EPERM;
+		/* can't increase priority */
+		if (policy != SCHED_NORMAL &&
+		    param->sched_priority > p->rt_priority)
+			return -EPERM;
+		/* can't change other user's priorities */
+		if ((current->euid != p->euid) &&
+		    (current->euid != p->uid))
+			return -EPERM;
+	}
 
 	retval = security_task_setscheduler(p, policy, param);
 	if (retval)

Re: [PATCH] Changing RT priority in kernel 2.6 without CAP_SYS_NICE

[Andrew Morton]

Ingo Molnar <mingo@elte.hu> wrote:
>
>  Presently, a process without the capability CAP_SYS_NICE can not change 
>  its own policy, which is OK.
> 
>  But it can also not decrease its RT priority (if scheduled with policy 
>  SCHED_RR or SCHED_FIFO), which is what this patch changes.

This patch needed some massaging to copt with the changes in
nice-and-rt-prio-rlimits.patch - please check.

I guess we should merge nice-and-rt-prio-rlimits.patch.

--- 25/kernel/sched.c~sched-changing-rt-priority-without-cap_sys_nice	2005-04-25 21:54:48.572295312 -0700
+++ 25-akpm/kernel/sched.c	2005-04-25 21:59:18.160311704 -0700
@@ -3445,13 +3445,24 @@ recheck:
 	if ((policy == SCHED_NORMAL) != (param->sched_priority == 0))
 		return -EINVAL;
 
-	if ((policy == SCHED_FIFO || policy == SCHED_RR) &&
-	    param->sched_priority > p->signal->rlim[RLIMIT_RTPRIO].rlim_cur &&
-	    !capable(CAP_SYS_NICE))
-		return -EPERM;
-	if ((current->euid != p->euid) && (current->euid != p->uid) &&
-	    !capable(CAP_SYS_NICE))
-		return -EPERM;
+	/*
+	 * Allow unprivileged RT tasks to decrease priority:
+	 */
+	if (!capable(CAP_SYS_NICE)) {
+		/* can't change policy */
+		if (policy != p->policy)
+			return -EPERM;
+		/* can't increase priority */
+		if (policy != SCHED_NORMAL &&
+		    param->sched_priority > p->rt_priority &&
+		    param->sched_priority >
+				p->signal->rlim[RLIMIT_RTPRIO].rlim_cur)
+			return -EPERM;
+		/* can't change other user's priorities */
+		if ((current->euid != p->euid) &&
+		    (current->euid != p->uid))
+			return -EPERM;
+	}
 
 	retval = security_task_setscheduler(p, policy, param);
 	if (retval)
_

Re: [PATCH] Changing RT priority in kernel 2.6 without CAP_SYS_NICE

[Olivier Croquette]

Hi!

The patch seems OK to me, I will try to test live in the next days.

Regards

Olivier

Re: [PATCH] Changing RT priority in kernel 2.6 without CAP_SYS_NICE

[Ingo Molnar]

* Andrew Morton <akpm@osdl.org> wrote:

> Ingo Molnar <mingo@elte.hu> wrote:
> >
> >  Presently, a process without the capability CAP_SYS_NICE can not change 
> >  its own policy, which is OK.
> > 
> >  But it can also not decrease its RT priority (if scheduled with policy 
> >  SCHED_RR or SCHED_FIFO), which is what this patch changes.
> 
> This patch needed some massaging to copt with the changes in 
> nice-and-rt-prio-rlimits.patch - please check.
> 
> I guess we should merge nice-and-rt-prio-rlimits.patch.

the massaging looks ok - and i agree that we should merge the rt-rlimits 
patch.

	Ingo