Re: your mail

Chris Wright
2004-05-24T22:34:05Z

* Laughlin, Joseph V (Joseph.V.Laughlin@boeing.com) wrote:
> I've been tasked with modifying a 2.4 kernel so that a non-root user can
> do the following:
>
> Dynamically change the priorities of processes (up and down)

Requires CAP_SYS_NICE.

> Lock processes in memory

Currently requires CAP_IPC_LOCK. However, this one is already been
done using rlimits (at least via mlock() and friends, SHM_LOCK has
different issue).

> Can change process cpu affinity

Requires CAP_SYS_NICE (but I believe this was a 2.6 feature).

> Anyone got any ideas about how I could start doing this? (I'm new to
> kernel development, btw.)

There's a few approaches floating about. Probably the simplest is to
disable the checks globally, but this will also be less secure. I have
an example of this in 2.6 if you'd like.

thanks,
-chris
--
Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net