Commit 37e4ab3f0cba13adf3535d373fd98e5ee47b5410

Authored by Olivier Croquette
Committed by Linus Torvalds
1 parent a3464a102a

[PATCH] Changing RT priority without CAP_SYS_NICE

Presently, a process without the capability CAP_SYS_NICE can not change
its own policy, which is OK.

But it can also not decrease its RT priority (if scheduled with policy
SCHED_RR or SCHED_FIFO), which is what this patch changes.

The rationale is the same as for the nice value: a process should be
able to require less priority for itself. Increasing the priority is
still not allowed.

This is for example useful if you give a multithreaded user process a RT
priority, and the process would like to organize its internal threads
using priorities also. Then you can give the process the highest
priority needed N, and the process starts its threads with lower
priorities: N-1, N-2...

The POSIX norm says that the permissions are implementation specific, so
I think we can do that.

In a sense, it makes the permissions consistent whatever the policy is:
with this patch, process scheduled by SCHED_FIFO, SCHED_RR and
SCHED_OTHER can all decrease their priority.

From: Ingo Molnar <mingo@elte.hu>

cleaned up and merged to -mm.

Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Showing 1 changed file with 18 additions and 7 deletions Side-by-side Diff

... ... @@ -3531,13 +3531,24 @@
3531 3531 if ((policy == SCHED_NORMAL) != (param->sched_priority == 0))
3532 3532 return -EINVAL;
3533 3533  
3534   - if ((policy == SCHED_FIFO || policy == SCHED_RR) &&
3535   - param->sched_priority > p->signal->rlim[RLIMIT_RTPRIO].rlim_cur &&
3536   - !capable(CAP_SYS_NICE))
3537   - return -EPERM;
3538   - if ((current->euid != p->euid) && (current->euid != p->uid) &&
3539   - !capable(CAP_SYS_NICE))
3540   - return -EPERM;
  3534 + /*
  3535 + * Allow unprivileged RT tasks to decrease priority:
  3536 + */
  3537 + if (!capable(CAP_SYS_NICE)) {
  3538 + /* can't change policy */
  3539 + if (policy != p->policy)
  3540 + return -EPERM;
  3541 + /* can't increase priority */
  3542 + if (policy != SCHED_NORMAL &&
  3543 + param->sched_priority > p->rt_priority &&
  3544 + param->sched_priority >
  3545 + p->signal->rlim[RLIMIT_RTPRIO].rlim_cur)
  3546 + return -EPERM;
  3547 + /* can't change other user's priorities */
  3548 + if ((current->euid != p->euid) &&
  3549 + (current->euid != p->uid))
  3550 + return -EPERM;
  3551 + }
3541 3552  
3542 3553 retval = security_task_setscheduler(p, policy, param);
3543 3554 if (retval)