https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126584
Bug ID: 126584
Summary: Ceiling_Locking broken in Linux containers (UID 0 /=
CAP_SYS_NICE)
Product: gcc
Version: 16.1.1
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: ada
Assignee: unassigned at gcc dot gnu.org
Reporter: liam at liampwll dot com
CC: dkm at gcc dot gnu.org
Target Milestone: ---
I found this while trying to containerise a GCC build, specifically because
test_prio and lto8 in the test suite were timing out.
Get_Ceiling_Support currently contains the line
Ceiling_Support := Superuser or else Has_Cap = 1;
where Has_Cap is a call out to libcap to check CAP_SYS_NICE and Superuser is
geteuid = 0.
The problem with this is that UID 0 does not imply CAP_SYS_NICE, especially in
a container where the process is actually just running as a regular user. It
also seems like CAP_SYS_NICE is far too broad and checking RLIMIT_RTPRIO may
work instead, however I have not dug into it too much.
This is also easy to work around by just not running as UID 0 in a container,
I'm mostly just reporting this to save some time for the next person who runs
into it if there's no interest in fixing it.
