Bottom line is I need to give a process started by systemd and any
process started by that process some privileges to chanage scheduler and
other things when it starts. How do I tell systemd to grant these
privileges to one of it's services?
Here's all the detail:
I'm having a really frustrating problem. I have a ruby webrick daemon
that starts up at boot. Previously it always started from init and that
always worked fine right up through fedora 8 on a 2.6.29.9 kernel. Now
I'm running the following:
OS: Fedora Core 15
Kernel: 2.6.38.8 64-bit with RTAI patches
SELinux is disabled
I did manage to get the thing to start using the following service file:
*********** BEGIN webrickd.service ************
[Unit]
Description=Configuration ruby webrick daemon
After=network.target
[Service]
Type=forking
WorkingDirectory=/home/rtuser/app/bin
PIDFile=/home/rtuser/app/data/logs/webrickd.pid
ExecStartPre=/home/rtuser/app/system/scripts/preStart.sh
ExecStart=/home/rtuser/app/bin/webrickd.rb -d -p
/home/rtuser/app/data/logs/webrickd.pid
StandardOutput=null
StandardError=null
User=rtuser
Group=rtuser
[Install]
WantedBy=multi-user.target
*********** END webrickd.service *************
This webrick daemon upon receiving a specific web service call uses
"exec" to start another process called appcore which is a compiled C
application. appcore runs real-time and consequently uses a call to
sched_setscheduler() to change it's scheduling from the default. Sample
code for reproduction is below:
*********** BEGIN appcore.c *************
#include <stdio.h>
#include <errno.h>
#include <sched.h>
int main(int argc, char *argv[])
{
struct sched_param mysched;
errno = 0;
mysched.sched_priority = sched_get_priority_max(SCHED_FIFO) - 1;
if( sched_setscheduler( 0, SCHED_FIFO, &mysched ) == -1 ) {
puts("appcore: ERROR IN SETTING THE SCHEDULER");
perror("errno");
return 1;
} // end
if
return 0;
}
************** END appcore.c **************
compile with gcc -o appcore appcore.c
Running the above program will work with a normally created unprivileged
user account but only when logged in with a PAM session using an
interactive shell. As soon as I try to start this up from anything that
is started by systemd, it yields an "Operation not permitted" error. I
realize there are other ways to specify what scheduling service a
process should have in the above systemd configuration file, but that
does not solve my problem. Even without this call, the RTAI extensions
I use which use a call to rtai_task_init() also apparently require this
same privilege (or one like it) because it too fails with "Operation not
permitted" so even if I tell systemd to give the ruby webrickdaemon
SCHED_FIFO priority and I can somehow get that inherited to appcore, I
will still have the same problem, because there is no way for systemd to
create a real-time task using the RTAI extensions for me before my
program starts. I've tried all the following (and their combinations)
without success:
LimitCPU=infinity
LimitFSIZE=infinity
LimitDATA=infinity
LimitSTACK=infinity
LimitCORE=infinity
LimitRSS=infinity
#LimitNOFILES=infinity # using any variety of this fails no matter what
LimitAS=infinity
LimitNPROC=infinity
LimitMEMLOCK=infinity
LimitLOCKS=infinity
LimitSIGPENDING=infinity
LimitMSGQUEUE=infinity
LimitNICE=infinity
LimitRTPRIO=infinity
LimitRTTIME=infinity
CapabilityBoundingSet=~CAP_SYS_PTRACE
PAMName=appcore
Modifications to /etc/security/limits.conf of course don't really help
because it works fine under a shell without any modifications and that
stuff all gets bypassed with init processes starting even when you
specify User and Group. I've tried using sudo (won't even start it) to
try to get a PAM session as though it were a login, I've tried setuid
without success, I've tried everything I can think of but absolutely
everything works when run from an interactive shell and absolutely
nothing works, all I get is "Operation not permitted" anytime I let
systemd start things up. Please help! I'm desperate. I get what
you're trying to do with systemd and I support it and I have to say for
a first release of it, it seems well designed and thought out. I'm
impressed with it's flexibility. However, I quite literally ***cannot
find a way to make this work*** when it just "worked" before. What in
the world do I have to do to have systemd start this process up with
whatever equivalent rights or permissions it used to have with init and
whatever it seems to have when run from an interactive shell.
_______________________________________________
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel
