Till, it allows quite a few things (from man capabilities):
CAP_SYS_NICE
* Raise process nice value (nice(2), setpriority(2)) and change the
nice value for arbitrary processes;
* set real-time scheduling policies for calling process, and set
scheduling policies and priorities for arbitrary processes
(sched_setscheduler(2), sched_setparam(2), sched_setattr(2));
* set CPU affinity for arbitrary processes (sched_setaffinity(2));
* set I/O scheduling class and priority for arbitrary processes (io‐
prio_set(2));
* apply migrate_pages(2) to arbitrary processes and allow processes
to be migrated to arbitrary nodes;
* apply move_pages(2) to arbitrary processes;
* use the MPOL_MF_MOVE_ALL flag with mbind(2) and move_pages(2).
cups-browsed is probably just trying to renice itself, which isn't
terrible for it to try, but it probably fails gracefully with this just
being noise. If it does fail gracefully, you could consider an explicit
deny rule to silence the log. Eg:
deny capability sys_nice,
That said, we've normally allowed system policy (ie, those shipped in
debs) to use sys_nice if they have a legitimate use case for it.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1897369
Title:
apparmor: Allow cups-browsed to change nice value (CAP_SYS_NICE)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1897369/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
