Date: Mon, 28 May 2012 17:04:20 +0200 From: Mateusz Guzik <mjguzik@gmail.com> To: Julian Elischer <julian@freebsd.org> Cc: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net>, FreeBSD-Jail <freebsd-jail@freebsd.org>, FreeBSD Hackers <freebsd-hackers@freebsd.org> Subject: Re: [jail] Allowing root privledged users to renice Message-ID: <20120528150420.GA15947@dft-labs.eu> In-Reply-To: <4FBFC029.10401@freebsd.org> References: <1337964514.8951.2.camel@powernoodle-l7.corp.yahoo.com> <8EE125C9-9FA7-495B-A6ED-CF3F7C2E8A3E@lists.zabbadoz.net> <4FBFC029.10401@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, May 25, 2012 at 10:23:53AM -0700, Julian Elischer wrote: > On 5/25/12 10:04 AM, Bjoern A. Zeeb wrote: > >On 25. May 2012, at 16:48 , Sean Bruno wrote: > > > >>I've been toying with the idea of letting jails renice processes ... how > >>dangerous and/or stupid is this idea? > >> > >>==== //depot/yahoo/ybsd_9/src/sys/kern/kern_jail.c#5 - > >>/home/seanbru/ybsd_9/src/sys/kern/kern_jail.c ==== > >>270a271,275 > >>+ int jail_allow_renice = 0; > >>+ SYSCTL_INT(_security_jail, OID_AUTO, allow_renice, CTLFLAG_RW, > >>+&jail_allow_renice, 0, > >>+ "Prison root can renice processes"); > >> > >>3857a3863,3865 > >>+ case PRIV_SCHED_SETPRIORITY: > >>+ if (!jail_allow_renice) > >>+ return (EPERM); > > > >I think sysctls are a bad idea given jails have per-jail flags these days. > > > >Maybe also only allow re-nicing to be nicer but not less nice? > ^^^^ for sure ! start a jail with it's max priority and the > root within can allow nicer priorities only.. > you can always add priority from teh master (parent) environment outside. > Unless I seriously misunderstood something, that's the case right now. That is, PRIV_SCHED_SETPRIORITY matters only if resulting nice parameter would be lower. -- Mateusz Guzik <mjguzik gmail.com>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20120528150420.GA15947>