[jail] Allowing root privledged users to renice

[Mateusz Guzik]

On Fri, May 25, 2012 at 10:23:53AM -0700, Julian Elischer wrote:
> On 5/25/12 10:04 AM, Bjoern A. Zeeb wrote:
> >On 25. May 2012, at 16:48 , Sean Bruno wrote:
> >
> >>I've been toying with the idea of letting jails renice processes ... how
> >>dangerous and/or stupid is this idea?
> >>
> >>==== //depot/yahoo/ybsd_9/src/sys/kern/kern_jail.c#5 -
> >>/home/seanbru/ybsd_9/src/sys/kern/kern_jail.c ====
> >>270a271,275
> >>+ int   jail_allow_renice = 0;
> >>+ SYSCTL_INT(_security_jail, OID_AUTO, allow_renice, CTLFLAG_RW,
> >>+&jail_allow_renice, 0,
> >>+    "Prison root can renice processes");
> >>
> >>3857a3863,3865
> >>+      case PRIV_SCHED_SETPRIORITY:
> >>+              if (!jail_allow_renice)
> >>+                       return (EPERM);
> >
> >I think sysctls are a bad idea given jails have per-jail flags these days.
> >
> >Maybe also only allow re-nicing to be nicer but not less nice?
>     ^^^^   for sure !  start a jail with it's max priority and the
> root within can allow nicer priorities only..
> you can always add priority from teh master (parent) environment outside.
> 

Unless I seriously misunderstood something, that's the case right now.

That is, PRIV_SCHED_SETPRIORITY matters only if resulting nice parameter
would be lower.

-- 
Mateusz Guzik <mjguzik gmail.com>