Source Mage code commit list

[Conner Clere <scm AT sourcemage.org>]

GIT changes to master grimoire by Conner Clere <xenanthropy AT sourcemage.org>:

 ChangeLog             |    3 ++
 utils/rtkit/BUILD     |    2 +
 utils/rtkit/CONFIGURE |    4 +++
 utils/rtkit/DEPENDS   |   12 +++++++++++
 utils/rtkit/DETAILS   |   52 
++++++++++++++++++++++++++++++++++++++++++++++++++
 utils/rtkit/HISTORY   |    3 ++
 6 files changed, 76 insertions(+)

New commits:
commit 0e2378eb443320bb47ee268e39cc4e1f8720a28c
Author: Conner Clere <xenanthropy AT sourcemage.org>
Commit: Conner Clere <xenanthropy AT sourcemage.org>

    utils/rtkit: new spell, realtime plicy and watchdog daemon

diff --git a/ChangeLog b/ChangeLog
index 2c245cd..862e199 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+2023-07-05 Conner Clere <xenanthropy AT sourcemage.org>
+       * utils/rtkit: new spell, realtime policy and watchdog daemon
+
 2023-06-28 Treeve Jelbert <treeve AT sourcemage.org>
        * KDE_FUNCTIONS: tweak build options
 
diff --git a/utils/rtkit/BUILD b/utils/rtkit/BUILD
new file mode 100755
index 0000000..21a90a1
--- /dev/null
+++ b/utils/rtkit/BUILD
@@ -0,0 +1,2 @@
+OPTS="$OPTS $TESTS" &&
+default_build
diff --git a/utils/rtkit/CONFIGURE b/utils/rtkit/CONFIGURE
new file mode 100755
index 0000000..0ddeb9c
--- /dev/null
+++ b/utils/rtkit/CONFIGURE
@@ -0,0 +1,4 @@
+. "${GRIMOIRE}/MESON_CONFIGURE" &&
+config_query_option TESTS "Install tests?" n \
+                          "installed_tests=true" \
+                          "installed_tests=false"
diff --git a/utils/rtkit/DEPENDS b/utils/rtkit/DEPENDS
new file mode 100755
index 0000000..90cd107
--- /dev/null
+++ b/utils/rtkit/DEPENDS
@@ -0,0 +1,12 @@
+. "${GRIMOIRE}/MESON_DEPENDS" &&
+depends PKG-CONFIG            &&
+depends dbus                  &&
+depends libcap                &&
+depends vim                   && # need it for 'xxd' binary
+
+optional_depends systemd               \
+                 'libsystemd=enabled'  \
+                 'libsystemd=disabled' \
+                 'Use systemd?'        &&
+
+optional_depends policykit '' '' 'policykit support'
diff --git a/utils/rtkit/DETAILS b/utils/rtkit/DETAILS
new file mode 100755
index 0000000..b75350f
--- /dev/null
+++ b/utils/rtkit/DETAILS
@@ -0,0 +1,52 @@
+. "${GRIMOIRE}/MESON_FUNCTIONS"
+           SPELL=rtkit
+         VERSION=0.13
+          SOURCE=$SPELL-$VERSION.tar.gz
+SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
+   
SOURCE_URL[0]=https://github.com/heftig/${SPELL}/archive/v${VERSION}.tar.gz
+     
SOURCE_HASH=sha256:0f9508530868109f0348e044cc1b20893672875467ace6d847ba6364274de003
+      LICENSE[0]=GPL
+        WEB_SITE=https://github.com/heftig/rtkit
+         ENTERED=20230705
+        KEYWORDS="utils dbus daemon"
+           SHORT="realtime policy and watchdog daemon"
+cat << EOF
+RealtimeKit is a D-Bus system service that changes the
+scheduling policy of user processes/threads to SCHED_RR
+(i.e. realtime scheduling mode) on request. It is intended to
+be used as a secure mechanism to allow real-time scheduling to
+be used by normal user processes.
+
+RealtimeKit enforces strict policies when handing out
+real-time security to user threads:
+
+* Only clients with RLIMIT_RTTIME set will get RT scheduling
+
+* RT scheduling will only be handed out to processes with
+  SCHED_RESET_ON_FORK set to guarantee that the scheduling
+  settings cannot 'leak' to child processes, thus making sure
+  that 'RT fork bombs' cannot be used to bypass RLIMIT_RTTIME
+  and take the system down.
+
+* Limits are enforced on all user controllable resources, only
+  a maximum number of users, processes, threads can request RT
+  scheduling at the same time.
+
+* Only a limited number of threads may be made RT in a
+  specific time frame.
+
+* Client authorization is verified with PolicyKit
+
+RealtimeKit can also be used to hand outh high priority
+scheduling (i.e. negative nice level) to user processes.
+
+In addition to this a-priori policy enforcement, RealtimeKit
+also provides a-posteriori policy enforcement, i.e. it
+includes a canary-based watchdog that automatically demotes
+all real-time threads to SCHED_OTHER should the system
+overload despite the logic pointed out above.
+
+In its duty to manage real-time scheduling *securely*
+RealtimeKit runs as unprivileged user, and uses capabilities,
+resource limits and chroot() to minimize its security impact.
+EOF
diff --git a/utils/rtkit/HISTORY b/utils/rtkit/HISTORY
new file mode 100644
index 0000000..d0b8c40
--- /dev/null
+++ b/utils/rtkit/HISTORY
@@ -0,0 +1,3 @@
+2023-07-05 Conner Clere <xenanthropy AT sourcemage.org>
+       * BUILD, CONFIGURE, DEPENDS, DETAILS: ver 0.13, new spell
+