Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Conner Clere (0e2378eb443320bb47ee268e39cc4e1f8720a28c)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Conner Clere <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Conner Clere (0e2378eb443320bb47ee268e39cc4e1f8720a28c)
  • Date: Thu, 6 Jul 2023 04:14:45 +0000

GIT changes to master grimoire by Conner Clere <xenanthropy AT sourcemage.org>:

ChangeLog | 3 ++
utils/rtkit/BUILD | 2 +
utils/rtkit/CONFIGURE | 4 +++
utils/rtkit/DEPENDS | 12 +++++++++++
utils/rtkit/DETAILS | 52
++++++++++++++++++++++++++++++++++++++++++++++++++
utils/rtkit/HISTORY | 3 ++
6 files changed, 76 insertions(+)

New commits:
commit 0e2378eb443320bb47ee268e39cc4e1f8720a28c
Author: Conner Clere <xenanthropy AT sourcemage.org>
Commit: Conner Clere <xenanthropy AT sourcemage.org>

utils/rtkit: new spell, realtime plicy and watchdog daemon

diff --git a/ChangeLog b/ChangeLog
index 2c245cd..862e199 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+2023-07-05 Conner Clere <xenanthropy AT sourcemage.org>
+ * utils/rtkit: new spell, realtime policy and watchdog daemon
+
2023-06-28 Treeve Jelbert <treeve AT sourcemage.org>
* KDE_FUNCTIONS: tweak build options

diff --git a/utils/rtkit/BUILD b/utils/rtkit/BUILD
new file mode 100755
index 0000000..21a90a1
--- /dev/null
+++ b/utils/rtkit/BUILD
@@ -0,0 +1,2 @@
+OPTS="$OPTS $TESTS" &&
+default_build
diff --git a/utils/rtkit/CONFIGURE b/utils/rtkit/CONFIGURE
new file mode 100755
index 0000000..0ddeb9c
--- /dev/null
+++ b/utils/rtkit/CONFIGURE
@@ -0,0 +1,4 @@
+. "${GRIMOIRE}/MESON_CONFIGURE" &&
+config_query_option TESTS "Install tests?" n \
+ "installed_tests=true" \
+ "installed_tests=false"
diff --git a/utils/rtkit/DEPENDS b/utils/rtkit/DEPENDS
new file mode 100755
index 0000000..90cd107
--- /dev/null
+++ b/utils/rtkit/DEPENDS
@@ -0,0 +1,12 @@
+. "${GRIMOIRE}/MESON_DEPENDS" &&
+depends PKG-CONFIG &&
+depends dbus &&
+depends libcap &&
+depends vim && # need it for 'xxd' binary
+
+optional_depends systemd \
+ 'libsystemd=enabled' \
+ 'libsystemd=disabled' \
+ 'Use systemd?' &&
+
+optional_depends policykit '' '' 'policykit support'
diff --git a/utils/rtkit/DETAILS b/utils/rtkit/DETAILS
new file mode 100755
index 0000000..b75350f
--- /dev/null
+++ b/utils/rtkit/DETAILS
@@ -0,0 +1,52 @@
+. "${GRIMOIRE}/MESON_FUNCTIONS"
+ SPELL=rtkit
+ VERSION=0.13
+ SOURCE=$SPELL-$VERSION.tar.gz
+SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
+
SOURCE_URL[0]=https://github.com/heftig/${SPELL}/archive/v${VERSION}.tar.gz
+
SOURCE_HASH=sha256:0f9508530868109f0348e044cc1b20893672875467ace6d847ba6364274de003
+ LICENSE[0]=GPL
+ WEB_SITE=https://github.com/heftig/rtkit
+ ENTERED=20230705
+ KEYWORDS="utils dbus daemon"
+ SHORT="realtime policy and watchdog daemon"
+cat << EOF
+RealtimeKit is a D-Bus system service that changes the
+scheduling policy of user processes/threads to SCHED_RR
+(i.e. realtime scheduling mode) on request. It is intended to
+be used as a secure mechanism to allow real-time scheduling to
+be used by normal user processes.
+
+RealtimeKit enforces strict policies when handing out
+real-time security to user threads:
+
+* Only clients with RLIMIT_RTTIME set will get RT scheduling
+
+* RT scheduling will only be handed out to processes with
+ SCHED_RESET_ON_FORK set to guarantee that the scheduling
+ settings cannot 'leak' to child processes, thus making sure
+ that 'RT fork bombs' cannot be used to bypass RLIMIT_RTTIME
+ and take the system down.
+
+* Limits are enforced on all user controllable resources, only
+ a maximum number of users, processes, threads can request RT
+ scheduling at the same time.
+
+* Only a limited number of threads may be made RT in a
+ specific time frame.
+
+* Client authorization is verified with PolicyKit
+
+RealtimeKit can also be used to hand outh high priority
+scheduling (i.e. negative nice level) to user processes.
+
+In addition to this a-priori policy enforcement, RealtimeKit
+also provides a-posteriori policy enforcement, i.e. it
+includes a canary-based watchdog that automatically demotes
+all real-time threads to SCHED_OTHER should the system
+overload despite the logic pointed out above.
+
+In its duty to manage real-time scheduling *securely*
+RealtimeKit runs as unprivileged user, and uses capabilities,
+resource limits and chroot() to minimize its security impact.
+EOF
diff --git a/utils/rtkit/HISTORY b/utils/rtkit/HISTORY
new file mode 100644
index 0000000..d0b8c40
--- /dev/null
+++ b/utils/rtkit/HISTORY
@@ -0,0 +1,3 @@
+2023-07-05 Conner Clere <xenanthropy AT sourcemage.org>
+ * BUILD, CONFIGURE, DEPENDS, DETAILS: ver 0.13, new spell
+



  • [SM-Commit] GIT changes to master grimoire by Conner Clere (0e2378eb443320bb47ee268e39cc4e1f8720a28c), Conner Clere, 07/06/2023

Archive powered by MHonArc 2.6.24.

Top of Page