Re: Where is RLIMIT_RT_CPU?

[Jean-Marc Valin <Jean-Marc.Valin@USherbrooke.ca>]

> You can't have "random" users scheduling thing at real-time priorities.
> A real-time system can only work if it is set up as whole and all 
> real-time tasks are taken into consideration. If you allow a user to start 
> another real-time task, that task might destroy the real-time properties 
> of all the rest by taking too much cpu.
> 
> As I see it the only thing you can do is to use sudo to run anything,
> which needs real-time priority, with higher priviliges, than what a normal 
> user have. Then he can only start specific audio programs and can't crash 
> the system (unless those programs have a bug).

I though we were past that point a long time ago. Of course you don't
want *any* random user to have access to rt scheduling. However, you
*do* want the user logged-in on the console be allowed to run tasks with
rt priority (within some limits). Why? Because 1) you don't want to give
root access to any user who needs RT for some apps and 2) you don't want
to make all these apps suid root either. 

Think about it, would you really feel safe with your sound daemon,
Ekiga/Gnomemeeting, jackd, Amarok, mplayer, ... all being run setuid
root. Yet all these apps (and many others) can benefit from being
allowed a few percent CPU running at rt priority. Not to mention the
fact that you may actually want to do rt *development* as a regular
user. That's why people have come up with realtime-lsm, and more
recently, with SCHED_ISO and rt-limit. What's currently missing is just
the tiny bit that prevents the user from locking up the machine. Even
that one was done by Ingo, but unfortunately not merged in the mainline
kernel. Controlled properly, access to rt scheduling is no more
dangerous (and probably less) than fork(), malloc() or mlock(), all of
which can lock up a machine efficiently if unlimited use is allowed.

	Jean-Marc