Ricardo Branco
2d3dd0a4fc
RestrictRealtime= only filtered sched_setscheduler(). sched_setattr() can switch a task to SCHED_FIFO and SCHED_RR as well, and is the only way to get SCHED_DEADLINE, so a process that is otherwise allowed to use realtime scheduling (CAP_SYS_NICE, or a non-zero RLIMIT_RTPRIO) could bypass the restriction. The policy is passed in a struct sched_attr by pointer, which seccomp cannot inspect, so refuse the syscall altogether. This also affects non-realtime callers of sched_setattr() (nice, utilization clamps), which now get the same error as the refused policies. Document this in systemd.exec(5) and extend the test. CPUSchedulingPolicy= is applied through sched_setattr(), so a service manager running under RestrictRealtime=yes (e.g. in a container) could no longer start units with a non-realtime policy. Fall back to sched_setscheduler() on EPERM, which the filter still allows for these policies. This is not possible with CPUSchedulingResetOnFork=yes, as the filter refuses SCHED_RESET_ON_FORK too, so setting the policy still fails in that case. Signed-off-by: Ricardo Branco <rbranco@suse.de> (cherry picked from commit 590ff29a641a4ddb736ea59303af9721fc6c1400)
System and Service Manager
Details
Most documentation is available on systemd's website.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release