On Friday 17 Aug 2018 at 11:57:31 (+0100), Patrick Bellasi wrote:

On 17-Aug 11:34, Quentin Perret wrote:

quoted

Hi Patrick,

On Thursday 09 Aug 2018 at 16:23:13 (+0100), Patrick Bellasi wrote:

quoted

On 09-Aug 11:50, Juri Lelli wrote:

quoted

On 09/08/18 10:14, Patrick Bellasi wrote:

quoted

On 07-Aug 14:35, Juri Lelli wrote:

quoted

On 06/08/18 17:39, Patrick Bellasi wrote:

[...]

quoted

quoted

1) make CAP_SYS_NICE protected the clamp groups, with an optional boot
   time parameter to relax this check

It seems to me that this might work well with that the intended usage of
the interface that you depict above. SMS only (or any privileged user)
will be in control of how groups are configured, so no problem for
normal users.

Yes, well... apart normal users still getting a -ENOSPC is they are
requesting one of the not pre-configured clamp values. Which is why
the following bits can be helpful.

So IIUC, normal users would still be free of choosing their clamp values
as long as they choose one in the list of pre-allocated ones ? Is that
correct ?

No, with the CAP_SYS_NICE/ADMIN guard in place, as discussed above in
point 1, the syscall will just fail for normal users.

Right, I just misunderstood then :-)
Sorry for the noise ...

Thanks,
Quentin