如何为Linux用户设置CAP_SYS_NICE功能? [英] How to set CAP_SYS_NICE capability to a Linux user?

问题描述

我的程序正在使用Linux系统调用setpriority()来更改其创建的线程的优先级.它需要设置负优先级(-10)，但是，如文档中所述，以普通用户身份运行时，此操作将失败.

My program is using the Linux system call setpriority() to change the priorities of the threads it creates. It needs to set negative priorities (-10) but, as mentioned on the documentation, this fails when run as a normal user.

用户需要CAP_SYS_NICE功能，以便能够根据需要设置优先级，但是我不知道如何为用户提供这种功能.

The user needs the CAP_SYS_NICE capability to be able to set the priorities as he wants, but I have no idea how to give such capability to the user.

所以我的问题是:如何为Linux用户设置CAP_SYS_NICE功能?

So my question: how to set CAP_SYS_NICE capability to a Linux user?

推荐答案

Jan Hudec说对了，一个进程不能仅仅为其自身提供能力，而setuid包装器显然是获得该能力的方法.另外，请记住，删除根目录时需要prctl(PR_SET_KEEPCAPS, ...). (有关详细信息，请参见prctl手册页.)否则，当您转换为非root用户身份时，将删除该功能.

Jan Hudec is right that a process can't just give itself a capability, and a setuid wrapper is the obvious way get the capability. Also, keep in mind that you'll need to prctl(PR_SET_KEEPCAPS, ...) when you drop root. (See the prctl man page for details.) Otherwise, you'll drop the capability when you transition to your non-root real user id.

如果您真的只是想以允许的不同允许级别启动用户会话，则可能会看到pam_limits和limits.conf手册页，因为pam_limits模块允许您更改硬限制.可能是这样的一行:

If you really just want to launch user sessions with a different allowed nice level, you might see the pam_limits and limits.conf man pages, as the pam_limits module allows you to change the hard nice limit. It could be a line like:

yourspecialusername hard nice -10

这篇关于如何为Linux用户设置CAP_SYS_NICE功能?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！