Hacker News new | ask | show | jobs
by throwawaysysd 1609 days ago
You can still get realtime priority for threads without rtkit but you will have to set the appropriate permissions on your user. See the section on privileges: https://www.man7.org/linux/man-pages/man7/sched.7.html

I wouldn't suggest giving those permissions to your user because it opens up the possibility of a denial of service. With those permissions, any program running as your user can spawn lots of realtime threads that can take over the scheduler and lock the system up. This was detailed in the rtkit announcement, and preventing it is the reason rtkit exists: http://lalists.stanford.edu/lad/2009/06/0191.html

Maybe realtime audio is not important to you, and that's fine. But it's never as simple as "delete these things and now I have a secure system", you may be trading off security elsewhere to get that. Please also note that pkexec is not required to use polkit. You can remove pkexec and still have a functioning polkit installation and still use all those other daemons too. For a really secure system you may want to remove all suid binaries anyway and only use polkit or SELinux or something.

1 comments

So essentially a whole another daemon/service designed to provide a fake permission system for real-time privileges?
Nothing fake about it? That is one of the actions that RealtimeKit allows clients to request:

    $ pkaction --action-id org.freedesktop.RealtimeKit1.acquire-high-priority --verbose org.freedesktop.RealtimeKit1.acquire-high-priority:
      description:       Grant high priority scheduling to a user process
      message:           Authentication is required to grant an application high priority scheduling
      vendor:            Lennart Poettering
      vendor_url:        
      icon:              
      implicit any:      no
      implicit inactive: yes
      implicit active:   yes
In the default configuration that will be granted to clients that are part of a local console session, but denied to clients that are not (e.g., batch jobs, SSH). That policy can be further customized by the OS vendor, organization, site, or local admin in quite a flexible way.