pyrox.dev
1{ lib, ... }:
2
3{
4 name = "rtkit";
5
6 meta.maintainers = with lib.maintainers; [ rvl ];
7
8 nodes.machine =
9 { config, pkgs, ... }:
10 {
11 assertions = [
12 {
13 assertion = config.security.polkit.enable;
14 message = "rtkit needs polkit to handle authorization";
15 }
16 ];
17
18 imports = [ ./common/user-account.nix ];
19 services.getty.autologinUser = "alice";
20
21 security.rtkit.enable = true;
22
23 # Modified configuration with higher maximum realtime priority.
24 specialisation.withHigherPrio.configuration = {
25 security.rtkit.args = [
26 "--max-realtime-priority=89"
27 "--our-realtime-priority=90"
28 ];
29 };
30
31 # Target process for testing - belongs to a logind session.
32 systemd.user.services.sleeper = {
33 description = "Guinea pig service";
34 serviceConfig = {
35 ExecStart = "@${pkgs.coreutils}/bin/sleep sleep inf";
36 # rtkit-daemon won't grant real-time to threads unless they have a rttime limit.
37 LimitRTTIME = 200000;
38 };
39 wantedBy = [ "default.target" ];
40 };
41
42 # Target process for testing - doesn't belong to a session.
43 systemd.services."sleeper@" = {
44 description = "Guinea pig system service for %I";
45 serviceConfig = {
46 ExecStart = "@${pkgs.coreutils}/bin/sleep sleep inf";
47 LimitRTTIME = 200000;
48 User = "%I";
49 };
50 };
51 systemd.targets.multi-user.wants = [ "sleeper@alice.service" ];
52
53 # Install chrt to check outcomes of rtkit calls
54 environment.systemPackages = [ pkgs.util-linux ];
55
56 # Provide a little logging of polkit checks - otherwise it's
57 # impossible to know what's going on.
58 security.polkit.debug = true;
59 security.polkit.extraConfig = ''
60 polkit.addRule(function(action, subject) {
61 const ns = "org.freedesktop.RealtimeKit1.";
62 const acquireHighPrio = ns + "acquire-high-priority";
63 const acquireRT = ns + "acquire-real-time";
64 if (action.id == acquireHighPrio || action.id == acquireRT) {
65 polkit.log("rtkit: Checking " + action.id + " for " + subject.user + "\n " + subject);
66 }
67 });
68 '';
69 };
70
71 interactive.nodes.machine =
72 { pkgs, ... }:
73 {
74 security.rtkit.args = [ "--debug" ];
75 systemd.services.strace-rtkit =
76 let
77 target = "rtkit-daemon.service";
78 in
79 {
80 bindsTo = [ target ];
81 after = [ target ];
82 scriptArgs = target;
83 script = ''
84 pid=$(systemctl show -P MainPID $1)
85 strace -tt -s 100 -e trace=all -p $pid
86 '';
87 path = [ pkgs.strace ];
88 };
89 };
90
91 testScript =
92 { nodes, ... }:
93 let
94 specialisations = "${nodes.machine.system.build.toplevel}/specialisation";
95 uid = toString nodes.machine.users.users.alice.uid;
96 in
97 ''
98 import json
99 import shlex
100 from collections import namedtuple
101 from typing import Any, Optional
102
103 Result = namedtuple("Result", ["command", "machine", "status", "out", "value"])
104 Value = namedtuple("Value", ["type", "data"])
105
106 def busctl(node: Machine, *args: Any, user: Optional[str] = None) -> Result:
107 command = f"busctl --json=short {shlex.join(map(str, args))}"
108 if user is not None:
109 command = f"su - {user} -c {shlex.quote(command)}"
110 (status, out) = node.execute(command)
111 out = out.strip()
112 value = json.loads(out, object_hook=lambda x: Value(**x)) if status == 0 and out else None
113 return Result(command, node, status, out, value)
114
115 def assert_result_success(result: Result):
116 if result.status != 0:
117 result.machine.log(f"output: {result.out}")
118 raise Exception(f"command `{result.command}` failed (exit code {result.status})")
119
120 def assert_result_fail(result: Result):
121 if result.status == 0:
122 raise Exception(f"command `{result.command}` unexpectedly succeeded")
123
124 def rtkit_make_process_realtime(node: Machine, pid: int, priority: int, user: Optional[str] = None) -> Result:
125 return busctl(node, "call", "org.freedesktop.RealtimeKit1", "/org/freedesktop/RealtimeKit1", "org.freedesktop.RealtimeKit1", "MakeThreadRealtimeWithPID", "ttu", pid, 0, priority, user=user)
126
127 def get_max_realtime_priority() -> int:
128 result = busctl(machine, "get-property", "org.freedesktop.RealtimeKit1", "/org/freedesktop/RealtimeKit1", "org.freedesktop.RealtimeKit1", "MaxRealtimePriority")
129 assert_result_success(result)
130 assert result.value.type == "i", f"""Unexpected MaxRealtimePriority property type ({result.value})"""
131 return int(result.value.data)
132
133 def parse_chrt(out: str, field: str) -> str:
134 return next(map(lambda l: l.split(": ")[1], filter(lambda l: field in l, out.splitlines())))
135
136 def get_pid(node: Machine, unit: str, user: Optional[str] = None) -> int:
137 node.wait_for_unit(unit, user=user)
138 (status, out) = node.systemctl(f"show -P MainPID {unit}", user=user)
139 if status == 0:
140 return int(out.strip())
141 else:
142 node.log(out)
143 raise Exception(f"unable to determine MainPID of {unit} (systemctl exit code {status})")
144
145 def assert_sched(node: Machine, pid: int, policy: Optional[str] = None, priority: Optional[int] = None):
146 out = node.succeed(f"chrt -p {pid}")
147 node.log(out)
148 if policy is not None:
149 thread_policy = parse_chrt(out, "policy")
150 assert policy in thread_policy, f"Expected {policy} scheduling policy, but got: {thread_policy}"
151 if priority is not None:
152 thread_priority = parse_chrt(out, "priority")
153 assert str(priority) == thread_priority, f"Expected scheduling priority {priority}, but got: {thread_priority}"
154
155 machine.wait_for_unit("basic.target")
156
157 rtprio = 20
158 higher_rtprio = 42
159 max_rtprio = get_max_realtime_priority()
160
161 with subtest("maximum sched_rr priority"):
162 assert max_rtprio >= rtprio, f"""MaxRealtimePriority ({max_rtprio}) too low"""
163 assert higher_rtprio > max_rtprio, f"""Test value higher_rtprio ({higher_rtprio}) insufficient compared to MaxRealtimePriority ({max_rtprio})"""
164
165 # wait for autologin and systemd user service manager
166 machine.wait_for_unit("multi-user.target")
167 machine.wait_for_unit("user@${uid}.service")
168
169 with subtest("polkit sanity check"):
170 pid = get_pid(machine, "sleeper.service", user="alice")
171 machine.succeed(f"pkcheck -p {pid} -a org.freedesktop.RealtimeKit1.acquire-real-time")
172
173 with subtest("chrt sanity check"):
174 print(machine.succeed("chrt --rr --max"))
175 pid = get_pid(machine, "sleeper.service", user="alice")
176 machine.succeed(f"chrt --rr --pid {rtprio} {pid}")
177 assert_sched(machine, pid, policy="SCHED_RR", priority=rtprio)
178 machine.stop_job("sleeper.service", user="alice")
179 machine.start_job("sleeper.service", user="alice")
180
181 # Permission granted by policy from rtkit package.
182 with subtest("local user process can acquire real-time scheduling"):
183 pid = get_pid(machine, "sleeper.service", user="alice")
184 result = rtkit_make_process_realtime(machine, pid, rtprio, user="alice")
185 assert_result_success(result)
186 assert_sched(machine, pid, policy="SCHED_RR", priority=rtprio)
187
188 # User must not get higher priority than the maximum
189 with subtest("real-time scheduling priority is limited"):
190 machine.stop_job("sleeper.service", user="alice")
191 machine.start_job("sleeper.service", user="alice")
192 pid = get_pid(machine, "sleeper.service", user="alice")
193 with machine.nested("rtkit call must fail"):
194 result = rtkit_make_process_realtime(machine, pid, max_rtprio + 1, user="alice")
195 assert_result_fail(result)
196 assert_sched(machine, pid, policy="SCHED_OTHER")
197
198 # This is a local shop for local people - we'll have no trouble here.
199 # In this test, the target process belongs to alice, but doesn't
200 # have a user session, so it's considered non-local.
201 with subtest("non-local user process cannot acquire real-time scheduling"):
202 pid = get_pid(machine, "sleeper@alice.service")
203 with machine.nested("rtkit call must fail"):
204 result = rtkit_make_process_realtime(machine, pid, rtprio, "alice")
205 assert_result_fail(result)
206 assert_sched(machine, pid, policy="SCHED_OTHER")
207
208 # Switch to alternate configuration then ask for higher priority.
209 with subtest("command-line arguments allow increasing maximum rtprio"):
210 machine.succeed("${specialisations}/withHigherPrio/bin/switch-to-configuration test")
211 pid = get_pid(machine, "sleeper.service", user="alice")
212 result = rtkit_make_process_realtime(machine, pid, higher_rtprio, user="alice")
213 assert_result_success(result)
214 assert_sched(machine, pid, policy="SCHED_RR", priority=higher_rtprio)
215 '';
216}