Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying grant a user the CAP_SYS_RESOURCE linux capability on an Ubuntu 10.04 machine. I need this so that a process run by this user can write to /proc/self/oom_adj (yes I realize this this is deprecated but I'm going to be stuck on kernel 2.6.32 for a while).

I've installed libcap2 and libcap2-bin. I've granted the user the cap_sys_resource capability in /etc/security/capability.conf and I've verified that pam_cap.so is loaded via pam but I'm still unable to lower my oom_adj score. I've re-initiated sessions after any change to this file and I have even rebooted. I've tried using the value of CAP_SYS_RESOURCE (24, from /usr/include/linux/capabilities.h) in capability.conf instead of the name but that didn't help either.

$ cat /proc/$$/oom_adj
0
$ echo -1 > /proc/$$/oom_adj
-bash: echo: write error: Permission denied
$ echo 1 > /proc/$$/oom_adj
$ cat /proc/$$/oom_adj
1

$ egrep -v "^#" /etc/security/capability.conf 
cap_sys_resource delete
none *

(yes the username is delete)

As far as I can tell, I am properly getting this capability

$ getpcaps $$
Capabilities for `10366': = cap_sys_resource+i

Am I missing something here? Am I doing something obviously wrong? Any pointers are appreciated.

Thanks!

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

I never figured out how to do this at a session\process level, but the workaround I used was

$ sudo setcap cap_sys_resource=pe my_program

So with file based capabilities set I was able to write to /proc/self/oom_adj

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.