FS#62316 - [rtkit] 0.12-1 doesn't work with hidepid=2 due to CAP_SYS_PTRACE removal

Attached to Project: Arch Linux
Opened by Sam (smudge) - Friday, 12 April 2019, 01:48 GMT
Last edited by Jan Alexander Steffens (heftig) - Sunday, 20 October 2019, 22:08 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To No-one
Architecture All
Severity Medium
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:

Using the hidepid=2 proc mount option leads to many "rtkit-daemon[pid]: Failed to look up client: No such file or directory" and "rtkit-daemon[pid]: Supervising 0 threads of 0 processes of 1 users." messages in the journal and pulseaudio not receiving its adjusted priority and niceness. hidepid=2 could be the cause of https://github.com/heftig/rtkit/issues/8. Rebuilding rtkit without https://github.com/heftig/rtkit/commit/946812433a50fb1e2ef815115c5197700f27afaa solves the problem.

Steps to reproduce:
Mount proc with hidepid=2
This task depends upon

Closed by  Jan Alexander Steffens (heftig)
Sunday, 20 October 2019, 22:08 GMT
Reason for closing:  Upstream
Additional comments about closing:  https://github.com/heftig/rtkit/issues/9
Comment by Jake Kreiger (Magali75) - Friday, 12 April 2019, 12:15 GMT
Users who use hidepid are supposed to adjust their systems themselves and rtkit isn't the only place to do that, see https://wiki.archlinux.org/index.php/Security#hidepid

"The proc group, provided by the filesystem package, acts as a whitelist of users authorized to learn other users' process information. If users or services need access to /proc/<pid> directories beyond their own, add them to the group. "

It's not acceptable to decrease everyone else security only because some people can't configure their systems properly.
Comment by Sam (smudge) - Friday, 12 April 2019, 15:36 GMT
Sorry I should have mentioned in the report that I had tried adding the rtkit user to the proc group and tried adding a SupplementaryGroups=proc override.conf to the rtkit-daemon.service neither of which worked. If I'm missing something or you have some tip to get it to work I'm all ears.
Comment by Jake Kreiger (Magali75) - Friday, 12 April 2019, 16:45 GMT
Perhaps rtkit is too stupid to be used with hidepid then.

If you don't do professional audio recording you may add:
high-priority = no
realtime-scheduling = no

to /etc/pulse/daemon.conf.d/no-rt.conf which should stop spawning rtkit.

Loading...