Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Fri, 24 Apr 2020 16:38:59 +0100
From:   Chris Down <chris@chrisdown.name>
To:     Suren Baghdasaryan <surenb@google.com>
Cc:     Johannes Weiner <hannes@cmpxchg.org>,
        Peter Zijlstra <peterz@infradead.org>,
        linux-kernel@vger.kernel.org
Subject: PSI poll() support for unprivileged users
Message-ID: <20200424153859.GA1481119@chrisdown.name>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hi Suren,

I noticed that one restriction of the PSI poll() interface is that currently 
only root can set up new triggers. Talking to Johannes, it seems the reason for 
this was that you end up with a realtime kernel thread for every cgroup where a 
trigger is set, and this could be used by unprivileged users to sap resources.

I'm building a userspace daemon for desktop users which notifies based on 
pressure events, and it's particularly janky to ask people to run such a 
notifier as root: the notification mechanism is usually tied to the user's 
display server auth, and the surrounding environment is generally pretty 
important to maintain. In addition to this, just in general this doesn't feel 
like the kind of feature that by its nature needs to be restricted to root -- 
it seems reasonable that there would be unprivileged users which want to use 
this, and that not using RT threads would be acceptable in that scenario.

Have you considered making the per-cgroup RT threads optional? If the 
processing isn't done in the FIFO kthread for unprivileged users, I think it 
should be safe to allow them to write to pressure files (perhaps with some 
additional limits or restrictions on things like the interval, as needed).

Thanks!

Chris