I'm currently packaging LinuxCNC on NixOS, and I find some design choices rather appalling.
LinuxCNC tries very hard to detect whether it is real-time capable. And this logic is flawed in multiple ways, at least from my point of view.
rt_api explicitly checks for setuid as root, as opposed to, just the needed capabilities. I guess for uspace with PREEMPT_RT kernel cap_net_admin,cap_sys_nice,cap_sys_resource+p would suffice, but oh well.
- It does not check this on
argv[0] (the actual file executable), but on on EMC2_BIN_DIR "/rtapi_app", regardless of whether that is the file which was called.
- It does check this, before considering the
LINUXCNC_FORCE_REALTIME, silently rendering that mechanism useless.
Now, on NixOS this causes a problem, because all applications reside in /nix/store and never have the setuid bit (or any file based capabilities) set. For things like sudo or rtapi_app, we usually create a wrapper with setuid set under /run/wrappers/bin/, than dispatching (I'm not sure how, I believe via exec) to the actual executable in /nix/store.
Regardless of my niche use-case on running LinuxCNC on NixOS, in general, I think at least the LINUXCNC_FORCE_REALTIME should be honored in all cases.
|
struct stat st; |
|
if ((stat(EMC2_BIN_DIR "/rtapi_app", &st) < 0) |
|
|| st.st_uid != 0 || !(st.st_mode & S_ISUID)) |
|
return 0; |
|
return detect_env_override() || detect_preempt_rt() || detect_rtai() || detect_xenomai() || detect_xenomai_evl(); |
I'm currently packaging LinuxCNC on NixOS, and I find some design choices rather appalling.
LinuxCNC tries very hard to detect whether it is real-time capable. And this logic is flawed in multiple ways, at least from my point of view.
rt_apiexplicitly checks for setuid as root, as opposed to, just the needed capabilities. I guess for uspace with PREEMPT_RT kernelcap_net_admin,cap_sys_nice,cap_sys_resource+pwould suffice, but oh well.argv[0](the actual file executable), but on onEMC2_BIN_DIR "/rtapi_app", regardless of whether that is the file which was called.LINUXCNC_FORCE_REALTIME, silently rendering that mechanism useless.Now, on NixOS this causes a problem, because all applications reside in
/nix/storeand never have the setuid bit (or any file based capabilities) set. For things likesudoorrtapi_app, we usually create a wrapper with setuid set under/run/wrappers/bin/, than dispatching (I'm not sure how, I believe via exec) to the actual executable in/nix/store.Regardless of my niche use-case on running LinuxCNC on NixOS, in general, I think at least the
LINUXCNC_FORCE_REALTIMEshould be honored in all cases.linuxcnc/src/rtapi/uspace_common.h
Lines 412 to 416 in 568354c