memory pressure documentation - requires CAP_SYS_RESOURCE

[grooverdan]

Component

systemd

Is your feature request related to a problem? Please describe

Sorry to say, at the same time you where adding MEMORY_PRESSURE PSI path by environment variable, Google limited it to services with CAP_SYS_RESOURCE capabilities - https://lore.kernel.org/all/20230303011346.3342233-1-surenb@google.com/ (effectively same patch in kernel).

Describe the solution you'd like

Stopgap documentation update to say SYS_RESOURCE is needed.

Advance the idea of providing a AF_UNIX socket so pid with is super capabilities can act as a proxy for less capable(ity) services.

Describe alternatives you've considered

cap_sys_resource for the service and dropping it after the file is memory.pressure is open.

The systemd version you checked that didn't have the feature you are asking for

No response

[bluca]

ugh this is a pain, as it makes it impossible to run services using user namespaces, can that be reverted?

[poettering]

This was relaxed again:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d82caa273565b45fcf103148950549af76c314b0

[bluca]

actually turns out it's not, there's a bug, the cgroup maintainers will take care of it shortly thankfully

[bluca]

Here's the fix: https://lore.kernel.org/all/CAMw=ZnQ56cm4Txgy5EhGYvR+Jt4s-KVgoA9_65HKWVMOXp7a9A@mail.gmail.com/T/#m3bd2a73c5ee49965cb73a830b1ccaa37ccf4e427

[grooverdan]

I'm very relieved. Thank you.

[grooverdan]

fix in 6.7-rc2 under "sched: psi: fix unprivileged polling against cgroups"