How to set CAP_SYS_NICE capability to a Linux user?

linux real-time
CJlano picture CJlano · Oct 3, 2011 · Viewed 22.3k times · Source

My program is using the Linux system call setpriority() to change the priorities of the threads it creates. It needs to set negative priorities (-10) but, as mentioned on the documentation, this fails when run as a normal user.

The user needs the CAP_SYS_NICE capability to be able to set the priorities as he wants, but I have no idea how to give such capability to the user.

So my question: how to set CAP_SYS_NICE capability to a Linux user?

Answer

Ryan Armstrong picture Ryan Armstrong · May 30, 2016

There is a nice handy utility for setting capabilities on a binary: setcap. This needs to be run as root on your application binary, but once set, can be run as a normal user. Example:

$ sudo setcap 'cap_sys_nice=eip' <application>

You can confirm what capabilities are on an application using getcap:

$ getcap <application>
<application> = cap_sys_nice+eip

I'd suggest integrating the capabilities into your makefile in the install line, which is typically run as root anyhow. Note that capabilities cannot be stored in a TAR file or any derivative package formats. If you do package your application later on, you will need a script (postinst for Debian packages) to apply the capability on deploy.

Related questions

Which real-time priority is the highest priority in Linux

In the Linux real-time process priority range 1 to 99, it's unclear to me which is the highest priority, 1 or 99. Section 7.2.2 of "Understanding the Linux Kernel" (O'Reilly) says 1 is the highest priority, which makes sense considering that normal processes have static priorities …

Read More
Run process with realtime output in PHP

I am trying to run a process on a web page that will return its output in realtime. For example if I run 'ping' process it should update my page every time it returns a new line (right now, when …

Read More
Starting point for CLOCK_MONOTONIC

As I understand on Linux starting point for CLOCK_MONOTONIC is boot time. In my current work I prefer to use monotonic clock instead of CLOCK_REALTIME (for calculation) but in same time I need to provide human friendly timestamps (…

Read More