Re: Successfully locked memory using mlockAll

[Henrique Almeida <hdante.lnls@gmail.com>]

 Hello, but these messages may appear to non root users, and are not really related to being root or not, but to the real time operations in libCom. For example:

[henrique.almeida@SOL1-HOST1 linux-x86]$ cp caget /tmp/

[henrique.almeida@SOL1-HOST1 linux-x86]$ cd /tmp/

[henrique.almeida@SOL1-HOST1 tmp]$ sudo setcap 'cap_sys_nice+ep cap_ipc_lock+ep' ./caget 

[henrique.almeida@SOL1-HOST1 tmp]$ ./caget LNLS:ANEL:corrente

Successfully locked memory using mlockAll

LNLS:ANEL:corrente             227.682

 In the example above, standard non-root user saw the debug message even though he's not root, only because I activated real time support.

 This looks like a design bug to me, because a helper library is writing on the standard error on behalf of the application when it was not asked for doing it. Can this feature be disabled ?

2015-11-23 19:44 GMT-02:00 Andrew Johnson <anj@aps.anl.gov>:

Hi,

On 11/23/2015 01:20 PM, Henrique Dante de Almeida wrote:
>
>  Hello, I'm testing EPICS base v 3.15 on a fresh Red Hat 6.6
> installation and after compiling, executing caget always returns
> the message "Successfully locked memory using mlockAll":
>
> [root@SOL1-HOST1 linux-x86]# ./caget LNLS:ANEL:corrente
> Successfully locked memory using mlockAll
> Successfully locked memory using mlockAll
> LNLS:ANEL:corrente             161.585
> [root@SOL1-HOST1 linux-x86]# cd
> [root@SOL1-HOST1 ~]# caget LNLS:ANEL:corrente
> Successfully locked memory using mlockAll
> LNLS:ANEL:corrente             161.553
> [root@SOL1-HOST1 ~]# caget LNLS:ANEL:corrente
> Successfully locked memory using mlockAll
> LNLS:ANEL:corrente             161.553
> (etc.)
>
> Can the message be removed ? Here is what seems to be the relevant
> commit:
>
> https://code.launchpad.net/~mshankar/epics-base/memlock_linux/+merge/232466

Those messages will be printed to stderr if you run caget (or any other
program linked with our libCom library) as root. Using the root account
to run programs that don't need such privilege is a bad idea from a
computer security perspective though. Some sites do need to run certain
IOCs with root privilege to enable the real-time scheduler (which then
makes it desirable to lock the IOC code into physical RAM) or to access
certain I/O hardware from user-space, but in most cases we'd recommend
that you use a non-root account for programs like caget/caput/camonitor.

- Andrew

--
Light thinks it travels faster than anything but it is wrong.
No matter how fast light travels, it finds the darkness has
always got there first, and is waiting for it.
    -- Terry Pratchett, Reaper Man