Realtime Linux Security Module
Posted on December 28th, 2006 by joey. Filed in linux, kernel.No comments yet. Be the first to comment!
Audio and video applications require low latency times in order to deliver high data rate content. On Linux, if you want to run audio applications such as Ardour or Rosegarden, which use JACK, then you either have to be willing to run them as root, or you have to set up the Realtime Linux Security Module. Realtime LSM allows non-root users to run applications with realtime priority, meaning that your audio apps can take priority over other processes.
There are a lot of HOWTOs out there that provide a good description of how to build a Linux kernel. I don’t want to write another one here, so if you’ve never compiled a Linux kernel before, you can hit Google up for the terms “Linux kernel build HOWTO” and bask in the wonders of the information age. I’ll summarize my own experience here in brief.
I’m running Fedora Core 6 on an older IBM ThinkPad. The sources that live under /usr/src/kernels/2.6.18-1.2798.fc6-i586/ were useless because they didn’t compile. What you want to do is go fetch the official Kernel sources. I unpacked the kernel sources under /usr/src/, creating the directory /usr/src/linux-2.6.18/. I then copied /usr/src/kernels/2.6.18-1.2798.fc6-i586/.conf to /usr/src/linux-2.6.18/.conf.
I couldn’t get the patch for Realtime LSM to apply cleanly, but it’s a simple patch, so I was able to manually fix it up. patch was ignoring or misreading directory information in the patch, so it dumped new files into the root of the kernel sources and tried to patch the wrong make file (I’d love to know how to fix that, but no -p option seemed to work). I had to move realtime.c into the security directory, and manually update security/Makefile to add the line from the patch. Then I edited .config to make sure that the following directives had the correct values:
CONFIG_MODULES=y
CONFIG_MODULE_UNLOAD=y
CONFIG_SECURITY=y
CONFIG_SECURITY_CAPABILITIES=m
I manually added the following line to .config, which would have gotten added automatically if I’d run $ make config.
CONFIG_SECURITY_REALTIME=m
Once all that was in place, the build process was simple, if time consuming:
$ sudo make bzImage
$ sudo make modules
$ sudo make modules_install
$ sudo make install
The install procedure will automatically update /etc/grub.conf so that you can select the new kernel from a list the next time you boot up. I updated /etc/grub.conf manually to make sure my custom kernel had a unique label since by default it was labeled as a Fedora Core kernel. Once you’ve rebooted and verified that the new kernel works, it’s time to load the realtime module. Since my GID is 500, I used the following command:
$ sudo /sbin/modprobe realtime gid=500
Note the capitalization on “gid”. You’ll pull out a lot less hair if you remember that it’s case sensitive. You can tell that the realtime module is working by running $ jackd -R -d alsa. If realtime isn’t working, then you’ll get a permissions error.



