From gjelinek@sac.sfbay.sun.com Wed May 19 11:55:56 2010 Received: from sunmail6brm.central.sun.com (sunmail6brm.Central.Sun.COM [129.147.4.169]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o4JItuui011587 for ; Wed, 19 May 2010 11:55:56 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail6brm.central.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o4JIttY5023066; Wed, 19 May 2010 13:55:56 -0500 (CDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0L2O00F07KL7K400@brm-avmta-1.central.sun.com>; Wed, 19 May 2010 12:55:55 -0600 (MDT) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0L2O00BBUKL7X230@brm-avmta-1.central.sun.com>; Wed, 19 May 2010 12:55:55 -0600 (MDT) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o4JIttUa008887; Wed, 19 May 2010 11:55:55 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o4JItqFN011581; Wed, 19 May 2010 11:55:52 -0700 (PDT) Received: (from gjelinek@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id o4JItqBe011577; Wed, 19 May 2010 11:55:52 -0700 (PDT) Date: Wed, 19 May 2010 11:55:52 -0700 (PDT) From: Gerald Jelinek Subject: PRIV_SYS_RES_BIND privilege [PSARC/2010/181 Self Review] To: PSARC-ext@sun.com Message-id: <201005191855.o4JItqBe011577@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 1705 I'm sponsoring this closed approved automatic case for myself. If anyone feels this needs to be a fasttrack, I'm happy to change it. Thanks, Jerry Template Version: @(#)sac_nextcase 1.70 03/30/10 SMI This information is Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved. 1. Introduction 1.1. Project/Component Working Name: PRIV_SYS_RES_BIND privilege 1.2. Name of Document Author/Supplier: Author: Gerald Jelinek 1.3 Date of This Document: 19 May, 2010 4. Technical Description On some hardware platforms it is necessary to control the binding of processes to processor sets so that acceptable performance can be achieved. Within a zone, it is not possible to do this binding, which is controlled by the PRIV_SYS_RES_CONFIG privilege (see privileges(5)). This privilege cannot be assigned to a zone since it controls too many other capabilities which are unsafe within a zone. We will create a new privilege PRIV_SYS_RES_BIND which allows a process to bind processes to processor sets. This privilege can be assigned to a zone, although it will not be assigned by default. This new privilege is a subset of PRIV_SYS_RES_CONFIG, so only having PRIV_SYS_RES_CONFIG will still allow a process to bind processes to processor sets. Requesting patch binding, although there are no current plans to backport this to S10. Interface Table PRIV_SYS_RES_BIND Committed PSARC/2002/188 Least Privilege for Solaris defined the privilege constants as Stable using the old taxonomy. 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: Automatic 6.6. ARC Exposure: open