pam: do not sort user sessions into their own cgroups in the 'cpu' hierarchy by default

While this offers quite a few benefits for normally scheduled processes
this breaks RT scheduling for all user processes, since we do not assign
an RT share to the cgroups created via this mechanism. If the user
cgroups have no RT share assigned no member process can make use of RT
functionality. However, software like JACK and PA/rtkit assume that RT
is available in some way or another, either via RLIMIT_RTPRIO or via
some privileged service. Creating implicit cpu cgroups but not adding
RT shares to them hence breaks these applications.

There is no sane way to implicitly add RT shares to these groups, since
they are pulled from a global, limited pool and it would hence be very
hard to make this work without limiting the number of concurrent
sessions, or constantly rewriting the cpu share settings of already
logged in session cgroups.

Most likely this issue needs to be fixed in-kernel because we can enable
this feature by default again.

diff --git a/src/pam-module.c b/src/pam-module.c
index 54a7b451e8b540de180395aee9305e3f9e09035f..6fbaecf51d83543e3a1ce7c945435ae71e1b055e 100644 (file)
--- a/src/pam-module.c
+++ b/src/pam-module.c
@@ -102,6 +102,7 @@ static int parse_argv(pam_handle_t *handle,
                 }
         }
 
+#if 0
         if (!controller_set && controllers) {
                 char **l;
 
@@ -112,6 +113,7 @@ static int parse_argv(pam_handle_t *handle,
 
                 *controllers = l;
         }
+#endif
 
         if (controllers)
                 strv_remove(*controllers, "name=systemd");