<p dir="ltr">Looks like another jira ticket is needed for Debian packaging.</p>
<div class="gmail_quote">On Sep 6, 2015 6:16 AM, "Anthony Minessale" <<a href="mailto:anthony.minessale@gmail.com">anthony.minessale@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">It's because FS changes the scheduler and enables some realtime threads when it can. If you have multiple cpu np and rp are the same. FS always needs root privs to change the platform parameters and nice level etc. The scheduler change is not possible if the shell is an unpriveledged user nor are a bunch of other things unless you carefully allowed them somehow as root before the shell started. S<span></span>o basically that is all expected behavior.<div><div><br></div><div><br></div><div><br><br>On Saturday, September 5, 2015, Bote Man <<a href="mailto:bote_radio@botecomm.com" target="_blank">bote_radio@botecomm.com</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Sorry, I did not use the utility named ‘runas’ I simply labeled the column that way and was trying to conserve character space in the header to get it to fit in a reasonable space.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Anyway, thanks to your post and some research I just changed my FS unit file to start FS as user root, but specified –u freeswitch –g freeswitch on the command line to FS, and changed the WorkingDirectory=/usr/local/freeswitch/bin (it had been set to ‘run’) and it’s doing the Right Thing, so that is what I will go with. I vaguely remember that FS can (should) start as root, then drops privileges to what is specified on the command line, so it looks like it is doing exactly that.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">‘top’ shows FS running as real and effective user ‘freeswitch’ with Priority=-2 and Nice=-10 so I am a happy camper.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">If nobody on the FS core development team has any objection to this approach I will update the Confluence page for the systemd unit file for building from MASTER. The Debian packages have their own file locations.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><a href="https://freeswitch.org/confluence/display/FREESWITCH/FreeSWITCH+1.6+Video#FreeSWITCH1.6Video-systemd" target="_blank">https://freeswitch.org/confluence/display/FREESWITCH/FreeSWITCH+1.6+Video#FreeSWITCH1.6Video-systemd</a><u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Any security concerns doing this?<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Thanks!<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Bote<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> <u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt"><div><div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in"><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Shaun Stokes<br><b>Sent:</b> Saturday, 05 September, 2015 03:18<br><b>Subject:</b> Re: [Freeswitch-users] FS priority<u></u><u></u></span></p></div></div><p class="MsoNormal"><u></u> <u></u></p><div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">Are you using FreeSwitch to specify the user to runas or is this being done by systemd? <u></u><u></u></span></p><div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><u></u> <u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">In FreeSwitch you use the -u argument to specify the user and the -g argument to specify the group, if you do this then I assume running the service as root should be ok providing you've given FreeSwitch an alternative user and group (in our environment we use the same for user and group).<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><u></u> <u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">Thanks,<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">Shaun<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><u></u> <u></u></span></p><div><div class="MsoNormal" align="center" style="text-align:center"><span style="color:black"><hr size="2" width="100%" align="center"></span></div><div><p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"> Bote Man </span><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1f497d"><br></span><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">Sent:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"> 05 September 2015 04:28<br><b>Subject:</b> Re: [Freeswitch-users] FS priority</span><span style="color:black"><u></u><u></u></span></p></div><div><div><div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="color:black">I'm not sure how much nice level matters compared to scheduler priority. I ran a series of tests to find out what Priority and Nice level are reported by the 'top' utility.<br><br>I ran the first 6 tests by using systemd to start FreeSWITCH, 3 times as user root with each of the FS priority flags, then 3 times as user freeswitch with each of the FS flags. Then I repeated that block of tests from the command line, 3 flags as root, 3 flags as freeswitch. You won't believe what happened next!<br><br>systemd starting FreeSWITCH as 'RUNAS' user with 'FLAG' command line priority flags to FS results in top showing priority 'PRI', nice level 'NICE' on a month-old install of Debian 8 on a bare metal Dell R320 server.<br><br>RUNAS FLAG PRI NICE<br>root -rp -2 -10<br>root -np 39 19<br>root -lp 39 19<br><br>fs -rp -2 19<br>fs -np 39 19<br>fs -lp 39 19<br><br>Run as root from command line<br>root -rp -2 -10<br>root -np 20 0<br>root -lp 39 19<br><br>Run as su=freeswitch from command line<br>fs -rp 20 0<br>fs -np 20 0<br>fs -lp 39 19<u></u><u></u></span></p></div><div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="color:black">Most processes show Priority of 20 so I assume that is considered "normal".<u></u><u></u></span></p></div><div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="color:black">So it looks like the only way to get truly higher priority for a process is to run it as root, which I expected. Once the scheduler priority is at -2 (higher priority) I don't know whether the nice level even matters.<u></u><u></u></span></p></div><div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="color:black">For now, the systemd unit file that I posted on Confluence runs as the freeswitch user so even with the -rp flag to FreeSWITCH it gets niced down to 19 which is the lowest level available for nice. Does this matter?<u></u><u></u></span></p></div><div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="color:black">Is there a serious security concern running FreeSWITCH as root?<u></u><u></u></span></p></div><div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="color:black">Thanks.<u></u><u></u></span></p></div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="color:black">Bote<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="color:black"><u></u> <u></u></span></p><div><p class="MsoNormal"><span style="color:black">On Fri, Sep 4, 2015 at 3:38 PM, Bote Man <<a>bote_radio@botecomm.com</a>> wrote:<u></u><u></u></span></p><div><div><div><div><div><div><div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="color:black">Thanks for that. I was under the impression that systemd was throwing FreeSWITCH into the generic scheduling group and starving it of resources as a result, but when I manually ran ./freeswitch as root it still showed the same values.<u></u><u></u></span></p></div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="color:black">Running FS manually with -np yielded pri=20 nice=0 and System Monitor reports priority "normal"<u></u><u></u></span></p></div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="color:black">Running FS manually with -rp yielded pri=-2 nice=-10 and System Monitor reports priority "very high", same results as when FS was started without any priority switch on the command line.<u></u><u></u></span></p></div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="color:black">BUT! When I start FS with systemd it maintains priority=-2 but nice all the way down to 19 which is why System Monitor reports "very low". This happens even with the -rp switch specified in the unit file.<u></u><u></u></span></p></div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="color:black">I don't know how scheduling priority and nice level interact on Debian, but it looks like I have a new research project for this weekend, assuming this is truly something to be concerned about. Or is it?<u></u><u></u></span></p></div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="color:black">Thanks for the tips. I will report my findings to the list if I discover anything substantive.<u></u><u></u></span></p></div><p class="MsoNormal"><span style="color:black">Bote<u></u><u></u></span></p><div><div><div><div><p class="MsoNormal" style="margin-bottom:12.0pt"><span style="color:black"><br><br><br><u></u><u></u></span></p></div></div></div></div></div><div><p class="MsoNormal"><span style="color:black"><u></u> <u></u></span></p><div><div><div><p class="MsoNormal"><span style="color:black">On Fri, Sep 4, 2015 at 2:02 PM, Shaun Stokes <<a>shaun.stokes@itec-support.co.uk</a>> wrote:<u></u><u></u></span></p></div></div><blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in"><div><div><div><div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">Hi Bote, <u></u><u></u></span></p><div><div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><u></u> <u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">I believe priority works in a similar way to metric (i.e. lower comes first), so -20 (most favorable scheduling) to +19 (least favorable scheduling).<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><u></u> <u></u></span></p></div><div><div style="border:dashed #2f6fab 1.0pt;padding:12.0pt 12.0pt 12.0pt 12.0pt;background:#f9f9f9"><pre style="line-height:15.6pt;background:#f9f9f9;border:none;padding:0in"><span style="font-size:9.5pt;color:black">-rp -- enable high(realtime) priority settings<u></u><u></u></span></pre><pre style="line-height:15.6pt;background:#f9f9f9;border:none;padding:0in"><span style="font-size:9.5pt;color:black">-lp -- enable low priority settings<u></u><u></u></span></pre><pre style="line-height:15.6pt;background:#f9f9f9;border:none;padding:0in"><span style="font-size:9.5pt;color:black">-np -- enable normal priority settings (system default)<u></u><u></u></span></pre></div></div><div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">Source: <a href="https://wiki.freeswitch.org/wiki/Command_line" target="_blank">https://wiki.freeswitch.org/wiki/Command_line</a><u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><u></u> <u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">Hope this helps.<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><u></u> <u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">Thanks,<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">Shaun<u></u><u></u></span></p><div><div class="MsoNormal" align="center" style="text-align:center"><span style="color:black"><hr size="2" width="100%" align="center"></span></div><div><p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"> <a>freeswitch-users-bounces@lists.freeswitch.org</a> [<a>freeswitch-users-bounces@lists.freeswitch.org</a>] on behalf of Bote Man [<a>bote_radio@botecomm.com</a>]<br><b>Sent:</b> 04 September 2015 15:54<br><b>To:</b> FreeSWITCH Users Help<br><b>Subject:</b> [Freeswitch-users] FS priority</span><span style="color:black"><u></u><u></u></span></p></div><div><div><div><div><p class="MsoNormal"><span style="color:black">I’m trying to set the priority on a new FreeSWITCH installation built from master on Debian 8 running on bare metal. It is currently running at “very low” priority according to Resource Monitor in the GUI and ‘top’ reports FS is running at priority = -2 (that’s negative two) and nice = 19</span><span style="color:#1f497d"><u></u><u></u></span></p><p class="MsoNormal"><span style="color:black">So with the way FreeSWITCH is now launched by systemd is it considered a service or a user application that is simply run in the background? </span><span style="color:#1f497d"><u></u><u></u></span></p><p class="MsoNormal"><span style="color:black">This affects how systemd treats its control groups and priority and how I will go about troubleshooting this.<u></u><u></u></span></p><p class="MsoNormal"><span style="color:black"><br>Thanks.<u></u><u></u></span></p><p class="MsoNormal"><span style="color:black"> <u></u><u></u></span></p><p class="MsoNormal"><span style="color:black">Bote<u></u><u></u></span></p><p class="MsoNormal" style="margin-left:16.8pt"><span style="color:black"> </span><u></u><u></u></p></div></div></div></div></div></div></div></div></div></div></div></blockquote></div></div></div></div></div></div></div></div></div></div></div></blockquote></div></div><br><br>-- <br><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">Anthony Minessale II ♬ @anthmfs ♬ @FreeSWITCH ♬<div><br><div>☞ <a href="http://freeswitch.org/" target="_blank">http://freeswitch.org/</a> ☞ <a href="http://cluecon.com/" target="_blank">http://cluecon.com/</a> ☞ <a href="http://twitter.com/FreeSWITCH" target="_blank">http://twitter.com/FreeSWITCH</a></div><div><div>☞ <a href="http://irc.freenode.net" target="_blank">irc.freenode.net</a> #freeswitch ☞ <u><a href="http://freeswitch.org/g+" target="_blank">http://freeswitch.org/g+</a></u><br><br></div><div>ClueCon Weekly Development Call <br></div><div>☎ <a href="mailto:sip%3A888@conference.freeswitch.org" target="_blank">sip:888@conference.freeswitch.org</a> ☎ <a href="tel:%2B19193869900" value="+19193869900" target="_blank">+19193869900</a> </div><div><br></div></div></div><div><a href="https://www.youtube.com/watch?v=9XXgW34t40s" style="color:rgb(17,85,204);font-size:12.8000001907349px" target="_blank">https://www.youtube.com/watch?v=9XXgW34t40s</a></div><div><a href="https://www.youtube.com/watch?v=NLaDpGQuZDA" target="_blank">https://www.youtube.com/watch?v=NLaDpGQuZDA</a><br></div></div></div></div></div></div><br>
<br>_________________________________________________________________________<br>
Professional FreeSWITCH Consulting Services:<br>
<a href="mailto:consulting@freeswitch.org">consulting@freeswitch.org</a><br>
<a href="http://www.freeswitchsolutions.com" rel="noreferrer" target="_blank">http://www.freeswitchsolutions.com</a><br>
<br>
Official FreeSWITCH Sites<br>
<a href="http://www.freeswitch.org" rel="noreferrer" target="_blank">http://www.freeswitch.org</a><br>
<a href="http://confluence.freeswitch.org" rel="noreferrer" target="_blank">http://confluence.freeswitch.org</a><br>
<a href="http://www.cluecon.com" rel="noreferrer" target="_blank">http://www.cluecon.com</a><br>
<br>
FreeSWITCH-users mailing list<br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" rel="noreferrer" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" rel="noreferrer" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a href="http://www.freeswitch.org" rel="noreferrer" target="_blank">http://www.freeswitch.org</a><br></blockquote></div>