sosy-lab / cpu-energy-meter

A tool for measuring energy consumption of Intel CPUs
BSD 3-Clause "New" or "Revised" License
321 stars 29 forks source link

Allow Running as non-root #7

Closed PhilippWendler closed 6 years ago

PhilippWendler commented 7 years ago

We should find out and document what is necessary to run this tool as a regular user without root rights.

lembergerth commented 7 years ago

The regular user needs read access to files /dev/cpu/*/msr and the power_gadget binary requires the CAP_SYS_RAWIO capability.

The following two commands are an example that provides the above conditions: # sudo chmod 666 /dev/cpu/*/msr # sudo setcap cap_sys_rawio=ep power_gadget

See http://icl.cs.utk.edu/projects/papi/wiki/PAPITopics:RAPL_Access

PhilippWendler commented 7 years ago

Better alternative that minimizes the necessary rights (AFAIK the MSR can leak critical information if read access is given to everyone):

chgrp msr cpu-energy-meter
chmod 2711 cpu-energy-meter
setcap cap_sys_rawio=ep cpu-energy-meter

This needs some initial setup to allow the group msr read the /dev/cpu/*/msr files:

addgroup --system msr
echo 'SUBSYSTEM=="msr", GROUP="msr", MODE="0640"' > /etc/udev/rules.d/msr.rules
udevadm control --reload-rules
udevadm trigger

This should be done during the installation of our Debian package (#6).

TBunk commented 6 years ago

Since commit 36ba08ac207d02028720825ccb95fe4d77c99c99, one can successfully execute the program without root rights after making the steps as described by @PhilippWendler in the above comment.

Note that since the last commit (66e8f66ef9ccd84ad99addbcf66c30dcf22712d6), the package libcap-dev is required in order to successfully execute the program. The package is used for dropping the capabilities of the own process. Is it ok for you that I use such a package, @PhilippWendler ?

PhilippWendler commented 6 years ago

You probably mean that libcap-dev is required for compilation, and libcap2 is required for execution. That's ok, libcap2 is a standard package required by many programs.

TBunk commented 6 years ago

Yes, that's what i meant.

TBunk commented 6 years ago

By doing the setup as described above, the program can be executed without root rights. This was implemented and successfully tested in the latest commit (66e8f66ef9ccd84ad99addbcf66c30dcf22712d6). Therefore the issue is now closed.