Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

nixos/ananicy: disable ananicy-cpp's BPF on hardened kernels, cleanup #331722

Merged
merged 3 commits into from
Aug 5, 2024
Merged

nixos/ananicy: disable ananicy-cpp's BPF on hardened kernels, cleanup #331722

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4c55a97
nixos/ananicy: use lib. explicitly
JohnRTitor Jun 19, 2024
d626da6
nixos/ananicy: format with nixfmt-rfc-style
JohnRTitor Aug 2, 2024
2cf5032
nixos/ananicy: disable ananicy-cpp's BPF on hardened kernels
JohnRTitor Aug 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
210 changes: 124 additions & 86 deletions nixos/modules/services/misc/ananicy.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,85 +1,119 @@
{ config, lib, pkgs, ... }:

with lib;
{
config,
lib,
pkgs,
...
}:

let
cfg = config.services.ananicy;
configFile = pkgs.writeText "ananicy.conf" (generators.toKeyValue { } cfg.settings);
extraRules = pkgs.writeText "extraRules" (concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraRules);
extraTypes = pkgs.writeText "extraTypes" (concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraTypes);
extraCgroups = pkgs.writeText "extraCgroups" (concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraCgroups);
servicename = if ((lib.getName cfg.package) == (lib.getName pkgs.ananicy-cpp)) then "ananicy-cpp" else "ananicy";
configFile = pkgs.writeText "ananicy.conf" (lib.generators.toKeyValue { } cfg.settings);
extraRules = pkgs.writeText "extraRules" (
lib.concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraRules
);
extraTypes = pkgs.writeText "extraTypes" (
lib.concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraTypes
);
extraCgroups = pkgs.writeText "extraCgroups" (
lib.concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraCgroups
);
servicename =
if ((lib.getName cfg.package) == (lib.getName pkgs.ananicy-pp)) then "ananicy-cpp" else "ananicy";
# Ananicy-CPP with BPF is not supported on hardened kernels https://github.com/NixOS/nixpkgs/issues/327382
finalPackage =
if (servicename == "ananicy-cpp" && config.boot.kernelPackages.isHardened) then
(cfg.package { withBpf = false; })
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Calling package works? I've tried in repl and it doesn't. I assume this should be cfg.package.override { withBpf = false; }.

The problem is that this makes it's impossible to override withBpf to true. There is a way to make bpf version work on hardened (explained in the linked issue), and I intend to apply this on my system and use bpf version of ananicy-cpp.

I couldn't find if there's a way to check whether the argument was overriden? We could add this functionality to makeOverridable.

Though a better idea is probably to add withBpf as a service option.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@JohnRTitor Yeah, this doesn't work. Just upgraded to 24.11 and got

error: attempt to call something which is not a function but a set: { type = "derivation"; NIX_HARDENING_ENABLE = «thunk»; __ignoreNulls = true; __structuredAttrs = «thunk»; all = «thunk»; args = «thunk»; buildInputs = «thunk»; builder = «thunk»; cmakeFlags = «thunk»; configureFlags = «thunk»; «37 attributes elided» }

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ugh, I hate GitHub, you never saw that comment, because it was pending. I always forget about this...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PRs welcomed

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Though a better idea is probably to add withBpf as a service option.

No, because it just duplicates the package override.

Copy link
Contributor

@MrQubo MrQubo Dec 2, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Though a better idea is probably to add withBpf as a service option.

No, because it just duplicates the package override.

I've made an issue, so we won't misuse this already merged PR. #360957

else
cfg.package;
in
{
options = {
services.ananicy = {
enable = mkEnableOption "Ananicy, an auto nice daemon";
options.services.ananicy = {
enable = lib.mkEnableOption "Ananicy, an auto nice daemon";

package = mkPackageOption pkgs "ananicy" {
example = "ananicy-cpp";
};
package = lib.mkPackageOption pkgs "ananicy" { example = "ananicy-cpp"; };

rulesProvider = mkPackageOption pkgs "ananicy" {
example = "ananicy-cpp";
} // {
description = ''
Which package to copy default rules,types,cgroups from.
'';
};
rulesProvider = lib.mkPackageOption pkgs "ananicy" { example = "ananicy-cpp"; } // {
description = ''
Which package to copy default rules,types,cgroups from.
'';
};

settings = mkOption {
type = with types; attrsOf (oneOf [ int bool str ]);
default = { };
example = {
apply_nice = false;
};
description = ''
See <https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf>
'';
settings = lib.mkOption {
type =
with lib.types;
attrsOf (oneOf [
int
bool
str
]);
default = { };
example = {
apply_nice = false;
};
description = ''
See <https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf>
'';
};

extraRules = mkOption {
type = with types; listOf attrs;
default = [ ];
description = ''
Rules to write in 'nixRules.rules'. See:
<https://github.com/Nefelim4ag/Ananicy#configuration>
<https://gitlab.com/ananicy-cpp/ananicy-cpp/#global-configuration>
'';
example = [
{ name = "eog"; type = "Image-Viewer"; }
{ name = "fdupes"; type = "BG_CPUIO"; }
];
};
extraTypes = mkOption {
type = with types; listOf attrs;
default = [ ];
description = ''
Types to write in 'nixTypes.types'. See:
<https://gitlab.com/ananicy-cpp/ananicy-cpp/#types>
'';
example = [
{ type = "my_type"; nice = 19; other_parameter = "value"; }
{ type = "compiler"; nice = 19; sched = "batch"; ioclass = "idle"; }
];
};
extraCgroups = mkOption {
type = with types; listOf attrs;
default = [ ];
description = ''
Cgroups to write in 'nixCgroups.cgroups'. See:
<https://gitlab.com/ananicy-cpp/ananicy-cpp/#cgroups>
'';
example = [
{ cgroup = "cpu80"; CPUQuota = 80; }
];
};
extraRules = lib.mkOption {
type = with lib.types; listOf attrs;
default = [ ];
description = ''
Rules to write in 'nixRules.rules'. See:
<https://github.com/Nefelim4ag/Ananicy#configuration>
<https://gitlab.com/ananicy-cpp/ananicy-cpp/#global-configuration>
'';
example = [
{
name = "eog";
type = "Image-Viewer";
}
{
name = "fdupes";
type = "BG_CPUIO";
}
];
};
extraTypes = lib.mkOption {
type = with lib.types; listOf attrs;
default = [ ];
description = ''
Types to write in 'nixTypes.types'. See:
<https://gitlab.com/ananicy-cpp/ananicy-cpp/#types>
'';
example = [
{
type = "my_type";
nice = 19;
other_parameter = "value";
}
{
type = "compiler";
nice = 19;
sched = "batch";
ioclass = "idle";
}
];
};
extraCgroups = lib.mkOption {
type = with lib.types; listOf attrs;
default = [ ];
description = ''
Cgroups to write in 'nixCgroups.cgroups'. See:
<https://gitlab.com/ananicy-cpp/ananicy-cpp/#cgroups>
'';
example = [
{
cgroup = "cpu80";
CPUQuota = 80;
}
];
};
};

config = mkIf cfg.enable {
config = lib.mkIf cfg.enable {
environment = {
systemPackages = [ cfg.package ];
systemPackages = [ finalPackage ];
etc."ananicy.d".source = pkgs.runCommandLocal "ananicyfiles" { } ''
mkdir -p $out
# ananicy-cpp does not include rules or settings on purpose
Expand All @@ -92,16 +126,16 @@ in
# configured through .setings
rm -f $out/ananicy.conf
cp ${configFile} $out/ananicy.conf
${optionalString (cfg.extraRules != [ ]) "cp ${extraRules} $out/nixRules.rules"}
${optionalString (cfg.extraTypes != [ ]) "cp ${extraTypes} $out/nixTypes.types"}
${optionalString (cfg.extraCgroups != [ ]) "cp ${extraCgroups} $out/nixCgroups.cgroups"}
${lib.optionalString (cfg.extraRules != [ ]) "cp ${extraRules} $out/nixRules.rules"}
${lib.optionalString (cfg.extraTypes != [ ]) "cp ${extraTypes} $out/nixTypes.types"}
${lib.optionalString (cfg.extraCgroups != [ ]) "cp ${extraCgroups} $out/nixCgroups.cgroups"}
'';
};

# ananicy and ananicy-cpp have different default settings
services.ananicy.settings =
let
mkOD = mkOptionDefault;
mkOD = lib.mkOptionDefault;
in
{
cgroup_load = mkOD true;
Expand All @@ -113,26 +147,30 @@ in
apply_sched = mkOD true;
apply_oom_score_adj = mkOD true;
apply_cgroup = mkOD true;
} // (if ((lib.getName cfg.package) == (lib.getName pkgs.ananicy-cpp)) then {
# https://gitlab.com/ananicy-cpp/ananicy-cpp/-/blob/master/src/config.cpp#L12
loglevel = mkOD "warn"; # default is info but its spammy
cgroup_realtime_workaround = true;
log_applied_rule = mkOD false;
} else {
# https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf
check_disks_schedulers = mkOD true;
check_freq = mkOD 5;
});
}
// (
if servicename == "ananicy-cpp" then
{
# https://gitlab.com/ananicy-cpp/ananicy-cpp/-/blob/master/src/config.cpp#L12
loglevel = mkOD "warn"; # default is info but its spammy
cgroup_realtime_workaround = true;
log_applied_rule = mkOD false;
}
else
{
# https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf
check_disks_schedulers = mkOD true;
check_freq = mkOD 5;
}
);

systemd = {
packages = [ cfg.package ];
packages = [ finalPackage ];
services."${servicename}" = {
wantedBy = [ "default.target" ];
};
};
};

meta = {
maintainers = with maintainers; [ artturin ];
};
meta.maintainers = with lib.maintainers; [ artturin ];
}