atagen

monolith

public
Star0
Fork0
Watch0
105 commits1 branch0 tags0 releases1.5 MiB

Commit e13e3c02ad0c

tarball

atagen <boss@atagen.co>2026-10-17 06:25 UTC

1 file changed+11-0
monolith: clear ambient capabilities before launching anything

A NixOS capability wrapper hands CAP_SYS_NICE to the binary as an ambient capability, and ambient capabilities survive exec, so every terminal and game started from monolith could raise itself to realtime.
crates/monolith/src/main.rs+11
@@ -148,7 +148,18 @@ fn main() -> ExitCode {
148148
149149 /// Puts the compositor thread on SCHED_RR so a busy desktop cannot delay a
150150 /// frame. Reset-on-fork keeps threads and programs it starts off realtime.
151+/// The NixOS capability wrapper raises CAP_SYS_NICE as an ambient capability,
152+/// which every launched program would inherit unless cleared.
151153 fn realtime() {
154+ unsafe {
155+ libc::prctl(
156+ libc::PR_CAP_AMBIENT,
157+ libc::PR_CAP_AMBIENT_CLEAR_ALL,
158+ 0,
159+ 0,
160+ 0,
161+ )
162+ };
152163 let param = libc::sched_param { sched_priority: 2 };
153164 // SAFETY: plain syscall on the calling thread with a valid param.
154165 let rc =