<div dir="ltr"><div dir="ltr" class="gmail_attr">On Sat, Jan 5, 2019 at 5:56 AM James Abernathy <<a href="mailto:jfabernathy@gmail.com">jfabernathy@gmail.com</a>> wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">In research other errors on the system I came across a lot of these errors.<br>
<br>
mythpreviewgen[22470]: E CoreContext main.cpp:81 (preview_helper) <br>
Setting priority failed. eno: Permission denied (13)<br>
<br>
Any idea if it's something that needs fixing?<br>
<br>
Jim A<br>
<br></blockquote><div><br></div><div>This error message appears to be coming from mythpreviewgen/main.cpp line 81 (assuming you were using a mythtv build based on fixes/29 branch at the time of your original post (Jan 5 2019). Here is the spot in the code where this message originated from: <br></div><div><br></div><div> <a href="https://github.com/MythTV/mythtv/blob/fixes/29/mythtv/programs/mythpreviewgen/main.cpp#L79-L81">https://github.com/MythTV/mythtv/blob/fixes/29/mythtv/programs/mythpreviewgen/main.cpp#L79-L81</a></div><div><br></div><div>I was seeing this same message too, but from a different line number using mythtv Ubuntu package versions based on fixes/31 branch (<span style="font-family:monospace"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)">2:31.0+fixes.202203040618.7e4ce1ba98~ubuntu20.04.1</span></span>):<br><br><div style="margin-left:40px"> <span style="font-family:monospace">mythpreviewgen[2034369]: mythpreviewgen[2034369]: E CoreContext main.cpp:77 (preview_helper) Setting priority failed.<br> eno: Permission denied (13)</span><br></div><br></div><div>The message comes from the same place in the code but it just moved line numbers in the fixes/31 branch:<br><br></div><div> <a href="https://github.com/MythTV/mythtv/blob/fixes/31/mythtv/programs/mythpreviewgen/main.cpp#L75-L77">https://github.com/MythTV/mythtv/blob/fixes/31/mythtv/programs/mythpreviewgen/main.cpp#L75-L77</a></div><div><br></div><div>It turns out that this error message has to do with mythpreviewgen trying to set its process priority (a.k.a. "nice level") and failing due to lack of permissions. The comment in the code provides the reasoning behind why it's doing this: <br></div><div><br></div><div><div style="margin-left:40px"><span style="font-family:monospace">// Lower scheduling priority, to avoid problems with recordings.</span><br></div></div><div><br>This is not a fatal error, so the process continues onward regardless of nice / process priority level. It appears safe to ignore, but depending on your backend hardware's CPU speed and general load it may have performance impacts on other processes deemed to have higher preferred priority such as recordings. If you're seeing performance impacts, or just want to silence this annoying error in the logs the solution is to grant the mythtv user or the process the permission to set a nice level.</div><div><br></div><div>The Linux kernel capability which controls this is CAP_SYS_NICE.<br><br></div><div>The following references help to explain kernel capabilities and a few different ways to grant them:<br></div><div><br></div><div><a href="https://stackoverflow.com/q/7635515">https://stackoverflow.com/q/7635515</a></div><div><a href="https://linux.die.net/man/7/capabilities">https://linux.die.net/man/7/capabilities</a></div><div><a href="https://linux.die.net/man/8/setcap">https://linux.die.net/man/8/setcap</a></div><div><a href="https://linux.die.net/man/3/cap_from_text">https://linux.die.net/man/3/cap_from_text</a><br><a href="https://linux.die.net/man/5/limits.conf">https://linux.die.net/man/5/limits.conf</a><br><a href="https://linux.die.net/man/8/pam_limits">https://linux.die.net/man/8/pam_limits</a><br><br></div><div>For processes started by SystemD, look into the <span style="font-family:monospace">AmbientCapabilities [Service]</span> setting:<br><br><a href="https://www.freedesktop.org/software/systemd/man/systemd.exec.html#AmbientCapabilities=">https://www.freedesktop.org/software/systemd/man/systemd.exec.html#AmbientCapabilities=</a><br><br></div><div>In this specific case, the process <span style="font-family:monospace">mythpreviewgen</span> is started by <span style="font-family:monospace">mythbackend</span> usually as the <span style="font-family:monospace">mythtv</span> user. Therefore, you have a few options to grant the <span style="font-family:monospace">CAP_SYS_NICE</span> capability. You can try to grant it to the <span style="font-family:monospace">mythpreviewgen</span> process itself via an extended file attribute called <span style="font-family:monospace">security.capability</span> (see the <a href="https://www.mankier.com/7/capabilities#Description-File_capabilities">"File capabilities" section of man capabilities</a>). Alternatively you can try to give it to the <span style="font-family:monospace">mythbackend</span> process and grant it via inheritance to the launched <span style="font-family:monospace">mythpreviewgen</span> sub-process (via either file extended attribute <span style="font-family:monospace">security.capability</span> or SystemD <span style="font-family:monospace">AmbientCapabilities=CAP_SYS_NICE</span>). Another option would be to give the <span style="font-family:monospace">mythtv</span> user this capability via <span style="font-family:monospace">pam_limits</span> / <span style="font-family:monospace">limits.conf</span>.</div><div><br></div><div>The option you choose will depend on your security stance and personal preference. I'd suggest granting just the <span style="font-family:monospace">mythpreviewgen</span> binary <span style="font-family:monospace">CAP_SYS_NICE</span> using file capabilities via the extended file attribute <span style="font-family:monospace">security.capability</span>. The reasoning for choosing this option is that granting it to the <span style="font-family:monospace">mythtv</span> user or <span style="font-family:monospace">mythbackend</span> may give more broad permissions to other processes that don't need this capability, while granting it just to the <span style="font-family:monospace">mythpreviewgen</span> process is a more granular approach giving just this process that capability.</div><div><br></div><div>Ideally, this file capability extended attribute would be automatically granted in the package manager's post-install hook (<a href="https://stackoverflow.com/a/37528755">See the discussion of this here</a>). However, it currently appears not to be done in this way at least on Ubuntu/Mythbuntu. As such, you'll probably have to re-run the <span style="font-family:monospace">setcap</span> command each time mythtv packages are upgraded on the system.</div><div><br></div><div>To set the file capability:<br><div style="margin-left:40px"><br></div></div><div style="margin-left:40px"><span style="font-family:monospace"># Check the current extended attributes for /usr/bin/mythpreviewgen<br></span></div><div style="margin-left:40px"><span style="font-family:monospace"># Default was that none were set<br></span></div><div><div style="margin-left:40px"><span style="font-family:monospace">$ getcap /usr/bin/mythpreviewgen <br>$ getfattr -d -m - /usr/bin/mythpreviewgen <br>$ sudo setcap 'cap_sys_nice=eip' /usr/bin/mythpreviewgen <br> <br># Show the new extended attributes for /usr/bin/mythpreviewgen<br># Now security.capability xattr is set to: "cap_sys_nice+eip"<br>$ getfattr -d -m - /usr/bin/mythpreviewgen <br>getfattr: Removing leading '/' from absolute path names<br># file: usr/bin/mythpreviewgen<br>security.capability=0sAQAAAgAAgAAAAIAAAAAAAAAAAAA=<br><br>$ getcap /usr/bin/mythpreviewgen <br>/usr/bin/mythpreviewgen = cap_sys_nice+eip</span><br></div><br></div><div>That will allow <span style="font-family:monospace">mythpreviewgen</span> to set nice level, and make those annoying log messages go away. At least... until the <span style="font-family:monospace">mythtv-backend</span> package is updated on the system and overwrites <span style="font-family:monospace">/usr/bin/mythpreviewgen</span> with the new version.<br></div><div>This will be necessary to re-run each time after upgrading packages unless this gets incorporated into both MythTV QMake post-build steps, and also into Debian / RPM or other packaging post-install scripts.<br></div><div><br></div></div></div>