allow run tuned-adm as root for users at the physical console

Makefile

@@ -8,7 +8,7 @@ MANDIR = /usr/share/man/
 GITTAG = v$(VERSION)
 
 DIRS = doc contrib tuningplugins monitorplugins ktune
-FILES = tuned tuned.spec Makefile tuned.py tuned.initscript tuned.conf tuned-adm
+FILES = tuned tuned.spec Makefile tuned.py tuned.initscript tuned.conf tuned-adm tuned_adm.py tuned-adm.pam tuned-adm.consolehelper
 FILES_doc = doc/DESIGN.txt doc/README.utils doc/TIPS.txt doc/tuned.8 doc/tuned.conf.5 doc/tuned-adm.1 doc/README.scomes
 FILES_contrib = contrib/diskdevstat contrib/netdevstat contrib/scomes contrib/varnetload
 FILES_tuningplugins = tuningplugins/cpu.py tuningplugins/disk.py tuningplugins/net.py tuningplugins/__init__.py
@@ -57,11 +57,20 @@ install:
 	install -m 0755 tuned $(DESTDIR)/usr/sbin/
 	install -m 0755 tuned-adm $(DESTDIR)/usr/sbin/
 
+	# Install the consolehelper files
+	mkdir -p $(DESTDIR)/etc/pam.d/
+	install -m 0644 tuned-adm.pam $(DESTDIR)/etc/pam.d/tuned-adm
+	mkdir -p $(DESTDIR)/etc/security/console.apps/
+	install -m 0644 tuned-adm.consolehelper $(DESTDIR)/etc/security/console.apps/tuned-adm
+	mkdir -p $(DESTDIR)/usr/bin/
+	ln -s consolehelper $(DESTDIR)/usr/bin/tuned-adm
+
 	# Install the plugins and classes
 	mkdir -p $(DESTDIR)/usr/share/$(NAME)/
 	mkdir -p $(DESTDIR)/usr/share/$(NAME)/tuningplugins
 	mkdir -p $(DESTDIR)/usr/share/$(NAME)/monitorplugins
 	install -m 0644 tuned.py $(DESTDIR)/usr/share/$(NAME)/
+	install -m 0644 tuned_adm.py $(DESTDIR)/usr/share/$(NAME)/
 	for file in $(FILES_tuningplugins); do \
 		install -m 0644 $$file $(DESTDIR)/usr/share/$(NAME)/tuningplugins; \
 	done

tuned-adm.consolehelper

@@ -0,0 +1 @@
+FALLBACK=true

tuned-adm.pam

@@ -0,0 +1,5 @@
+#%PAM-1.0
+auth       sufficient   pam_rootok.so
+auth       required     pam_console.so
+#auth       include     system-auth
+account    required     pam_permit.so

tuned.spec

@@ -1,7 +1,7 @@
 Summary: A dynamic adaptive system tuning daemon
 Name: tuned
 Version: 0.2.5
-Release: 0.1%{?dist}
+Release: 0.2%{?dist}
 License: GPLv2+
 Group: System Environment/Daemons
 # The source for this package was pulled from upstream git.  Use the
@@ -13,6 +13,7 @@ Group: System Environment/Daemons
 Source: tuned-%{version}.tar.bz2
 URL: https://fedorahosted.org/tuned/
 Buildroot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
+Requires: usermode
 Requires(post): chkconfig
 Requires(preun): chkconfig
 Requires(preun): initscripts
@@ -73,8 +74,11 @@ fi
 %doc AUTHORS ChangeLog COPYING INSTALL NEWS README doc/DESIGN.txt doc/TIPS.txt ktune/README.ktune
 %{_initddir}/tuned
 %config(noreplace) %{_sysconfdir}/tuned.conf
+%config(noreplace) /etc/pam.d/tuned-adm
+%config(noreplace) /etc/security/console.apps/tuned-adm
 %{_sbindir}/tuned
 %{_sbindir}/tuned-adm
+%{_bindir}/tuned-adm
 %{_sysconfdir}/tune-profiles
 %{_datadir}/tuned
 %{_mandir}/man1/*
@@ -96,6 +100,9 @@ fi
 
 
 %changelog
+* Thu Oct 15 2009 Petr Lautrbach <plautrba@redhat.com> 0.2.5-0.2
+- Allow run tuned-adm as root for users at the physical console
+
 * Mon Oct 12 2009 Petr Lautrbach <plautrba@redhat.com> 0.2.5-0.1
 - Removed dependence on kobo
 - Bumped to 0.2.5 pre release version

tuned_adm.py

@@ -31,8 +31,14 @@ class Tuned_adm:
 		if   args[0] == "list":
 			self.list()
 		elif args[0] == "off":
+			if not os.getuid()==0:
+				print >>sys.stderr, "Only root can run this script";
+				sys.exit(2)
 			self.off()
 		elif args[0] == "profile":
+			if not os.getuid()==0:
+				print >>sys.stderr, "Only root can run this script";
+				sys.exit(2)
 			self.profile(args[1:])
 		else:
 			print >>sys.stderr, "Nonexistent argument %s" % args[0]