Access to RAPL data is restricted in Linux kernel to only privileged users (sudo/root), in order to avoid the PLATYPUS vulnerability.
To avoid running PowerJoular with sudo or root, a proposed approach is to set RAPL files to read for all users. Read status is reset on reboot, so the proposition is to add this right to /etc/sysfs.conf : mode class/powercap/intel-rapl:0/energy_uj = 0444.
In PowerJoular, we read 2 files for each RAPL domain: name and energy_uj. Both files need to have read rights.
Mainly theses files (if they exist):
/sys/class/powercap/intel-rapl/intel-rapl:1/energy_uj
/sys/class/powercap/intel-rapl/intel-rapl:0/energy_uj
/sys/class/powercap/intel-rapl/intel-rapl:0/intel-rapl:0:2/energy_uj
/sys/class/powercap/intel-rapl/intel-rapl:1/name
/sys/class/powercap/intel-rapl/intel-rapl:0/name
/sys/class/powercap/intel-rapl/intel-rapl:0/intel-rapl:0:2/name
If you only use the PowerJoular systemd service, which needs to be enabled and run as root/sudo as all systemd services, then you can keep your system unchanged as the service will run with privileged rights and writes data to /tmp folder as we explained in the project's page.
Access to RAPL data is restricted in Linux kernel to only privileged users (sudo/root), in order to avoid the PLATYPUS vulnerability.
To avoid running PowerJoular with sudo or root, a proposed approach is to set RAPL files to read for all users. Read status is reset on reboot, so the proposition is to add this right to
/etc/sysfs.conf:mode class/powercap/intel-rapl:0/energy_uj = 0444.In PowerJoular, we read 2 files for each RAPL domain:
nameandenergy_uj. Both files need to have read rights.Mainly theses files (if they exist):
If you only use the PowerJoular systemd service, which needs to be enabled and run as root/sudo as all systemd services, then you can keep your system unchanged as the service will run with privileged rights and writes data to
/tmpfolder as we explained in the project's page.