Messages in this thread Patch in this message | | | Subject | [PATCH] Increase the default RLIMIT_MEMLOCK | From | Josselin Mouette <> | Date | Sun, 27 Apr 2008 21:26:27 +0200 |
| |
Hi,
Currently, the default value for RLIMIT_MEMLOCK (defined in include/linux/resource.h) is 32 KiB, because this value is enough for GnuPG.
However this value is not enough for gnome-keyring-daemon, which will store both SSH and GnuPG keys, plus user passwords for various kinds of resources. Upstream authors recommend to provide a limit of at least 256 KiB for RLIMIT_MEMLOCK for the keys to remain securely in memory.
Given the amount of memory in current machines, I think 256 KiB is still a very reasonable value. What do you think of increasing this default value in the kernel?
Cheers, -- .''`. : :' : We are debian.org. Lower your prices, surrender your code. `. `' We will add your hardware and software distinctiveness to `- our own. Resistance is futile. --- include/linux/resource.h.orig 2008-04-27 21:15:47.000000000 +0200 +++ include/linux/resource.h 2008-04-27 21:23:06.000000000 +0200 @@ -58,10 +58,11 @@ #define _STK_LIM (8*1024*1024) /* - * GPG wants 32kB of mlocked memory, to make sure pass phrases - * and other sensitive information are never written to disk. + * The biggest widespread mlocked memory consumer is + * gnome-keyring-manager. It needs 256kB to make sure SSH/GPG + * passphrases and network passwords are never written to disk. */ -#define MLOCK_LIMIT (8 * PAGE_SIZE) +#define MLOCK_LIMIT (64 * PAGE_SIZE) /* * Due to binary compatibility, the actual resource numbers[unhandled content-type:application/pgp-signature] | |