lkml.org 
[lkml]   [2010]   [Nov]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Re:[PATCH v2]oom-kill: CAP_SYS_RESOURCE should get bonus
On Thu, 4 Nov 2010, Figo.zhang wrote:

> CAP_SYS_RESOURCE == 1 means without resource limits just like a
> superuser,
> CAP_SYS_RESOURCE == 0 means hold resource limits, like normal user,
> right?
>

Yes.

> a new lower oom_score_adj will protect the process, right?
>

Yes.

> Tasks without CAP_SYS_RESOURCE, means that it is not a superuser, why
> user canot protect it by oom_score_adj?
>

Because, as I said, it would be trivial for a user program to deplete all
memory (either intentionally or unintentioally) and cause every other task
on the system to be oom killed as a result. That's an undesired result of
a blatently obvious DoS.

> like i want to protect my program such as gnome-terminal which is
> without CAP_SYS_RESOURCE (have resource limits),
>
> [figo@myhost ~]$ ps -ax | grep gnome-ter
> Warning: bad ps syntax, perhaps a bogus '-'? See
> http://procps.sf.net/faq.html
> 2280 ? Sl 0:01 gnome-terminal
> 8839 pts/0 S+ 0:00 grep gnome-ter
> [figo@myhost ~]$ cat /proc/2280/oom_adj
> 3
> [figo@myhost ~]$ echo -17 > /proc/2280/oom_adj
> bash: echo: write error: Permission denied
> [figo@myhost ~]$
>
> so, i canot protect my program.
>

If this is your system, you can either give yourself CAP_SYS_RESOURCE or
do it through the superuser. This isn't exactly new, it's been the case
for the past four years.

I'm still struggling to find out the problem that you're trying to address
with your various patches, perhaps because you haven't said what it is.


\
 
 \ /
  Last update: 2010-11-04 06:11    [W:0.056 / U:0.056 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site