Messages in this thread | | | Date | Tue, 25 Apr 2006 17:23:17 +1000 | From | Nick Piggin <> | Subject | Re: [PATCH 1/1] threads_max: Simple lockout prevention patch |
| |
Al Boldi wrote: > Nick Piggin wrote: > >>Al Boldi wrote: >> >>>Could do that by: >>> >>> # echo 1 > /proc/sys/kernel/su-pid >>> >>>which would imply nr-threads = 1 >>> >>>So maybe introduce /proc/sys/kernel/nr-threads to allow that to be >>>variable, but this isn't really critical. >> >>Why not just have su-nr-threads? > > > Unless I am misunderstanding you, even root/root-proc can be hit by a > runaway, so the threads-max limits this globally which is great, but this > may lock-you out of being able to control the situation based on uid only. > > Thus this patch gives root the ability to allow a certain pid to exceed the > threads-max limit, while all other pids are still limited.
But the point is that root is able to get their pids under control, and can't be DoSed by unpriv users. Right?
Nothing is going to be perfect, I mean the su-pid pid could get "hit bya runaway" and is arguably worse than nr-threads-su, because it has no upper limit and coult take down the whole system.
-- SUSE Labs, Novell Inc. Send instant messages to your online friends http://au.messenger.yahoo.com
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |