Messages in this thread | | | Date | Fri, 8 May 2009 18:37:56 +0100 | From | Alan Cox <> | Subject | Re: [PATCH -mm] vmscan: make mapped executable pages the first class citizen |
| |
> I don't think this sort of DOS is relevant for a single user or trusted user > system. > > I don't know of any distro that applies default ulimits, so desktops are
A lot of people turn on the vm overcommit protection. In fact if you run some of the standard desktop apps today its practically essential to deal with them quietly leaking the box into oblivion or just going mad at random intervals.
> already susceptible to the far more trivial "call malloc a lot" or "fork bomb" > attacks. Plus, ulimits don't help, since they only apply per process - you'd > need a default mem cgroup before this mattered, I think.
We have a system wide one in effect via the vm overcommit stuff and have had for years. It works, its relevant and even if it didn't "everything else sucks" isn't an excuse for more suckage but a call for better things.
If you want any kind of tunable user controllable vm priority then the obvious things to do would be to borrow the nice() values or implement a vmnice() for VMAs so users can only say "flog me harder".
Not I fear that it matters - until you fix the two problems of obscenely bloated leaky apps and bad I/O performance its really an "everything louder than everything else" kind of argument.
Alan
| |