Re: [PATCH 1/1] threads_max: Simple lockout prevention patch

[Nick Piggin <nickpiggin@yahoo.com.au>]

Al Boldi wrote:
> Nick Piggin wrote:
> 
>>Al Boldi wrote:
>>
>>>Could do that by:
>>>
>>>	# echo 1 > /proc/sys/kernel/su-pid
>>>
>>>which would imply nr-threads = 1
>>>
>>>So maybe introduce /proc/sys/kernel/nr-threads to allow that to be
>>>variable, but this isn't really critical.
>>
>>Why not just have su-nr-threads?
> 
> 
> Unless I am misunderstanding you, even root/root-proc can be hit by a 
> runaway, so the threads-max limits this globally which is great, but this 
> may lock-you out of being able to control the situation based on uid only.
> 
> Thus this patch gives root the ability to allow a certain pid to exceed the 
> threads-max limit, while all other pids are still limited.

But the point is that root is able to get their pids under control,
and can't be DoSed by unpriv users. Right?

Nothing is going to be perfect, I mean the su-pid pid could get "hit
bya runaway" and is arguably worse than nr-threads-su, because it has
no upper limit and coult take down the whole system.

-- 
SUSE Labs, Novell Inc.
Send instant messages to your online friends http://au.messenger.yahoo.com