From: KOSAKI Motohiro <kosaki.motohiro@gmail.com>
To: dledford@redhat.com
Cc: akpm@linux-foundation.org, torvalds@linux-foundation.org,
linux-kernel@vger.kernel.org, joe.korty@ccur.com,
amwang@redhat.com
Subject: [PATCH 5/4] ipc/mqueue: revert bump up DFLT_*MAX
Date: Wed, 26 Oct 2011 11:37:10 -0400 [thread overview]
Message-ID: <4EA82926.8050502@gmail.com> (raw)
In-Reply-To: <4EA828E4.1070409@gmail.com>
Mqueue limitation is slightly naieve parameter likes other ipcs
because unprivileged user can consume kernel memory by using ipcs.
Thus, too aggressive raise bring us security issue. Example,
current setting allow evil unprivileged user use 256GB (= 256
* 1024 * 1024*1024) and it's enough large to system will belome
unresponsive. Don't do that.
Instead, every admin should adjust the knobs for their own systems.
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@gmail.com>
Cc: Doug Ledford <dledford@redhat.com>
Cc: Amerigo Wang <amwang@redhat.com>
Cc: Serge E. Hallyn <serue@us.ibm.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Joe Korty <joe.korty@ccur.com>
---
include/linux/ipc_namespace.h | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h
index e2bac00..2d7c5e0 100644
--- a/include/linux/ipc_namespace.h
+++ b/include/linux/ipc_namespace.h
@@ -118,12 +118,12 @@ extern int mq_init_ns(struct ipc_namespace *ns);
#define DFLT_QUEUESMAX 256
#define HARD_QUEUESMAX 1024
#define MIN_MSGMAX 1
-#define DFLT_MSG 64U
-#define DFLT_MSGMAX 1024
+#define DFLT_MSG 10U
+#define DFLT_MSGMAX 10
#define HARD_MSGMAX 65536
#define MIN_MSGSIZEMAX 128
#define DFLT_MSGSIZE 8192U
-#define DFLT_MSGSIZEMAX (1024*1024)
+#define DFLT_MSGSIZEMAX 8192
#define HARD_MSGSIZEMAX (16*1024*1024)
#else
static inline int mq_init_ns(struct ipc_namespace *ns) { return 0; }
--
1.7.5.2
next prev parent reply other threads:[~2011-10-26 15:36 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-09-27 22:30 Various cleanups and a couple fixes to ipc/mqueue Doug Ledford
2011-09-27 22:30 ` [PATCH 1/4] ipc/mqueue: cleanup definition names and locations Doug Ledford
2011-09-27 22:30 ` [PATCH 2/4] ipc/mqueue: switch back to using non-max values on create Doug Ledford
2011-10-25 0:56 ` KOSAKI Motohiro
2011-10-26 15:36 ` KOSAKI Motohiro
[not found] ` <4EA828E4.1070409@gmail.com>
2011-10-26 15:37 ` KOSAKI Motohiro [this message]
2011-10-26 17:28 ` [PATCH 5/4] ipc/mqueue: revert bump up DFLT_*MAX Doug Ledford
2011-10-27 16:41 ` Joe Korty
2011-10-26 15:37 ` [PATCH 6/4] ipc/mqueue: don't use kmalloc(KMALLOC_MAX_SIZE) KOSAKI Motohiro
2011-10-26 17:29 ` Doug Ledford
2011-10-27 16:41 ` Joe Korty
2011-10-26 15:38 ` [PATCH 7/4] ipc/mqueue: separate mqueue default value from maximum value KOSAKI Motohiro
2011-10-26 17:31 ` Doug Ledford
2011-10-27 16:44 ` Joe Korty
2011-09-27 22:30 ` [PATCH 3/4] ipc/mqueue: enforce hard limits Doug Ledford
2011-09-27 22:30 ` [PATCH 4/4] ipc/mqueue: update maximums for the mqueue subsystem Doug Ledford
2011-10-25 1:00 ` KOSAKI Motohiro
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4EA82926.8050502@gmail.com \
--to=kosaki.motohiro@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=amwang@redhat.com \
--cc=dledford@redhat.com \
--cc=joe.korty@ccur.com \
--cc=linux-kernel@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.