Re: mlock(1)

[Chris Wright <chrisw@osdl.org>]

* Jeff Garzik (jgarzik@pobox.com) wrote:
> 
> How feasible is it to create an mlock(1) utility, that would allow 
> priveleged users to execute a daemon such that none of the memory the 
> daemon allocates will ever be swapped out?

1. Doesn't require privilege, just proper rlimits ;-)
2. Problem is the execve(2) that the mlock(1) program would have to call.
This blows away the mappings which contain the locking info.  Unless you
were thinking of promoting something akin to VM_LOCKED from the ->mm
def_flags to a per task flag.

> ntp daemon does mlock(2) internally, for example, but IMHO this is 
> really a policy decision that could be moved out of the app.

Hard to say if it's a policy decision outside the scope of the app.
Esp. if the app knows it needs to not be swapped.  Either something that
has realtime needs, or more specifically, privacy needs.  Don't need to
mlock all of gpg to ensure key data never hits swap.

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net