Re: [PATCH] Reserve N process to root

2007-10-12 Thread Al Boldi
Gustavo Chain wrote: > Al Boldi <[EMAIL PROTECTED]> escribió: > > Kyle Moffett wrote: > > > On Oct 12, 2007, at 01:37:23, Al Boldi wrote: > > > > You have a point, and resource-controllers can probably control > > > > DoS a lot better, but the they also incur more overhead. Think > > > > of this "

Re: [PATCH] Reserve N process to root

2007-10-12 Thread Gustavo Chain
El Fri, 12 Oct 2007 09:29:10 +0300 Al Boldi <[EMAIL PROTECTED]> escribió: > Kyle Moffett wrote: > > On Oct 12, 2007, at 01:37:23, Al Boldi wrote: > > > You have a point, and resource-controllers can probably control > > > DoS a lot better, but the they also incur more overhead. Think > > > of thi

Re: [PATCH] Reserve N process to root

2007-10-11 Thread Al Boldi
Kyle Moffett wrote: > On Oct 12, 2007, at 01:37:23, Al Boldi wrote: > > You have a point, and resource-controllers can probably control DoS > > a lot better, but the they also incur more overhead. Think of this > > "lockout prevention" patch as a near zero overhead safety valve. > > But why do you

Re: [PATCH] Reserve N process to root

2007-10-11 Thread Kyle Moffett
On Oct 12, 2007, at 01:37:23, Al Boldi wrote: Kyle Moffett wrote: This isn't really necessary any more with the new CFS scheduler. If you want to prevent excess memory usage then you limit memory usage, not process count, so just set the system max process count to something absurdly high

Re: [PATCH] Reserve N process to root

2007-10-11 Thread Al Boldi
Kyle Moffett wrote: > Please don't trim CC lists > > On Oct 11, 2007, at 17:02:37, Al Boldi wrote: > > David Newall wrote: > >> [EMAIL PROTECTED] wrote: > >>> What David meant was that "root will always have a slot" doesn't > >>> *actually* help unless you *also* have a way to actually *spawn* > >>

Re: [PATCH] Reserve N process to root

2007-10-11 Thread Kyle Moffett
Please don't trim CC lists On Oct 11, 2007, at 17:02:37, Al Boldi wrote: David Newall wrote: [EMAIL PROTECTED] wrote: What David meant was that "root will always have a slot" doesn't *actually* help unless you *also* have a way to actually *spawn* such a process. In order to do the ps, kil

Re: [PATCH] Reserve N process to root

2007-10-11 Thread Al Boldi
David Newall wrote: > [EMAIL PROTECTED] wrote: > > What David meant was that "root will always have a slot" doesn't > > *actually* help unless you *also* have a way to actually *spawn* such a > > process. In order to do the ps, kill, and so on that you need to > > recover, you need to already have

Re: [PATCH] Reserve N process to root

2007-10-10 Thread David Newall
[EMAIL PROTECTED] wrote: What David meant was that "root will always have a slot" doesn't *actually* help unless you *also* have a way to actually *spawn* such a process. In order to do the ps, kill, and so on that you need to recover, you need to already have either a root shell available, or a

Re: [PATCH] Reserve N process to root

2007-10-10 Thread g
> On Wed, 10 Oct 2007 09:46:22 EDT, Gustavo Chain said: >> El Wed, 10 Oct 2007 15:14:06 +0930 >> David Newall <[EMAIL PROTECTED]> escribió: >> > That was what I thought you had in mind; it protects from some kind >> > of fork bomb, right? But it doesn't seem useful unless you guarantee >> > having

Re: [PATCH] Reserve N process to root

2007-10-10 Thread Valdis . Kletnieks
On Wed, 10 Oct 2007 09:46:22 EDT, Gustavo Chain said: > El Wed, 10 Oct 2007 15:14:06 +0930 > David Newall <[EMAIL PROTECTED]> escribió: > > That was what I thought you had in mind; it protects from some kind > > of fork bomb, right? But it doesn't seem useful unless you guarantee > > having a pro

Re: [PATCH] Reserve N process to root

2007-10-10 Thread David Newall
Gustavo Chain wrote: El Wed, 10 Oct 2007 15:14:06 +0930 David Newall <[EMAIL PROTECTED]> escribió: Gustavo Chain wrote: El Wed, 10 Oct 2007 11:19:27 +0930 David Newall <[EMAIL PROTECTED]> escribió: Gustavo Chain wrote: I think it's necessary to reserve some pid

Re: [PATCH] Reserve N process to root

2007-10-10 Thread Gustavo Chain
El Wed, 10 Oct 2007 15:14:06 +0930 David Newall <[EMAIL PROTECTED]> escribió: > Gustavo Chain wrote: > > El Wed, 10 Oct 2007 11:19:27 +0930 > > David Newall <[EMAIL PROTECTED]> escribió: > > > >> Gustavo Chain wrote: > >> > >>> I think it's necessary to reserve some pids to the super user.

Re: [PATCH] Reserve N process to root

2007-10-09 Thread David Newall
Gustavo Chain wrote: El Wed, 10 Oct 2007 11:19:27 +0930 David Newall <[EMAIL PROTECTED]> escribió: Gustavo Chain wrote: I think it's necessary to reserve some pids to the super user. 5 must be sufficient. Why? (Sorry if I missed something.) ¿ To prevent a posible DoS ?

Re: [PATCH] Reserve N process to root

2007-10-09 Thread Gustavo Chain
El Wed, 10 Oct 2007 11:19:27 +0930 David Newall <[EMAIL PROTECTED]> escribió: > Gustavo Chain wrote: > > I think it's necessary to reserve some pids to the super user. > > 5 must be sufficient. > > Why? (Sorry if I missed something.) To prevent a posible DoS ? > > Shouldn't you test for error

Re: [PATCH] Reserve N process to root

2007-10-09 Thread David Newall
Gustavo Chain wrote: I think it's necessary to reserve some pids to the super user. 5 must be sufficient. Why? (Sorry if I missed something.) Shouldn't you test for error return before the pid is allocated? Otherwise, I think, you have to free it. Thus: long do_fork(unsigned long clone_f

[PATCH] Reserve N process to root

2007-10-09 Thread Gustavo Chain
I think it's necessary to reserve some pids to the super user. 5 must be sufficient. Signed-off-by: Gustavo Chain <[EMAIL PROTECTED]> --- kernel/fork.c |6 ++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/kernel/fork.c b/kernel/fork.c index 33f12f4..db23cb3 100644 --- a/k