Re: [PATCH 1/3] memcg: limit the number of thresholds per-memcg

2013-08-08 Thread Tejun Heo
Hello, On Thu, Aug 08, 2013 at 04:43:51PM +0200, Michal Hocko wrote: > > Is it correct that you fix one local DoS by introducing a new one? > > With the page the !priv user can block root from registering a threshold. > > Is it really the way we want to fix it? > > OK, I will think about it some

Re: [PATCH 1/3] memcg: limit the number of thresholds per-memcg

2013-08-08 Thread Michal Hocko
On Thu 08-08-13 01:05:13, Kirill A. Shutemov wrote: > On Wed, Aug 07, 2013 at 04:37:27PM +0200, Michal Hocko wrote: > > On Wed 07-08-13 09:58:18, Tejun Heo wrote: > > > Hello, > > > > > > On Wed, Aug 07, 2013 at 03:46:54PM +0200, Michal Hocko wrote: > > > > OK, I have obviously misunderstood your

Re: [PATCH 1/3] memcg: limit the number of thresholds per-memcg

2013-08-08 Thread Michal Hocko
On Thu 08-08-13 01:05:13, Kirill A. Shutemov wrote: On Wed, Aug 07, 2013 at 04:37:27PM +0200, Michal Hocko wrote: On Wed 07-08-13 09:58:18, Tejun Heo wrote: Hello, On Wed, Aug 07, 2013 at 03:46:54PM +0200, Michal Hocko wrote: OK, I have obviously misunderstood your concern

Re: [PATCH 1/3] memcg: limit the number of thresholds per-memcg

2013-08-08 Thread Tejun Heo
Hello, On Thu, Aug 08, 2013 at 04:43:51PM +0200, Michal Hocko wrote: Is it correct that you fix one local DoS by introducing a new one? With the page the !priv user can block root from registering a threshold. Is it really the way we want to fix it? OK, I will think about it some more.

Re: [PATCH 1/3] memcg: limit the number of thresholds per-memcg

2013-08-07 Thread Kirill A. Shutemov
On Wed, Aug 07, 2013 at 04:37:27PM +0200, Michal Hocko wrote: > On Wed 07-08-13 09:58:18, Tejun Heo wrote: > > Hello, > > > > On Wed, Aug 07, 2013 at 03:46:54PM +0200, Michal Hocko wrote: > > > OK, I have obviously misunderstood your concern mentioned in the other > > > email. Could you be more

Re: [PATCH 1/3] memcg: limit the number of thresholds per-memcg

2013-08-07 Thread Michal Hocko
On Wed 07-08-13 09:58:18, Tejun Heo wrote: > Hello, > > On Wed, Aug 07, 2013 at 03:46:54PM +0200, Michal Hocko wrote: > > OK, I have obviously misunderstood your concern mentioned in the other > > email. Could you be more specific what is the DoS scenario which was > > your concern, then? > >

Re: [PATCH 1/3] memcg: limit the number of thresholds per-memcg

2013-08-07 Thread Tejun Heo
Hello, On Wed, Aug 07, 2013 at 03:46:54PM +0200, Michal Hocko wrote: > OK, I have obviously misunderstood your concern mentioned in the other > email. Could you be more specific what is the DoS scenario which was > your concern, then? So, let's say the file is write-accessible to !priv user

Re: [PATCH 1/3] memcg: limit the number of thresholds per-memcg

2013-08-07 Thread Michal Hocko
On Wed 07-08-13 09:22:10, Tejun Heo wrote: > Hello, > > On Wed, Aug 07, 2013 at 01:28:25PM +0200, Michal Hocko wrote: > > There is no limit for the maximum number of threshold events registered > > per memcg. This might lead to an user triggered memory depletion if a > > regular user is allowed

Re: [PATCH 1/3] memcg: limit the number of thresholds per-memcg

2013-08-07 Thread Tejun Heo
Hello, On Wed, Aug 07, 2013 at 01:28:25PM +0200, Michal Hocko wrote: > There is no limit for the maximum number of threshold events registered > per memcg. This might lead to an user triggered memory depletion if a > regular user is allowed to register on memory.[memsw.]usage_in_bytes > eventfd

[PATCH 1/3] memcg: limit the number of thresholds per-memcg

2013-08-07 Thread Michal Hocko
There is no limit for the maximum number of threshold events registered per memcg. This might lead to an user triggered memory depletion if a regular user is allowed to register on memory.[memsw.]usage_in_bytes eventfd interface. Let's be more strict and cap the number of events that might be

[PATCH 1/3] memcg: limit the number of thresholds per-memcg

2013-08-07 Thread Michal Hocko
There is no limit for the maximum number of threshold events registered per memcg. This might lead to an user triggered memory depletion if a regular user is allowed to register on memory.[memsw.]usage_in_bytes eventfd interface. Let's be more strict and cap the number of events that might be

Re: [PATCH 1/3] memcg: limit the number of thresholds per-memcg

2013-08-07 Thread Tejun Heo
Hello, On Wed, Aug 07, 2013 at 01:28:25PM +0200, Michal Hocko wrote: There is no limit for the maximum number of threshold events registered per memcg. This might lead to an user triggered memory depletion if a regular user is allowed to register on memory.[memsw.]usage_in_bytes eventfd

Re: [PATCH 1/3] memcg: limit the number of thresholds per-memcg

2013-08-07 Thread Michal Hocko
On Wed 07-08-13 09:22:10, Tejun Heo wrote: Hello, On Wed, Aug 07, 2013 at 01:28:25PM +0200, Michal Hocko wrote: There is no limit for the maximum number of threshold events registered per memcg. This might lead to an user triggered memory depletion if a regular user is allowed to

Re: [PATCH 1/3] memcg: limit the number of thresholds per-memcg

2013-08-07 Thread Tejun Heo
Hello, On Wed, Aug 07, 2013 at 03:46:54PM +0200, Michal Hocko wrote: OK, I have obviously misunderstood your concern mentioned in the other email. Could you be more specific what is the DoS scenario which was your concern, then? So, let's say the file is write-accessible to !priv user which

Re: [PATCH 1/3] memcg: limit the number of thresholds per-memcg

2013-08-07 Thread Michal Hocko
On Wed 07-08-13 09:58:18, Tejun Heo wrote: Hello, On Wed, Aug 07, 2013 at 03:46:54PM +0200, Michal Hocko wrote: OK, I have obviously misunderstood your concern mentioned in the other email. Could you be more specific what is the DoS scenario which was your concern, then? So, let's say

Re: [PATCH 1/3] memcg: limit the number of thresholds per-memcg

2013-08-07 Thread Kirill A. Shutemov
On Wed, Aug 07, 2013 at 04:37:27PM +0200, Michal Hocko wrote: On Wed 07-08-13 09:58:18, Tejun Heo wrote: Hello, On Wed, Aug 07, 2013 at 03:46:54PM +0200, Michal Hocko wrote: OK, I have obviously misunderstood your concern mentioned in the other email. Could you be more specific what