Date: Mon, 13 Sep 2021 15:25:55 +0000 From: bugzilla-noreply@freebsd.org To: jail@FreeBSD.org Subject: [Bug 258364] [jail]Two issues that can easily exhaust the host kernel's numvnodes or dp_dirty_total in jail, and may cause DoS attack Message-ID: <bug-258364-29815-6ikgRWeH1C@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-258364-29815@https.bugs.freebsd.org/bugzilla/> References: <bug-258364-29815@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D258364 Mark Johnston <markj@FreeBSD.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|New |Open CC| |markj@FreeBSD.org Assignee|secteam@FreeBSD.org |jail@FreeBSD.org --- Comment #1 from Mark Johnston <markj@FreeBSD.org> --- We do not consider this to be a security bug. Jails do not provide perfect resource isolation, and there are many cases beyond the vnode cache and dir= ty buffer pool where this is evident. Any resources utilized by a jail become unavailable to the host by definition. In the case of vnodes, numvnodes counts the number of cached vnodes. This cache is subject to an eviction policy, so reaching maxvnodes (using mkdir(= 1)) should not prevent the host from opening files. Similarly, ZFS imposes a l= imit on the amount of dirty buffers that may be accumulated, but will (eventuall= y) make space for newly dirtied data by flushing. So I do not think that these problems result in anything other than a marginal performance degradation, which appears to agree with your report. Certainly it's desirable to have some way of limiting consumption of these resources by a particular jail (e.g., via rctl), but for vnodes at least it= 's not immediately obvious to me how one would go about that, since filesystem namespaces are shared with the host. Opened vnodes are not subject to reclamation in general but can be limited using rctl. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-258364-29815-6ikgRWeH1C>