Date: Mon, 2 Aug 2021 17:06:43 +0200 From: Michael Gmelin <freebsd@grem.de> To: Konstantin Belousov <kostikbel@gmail.com> Cc: jail@freebsd.org Subject: Re: POSIX shared memory, jails, and (lack of) limits Message-ID: <EF1E80B4-684B-4698-A971-F637F0D726B4@grem.de> In-Reply-To: <YQf5ZNUV6hVm5gOK@kib.kiev.ua> References: <YQf5ZNUV6hVm5gOK@kib.kiev.ua>
next in thread | previous in thread | raw e-mail | index | archive | help
> On 2. Aug 2021, at 15:56, Konstantin Belousov <kostikbel@gmail.com> wrote:= >=20 > =EF=BB=BFOn Mon, Aug 02, 2021 at 02:19:00PM +0200, Michael Gmelin wrote: >> Hi, >>=20 >> I've been playing a bit with POSIX shared memory and, unlike for SysV >> shared memory, I couldn't find any way to limit its use by jails. >>=20 >> First, I looked at racct/rctl, but there is no resource for POSIX shared >> memory and memoryuse/vmemoryuse don't seem to have an effect (which >> makes sense). >>=20 >> Then I checked if there are jail parameters that could help, but there >> doesn't seem to be anything like "allow.sysvshm" for POSIX shared >> memory to limit access to the feature. >>=20 >> So, unless I'm missing something, it seems like all jails on a system >> have unlimited access to POSIX shared memory and therefore any single >> jail can use up the jailhost's virtual memory until the jailhost comes >> to a grinding halt. >>=20 >> I wrote a little test program that keeps allocating POSIX shared memory >> inside of a jail and it can easily bring the host down to its knees: >>=20 >> login: Aug 2 12:12:09 test kernel: pid 11825 (getty), jid 0, uid 0, >> was killed: out of swap space >> Aug 2 12:12:10 test init[11827]: getty repeating too quickly on port >> /dev/ttyu0, sleeping 30 secs >> Aug 2 12:12:10 test kernel: pid 11826 (getty), jid 0, uid 0, was >> killed: out of swap space >=20 > Posix shm is limited by the swap accounting. For non-jail consumers, > it is per-uid RLIMIT_SWAP. I do not know if other mechanisms make > RLIMIT_SWAP per-jail per-uid. Unfortunately it seems like POSIX shared memory is not linked to the jail it= was created in (we discussed this on this list in June and I created a few P= Rs about that), so per jail rctl rules don=E2=80=99t apply (and limiting uid= 0 won=E2=80=99t have the desired effect ^_^). Best Michael
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?EF1E80B4-684B-4698-A971-F637F0D726B4>