From owner-freebsd-hackers@freebsd.org Wed Jan 27 08:27:08 2016 Return-Path: Delivered-To: freebsd-hackers@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id A24C9A6EEA3 for ; Wed, 27 Jan 2016 08:27:08 +0000 (UTC) (envelope-from timp87@gmail.com) Received: from mail-wm0-x22b.google.com (mail-wm0-x22b.google.com [IPv6:2a00:1450:400c:c09::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 3CC7617EB; Wed, 27 Jan 2016 08:27:08 +0000 (UTC) (envelope-from timp87@gmail.com) Received: by mail-wm0-x22b.google.com with SMTP id n5so14302523wmn.0; Wed, 27 Jan 2016 00:27:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=+ox8q0n/qjHkfPGOcBDB4WD1QwQiRJgcgKtU0azXeag=; b=dh0gVa6/Irk7iiqgEku2i5g54+fiswPmpTWCHHGf7Fo1GcZ8m+Yp9f/2v16EpFNNRD LheQUkCrO3Ku9WfKps/OhXCoWqfYLiI4jxbnFFg+F1bVG6YEAGrpJCaNw7jP752uTfoE CwjBv1K2IJis/7wmFlbGtWr9CxHpDeXj+dDEL1G8DHlEjtp9fSNPDT61//s51YBKStkI M7IXhcBeL4N1El8WtEZig6rBpRufN12LB+uAqdOpER44im/UgjH31kZtnAtkkVmIojr5 7aYQKNEA1KsFWLIuyro7tXwvfOIJGoO3P/Xcu6fo51tpVT3pkV5MWmoJl/Qdhc+bVVmt G/YA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=+ox8q0n/qjHkfPGOcBDB4WD1QwQiRJgcgKtU0azXeag=; b=Ku0sfTEXAa9kKNVxZhK+k9/bWSCZO3Vc7cQORw8wZgC1a3vHrSV0T5LM1L0GPZvFgf YwyyHm0ib+bdRhZfHJdsEum1BXl7iEnvJ4PInQc60Rqaz6pCkD+hLFbAPSKdIewMnF5X qYQzJrp7tLPfnbPMemXbc0MrThAJHd4+yzIIhUE0/38ftAN1gwPFb3LciwnOjB40yAjp xI4PpWocf9hUobaxCI0Z50tMLm8kvfNctFVkzKu0o4L+laoLoteD17HDtiz6EOlyxV+U FINnbuHXZI+z067jBGIX0BPlYNy4GItGPSK9jD1mzC/ZvuvH1NDRJJVJoLX40V6mLpcX HZ4g== X-Gm-Message-State: AG10YOScd3GSxpw3HMwq7vfcAzStW+vaTQnCsCQlt1I6jU+NbOeN3rVO3dXAAuvrsq/blw4S0Erz2v1bs5ZgEA== MIME-Version: 1.0 X-Received: by 10.194.161.166 with SMTP id xt6mr29996823wjb.98.1453883226735; Wed, 27 Jan 2016 00:27:06 -0800 (PST) Received: by 10.28.89.129 with HTTP; Wed, 27 Jan 2016 00:27:06 -0800 (PST) In-Reply-To: <20160127072850.GG35911@ivaldir.etoilebsd.net> References: <56A86D91.3040709@freebsd.org> <20160127072850.GG35911@ivaldir.etoilebsd.net> Date: Wed, 27 Jan 2016 11:27:06 +0300 Message-ID: Subject: Re: syslogd(8) with OOM Killer protection From: Pavel Timofeev To: Baptiste Daroussin Cc: Allan Jude , freebsd-hackers@freebsd.org Content-Type: text/plain; charset=UTF-8 X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Jan 2016 08:27:08 -0000 2016-01-27 10:28 GMT+03:00 Baptiste Daroussin : > On Wed, Jan 27, 2016 at 02:11:13AM -0500, Allan Jude wrote: >> On 2016-01-27 01:21, Marcelo Araujo wrote: >> > Hi guys, >> > >> > I would like to know your opinion about this REVIEW[1]. >> > The basic idea is protect by default the syslogd(8) against been killed by >> > OOM with an option to disable the protection. >> > >> > Some people like the idea, other people would prefer something more global >> > where we can protect any daemon by the discretion of our choice. >> > >> > Thoughts? >> > >> > >> > [1] https://reviews.freebsd.org/D4973 >> > >> > >> > Best, >> > >> >> I do like the idea of generalizing it, say via rc.subr >> >> So you can just do: >> >> someapp_protect=YES (and maybe syslogd has this enabled by default in >> /etc/defaults/rc.conf) and it prefixes the start command with protect -i. >> > I do support that idea, I think it is will be useful to more people. > > Bapt I'm one that people. I find this generilized way very usefull. I have least a couple of daemons that it'd never wanted to be OOMed on my machines. Besides syslogd, I'd protect sshd and even crond in some cases.