Date: Thu, 7 Apr 2005 13:43:28 -0700 From: Brooks Davis <brooks@one-eyed-alien.net> To: Kris Kennaway <kris@obsecurity.org> Cc: stable@freebsd.org Subject: Re: nfsiod tasks started in error Message-ID: <20050407204328.GC21190@odin.ac.hmc.edu> In-Reply-To: <20050407203626.GB33137@xor.obsecurity.org> References: <MIEPLLIBMLEEABPDBIEGKELKHDAA.bob@a1poweruser.com> <20050407202947.GB21190@odin.ac.hmc.edu> <20050407203626.GB33137@xor.obsecurity.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--raC6veAxrt5nqIoY Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Apr 07, 2005 at 01:36:26PM -0700, Kris Kennaway wrote: > On Thu, Apr 07, 2005 at 01:29:48PM -0700, Brooks Davis wrote: > > On Thu, Apr 07, 2005 at 04:11:55PM -0400, bob@a1poweruser.com wrote: > > > During sysinstall answered no to the server and client nfs questions > > > and after installed completed and system rebooted I see task > > > nfsiod1,2,3,4 running in output of ps ax command. This was not the > > > case in any of the 4.x releases. This can be looked upon as a > > > security leak. This may be a error in the new boot up process. This > > > was first reported 1/16/2004 in 5.2 RC2 as Problem Report kern/61438 > > > and again in 5.3 as Problem Report kern/79539 > > >=20 > > > I tried to run /usr/local/etc/rc.d/killnfs.sh script to kill these > > > unwanted tasks but that does not work. > > >=20 > > > Any suggestions on how I can kill these bogus nfs tasks as part of > > > boot up or what to change in the boot up process so these tasks > > > don't get started in the first place? Doing a manual recompile of > > > the kernel to remove the nfs statements is not a viable solution. > >=20 > > nfsiod now runs as a kernel process and is control by these sysctls: > >=20 > > vfs.nfs.iodmaxidle: 120 > > vfs.nfs.iodmin: 4 > > vfs.nfs.iodmax: 20 > >=20 > > It looks like setting vfs.nfs.iodmin=3D0 and then klling them off works. > > We probably should think about changing the default to 0 and setting > > appropriate values via /etc/rc.d/nfs. Over all, I can't say this is a > > very high priority though patches would certaintly be accepted. >=20 > This was a deliberate change by Peter, since if you have NFSCLIENT in > the kernel it's assumed you want to use the machine as a NFS client. I was thinking the thing to do would be to change the minimum to 0 by default and push it back to 4 if you have nfs_client_enable=3Dyes. It doesn't look like that would have much performance impact given the default max of 20 and the default 2 minute timeout once they are started. It would be intresting to see if you'd even notice the difference between 0 and 4 in worldstone. -- Brooks --=20 Any statement of the form "X is the one, true Y" is FALSE. PGP fingerprint 655D 519C 26A7 82E7 2529 9BF0 5D8E 8BE9 F238 1AD4 --raC6veAxrt5nqIoY Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFCVZtvXY6L6fI4GtQRAnzPAKDRgfj+nrEAIMFio64lMFDT4+gmUgCg15F5 8oCxpgfDW8JfSu3XFHig0yU= =2RDy -----END PGP SIGNATURE----- --raC6veAxrt5nqIoY--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050407204328.GC21190>