Date: Sat, 9 Feb 2013 14:07:33 +0100 From: Fabian Keil <freebsd-listen@fabiankeil.de> To: Eitan Adler <lists@eitanadler.com> Cc: zont@freebsd.org, current@freebsd.org, Andriy Gapon <avg@freebsd.org> Subject: Re: geli(8) breaks after a couple hours of uptime Message-ID: <20130209140733.0b753c60@fabiankeil.de> In-Reply-To: <CAF6rxgn7PRmBkx3FLnXfOjKzSHi1JEQQ_wc4273oHCmpTCjR1A@mail.gmail.com> References: <20130207141833.GA15884@acme.spoerlein.net> <20130207153322.5c371beb@fabiankeil.de> <20130207180153.GX35868@acme.spoerlein.net> <20130208095709.6ae61cff@fabiankeil.de> <20130208114825.GY35868@acme.spoerlein.net> <5114F390.4010302@FreeBSD.org> <CAF6rxgn7PRmBkx3FLnXfOjKzSHi1JEQQ_wc4273oHCmpTCjR1A@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--Sig_/jY2+Yx8L8PEl1v6N.Rbl=Fs Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Eitan Adler <lists@eitanadler.com> wrote: > On 8 February 2013 07:46, Andriy Gapon <avg@freebsd.org> wrote: > > on 08/02/2013 13:48 Ulrich Sp=C3=B6rlein said the following: > >> It looks like 128k as a limit is still too low for geli(8) to work, and > >> I've set it to 256k now, so that I can use "sudo geli". Can you maybe > >> revise the patch to not use 1024k as an arbitrary limit, but rather ma= ke > >> sure you test for precisely as much memory as will be needed? IIRC 256K didn't work for me, 512K did, so I doubled it to have some leg room. I'm not sure it's possible to reliably estimate the required memory without first changing geli to mlock less generously, something Konstantin suggested in: http://lists.freebsd.org/pipermail/svn-src-all/2013-January/063939.html While I agree that mlocking less generously would technically be a better solution than increasing the limit, it would also require a lot more work, additional audits to make sure it's done correctly and in case of geli I don't really see a problem with mlocking 1024K for a few seconds. > >> Also, can we maybe revisit the new 64k default limit, as it will > >> obviously make peoples work with geli a bit painful, this should work > >> out of the box. > > > > I have some, IMO, better suggestions: > > - use -c option with sudo I usually execute "sudo geli" through a wrapper (zogftw) so this makes patching geli optional for me. Thanks for mentioning it (again). > > - tune your system for your needs > > > > - [major] abolish the silliness of tying resource limits to login class= and apply > > resource limits based on user and group IDs; including after su/sudo (s= ubject to > > local policies) While we are dreaming, it would be nice to have more resource limits that apply to all the processes belonging to the user combined. It also wouldn't hurt to document why a 64K per-process limit with an unlimited number of processes per user is considered a good default in the first place. > The default settings should not make another feature unusable. At a > minimum it should be documented in geli's man page that such tuning is > required. If the consensus is that 1024K are too much for geli and nobody can be bothered to come up with a more fine grained mlocking patch, geli could be changed to check the mlock limit and exit with a useful error message if it's too low. This would at least prevent the segfault. Fabian --Sig_/jY2+Yx8L8PEl1v6N.Rbl=Fs Content-Type: application/pgp-signature; name=signature.asc Content-Disposition: attachment; filename=signature.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iEYEARECAAYFAlEWSj8ACgkQBYqIVf93VJ3rAgCgu1iYg5yzcXQcPdIbZkIEDpt6 b4UAn0jMgyb4DIpCJQTh3sBMVaN6pNfP =wEMK -----END PGP SIGNATURE----- --Sig_/jY2+Yx8L8PEl1v6N.Rbl=Fs--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20130209140733.0b753c60>