Re: Sys Admin question

Matti Aarnio (matti.aarnio@sonera.fi)
Tue, 26 Oct 1999 17:01:10 +0300


On Tue, Oct 26, 1999 at 09:37:00AM -0400, Michael Bacarella wrote:
> This probably isn't the best place to ask, but it's Linux, and I trust the
> natural order of internet flamethrowing to cordially correct me.
>
> I have a Linux server with evil users looking to destroy it (ISP).
> Even effortlessly, I find that I can consume all of the VM on the system.
>
> The limits are set to something rather reasonable (10M of addressable
> memory per process, 12 processes max per user). Stricter restrictions
> make trivial tasks impossible (man, for one). Under this scheme, a single
> user can still consume 120 megs of virtual memory.

Yes, memory accounting is per process. We don't have
(nor BSD has) a per *user* memory limit, although such
might be of what people like you would love to see.

> Perusing the kernel source shows that such a framework is in place, but no
> real meat is attached to it, so it rules that option out (unless I'm
> misreading).
>
> What can I do in the meantime? There's only so much swap space that I can
> add, and I'm still vulnerable if enough users decide that they want to run
> resource intensive tasks.

With 2.2 kernels (and fresh utilities) you can create 2 GB swap
partitions, and (if I read mm/swapfile.c correctly), there is
no upper hard limit on number of swap files/partitions allowed
in the system. ( That is, after some fast swap, do throw in a
20 GB IDE disk sliced to 10 partitions, 2GB each.. I have heard
that such monsters are around USD 400 apiece.. )

> It seems like the system can't say that enough is enough for a greedy user
> and start making mmap() fail for them, choosing to instead axe some
> processes (such as init(!)) to satisfy memory demand.
>
> Am I missing something bluntly obvious?

No. (Aside of not mentioning what kernel you are now running.)

> Thanks
> -Michael Bacarella

/Matti Aarnio <matti.aarnio@sonera.fi>

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/