On Fri, 4 Jan 2008, Dag-Erling Sm=F8rgrav wrote:

quoted text
> Robert Watson <rwatson@FreeBSD.org> writes:
>> Dag-Erling Sm=F8rgrav <des@des.no> writes:
>>> Robert Watson <rwatson@FreeBSD.org> writes:
>>>> The right answer is presumably to introduce a new LIMIT_SWAP, which=20
>>>> limits the allocation of anonymous memory by processes, and size it to=
=20
quoted text
>>>> something like 90% of swap space by default.
>>> Not a good solution on its own.  You need a per-process limit as well,=
=20
quoted text
>>> otherwise a malloc() bomb will still cause other processes to fail=20
>>> randomly.
>> That was what I had in mind, the above should read RLIMIT_SWAP.
>
> You don't want the default to be so high.  You want a low default, with t=
he=20
quoted text
> possibility for the admin to increase the limit for a particular user in=
=20
quoted text
> login.conf or similar without rebooting (which is currently not possible=
=20
quoted text
> since the default datasize =3D=3D maxdsiz, which can only be changed in t=
he=20
quoted text
> kernel config or loader.conf)

I'm fine with also having global limits.

quoted text
> You may also want to have a collective limit for unprivileged users, so r=
oot=20
quoted text
> will still be able to log in if something goes wrong.

This will presumably only work for console logins, as sshd (etc) will depen=
d=20
on unprivileged users, but perhaps that is fine.  I'm less concerned with t=
he=20
details of the implementation or policy than that we simply be able to supp=
ort=20
even a basic policy and have it configured by default to prevent=20
foot-shooting.

Robert N M Watson
Computer Laboratory
University of Cambridge