Home » Mailing list archives » linux-kernel » 2008 » April » 1

Re: [PATCH 06/45] KEYS: Make the keyring quotas controllable through /proc/sys [ver #35]

!MAILaRCHIVE_VOTE_RePLACE
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
[view in full thread]
From: Berthold Cogel <cogel@...>
To: David Howells <dhowells@...>
Cc: <torvalds@...>, <akpm@...>, <trond.myklebust@...>, <chuck.lever@...>, <nfsv4@...>, <linux-kernel@...>, <linux-fsdevel@...>, <selinux@...>, <linux-security-module@...>
Subject: Re: [PATCH 06/45] KEYS: Make the keyring quotas controllable through /proc/sys [ver #35]
Date: Tuesday, April 1, 2008 - 11:29 am

David Howells schrieb:

Hello David,

you're our hero! ;-)

We just hit this wall while migrating from RHEl 3 to RHEL 5 with some of 
our webservers.

[root@lvr11 ~]# cat /proc/key-users
     0:    99 98/98 96/100 1681/10000
    32:     2 2/2 2/100 56/10000
    38:     2 2/2 2/100 56/10000
    43:     2 2/2 2/100 56/10000
    51:     2 2/2 2/100 56/10000
    68:     2 2/2 2/100 56/10000
    81:     2 2/2 2/100 56/10000
    99:     2 2/2 2/100 56/10000
   348:     2 2/2 2/100 58/10000
42216:     2 2/2 2/100 62/10000
55188:     3 3/3 3/100 72/10000
56537:     2 2/2 2/100 62/10000
63743:     2 2/2 2/100 62/10000
68054:     2 2/2 2/100 62/10000

....


We're using OpenAFS on our systems and most of our webpages are stored 
in AFS. We have a lot of small projects for which a separate server 
would be a waste of 'metal'. Even in a virtual environment. So we're 
hosting a lot of apache instances on a single machine. Beause suexec 
doesn't work in an AFS environment, each instance is started by root 
with its own IP (to be able to talk HTTPS) and in a PAG with a separate 
token for a service user (to isolate the projects). Although each apache 
switches  over to the service user, the initial tokens are acquired by root.

On RHEL 3 with the old 2.4 kernel this was never a problem. But now...

Btw.: We have some machines with about hundred (!) different projects 
which need tokens.


Best regards,

Berthold Cogel

-- 
Dr. Berthold Cogel                             University of Cologne
E-Mail: cogel@uni-koeln.de                     ZAIK-US (RRZK)
Tel.:   +49(0)221/470-7873                     Robert-Koch-Str. 10
FAX:    +49(0)221/478-85845                    D-50931 Cologne - Germany
--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
Messages in current thread:
[PATCH 00/45] Permit filesystem local caching [ver #35], David Howells, (Fri Mar 28, 10:30 am)
[PATCH 35/45] NFS: Define and create inode-level cache objec..., David Howells, (Fri Mar 28, 10:33 am)
[PATCH 37/45] NFS: Invalidate FsCache page flags when cache ..., David Howells, (Fri Mar 28, 10:33 am)
[PATCH 42/45] NFS: Read pages from FS-Cache into an NFS inod..., David Howells, (Fri Mar 28, 10:33 am)
[PATCH 32/45] NFS: Register NFS for caching and retrieve the..., David Howells, (Fri Mar 28, 10:32 am)
[PATCH 39/45] NFS: FS-Cache page management [ver #35], David Howells, (Fri Mar 28, 10:33 am)
[PATCH 41/45] NFS: nfs_readpage_async() needs to be accessib..., David Howells, (Fri Mar 28, 10:33 am)
[PATCH 36/45] NFS: Use local disk inode cache [ver #35], David Howells, (Fri Mar 28, 10:33 am)
[PATCH 34/45] NFS: Define and create superblock-level object..., David Howells, (Fri Mar 28, 10:33 am)
[PATCH 45/45] NFS: Add mount options to enable local caching..., David Howells, (Fri Mar 28, 10:34 am)
[PATCH 33/45] NFS: Define and create server-level objects [v..., David Howells, (Fri Mar 28, 10:33 am)
[PATCH 31/45] NFS: Permit local filesystem caching to be ena..., David Howells, (Fri Mar 28, 10:32 am)
[PATCH 44/45] NFS: Display local caching state [ver #35], David Howells, (Fri Mar 28, 10:33 am)
[PATCH 22/45] CacheFiles: Add a hook to write a single page ..., David Howells, (Fri Mar 28, 10:32 am)
[PATCH 28/45] FS-Cache: Make kAFS use FS-Cache [ver #35], David Howells, (Fri Mar 28, 10:32 am)
[PATCH 19/45] Add missing consts to xattr function arguments..., David Howells, (Fri Mar 28, 10:31 am)
[PATCH 30/45] NFS: Add FS-Cache option bit and debug bit [ve..., David Howells, (Fri Mar 28, 10:32 am)
[PATCH 29/45] NFS: Add comment banners to some NFS functions..., David Howells, (Fri Mar 28, 10:32 am)
[PATCH 09/45] Security: Change current-&gt;fs[ug]id to curre..., David Howells, (Fri Mar 28, 10:30 am)
[PATCH 25/45] CacheFiles: A cache that backs onto a mounted ..., David Howells, (Fri Mar 28, 10:32 am)
[PATCH 06/45] KEYS: Make the keyring quotas controllable thr..., David Howells, (Fri Mar 28, 10:30 am)
Re: [PATCH 06/45] KEYS: Make the keyring quotas controllable..., Berthold Cogel, (Tue Apr 1, 11:29 am)
[PATCH 40/45] NFS: Add read context retention for FS-Cache t..., David Howells, (Fri Mar 28, 10:33 am)
[PATCH 26/45] AFS: Add a MAINTAINERS record for AFS [ver #35], David Howells, (Fri Mar 28, 10:32 am)
[PATCH 27/45] AFS: prevent double cell registration [ver #35], David Howells, (Fri Mar 28, 10:32 am)
[PATCH 11/45] Security: De-embed task security record from t..., David Howells, (Fri Mar 28, 10:31 am)
[PATCH 16/45] FS-Cache: Recruit a couple of page flags for c..., David Howells, (Fri Mar 28, 10:31 am)
[PATCH 05/45] KEYS: Don't generate user and user session key..., David Howells, (Fri Mar 28, 10:30 am)
[PATCH 24/45] CacheFiles: Export things for CacheFiles [ver ..., David Howells, (Fri Mar 28, 10:32 am)
[PATCH 13/45] Security: Allow kernel services to override LS..., David Howells, (Fri Mar 28, 10:31 am)
[PATCH 23/45] CacheFiles: Permit the page lock state to be m..., David Howells, (Fri Mar 28, 10:32 am)
[PATCH 43/45] NFS: Store pages from an NFS inode into a loca..., David Howells, (Fri Mar 28, 10:33 am)
[PATCH 18/45] FS-Cache: Generic filesystem caching facility ..., David Howells, (Fri Mar 28, 10:31 am)
[PATCH 14/45] Security: Make NFSD work with detached securit..., David Howells, (Fri Mar 28, 10:31 am)
[PATCH 20/45] CacheFiles: Add missing copy_page export for i..., David Howells, (Fri Mar 28, 10:31 am)
[PATCH 02/45] KEYS: Check starting keyring as part of search..., David Howells, (Fri Mar 28, 10:30 am)
[PATCH 07/45] KEYS: Make key_serial() a function if CONFIG_K..., David Howells, (Fri Mar 28, 10:30 am)
[PATCH 12/45] Security: Add a kernel_service object class to..., David Howells, (Fri Mar 28, 10:31 am)
[PATCH 38/45] NFS: Add some new I/O counters for FS-Cache do..., David Howells, (Fri Mar 28, 10:33 am)
[PATCH 21/45] CacheFiles: Be consistent about the use of map..., David Howells, (Fri Mar 28, 10:31 am)
[PATCH 17/45] FS-Cache: Provide an add_wait_queue_tail() fun..., David Howells, (Fri Mar 28, 10:31 am)
[PATCH 15/45] FS-Cache: Release page-&gt;private after faile..., David Howells, (Fri Mar 28, 10:31 am)
[PATCH 10/45] Security: Separate task security context from ..., David Howells, (Fri Mar 28, 10:31 am)
[PATCH 08/45] KEYS: Add keyctl function to get a security la..., David Howells, (Fri Mar 28, 10:30 am)
[PATCH 04/45] KEYS: Allow clients to set key perms in key_cr..., David Howells, (Fri Mar 28, 10:30 am)
[PATCH 03/45] KEYS: Allow the callout data to be passed as a..., David Howells, (Fri Mar 28, 10:30 am)
[PATCH 01/45] KEYS: Increase the payload size when instantia..., David Howells, (Fri Mar 28, 10:30 am)