Allow small amount of memory be mlock()'ed by unprivileged process?

[Andriy Gapon]

on 01/06/2012 04:40 Doug Barton said the following:
> On 5/31/2012 5:23 AM, Andriy Gapon wrote:
>> In fact, FreeBSD also has this rlimit and there seems to be full support for it on
>> both user and kernel sides.
>> OTOH, PRIV_VM_MLOCK privilege seems to be granted only to the super-user in the
>> default configuration.  And this privilege kind of defeats the limit.
>>
>> Perhaps, we should/could kill the privilege and set the limit to a sufficiently
>> small/safe value for ordinary users?
> 
> I like this idea, but someone else in the thread (sorry, don't have it
> handy) brought up the point that we don't want the aggregate of per-user
> limits to be able to bring down the system either.


The unprivileged users can not spawn any new users on their own and there is a
limit on number of processes per user, so a system administrator should be able
to plan resource limits based on system capacity and utilization.

> So the right solution
> would seem to be a reasonable per-user limit, and a cap on the maximum
> total amount of locked pages for all unprivileged users, probably based
> on some percentage of total available memory?

I would agree for a default limit of zero even.  As long as I (as a system
administrator) am able to increase it for selected users and groups.

-- 
Andriy Gapon