Attachment 104444 Details for Bug 81469 – [PATCH 1/4] config: add new limit: max_connections_per_cgroup

[PATCH 1/4] config: add new limit: max_connections_per_cgroup

0001-config-add-new-limit-max_connections_per_cgroup.patch (text/plain), 6.10 KB, created by Alban Crequy on 2014-08-11 14:51:39 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Alban Crequy

Created: 2014-08-11 14:51:39 UTC

Size: 6.10 KB

patch

obsolete

>From b417caae5f3666bc6b1fe0018204131e61705cdb Mon Sep 17 00:00:00 2001
>From: Alban Crequy <alban.crequy@collabora.co.uk>
>Date: Wed, 16 Jul 2014 14:34:35 +0100
>Subject: [PATCH 1/4] config: add new limit: max_connections_per_cgroup
>
>dbus-daemon already has the following limits:
>- max_completed_connections: (default|system bus)=2048 (session bus)=100000
>- max_connections_per_user: (default|system bus)=256 (session bus)=100000
>
>So an user on the system bus cannot use all connections and prevent other users
>from connecting to the bus.
>
>But this per-user granularity does not allow to distinguish different services
>running as the same user. For example, both Avahi and ConsoleKit are system
>services, running as the same user root, and they connect to the system bus. If
>one of them starts to use all the available connections due to a bug, the other
>will not be able to connect.
>
>To fix this issue, this patch introduces a new configurable limit:
>- max_connections_per_cgroup: (default|system bus)=256 (session bus)=100000
>
>The default values are large enough to avoid impacting current systems but an
>administrator could restrict it more.
>
>https://bugs.freedesktop.org/show_bug.cgi?id=81469
>---
> bus/bus.c                | 6 ++++++
> bus/bus.h                | 2 ++
> bus/config-parser.c      | 8 ++++++++
> bus/session.conf.in      | 1 +
> doc/dbus-daemon.1.xml.in | 3 +++
> 5 files changed, 20 insertions(+)
>
>diff --git a/bus/bus.c b/bus/bus.c
>index edce063..9141dcd 100644
>--- a/bus/bus.c
>+++ b/bus/bus.c
>@@ -1249,6 +1249,12 @@ bus_context_get_max_incomplete_connections (BusContext *context)
> }
> 
> int
>+bus_context_get_max_connections_per_cgroup (BusContext *context)
>+{
>+  return context->limits.max_connections_per_cgroup;
>+}
>+
>+int
> bus_context_get_max_connections_per_user (BusContext *context)
> {
>   return context->limits.max_connections_per_user;
>diff --git a/bus/bus.h b/bus/bus.h
>index 2c4cec3..c855b93 100644
>--- a/bus/bus.h
>+++ b/bus/bus.h
>@@ -56,6 +56,7 @@ typedef struct
>   int auth_timeout;                 /**< How long to wait for an authentication to time out */
>   int max_completed_connections;    /**< Max number of authorized connections */
>   int max_incomplete_connections;   /**< Max number of incomplete connections */
>+  int max_connections_per_cgroup;   /**< Max number of connections with the same cgroup */
>   int max_connections_per_user;     /**< Max number of connections auth'd as same user */
>   int max_connections_per_process;  /**< Max number of connections per process */
>   int max_pending_activations;      /**< Max number of pending activations for the entire bus */
>@@ -109,6 +110,7 @@ int               bus_context_get_activation_timeout             (BusContext
> int               bus_context_get_auth_timeout                   (BusContext       *context);
> int               bus_context_get_max_completed_connections      (BusContext       *context);
> int               bus_context_get_max_incomplete_connections     (BusContext       *context);
>+int               bus_context_get_max_connections_per_cgroup     (BusContext       *context);
> int               bus_context_get_max_connections_per_user       (BusContext       *context);
> int               bus_context_get_max_connections_per_process    (BusContext       *context);
> int               bus_context_get_max_pending_activations        (BusContext       *context);
>diff --git a/bus/config-parser.c b/bus/config-parser.c
>index 781d857..31d20ae 100644
>--- a/bus/config-parser.c
>+++ b/bus/config-parser.c
>@@ -441,6 +441,7 @@ bus_config_parser_new (const DBusString      *basedir,
>       parser->limits.auth_timeout = 30000; /* 30 seconds */
>       
>       parser->limits.max_incomplete_connections = 64;
>+      parser->limits.max_connections_per_cgroup = 256;
>       parser->limits.max_connections_per_user = 256;
>       parser->limits.max_connections_per_process = 8;
>       
>@@ -1921,6 +1922,12 @@ set_limit (BusConfigParser *parser,
>       must_be_int = TRUE;
>       parser->limits.max_incomplete_connections = value;
>     }
>+  else if (strcmp (name, "max_connections_per_cgroup") == 0)
>+    {
>+      must_be_positive = TRUE;
>+      must_be_int = TRUE;
>+      parser->limits.max_connections_per_cgroup = value;
>+    }
>   else if (strcmp (name, "max_connections_per_user") == 0)
>     {
>       must_be_positive = TRUE;
>@@ -3117,6 +3124,7 @@ limits_equal (const BusLimits *a,
>      || a->auth_timeout == b->auth_timeout
>      || a->max_completed_connections == b->max_completed_connections
>      || a->max_incomplete_connections == b->max_incomplete_connections
>+     || a->max_connections_per_cgroup == b->max_connections_per_cgroup
>      || a->max_connections_per_user == b->max_connections_per_user
>      || a->max_connections_per_process == b->max_connections_per_process
>      || a->max_pending_activations == b->max_pending_activations
>diff --git a/bus/session.conf.in b/bus/session.conf.in
>index cd799f7..00e85c2 100644
>--- a/bus/session.conf.in
>+++ b/bus/session.conf.in
>@@ -54,6 +54,7 @@
>   <limit name="auth_timeout">240000</limit>
>   <limit name="max_completed_connections">100000</limit>  
>   <limit name="max_incomplete_connections">10000</limit>
>+  <limit name="max_connections_per_cgroup">100000</limit>
>   <limit name="max_connections_per_user">100000</limit>
>   <limit name="max_connections_per_process">8</limit>
>   <limit name="max_pending_service_starts">10000</limit>
>diff --git a/doc/dbus-daemon.1.xml.in b/doc/dbus-daemon.1.xml.in
>index af8ba9f..77e1635 100644
>--- a/doc/dbus-daemon.1.xml.in
>+++ b/doc/dbus-daemon.1.xml.in
>@@ -531,6 +531,9 @@ Available limit names are:</para>
>       "max_completed_connections"  : max number of authenticated connections
>       "max_incomplete_connections" : max number of unauthenticated
>                                      connections
>+      "max_connections_per_cgroup" : max number of completed connections from
>+                                     the same cgroup path in the hierarchy
>+                                     with the lowest hierarchy id
>       "max_connections_per_user"   : max number of completed connections from
>                                      the same user
>       "max_connections_per_process": max number of completed connections from
>-- 
>1.8.5.3
>

Actions: View

Attachments on bug 81469: 102994 | 102995 | 102996 | 104444 | 104445 | 104446 | 104447 | 104664 | 104665 | 104666

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.