File 0045-main-bump-RLIMIT_MEMLOCK-for-the-root-user... of Package systemd

Overview Repositories Revisions Requests Users Attributes Meta

File 0045-main-bump-RLIMIT_MEMLOCK-for-the-root-user-substanti.patch of Package systemd (Revision 2a0ef622b860d89b09df9bc0f43c3432)

Currently displaying revision 2a0ef622b860d89b09df9bc0f43c3432 , Show latest

From 608a5f400268a6689c2bcf8b5dc8a8fcc7219958 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 21 Sep 2017 19:43:07 +0200
Subject: [PATCH 45/51] main: bump RLIMIT_MEMLOCK for the root user
 substantially

On current kernels BPF_MAP_TYPE_LPM_TRIE bpf maps are charged against
RLIMIT_MEMLOCK even for privileged users that have CAP_IPC_LOCK. Given
that mlock() generally ignores RLIMIT_MEMLOCK if CAP_IPC_LOCK is set
this appears to be an oversight in the kernel. Either way, until that's
fixed, let's just bump RLIMIT_MEMLOCK for the root user considerably, as
the default is quite limiting, and doesn't permit us to create more than
a few TRIE maps.

(cherry picked from commit fb3ae275cbd6bc17444e0816ee4c7496f2750209)

[fbui: adjust context]
[fbui: also fixes $SUBJECT as this commit is about RLIMIT_MEMLOCK, i.e. not RLIMIT_NOFILE]
---
 src/core/main.c | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/src/core/main.c b/src/core/main.c
index 69e8382a9e..36e53f07f6 100644
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -1215,6 +1215,26 @@ static int bump_rlimit_nofile(struct rlimit *saved_rlimit) {
         return 0;
 }
 
+static int bump_rlimit_memlock(struct rlimit *saved_rlimit) {
+        int r;
+
+        assert(saved_rlimit);
+        assert(getuid() == 0);
+
+        /* BPF_MAP_TYPE_LPM_TRIE bpf maps are charged against RLIMIT_MEMLOCK, even though we have CAP_IPC_LOCK which
+         * should normally disable such checks. We need them to implement IPAccessAllow= and IPAccessDeny=, hence let's
+         * bump the value high enough for the root user. */
+
+        if (getrlimit(RLIMIT_MEMLOCK, saved_rlimit) < 0)
+                return log_warning_errno(errno, "Reading RLIMIT_MEMLOCK failed, ignoring: %m");
+
+        r = setrlimit_closest(RLIMIT_MEMLOCK, &RLIMIT_MAKE_CONST(1024ULL*1024ULL*16ULL));
+        if (r < 0)
+                return log_warning_errno(r, "Setting RLIMIT_MEMLOCK failed, ignoring: %m");
+
+        return 0;
+}
+
 static void test_usr(void) {
 
         /* Check that /usr is not a separate fs */
@@ -1412,7 +1432,7 @@ int main(int argc, char *argv[]) {
         bool queue_default_job = false;
         bool empty_etc = false;
         char *switch_root_dir = NULL, *switch_root_init = NULL;
-        struct rlimit saved_rlimit_nofile = RLIMIT_MAKE_CONST(0);
+        struct rlimit saved_rlimit_nofile = RLIMIT_MAKE_CONST(0), saved_rlimit_memlock = RLIMIT_MAKE_CONST((rlim_t) -1);
         const char *error_message = NULL;
 
 #ifdef HAVE_SYSV_COMPAT
@@ -1844,6 +1864,7 @@ int main(int argc, char *argv[]) {
 
         if (arg_system) {
                 (void) bump_rlimit_nofile(&saved_rlimit_nofile);
+                (void) bump_rlimit_memlock(&saved_rlimit_memlock);
 
                 if (empty_etc) {
                         r = unit_file_preset_all(UNIT_FILE_SYSTEM, 0, NULL, UNIT_FILE_PRESET_ENABLE_ONLY, NULL, 0);
@@ -2083,6 +2104,8 @@ finish:
                  * its child processes */
                 if (saved_rlimit_nofile.rlim_cur > 0)
                         (void) setrlimit(RLIMIT_NOFILE, &saved_rlimit_nofile);
+                if (saved_rlimit_memlock.rlim_cur != (rlim_t) -1)
+                        (void) setrlimit(RLIMIT_MEMLOCK, &saved_rlimit_memlock);
 
                 if (switch_root_dir) {
                         /* Kill all remaining processes from the
-- 
2.16.4

Places

File 0045-main-bump-RLIMIT_MEMLOCK-for-the-root-user-substanti.patch of Package systemd (Revision 2a0ef622b860d89b09df9bc0f43c3432)

Places