Date: Tue, 10 Jun 2014 17:24:19 +0200
From: Andres Freund <andres@2ndquadrant.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Robert Haas <robertmhaas@gmail.com>, Gurjeet Singh <gurjeet@singh.im>,
 Peter Eisentraut <peter_e@gmx.net>,
 PGSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: /proc/self/oom_adj is deprecated in newer Linux kernels
Message-ID: <20140610152419.GL8406@alap3.anarazel.de>
References: <1316355543.12186.9.camel@vanquo.pezone.net>
 <15953.1316362868@sss.pgh.pa.us>
 <1316420754.14001.3.camel@fsopti579.F-Secure.com>
 <16241.1316441883@sss.pgh.pa.us>
 <CABwTF4XDdYiBQXqj=CKrFXN7x2NiBbVnpHSJG6AVnMBLnLBmLA@mail.gmail.com>
 <28946.1402408948@sss.pgh.pa.us>
 <CA+Tgmoaps4ih-VEKvUgftqJ66_oSo-h9PpHi2_-wAzhVTYnzYw@mail.gmail.com>
 <30117.1402411876@sss.pgh.pa.us>
 <CA+TgmoZ2tDAVB5cLPt=UKHaogw+cfq6ZEis1yCTD_gsBWud9SA@mail.gmail.com>
 <30601.1402413283@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <30601.1402413283@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

On 2014-06-10 11:14:43 -0400, Tom Lane wrote:
> Sure, but what's that have to do with this?  Any Red Hat or PGDG RPM will
> come with this code already enabled in the build, so there is no need for
> anyone to have a GUC to play around with the behavior.

That's imo a fair point. Unless I misunderstand things Gurjeet picked
the topic up again because he wants to increase the priority of the
children. Is that correct Gurjeet?

I do think a GUC might be a nicer interface for this than a
#define. Possibly even with a absolute reset value for the children. But
only because there's no way, afaics, to explicitly reset to the default
value.

> >> I remain of the opinion that allowing nonprivileged people to decide
> >> whether that code is active or not is unsafe from a system level.
> 
> > On what factual basis?
> 
> Because it would convert the intended behavior (postmaster and only
> postmaster is exempt from OOM kill) into a situation where possibly
> all of the database processes are exempt from OOM kill, at the whim
> of somebody who should not have the privilege to decide that.

Meh^3. By that argument we need to forbid superusers to create any form
of untrusted functions. Forbid anything that does malloc(), system(),
fork(), whatever from a user's influence.
Superusers can execute code in the postmaster using
shared_preload_libraries. Feigning that that's not possible isn't buying
us anything.

Greetings,

Andres Freund

-- 
 Andres Freund	                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers