Date: Tue, 10 Jun 2014 17:49:32 +0200
From: Andres Freund <andres@2ndquadrant.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Robert Haas <robertmhaas@gmail.com>, Gurjeet Singh <gurjeet@singh.im>,
 Peter Eisentraut <peter_e@gmx.net>,
 PGSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: /proc/self/oom_adj is deprecated in newer Linux kernels
Message-ID: <20140610154932.GO8406@alap3.anarazel.de>
References: <1316420754.14001.3.camel@fsopti579.F-Secure.com>
 <16241.1316441883@sss.pgh.pa.us>
 <CABwTF4XDdYiBQXqj=CKrFXN7x2NiBbVnpHSJG6AVnMBLnLBmLA@mail.gmail.com>
 <28946.1402408948@sss.pgh.pa.us>
 <CA+Tgmoaps4ih-VEKvUgftqJ66_oSo-h9PpHi2_-wAzhVTYnzYw@mail.gmail.com>
 <30117.1402411876@sss.pgh.pa.us>
 <CA+TgmoZ2tDAVB5cLPt=UKHaogw+cfq6ZEis1yCTD_gsBWud9SA@mail.gmail.com>
 <30601.1402413283@sss.pgh.pa.us>
 <20140610152419.GL8406@alap3.anarazel.de>
 <31103.1402414825@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <31103.1402414825@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

On 2014-06-10 11:40:25 -0400, Tom Lane wrote:
> Andres Freund <andres@2ndquadrant.com> writes:
> > On 2014-06-10 11:14:43 -0400, Tom Lane wrote:
> >> Because it would convert the intended behavior (postmaster and only
> >> postmaster is exempt from OOM kill) into a situation where possibly
> >> all of the database processes are exempt from OOM kill, at the whim
> >> of somebody who should not have the privilege to decide that.
> 
> > Meh^3. By that argument we need to forbid superusers to create any form
> > of untrusted functions. Forbid anything that does malloc(), system(),
> > fork(), whatever from a user's influence.
> 
> That's utter and complete nonsense.  We're discussing an operation that is
> root-privileged (ie, lowering a process's OOM score), not random stuff
> that unprivileged processes can do.

Oh, comeon. Tom. You a) conveniently left of the part where I said that
the user can execute code from the postmaster. b) fork() can be used to
escape the oom killer. c) Lots of much worse things can be done to the
system with arbitrary system calls than adjusting oom_score_adj.

The postmaster can currently change oom_score_adj. Users can run code as
a postmaster. Simple as that.

Besides, as demonstrated in
http://www.postgresql.org/message-id/20140610154536.GN8406@alap3.anarazel.de
postmaster children can already reset their score.

Greetings,

Andres Freund

-- 
 Andres Freund	                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers