From: George Dunlap Date: Mon, 12 Nov 2018 11:24:54 +0000 (+0000) Subject: libxl/depriv: Remove RLIMIT_NPROC restriction X-Git-Tag: archive/raspbian/4.14.0+80-gd101b417b7-1+rpi1^2~63^2~2982 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=9d5cedefbaafd5b66f74edecea2d569332a41c95;p=xen.git libxl/depriv: Remove RLIMIT_NPROC restriction This also prevents QEMU from creating pthreads, which it requires for certain devices to function. Signed-off-by: George Dunlap Acked-by: Ian Jackson Acked-by: Wei Liu --- diff --git a/docs/designs/qemu-deprivilege.md b/docs/designs/qemu-deprivilege.md index 067cf24762..f7444a434d 100644 --- a/docs/designs/qemu-deprivilege.md +++ b/docs/designs/qemu-deprivilege.md @@ -114,7 +114,6 @@ resources available to it. Limits that can be implemented immediately without much effort: - RLIMIT_FSIZE` (file size) to 256KiB. - - RLIMIT_NPROC (after uid changes to a unique uid) Probably not necessary but why not: - RLIMIT_CORE: 0 @@ -142,6 +141,9 @@ virtual memory which QEMU uses as a mapcache. xen-mapcache.c already fiddles with this; it would be straightforward to make it *set* the rlimit to what it thinks a sensible limit is. +RLIMIT_NPROC limits total number of processes or threads. QEMU uses +threads for some devices, so this would require some thought. + Other things that would take some cleverness / changes to QEMU to utilize due to ordering constrants: - RLIMIT_NOFILES (after all necessary files are opened) diff --git a/tools/libxl/libxl_linux.c b/tools/libxl/libxl_linux.c index 921051c0e6..6475cca64b 100644 --- a/tools/libxl/libxl_linux.c +++ b/tools/libxl/libxl_linux.c @@ -318,7 +318,6 @@ static struct { RLIMIT_ENTRY(RLIMIT_FSIZE, 256*1024), /* Shouldn't need any of these */ - RLIMIT_ENTRY(RLIMIT_NPROC, 0), RLIMIT_ENTRY(RLIMIT_CORE, 0), RLIMIT_ENTRY(RLIMIT_MSGQUEUE, 0), RLIMIT_ENTRY(RLIMIT_LOCKS, 0),