search for: mlock

From: Martin Schwidefsky <schwidefsky@de.ibm.com> From: Hubertus Franke <frankeh@watson.ibm.com> From: Himanshu Raj <rhim@cc.gatech.edu> [patch 5/9] Guest page hinting: mlocked pages. Add code to get mlock() working with guest page hinting. The problem with mlock is that locked pages may not be removed from page cache. That means they need to be stable. page_make_volatile needs a way to check if a page has been locked. To avoid traversing vma lists - which would hurt p...

From: Martin Schwidefsky <schwidefsky@de.ibm.com> From: Hubertus Franke <frankeh@watson.ibm.com> From: Himanshu Raj <rhim@cc.gatech.edu> [patch 5/9] Guest page hinting: mlocked pages. Add code to get mlock() working with guest page hinting. The problem with mlock is that locked pages may not be removed from page cache. That means they need to be stable. page_make_volatile needs a way to check if a page has been locked. To avoid traversing vma lists - which would hurt p...

c:\APPS\TINC\tincd.exe --mlock --net=mynet --config=C:\APPS\tinc\mynet Without --mlock, the service starts OK. With --mlock, the service fails to start.

...'s one vulnerability that's bugged me for some time. It applies to nearly all crypto software, including ssh. That's the swapping of sensitive info (such as keys and key equivalents) onto hard drives where they could possibly be recovered later. The Linux kernel provides a system call, mlock(), that inhibits swapping of a specified region of virtual memory. It locks it into real memory. I see no calls to mlock anywhere in ssh. The easiest thing would be for ssh to mlock its entire data and stack segments at startup (no need to protect the text segment). This does entail a risk of dea...

Last year we had a discussion[1] about how the hypercall ABI unfortunately contains fields that change width between 32- and 64-bit builds. This is a huge problem as we come up on the python management stack for ppc64, since the distributions ship 32-bit python. A 32-bit python/libxc cannot currently manage a 64-bit hypervisor. I had a patch but was unable to test it, and some other things were

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Is there any interest in using mlock to lock pages in core so that potentially sensitive data won't get swapped out to disk? (GnuPG, for example, does this). There was a thread on this a long time ago, and it degenerated into a discussion of crypto-swap, but the question was never answered. Is there a good reason not to do this...

So as best practice running tinc I should include it ? Regards Yazeed Fataar <yazeedfataar at hotmail.com> On Sun, Feb 14, 2016 at 1:08 PM, Guus Sliepen <guus at tinc-vpn.org> wrote: > On Sun, Feb 14, 2016 at 10:53:19AM +0300, Yazeed Fataar wrote: > > > Going through the options tinc has . Can someone explain exactly what the > > purpose is for -L option for the

Hi All Going through the options tinc has . Can someone explain exactly what the purpose is for -L option for the runtime command. So does this mean that tinc will run in RAM and will not be saved in swap (default) ? ================ -L, --mlock Lock tinc into main memory. This will prevent sensitive data like shared private keys to be written to the system swap files/partitions. ================ Regards Yazeed <yazeedfataar at hotmail.com> -------------- next part -------------- An HTML attachment was scrubbed... UR...

...e little value in it. If you want to enable it, be sure to understand the implications of locking a process in RAM; you should have more RAM than the tincd process memory will ever use, and you should check that there are no resource limits that prevent tinc from allocating locked memory (check the mlock manpage, the limits.conf manpage and the bash manpage for the ulimit command). And of course, if you don't have any swap space enabled, you don't need the -L option. -- Met vriendelijke groet / with kind regards, Guus Sliepen <guus at tinc-vpn.org> -------------- next part --...

...> Nope, this __GFP_NORETRY has nothing to do with this. > > > > I am not yet convinced we want it. > > > > This needs mm guys advice, as its a tradeoff for mm layer more than > > networking... > > Well maybe Cc linux-mm then? Well, I do not care of people mlocking the memory and complaining that compaction does not work. If these people care, they should contact mm guys, eventually. Really this is an issue that has nothing to do with this patch set.

...> Nope, this __GFP_NORETRY has nothing to do with this. > > > > I am not yet convinced we want it. > > > > This needs mm guys advice, as its a tradeoff for mm layer more than > > networking... > > Well maybe Cc linux-mm then? Well, I do not care of people mlocking the memory and complaining that compaction does not work. If these people care, they should contact mm guys, eventually. Really this is an issue that has nothing to do with this patch set.

On Sun, Feb 14, 2016 at 10:53:19AM +0300, Yazeed Fataar wrote: > Going through the options tinc has . Can someone explain exactly what the > purpose is for -L option for the runtime command. > > So does this mean that tinc will run in RAM and will not be saved in swap > (default) ? Yes, that's exactly what it does. -- Met vriendelijke groet / with kind regards, Guus

Hi, secpwgen is always reporting "mlock: Cannot allocate memory" even with user root. CentOS 6.2. Problem with selinux? Thank you for help in advance. Best regards Helmut Drodofsky

On Mon, 2004-10-18 at 22:14, Paul Davis wrote: > jackd (realtime) requires various resources which it shares with its > clients: > > realtime scheduling > mlock-ability > shared memory segments > FIFOs (or Mach ports on OS X) > > we consider it *more* of a security risk to allow jackd-as-root to > share these with non-root processes. YMMV. Whenever communication is done to an as-root app then the risk *is* increased (I treat th...

...pps to also run as >root then that is a pretty bad issue. I would of thought that running >jackd as a realtime process (whether root or not) would be an important >consideration. jackd (realtime) requires various resources which it shares with its clients: realtime scheduling mlock-ability shared memory segments FIFOs (or Mach ports on OS X) we consider it *more* of a security risk to allow jackd-as-root to share these with non-root processes. YMMV. >What I can say is that ices tries to acquire realtime scheduling if >enabled (default is yes) which may or...

...e:0 free:283729 slab_reclaimable:4785 slab_unreclaimable:2380 mapped:3362 shmem:36 pagetables:1029 bounce:0 Node 0 DMA free:12904kB min:32kB low:40kB high:48kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:12712kB mlocked:0kB dirty:0kB writeback:0kB mapped:0kB shmem:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB unstable:0kB bounce:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no lowmem_reserve[]: 0 1464 1936 1936 Node 0 DMA32 free:1122012kB min:4240kB low:5300kB high:63...

...aimable:14431 mapped:105321 shmem:34094 pagetables:8218 bounce:0 free:14592 free_pcp:30 free_cma:0 DMA free:15888kB min:20kB low:24kB high:28kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:15980kB managed:15896kB mlocked:0kB dirty:0kB writeback:0kB mapped:0kB shmem:0kB slab_reclaimable:0kB slab_unreclaimable:8kB kernel_stack:0kB pagetables:0kB unstable:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? yes lowmem_reserve[]: 0 3235 7959 7959 DMA32 free:29480...

...> [ 1.971103] free:4065966 free_pcp:763 free_cma:0 > [ 1.971131] Node 0 DMA free:15912kB min:12kB low:12kB high:16kB > active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB > unevictable:0kB isolated(anon):0kB isolated(file):0kB present:15996kB > managed:15912kB mlocked:0kB dirty:0kB writeback:0kB mapped:0kB shmem:0kB > slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB > pagetables:0kB unstable:0kB bounce:0kB free_pcp:0kB local_pcp:0kB > free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no > [ 1.971217] lowmem_reserve[]:...

...nothing to do with this. >> > >> > I am not yet convinced we want it. >> > >> > This needs mm guys advice, as its a tradeoff for mm layer more than >> > networking... >> >> Well maybe Cc linux-mm then? > > Well, I do not care of people mlocking the memory and complaining that > compaction does not work. > > If these people care, they should contact mm guys, eventually. > > Really this is an issue that has nothing to do with this patch set. > Actually I have more data on this: 1. __GFP_NORETRY really does help and sh...

...14968 slab_unreclaimable:35363 kernel: mapped:3896 shmem:77 pagetables:2034 bounce:0 kernel: free_cma:0 kernel: Node 0 DMA free:15836kB min:8kB low:8kB high:12kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:15612kB mlocked:0kB dirty:0kB writeback:0kB mapped:0kB shmem:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB unstable:0kB bounce:0kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? yes kernel: lowmem_reserve[]: 0 1948 56488 56488 kernel: Node 0 DMA32 free:218864k...