OpenVZ Forum - RDF feed
type: channel
items: [PATCH] new cgroup controller "fork"

[PATCH] new cgroup controller "fork"
type: item
description: Can limit the number of fork()/clone() calls in a cgroup. It is useful as a safeguard against fork bombs. Signed-off-by: Max Kellermann <mk@cm4all.com> --- Documentation/cgroups/fork.txt | 30 +++++++ include/linux/cgroup_fork.h | 26 ++++++ include/linux/cgroup_subsys.h | 6 + init/Kconfig | 6 + kernel/Makefile | 1 kernel/cgroup_fork.c | 180 ++++++++++++++++++++++++++++++++++++++++ kernel/fork.c | 5 + 7 files changed, 254 insertions(+), 0 deletions(-) create mode 100644 Documentation/cgroups/fork.txt create mode 100644 include/linux/cgroup_fork.h create mode 100644 kernel/cgroup_fork.c diff --git a/Documentation/cgroups/fork.txt b/Documentation/cgroups/fork.txt new file mode 100644 index 0000000..dfbf291 --- /dev/null +++ b/Documentation/cgroups/fork.txt @@ -0,0 +1,30 @@ +The "fork" Controller +--------------------- + +The "fork" controller limits the number of times a new child process +or thread can be created. It maintains a per-group counter which gets +decremented on each fork() / clone(). When the counter reaches zero, +no process in the cgroup is allowed to create new child +processes/threads, even if existing ones quit. + +This has been proven useful in a shared hosting environment. A new +temporary cgroup is created for each CGI process, and the maximum fork +count is configured to a sensible value. Since CGIs are expected to +run for only a short time with predictable resource usage, this may be +an appropriate tool to limit the damage that a freaked CGI can do. + +Initially, the counter is set to -1, which is a magic value for +"disabled" - no limits are imposed on the processes in the group. To +set a new value, type (in the working directory of that control +group): + + echo 16 > fork.remaining + +This examples allows 16 forks in the control group. 0 means no +further forks are allowed. The limit may be lowered or increased or +even disabled at any time by a process with write permissions to the +attribute. + +To check if a fork is allowed, the controller…
creator: Max Kellermann
date: 2011-02-17T13:31:52-00:00