Subject: Re: [vserver] Is writing to om_adj important ?
From: Declan Mullen <declan@jadplace.com>
Date: Tue, 27 Jan 2009 17:44:59 +1100



John A. Sullivan III wrote:
> On Mon, 2009-01-26 at 07:26 -0500, John A. Sullivan III wrote:
>   
>> On Mon, 2009-01-26 at 06:28 -0500, John A. Sullivan III wrote:
>>     
>>> On Mon, 2009-01-26 at 20:25 +1100, Declan Mullen wrote:
>>>       
>>>> Hi
>>>>
>>>> When I ssh into my Linux server, the login succeeds but I notice that I 
>>>> get the following type of entry appended to the auth.log :
>>>>
>>>>     Jan 26 17:10:45 maxv1 sshd[32624]: error writing /proc/self/oom_adj: 
>>>> Permission denied
>>>>
>>>> What are the implications of the sshd not being able to write to the 
>>>> oom_adj ? Ie Is this error significant or should I just ignore it ?
>>>>
>>>> The sshd's write is failing because the server I'm logging into is a 
>>>> VServer guest/virtual server, and the VServer virtualisation technology 
>>>> places restrictions on what can be written to the /proc filesystem from 
>>>> within the guest.
>>>>
>>>> The guest server OS is Debian Lenny and the sshd versions is 
>>>> "1:5.1p1-5". Within the sshd_config Privilege Separation is turned on.
>>>>
>>>> The host server's kernel is Lenny's "linux-source-2.6.26" (version 
>>>> "2.6.26-13") with Lenny's vserver patches applied from 
>>>> "linux-patch-debian-2.6.26" (version "2.6.26-13"). The host's 
>>>> util-vserver package is version "0.30.216~r2772-6". The host's
>>>> "vserver-debiantools" package is version "0.6.3".
>>>>         
>>> <snip>
>>> I'm facing the same issue and would like for the guest to be able to set
>>> oom_adj.  I would imagine this is done by editing the vprocunhidefiles
>>> file  However, before doing so, I'd like to ask the list if there is a
>>> security issue in doing so.  I suppose a savvy guest could make their
>>> system a hog - the last one to have any processes shut down in an out of
>>> memory condition thus creating an availability problem but I wouldn't
>>> imagine it creates a data confidentiality or integrity problem.  Is this
>>> true? Thanks - John
>>>       
>> Oops! That's not true.  OpenSSH appears to want to create this /proc
>> entry.  vprocunhide doesn't seem to solve that problem! - John
>>     
>
> By the way, if one wants to stop the error message, one can
> edit /etc/init.d/ssh and comment out the calls to adjust_oom in the
> start and restart sections of the init script - John
>   

I have just noticed that in /etc/default/ssh :

  # OOM-killer adjustment for sshd (see
  # linux/Documentation/filesystems/proc.txt; lower values reduce likelihood
  # of being killed, while -17 means the OOM-killer will ignore sshd; set to
  # the empty string to skip adjustment)
  SSHD_OOM_ADJUST=-17

I've modified this file to set SSHD_OOM_ADJUST to a null string, and now 
sshd no longer attempts to write to oom_adj and the error messages no 
longer occur.