Subject: Re: [vserver] Is writing to om_adj important ?
From: "John A. Sullivan III" <jsullivan@opensourcedevel.com>
Date: Mon, 26 Jan 2009 06:28:49 -0500

On Mon, 2009-01-26 at 20:25 +1100, Declan Mullen wrote:
> Hi
> 
> When I ssh into my Linux server, the login succeeds but I notice that I 
> get the following type of entry appended to the auth.log :
> 
>     Jan 26 17:10:45 maxv1 sshd[32624]: error writing /proc/self/oom_adj: 
> Permission denied
> 
> What are the implications of the sshd not being able to write to the 
> oom_adj ? Ie Is this error significant or should I just ignore it ?
> 
> The sshd's write is failing because the server I'm logging into is a 
> VServer guest/virtual server, and the VServer virtualisation technology 
> places restrictions on what can be written to the /proc filesystem from 
> within the guest.
> 
> The guest server OS is Debian Lenny and the sshd versions is 
> "1:5.1p1-5". Within the sshd_config Privilege Separation is turned on.
> 
> The host server's kernel is Lenny's "linux-source-2.6.26" (version 
> "2.6.26-13") with Lenny's vserver patches applied from 
> "linux-patch-debian-2.6.26" (version "2.6.26-13"). The host's 
> util-vserver package is version "0.30.216~r2772-6". The host's
> "vserver-debiantools" package is version "0.6.3".
<snip>
I'm facing the same issue and would like for the guest to be able to set
oom_adj.  I would imagine this is done by editing the vprocunhidefiles
file  However, before doing so, I'd like to ask the list if there is a
security issue in doing so.  I suppose a savvy guest could make their
system a hog - the last one to have any processes shut down in an out of
memory condition thus creating an availability problem but I wouldn't
imagine it creates a data confidentiality or integrity problem.  Is this
true? Thanks - John
-- 
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan@opensourcedevel.com

http://www.spiritualoutreach.com
Making Christianity intelligible to secular society