Subject: Re: [vserver] Is writing to om_adj important ?
From: "John A. Sullivan III" <jsullivan@opensourcedevel.com>
Date: Tue, 27 Jan 2009 06:45:21 -0500

On Tue, 2009-01-27 at 06:35 -0500, John A. Sullivan III wrote:
> On Tue, 2009-01-27 at 17:44 +1100, Declan Mullen wrote:
> > 
> > John A. Sullivan III wrote:
> > > On Mon, 2009-01-26 at 07:26 -0500, John A. Sullivan III wrote:
> > >   
> > >> On Mon, 2009-01-26 at 06:28 -0500, John A. Sullivan III wrote:
> > >>     
> > >>> On Mon, 2009-01-26 at 20:25 +1100, Declan Mullen wrote:
> > >>>       
> > >>>> Hi
> > >>>>
> > >>>> When I ssh into my Linux server, the login succeeds but I notice that I 
> > >>>> get the following type of entry appended to the auth.log :
> > >>>>
> > >>>>     Jan 26 17:10:45 maxv1 sshd[32624]: error writing /proc/self/oom_adj: 
> > >>>> Permission denied
> > >>>>
> > >>>> What are the implications of the sshd not being able to write to the 
> > >>>> oom_adj ? Ie Is this error significant or should I just ignore it ?
> > >>>>
> > >>>> The sshd's write is failing because the server I'm logging into is a 
> > >>>> VServer guest/virtual server, and the VServer virtualisation technology 
> > >>>> places restrictions on what can be written to the /proc filesystem from 
> > >>>> within the guest.
> > >>>>
> > >>>> The guest server OS is Debian Lenny and the sshd versions is 
> > >>>> "1:5.1p1-5". Within the sshd_config Privilege Separation is turned on.
> > >>>>
> > >>>> The host server's kernel is Lenny's "linux-source-2.6.26" (version 
> > >>>> "2.6.26-13") with Lenny's vserver patches applied from 
> > >>>> "linux-patch-debian-2.6.26" (version "2.6.26-13"). The host's 
> > >>>> util-vserver package is version "0.30.216~r2772-6". The host's
> > >>>> "vserver-debiantools" package is version "0.6.3".
> > >>>>         
> > >>> <snip>
> > >>> I'm facing the same issue and would like for the guest to be able to set
> > >>> oom_adj.  I would imagine this is done by editing the vprocunhidefiles
> > >>> file  However, before doing so, I'd like to ask the list if there is a
> > >>> security issue in doing so.  I suppose a savvy guest could make their
> > >>> system a hog - the last one to have any processes shut down in an out of
> > >>> memory condition thus creating an availability problem but I wouldn't
> > >>> imagine it creates a data confidentiality or integrity problem.  Is this
> > >>> true? Thanks - John
> > >>>       
> > >> Oops! That's not true.  OpenSSH appears to want to create this /proc
> > >> entry.  vprocunhide doesn't seem to solve that problem! - John
> > >>     
> > >
> > > By the way, if one wants to stop the error message, one can
> > > edit /etc/init.d/ssh and comment out the calls to adjust_oom in the
> > > start and restart sections of the init script - John
> > >   
> > 
> > I have just noticed that in /etc/default/ssh :
> > 
> >   # OOM-killer adjustment for sshd (see
> >   # linux/Documentation/filesystems/proc.txt; lower values reduce likelihood
> >   # of being killed, while -17 means the OOM-killer will ignore sshd; set to
> >   # the empty string to skip adjustment)
> >   SSHD_OOM_ADJUST=-17
> > 
> > I've modified this file to set SSHD_OOM_ADJUST to a null string, and now 
> > sshd no longer attempts to write to oom_adj and the error messages no 
> > longer occur.
> <snip>
> Much better solution.  I had read in an older post that doing so did not
> work as expected.  I'm glad it has been fixed and will change my
> installations to this method.  Thanks - John
Argh! It does not appear to work on fully patched Ubuntu 8.0.4.  In
fact, the comment is different:

# OOM-killer adjustment for sshd (see
# linux/Documentation/filesystems/proc.txt; lower values reduce
likelihood
# of being killed, -17 = disable)
SSHD_OOM_ADJUST=-17

Back to commenting out the lines in the init script :(
-- 
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan@opensourcedevel.com

http://www.spiritualoutreach.com
Making Christianity intelligible to secular society