[Xen-changelog] [xen staging] libxl/depriv: Remove RLIMIT_NPROC restriction

[p***@xen.org]

commit 9d5cedefbaafd5b66f74edecea2d569332a41c95
Author: George Dunlap <***@citrix.com>
AuthorDate: Mon Nov 12 11:24:54 2018 +0000
Commit: Wei Liu <***@citrix.com>
CommitDate: Mon Nov 12 11:32:27 2018 +0000

libxl/depriv: Remove RLIMIT_NPROC restriction

This also prevents QEMU from creating pthreads, which it requires for
certain devices to function.

Signed-off-by: George Dunlap <***@citrix.com>
Acked-by: Ian Jackson <***@eu.citrix.com>
Acked-by: Wei Liu <***@citrix.com>
---
docs/designs/qemu-deprivilege.md | 4 +++-
tools/libxl/libxl_linux.c | 1 -
2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/designs/qemu-deprivilege.md b/docs/designs/qemu-deprivilege.md
index 067cf24762..f7444a434d 100644
--- a/docs/designs/qemu-deprivilege.md
+++ b/docs/designs/qemu-deprivilege.md
@@ -114,7 +114,6 @@ resources available to it.

Limits that can be implemented immediately without much effort:
- RLIMIT_FSIZE` (file size) to 256KiB.
- - RLIMIT_NPROC (after uid changes to a unique uid)

Probably not necessary but why not:
- RLIMIT_CORE: 0
@@ -142,6 +141,9 @@ virtual memory which QEMU uses as a mapcache. xen-mapcache.c already
fiddles with this; it would be straightforward to make it *set* the
rlimit to what it thinks a sensible limit is.

+RLIMIT_NPROC limits total number of processes or threads. QEMU uses
+threads for some devices, so this would require some thought.
+
Other things that would take some cleverness / changes to QEMU to
utilize due to ordering constrants:
- RLIMIT_NOFILES (after all necessary files are opened)
diff --git a/tools/libxl/libxl_linux.c b/tools/libxl/libxl_linux.c
index 921051c0e6..6475cca64b 100644
--- a/tools/libxl/libxl_linux.c
+++ b/tools/libxl/libxl_linux.c
@@ -318,7 +318,6 @@ static struct {
RLIMIT_ENTRY(RLIMIT_FSIZE, 256*1024),

/* Shouldn't need any of these */
- RLIMIT_ENTRY(RLIMIT_NPROC, 0),
RLIMIT_ENTRY(RLIMIT_CORE, 0),
RLIMIT_ENTRY(RLIMIT_MSGQUEUE, 0),
RLIMIT_ENTRY(RLIMIT_LOCKS, 0),
--
generated by git-patchbot for /home/xen/git/xen.git#staging