fix: fix oom_score adjustments failing if caps set #15758
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
deansheather
reviewed
Dec 5, 2024
|
Agreed it's pretty hard to test without root |
mafredri
approved these changes
Dec 5, 2024
| // We drop effective caps prior to setting dumpable so that we limit the | ||
| // impact of someone attempting to hijack the process (i.e. with a debugger) | ||
| // to take advantage of the capabilities of the agent process. We encourage | ||
| // users to set cap_net_admin on the agent binary for improved networking |
There was a problem hiding this comment.
Do we mention this in coder.com/docs?
There was a problem hiding this comment.
If not, we probably should (wherever we're documenting the nice/oom adjustments).
There was a problem hiding this comment.
Yeah once this is merged and there are no bugs, I'm going to write up some documentation for resource management in Coder
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
coderbinary has capabilities set on it. This is becausePR_SET_DUMPABLEis set to0when a process is executed with elevated capabilities. The fix is to flipPR_SET_DUMPABLEto1prior to writing tooom_score_adj.