Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-631

fapolicyd needs to make sure the FD limit is never reached

    • fapolicyd-1.3.2-1.el8
    • None
    • Moderate
    • sst_security_special_projects
    • 20
    • None
    • QE ack, Dev ack
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • If docs needed, set a value
    • None

      Description of problem:

      Since the queue size (q_size) can be set to a large value, it's necessary for fapolicyd to ensure the current soft limit won't be reached, or else some undefined behavior may happen (I didn't check what would be the consequence yet).

      By default, fapolicyd service use has a soft limit of 1024:
      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

      1. cat /proc/1792/limits
        Limit Soft Limit Hard Limit Units
        [...]
        Max open files 1024 262144 files
        [...]
                    • 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

      Potentially, if a customer sets a larger q_size than RHEL's default (640), e.g. uses the default value from manpage (1024), it's possible the limit gets reached.

      Version-Release number of selected component (if applicable):

      fapolicyd-1.1.3-8.el8_7.1.x86_64

      How reproducible:

      N/A

      Acceptance Criteria:

      • the soft limit for open files is equal to its hard limit
      • the hard limit is set to the default hard limit (ulimit -n -H)

            dapospis@redhat.com Dalibor Pospíšil
            rhn-support-rmetrich Renaud Métrich
            Radovan Sroka Radovan Sroka
            Dalibor Pospíšil Dalibor Pospíšil
            Votes:
            0 Vote for this issue
            Watchers:
            9 Start watching this issue

              Created:
              Updated:
              Resolved: