Subject: Re: Fork bomb protection patch
To: None <tech-kern@netbsd.org>
From: Roland Dowdeswell <elric@imrryr.org>
List: tech-kern
Date: 12/05/2002 17:39:44
On 1039112302 seconds since the Beginning of the UNIX epoch
Roland Dowdeswell wrote:
>

To reply to my own post, the enforced .5s sleep is going to cause
some rather odd behaviour when, e.g. an event driven program forks
and runs into its process limit.  An example would be thttpd and
running CGI scripts.  With the .5s sleep, if thttpd is asked to
run too many CGI scripts it will also mysteriously pause every once
in a while when serving up flat files---a situation which is both
counter-intuitive and suboptimal.

Now consider if you intentionally limit the web user's number of
processes to ensure that thttpd doesn't hog system resources.  What
you end up with is a web server that inexplicably pauses at seemingly
random times.

We should fix this so that it does not have side effects that can
take down a well behaved web server in this way.

Information from:

- If the process hits either system limit of number of processes in system,
  or user's limit of same, force the process to sleep for 0.5 seconds
  before returning failure. This turns 2000 rampaging fork monsters into
  2000 harmlessly snoozing fork monsters.

--
    Roland Dowdeswell                      http://www.Imrryr.ORG/~elric/