Re: Locking processes against being killed when low on memory

["Steven M. Bellovin" <smb%cs.columbia.edu@localhost>]

On Thu, 21 Feb 2008 14:28:53 -0500 (EST)
Gary Thorpe <gathorpe79%yahoo.com@localhost> wrote:

> --- Stephen Borrill <netbsd%precedence.co.uk@localhost> wrote:
> 
> > I'm using NetBSD 4.0 with Xorg, etc. running from flash, i.e. no
> > swap. As 
> > it's embedded, everything is running as root. Is there any way to
> > tag
> > 
> > processes as unkillable when running out of memory? Some processes
> > (e.g. 
> > the X server, management daemon and session manager) need to remain 
> > running throughout. I don't mind if other things such as
> > web-browsers get 
> > killed. Currently bad things happen when it starts to run out of
> > RAM...
> > 
> > -- 
> > Stephen
> 
> I don't think NetBSD has an "out-of-memory" killer (as in Linux?): I
> think the application which causes the unserviceable page fault is
> just killed. If I am not mistaken in this, you cannot predict
> beforehand which applications will be targeted (this includes 'init')
> because any of them may try to access over-committed memory. Maybe
> you could try 'ulimit' to make sure the memory usage is contained?
> This may be feasible for an embedded system (or maybe not).
> 
I wrote a program that was intended to grab and zero all free memory.
When I tried running it while multiuser, it crashed the machine...  I
was unable to reproduce that in single-user, and since I was in X I
have no idea what the crash was.  (Why did I write such a program?  I
wanted to generate a system core file to upload.  First, I know from
experience (and running the 'strings' command) that a lot of sensitive
information can be left lying around memory.  Second, when most of RAM
is zeros the file compresses a lot better, and that's a big advantage
when you have 3GB of RAM in the dump...)



                --Steve Bellovin, http://www.cs.columbia.edu/~smb