Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752905AbbHJCtU (ORCPT ); Sun, 9 Aug 2015 22:49:20 -0400 Received: from mail.lang.hm ([64.81.33.126]:60412 "EHLO bifrost.lang.hm" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752487AbbHJCtT (ORCPT ); Sun, 9 Aug 2015 22:49:19 -0400 Date: Sun, 9 Aug 2015 19:48:15 -0700 (PDT) From: David Lang X-X-Sender: dlang@asgard.lang.hm To: Greg Kroah-Hartman cc: Linus Torvalds , Daniel Mack , Tom Gundersen , "Kalle A. Sandstrom" , Borislav Petkov , One Thousand Gnomes , Havoc Pennington , Djalal Harouni , Andy Lutomirski , "linux-kernel@vger.kernel.org" , "Eric W. Biederman" , cee1 , David Herrmann Subject: Re: kdbus: to merge or not to merge? In-Reply-To: <20150809190027.GA24185@kroah.com> Message-ID: References: <55C3A403.8020202@zonque.org> <55C4C35A.4070306@zonque.org> <20150809190027.GA24185@kroah.com> User-Agent: Alpine 2.02 (DEB 1266 2009-07-14) MIME-Version: 1.0 Content-Type: MULTIPART/MIXED; BOUNDARY="680960-2001267224-1439174895=:2141" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2227 Lines: 44 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --680960-2001267224-1439174895=:2141 Content-Type: TEXT/PLAIN; charset=iso-8859-1; format=flowed Content-Transfer-Encoding: 8BIT On Sun, 9 Aug 2015, Greg Kroah-Hartman wrote: > The issue is with userspace clients opting in to receive all > NameOwnerChanged messages on the bus, which is not a good idea as they > constantly get woken up and process them, which is why the CPU was > pegged.? This issue should now be fixed in Rawhide for some of the > packages we found that were doing this. Maintainers of other packages > have been informed.? End result, no one has ever really tested sending > "bad" messages to the current system as all existing dbus users try to > be "good actors", thanks to Andy's testing, these apps should all now > become much more robust. Does it require elevated privileges to opt to receive all NameOwnerChanged messages on the bus? Is it the default unless the apps opt for something more restrictive? or is it somewhere in between? I was under the impression that the days of writing system-level stuff that assumes that all userspace apps are going to 'play nice' went out a decade or more ago. It's fine if the userspace app can kill itself, or possibly even the user it's running as, but being able to kill apps running as other users, let alone the whole system is a problem nowdays. It may be able to happen in a default system, but this is why cgroups and namespaces have been created, to give the system admin the ability to limit the resources that any one app can consume. Introducing a new mechanism that allows one user to consume resources allocated to another and kill the system without providing a kernel level mechanism to limit the damage (as opposed to fixing individual apps) seems rather short-sighted at best. David Lang --680960-2001267224-1439174895=:2141-- -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/