aboutsummaryrefslogtreecommitdiffstats
path: root/Documentation/sysctl
diff options
context:
space:
mode:
authorJonathan Herman <hermanjl@cs.unc.edu>2013-01-17 16:15:55 -0500
committerJonathan Herman <hermanjl@cs.unc.edu>2013-01-17 16:15:55 -0500
commit8dea78da5cee153b8af9c07a2745f6c55057fe12 (patch)
treea8f4d49d63b1ecc92f2fddceba0655b2472c5bd9 /Documentation/sysctl
parent406089d01562f1e2bf9f089fd7637009ebaad589 (diff)
Patched in Tegra support.
Diffstat (limited to 'Documentation/sysctl')
-rw-r--r--Documentation/sysctl/fs.txt67
-rw-r--r--Documentation/sysctl/kernel.txt66
-rw-r--r--Documentation/sysctl/net.txt7
-rw-r--r--Documentation/sysctl/vm.txt44
4 files changed, 29 insertions, 155 deletions
diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt
index 88152f214f4..88fd7f5c8dc 100644
--- a/Documentation/sysctl/fs.txt
+++ b/Documentation/sysctl/fs.txt
@@ -32,8 +32,6 @@ Currently, these files are in /proc/sys/fs:
32- nr_open 32- nr_open
33- overflowuid 33- overflowuid
34- overflowgid 34- overflowgid
35- protected_hardlinks
36- protected_symlinks
37- suid_dumpable 35- suid_dumpable
38- super-max 36- super-max
39- super-nr 37- super-nr
@@ -159,68 +157,22 @@ The default is 65534.
159 157
160============================================================== 158==============================================================
161 159
162protected_hardlinks:
163
164A long-standing class of security issues is the hardlink-based
165time-of-check-time-of-use race, most commonly seen in world-writable
166directories like /tmp. The common method of exploitation of this flaw
167is to cross privilege boundaries when following a given hardlink (i.e. a
168root process follows a hardlink created by another user). Additionally,
169on systems without separated partitions, this stops unauthorized users
170from "pinning" vulnerable setuid/setgid files against being upgraded by
171the administrator, or linking to special files.
172
173When set to "0", hardlink creation behavior is unrestricted.
174
175When set to "1" hardlinks cannot be created by users if they do not
176already own the source file, or do not have read/write access to it.
177
178This protection is based on the restrictions in Openwall and grsecurity.
179
180==============================================================
181
182protected_symlinks:
183
184A long-standing class of security issues is the symlink-based
185time-of-check-time-of-use race, most commonly seen in world-writable
186directories like /tmp. The common method of exploitation of this flaw
187is to cross privilege boundaries when following a given symlink (i.e. a
188root process follows a symlink belonging to another user). For a likely
189incomplete list of hundreds of examples across the years, please see:
190http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=/tmp
191
192When set to "0", symlink following behavior is unrestricted.
193
194When set to "1" symlinks are permitted to be followed only when outside
195a sticky world-writable directory, or when the uid of the symlink and
196follower match, or when the directory owner matches the symlink's owner.
197
198This protection is based on the restrictions in Openwall and grsecurity.
199
200==============================================================
201
202suid_dumpable: 160suid_dumpable:
203 161
204This value can be used to query and set the core dump mode for setuid 162This value can be used to query and set the core dump mode for setuid
205or otherwise protected/tainted binaries. The modes are 163or otherwise protected/tainted binaries. The modes are
206 164
2070 - (default) - traditional behaviour. Any process which has changed 1650 - (default) - traditional behaviour. Any process which has changed
208 privilege levels or is execute only will not be dumped. 166 privilege levels or is execute only will not be dumped
2091 - (debug) - all processes dump core when possible. The core dump is 1671 - (debug) - all processes dump core when possible. The core dump is
210 owned by the current user and no security is applied. This is 168 owned by the current user and no security is applied. This is
211 intended for system debugging situations only. Ptrace is unchecked. 169 intended for system debugging situations only. Ptrace is unchecked.
212 This is insecure as it allows regular users to examine the memory
213 contents of privileged processes.
2142 - (suidsafe) - any binary which normally would not be dumped is dumped 1702 - (suidsafe) - any binary which normally would not be dumped is dumped
215 anyway, but only if the "core_pattern" kernel sysctl is set to 171 readable by root only. This allows the end user to remove
216 either a pipe handler or a fully qualified path. (For more details 172 such a dump but not access it directly. For security reasons
217 on this limitation, see CVE-2006-2451.) This mode is appropriate 173 core dumps in this mode will not overwrite one another or
218 when administrators are attempting to debug problems in a normal 174 other files. This mode is appropriate when administrators are
219 environment, and either have a core dump pipe handler that knows 175 attempting to debug problems in a normal environment.
220 to treat privileged core dumps with care, or specific directory
221 defined for catching core dumps. If a core dump happens without
222 a pipe handler or fully qualifid path, a message will be emitted
223 to syslog warning about the lack of a correct setting.
224 176
225============================================================== 177==============================================================
226 178
@@ -273,13 +225,6 @@ a queue must be less or equal then msg_max.
273maximum message size value (it is every message queue's attribute set during 225maximum message size value (it is every message queue's attribute set during
274its creation). 226its creation).
275 227
276/proc/sys/fs/mqueue/msg_default is a read/write file for setting/getting the
277default number of messages in a queue value if attr parameter of mq_open(2) is
278NULL. If it exceed msg_max, the default value is initialized msg_max.
279
280/proc/sys/fs/mqueue/msgsize_default is a read/write file for setting/getting
281the default message size value if attr parameter of mq_open(2) is NULL. If it
282exceed msgsize_max, the default value is initialized msgsize_max.
283 228
2844. /proc/sys/fs/epoll - Configuration options for the epoll interface 2294. /proc/sys/fs/epoll - Configuration options for the epoll interface
285-------------------------------------------------------- 230--------------------------------------------------------
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index ccd42589e12..704e474a93d 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -24,7 +24,6 @@ show up in /proc/sys/kernel:
24- bootloader_type [ X86 only ] 24- bootloader_type [ X86 only ]
25- bootloader_version [ X86 only ] 25- bootloader_version [ X86 only ]
26- callhome [ S390 only ] 26- callhome [ S390 only ]
27- cap_last_cap
28- core_pattern 27- core_pattern
29- core_pipe_limit 28- core_pipe_limit
30- core_uses_pid 29- core_uses_pid
@@ -38,7 +37,6 @@ show up in /proc/sys/kernel:
38- l2cr [ PPC only ] 37- l2cr [ PPC only ]
39- modprobe ==> Documentation/debugging-modules.txt 38- modprobe ==> Documentation/debugging-modules.txt
40- modules_disabled 39- modules_disabled
41- msg_next_id [ sysv ipc ]
42- msgmax 40- msgmax
43- msgmnb 41- msgmnb
44- msgmni 42- msgmni
@@ -50,7 +48,6 @@ show up in /proc/sys/kernel:
50- panic 48- panic
51- panic_on_oops 49- panic_on_oops
52- panic_on_unrecovered_nmi 50- panic_on_unrecovered_nmi
53- panic_on_stackoverflow
54- pid_max 51- pid_max
55- powersave-nap [ PPC only ] 52- powersave-nap [ PPC only ]
56- printk 53- printk
@@ -63,9 +60,7 @@ show up in /proc/sys/kernel:
63- rtsig-max 60- rtsig-max
64- rtsig-nr 61- rtsig-nr
65- sem 62- sem
66- sem_next_id [ sysv ipc ]
67- sg-big-buff [ generic SCSI device (sg) ] 63- sg-big-buff [ generic SCSI device (sg) ]
68- shm_next_id [ sysv ipc ]
69- shm_rmid_forced 64- shm_rmid_forced
70- shmall 65- shmall
71- shmmax [ sysv ipc ] 66- shmmax [ sysv ipc ]
@@ -160,13 +155,6 @@ on has a service contract with IBM.
160 155
161============================================================== 156==============================================================
162 157
163cap_last_cap
164
165Highest valid capability of the running kernel. Exports
166CAP_LAST_CAP from the kernel.
167
168==============================================================
169
170core_pattern: 158core_pattern:
171 159
172core_pattern is used to specify a core dumpfile pattern name. 160core_pattern is used to specify a core dumpfile pattern name.
@@ -184,8 +172,6 @@ core_pattern is used to specify a core dumpfile pattern name.
184 %p pid 172 %p pid
185 %u uid 173 %u uid
186 %g gid 174 %g gid
187 %d dump mode, matches PR_SET_DUMPABLE and
188 /proc/sys/fs/suid_dumpable
189 %s signal number 175 %s signal number
190 %t UNIX time of dump 176 %t UNIX time of dump
191 %h hostname 177 %h hostname
@@ -323,22 +309,6 @@ to false.
323 309
324============================================================== 310==============================================================
325 311
326msg_next_id, sem_next_id, and shm_next_id:
327
328These three toggles allows to specify desired id for next allocated IPC
329object: message, semaphore or shared memory respectively.
330
331By default they are equal to -1, which means generic allocation logic.
332Possible values to set are in range {0..INT_MAX}.
333
334Notes:
3351) kernel doesn't guarantee, that new object will have desired id. So,
336it's up to userspace, how to handle an object with "wrong" id.
3372) Toggle with non-default value will be set back to -1 by kernel after
338successful IPC object allocation.
339
340==============================================================
341
342nmi_watchdog: 312nmi_watchdog:
343 313
344Enables/Disables the NMI watchdog on x86 systems. When the value is 314Enables/Disables the NMI watchdog on x86 systems. When the value is
@@ -415,19 +385,6 @@ Controls the kernel's behaviour when an oops or BUG is encountered.
415 385
416============================================================== 386==============================================================
417 387
418panic_on_stackoverflow:
419
420Controls the kernel's behavior when detecting the overflows of
421kernel, IRQ and exception stacks except a user stack.
422This file shows up if CONFIG_DEBUG_STACKOVERFLOW is enabled.
423
4240: try to continue operation.
425
4261: panic immediately.
427
428==============================================================
429
430
431pid_max: 388pid_max:
432 389
433PID allocation wrap value. When the kernel's next PID value 390PID allocation wrap value. When the kernel's next PID value
@@ -436,14 +393,6 @@ PIDs of value pid_max or larger are not allocated.
436 393
437============================================================== 394==============================================================
438 395
439ns_last_pid:
440
441The last pid allocated in the current (the one task using this sysctl
442lives in) pid namespace. When selecting a pid for a next task on fork
443kernel tries to allocate a number starting from this one.
444
445==============================================================
446
447powersave-nap: (PPC only) 396powersave-nap: (PPC only)
448 397
449If set, Linux-PPC will use the 'nap' mode of powersaving, 398If set, Linux-PPC will use the 'nap' mode of powersaving,
@@ -561,19 +510,6 @@ are doing anyway :)
561 510
562============================================================== 511==============================================================
563 512
564shmall:
565
566This parameter sets the total amount of shared memory pages that
567can be used system wide. Hence, SHMALL should always be at least
568ceil(shmmax/PAGE_SIZE).
569
570If you are not sure what the default PAGE_SIZE is on your Linux
571system, you can run the following command:
572
573# getconf PAGE_SIZE
574
575==============================================================
576
577shmmax: 513shmmax:
578 514
579This value can be used to query and set the run time limit 515This value can be used to query and set the run time limit
@@ -635,8 +571,6 @@ can be ORed together:
635 instead of using the one provided by the hardware. 571 instead of using the one provided by the hardware.
636 512 - A kernel warning has occurred. 572 512 - A kernel warning has occurred.
6371024 - A module from drivers/staging was loaded. 5731024 - A module from drivers/staging was loaded.
6382048 - The system is working around a severe firmware bug.
6394096 - An out-of-tree module has been loaded.
640 574
641============================================================== 575==============================================================
642 576
diff --git a/Documentation/sysctl/net.txt b/Documentation/sysctl/net.txt
index 98335b7a533..3201a7097e4 100644
--- a/Documentation/sysctl/net.txt
+++ b/Documentation/sysctl/net.txt
@@ -43,13 +43,6 @@ Values :
43 1 - enable the JIT 43 1 - enable the JIT
44 2 - enable the JIT and ask the compiler to emit traces on kernel log. 44 2 - enable the JIT and ask the compiler to emit traces on kernel log.
45 45
46dev_weight
47--------------
48
49The maximum number of packets that kernel can handle on a NAPI interrupt,
50it's a Per-CPU variable.
51Default: 64
52
53rmem_default 46rmem_default
54------------ 47------------
55 48
diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
index 078701fdbd4..96f0ee825be 100644
--- a/Documentation/sysctl/vm.txt
+++ b/Documentation/sysctl/vm.txt
@@ -42,6 +42,7 @@ Currently, these files are in /proc/sys/vm:
42- mmap_min_addr 42- mmap_min_addr
43- nr_hugepages 43- nr_hugepages
44- nr_overcommit_hugepages 44- nr_overcommit_hugepages
45- nr_pdflush_threads
45- nr_trim_pages (only if CONFIG_MMU=n) 46- nr_trim_pages (only if CONFIG_MMU=n)
46- numa_zonelist_order 47- numa_zonelist_order
47- oom_dump_tasks 48- oom_dump_tasks
@@ -76,8 +77,8 @@ huge pages although processes will also directly compact memory as required.
76 77
77dirty_background_bytes 78dirty_background_bytes
78 79
79Contains the amount of dirty memory at which the background kernel 80Contains the amount of dirty memory at which the pdflush background writeback
80flusher threads will start writeback. 81daemon will start writeback.
81 82
82Note: dirty_background_bytes is the counterpart of dirty_background_ratio. Only 83Note: dirty_background_bytes is the counterpart of dirty_background_ratio. Only
83one of them may be specified at a time. When one sysctl is written it is 84one of them may be specified at a time. When one sysctl is written it is
@@ -89,7 +90,7 @@ other appears as 0 when read.
89dirty_background_ratio 90dirty_background_ratio
90 91
91Contains, as a percentage of total system memory, the number of pages at which 92Contains, as a percentage of total system memory, the number of pages at which
92the background kernel flusher threads will start writing out dirty data. 93the pdflush background writeback daemon will start writing out dirty data.
93 94
94============================================================== 95==============================================================
95 96
@@ -112,9 +113,9 @@ retained.
112dirty_expire_centisecs 113dirty_expire_centisecs
113 114
114This tunable is used to define when dirty data is old enough to be eligible 115This tunable is used to define when dirty data is old enough to be eligible
115for writeout by the kernel flusher threads. It is expressed in 100'ths 116for writeout by the pdflush daemons. It is expressed in 100'ths of a second.
116of a second. Data which has been dirty in-memory for longer than this 117Data which has been dirty in-memory for longer than this interval will be
117interval will be written out next time a flusher thread wakes up. 118written out next time a pdflush daemon wakes up.
118 119
119============================================================== 120==============================================================
120 121
@@ -128,7 +129,7 @@ data.
128 129
129dirty_writeback_centisecs 130dirty_writeback_centisecs
130 131
131The kernel flusher threads will periodically wake up and write `old' data 132The pdflush writeback daemons will periodically wake up and write `old' data
132out to disk. This tunable expresses the interval between those wakeups, in 133out to disk. This tunable expresses the interval between those wakeups, in
133100'ths of a second. 134100'ths of a second.
134 135
@@ -425,6 +426,16 @@ See Documentation/vm/hugetlbpage.txt
425 426
426============================================================== 427==============================================================
427 428
429nr_pdflush_threads
430
431The current number of pdflush threads. This value is read-only.
432The value changes according to the number of dirty pages in the system.
433
434When necessary, additional pdflush threads are created, one per second, up to
435nr_pdflush_threads_max.
436
437==============================================================
438
428nr_trim_pages 439nr_trim_pages
429 440
430This is available only on NOMMU kernels. 441This is available only on NOMMU kernels.
@@ -491,10 +502,9 @@ oom_dump_tasks
491 502
492Enables a system-wide task dump (excluding kernel threads) to be 503Enables a system-wide task dump (excluding kernel threads) to be
493produced when the kernel performs an OOM-killing and includes such 504produced when the kernel performs an OOM-killing and includes such
494information as pid, uid, tgid, vm size, rss, nr_ptes, swapents, 505information as pid, uid, tgid, vm size, rss, cpu, oom_adj score, and
495oom_score_adj score, and name. This is helpful to determine why the 506name. This is helpful to determine why the OOM killer was invoked
496OOM killer was invoked, to identify the rogue task that caused it, 507and to identify the rogue task that caused it.
497and to determine why the OOM killer chose the task it did to kill.
498 508
499If this is set to zero, this information is suppressed. On very 509If this is set to zero, this information is suppressed. On very
500large systems with thousands of tasks it may not be feasible to dump 510large systems with thousands of tasks it may not be feasible to dump
@@ -564,24 +574,16 @@ of physical RAM. See above.
564 574
565page-cluster 575page-cluster
566 576
567page-cluster controls the number of pages up to which consecutive pages 577page-cluster controls the number of pages which are written to swap in
568are read in from swap in a single attempt. This is the swap counterpart 578a single attempt. The swap I/O size.
569to page cache readahead.
570The mentioned consecutivity is not in terms of virtual/physical addresses,
571but consecutive on swap space - that means they were swapped out together.
572 579
573It is a logarithmic value - setting it to zero means "1 page", setting 580It is a logarithmic value - setting it to zero means "1 page", setting
574it to 1 means "2 pages", setting it to 2 means "4 pages", etc. 581it to 1 means "2 pages", setting it to 2 means "4 pages", etc.
575Zero disables swap readahead completely.
576 582
577The default value is three (eight pages at a time). There may be some 583The default value is three (eight pages at a time). There may be some
578small benefits in tuning this to a different value if your workload is 584small benefits in tuning this to a different value if your workload is
579swap-intensive. 585swap-intensive.
580 586
581Lower values mean lower latencies for initial faults, but at the same time
582extra faults and I/O delays for following faults if they would have been part of
583that consecutive pages readahead would have brought in.
584
585============================================================= 587=============================================================
586 588
587panic_on_oom 589panic_on_oom