diff options
author | Jonathan Herman <hermanjl@cs.unc.edu> | 2013-01-17 16:15:55 -0500 |
---|---|---|
committer | Jonathan Herman <hermanjl@cs.unc.edu> | 2013-01-17 16:15:55 -0500 |
commit | 8dea78da5cee153b8af9c07a2745f6c55057fe12 (patch) | |
tree | a8f4d49d63b1ecc92f2fddceba0655b2472c5bd9 /Documentation/sysctl | |
parent | 406089d01562f1e2bf9f089fd7637009ebaad589 (diff) |
Patched in Tegra support.
Diffstat (limited to 'Documentation/sysctl')
-rw-r--r-- | Documentation/sysctl/fs.txt | 67 | ||||
-rw-r--r-- | Documentation/sysctl/kernel.txt | 66 | ||||
-rw-r--r-- | Documentation/sysctl/net.txt | 7 | ||||
-rw-r--r-- | Documentation/sysctl/vm.txt | 44 |
4 files changed, 29 insertions, 155 deletions
diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt index 88152f214f4..88fd7f5c8dc 100644 --- a/Documentation/sysctl/fs.txt +++ b/Documentation/sysctl/fs.txt | |||
@@ -32,8 +32,6 @@ Currently, these files are in /proc/sys/fs: | |||
32 | - nr_open | 32 | - nr_open |
33 | - overflowuid | 33 | - overflowuid |
34 | - overflowgid | 34 | - overflowgid |
35 | - protected_hardlinks | ||
36 | - protected_symlinks | ||
37 | - suid_dumpable | 35 | - suid_dumpable |
38 | - super-max | 36 | - super-max |
39 | - super-nr | 37 | - super-nr |
@@ -159,68 +157,22 @@ The default is 65534. | |||
159 | 157 | ||
160 | ============================================================== | 158 | ============================================================== |
161 | 159 | ||
162 | protected_hardlinks: | ||
163 | |||
164 | A long-standing class of security issues is the hardlink-based | ||
165 | time-of-check-time-of-use race, most commonly seen in world-writable | ||
166 | directories like /tmp. The common method of exploitation of this flaw | ||
167 | is to cross privilege boundaries when following a given hardlink (i.e. a | ||
168 | root process follows a hardlink created by another user). Additionally, | ||
169 | on systems without separated partitions, this stops unauthorized users | ||
170 | from "pinning" vulnerable setuid/setgid files against being upgraded by | ||
171 | the administrator, or linking to special files. | ||
172 | |||
173 | When set to "0", hardlink creation behavior is unrestricted. | ||
174 | |||
175 | When set to "1" hardlinks cannot be created by users if they do not | ||
176 | already own the source file, or do not have read/write access to it. | ||
177 | |||
178 | This protection is based on the restrictions in Openwall and grsecurity. | ||
179 | |||
180 | ============================================================== | ||
181 | |||
182 | protected_symlinks: | ||
183 | |||
184 | A long-standing class of security issues is the symlink-based | ||
185 | time-of-check-time-of-use race, most commonly seen in world-writable | ||
186 | directories like /tmp. The common method of exploitation of this flaw | ||
187 | is to cross privilege boundaries when following a given symlink (i.e. a | ||
188 | root process follows a symlink belonging to another user). For a likely | ||
189 | incomplete list of hundreds of examples across the years, please see: | ||
190 | http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=/tmp | ||
191 | |||
192 | When set to "0", symlink following behavior is unrestricted. | ||
193 | |||
194 | When set to "1" symlinks are permitted to be followed only when outside | ||
195 | a sticky world-writable directory, or when the uid of the symlink and | ||
196 | follower match, or when the directory owner matches the symlink's owner. | ||
197 | |||
198 | This protection is based on the restrictions in Openwall and grsecurity. | ||
199 | |||
200 | ============================================================== | ||
201 | |||
202 | suid_dumpable: | 160 | suid_dumpable: |
203 | 161 | ||
204 | This value can be used to query and set the core dump mode for setuid | 162 | This value can be used to query and set the core dump mode for setuid |
205 | or otherwise protected/tainted binaries. The modes are | 163 | or otherwise protected/tainted binaries. The modes are |
206 | 164 | ||
207 | 0 - (default) - traditional behaviour. Any process which has changed | 165 | 0 - (default) - traditional behaviour. Any process which has changed |
208 | privilege levels or is execute only will not be dumped. | 166 | privilege levels or is execute only will not be dumped |
209 | 1 - (debug) - all processes dump core when possible. The core dump is | 167 | 1 - (debug) - all processes dump core when possible. The core dump is |
210 | owned by the current user and no security is applied. This is | 168 | owned by the current user and no security is applied. This is |
211 | intended for system debugging situations only. Ptrace is unchecked. | 169 | intended for system debugging situations only. Ptrace is unchecked. |
212 | This is insecure as it allows regular users to examine the memory | ||
213 | contents of privileged processes. | ||
214 | 2 - (suidsafe) - any binary which normally would not be dumped is dumped | 170 | 2 - (suidsafe) - any binary which normally would not be dumped is dumped |
215 | anyway, but only if the "core_pattern" kernel sysctl is set to | 171 | readable by root only. This allows the end user to remove |
216 | either a pipe handler or a fully qualified path. (For more details | 172 | such a dump but not access it directly. For security reasons |
217 | on this limitation, see CVE-2006-2451.) This mode is appropriate | 173 | core dumps in this mode will not overwrite one another or |
218 | when administrators are attempting to debug problems in a normal | 174 | other files. This mode is appropriate when administrators are |
219 | environment, and either have a core dump pipe handler that knows | 175 | attempting to debug problems in a normal environment. |
220 | to treat privileged core dumps with care, or specific directory | ||
221 | defined for catching core dumps. If a core dump happens without | ||
222 | a pipe handler or fully qualifid path, a message will be emitted | ||
223 | to syslog warning about the lack of a correct setting. | ||
224 | 176 | ||
225 | ============================================================== | 177 | ============================================================== |
226 | 178 | ||
@@ -273,13 +225,6 @@ a queue must be less or equal then msg_max. | |||
273 | maximum message size value (it is every message queue's attribute set during | 225 | maximum message size value (it is every message queue's attribute set during |
274 | its creation). | 226 | its creation). |
275 | 227 | ||
276 | /proc/sys/fs/mqueue/msg_default is a read/write file for setting/getting the | ||
277 | default number of messages in a queue value if attr parameter of mq_open(2) is | ||
278 | NULL. If it exceed msg_max, the default value is initialized msg_max. | ||
279 | |||
280 | /proc/sys/fs/mqueue/msgsize_default is a read/write file for setting/getting | ||
281 | the default message size value if attr parameter of mq_open(2) is NULL. If it | ||
282 | exceed msgsize_max, the default value is initialized msgsize_max. | ||
283 | 228 | ||
284 | 4. /proc/sys/fs/epoll - Configuration options for the epoll interface | 229 | 4. /proc/sys/fs/epoll - Configuration options for the epoll interface |
285 | -------------------------------------------------------- | 230 | -------------------------------------------------------- |
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt index ccd42589e12..704e474a93d 100644 --- a/Documentation/sysctl/kernel.txt +++ b/Documentation/sysctl/kernel.txt | |||
@@ -24,7 +24,6 @@ show up in /proc/sys/kernel: | |||
24 | - bootloader_type [ X86 only ] | 24 | - bootloader_type [ X86 only ] |
25 | - bootloader_version [ X86 only ] | 25 | - bootloader_version [ X86 only ] |
26 | - callhome [ S390 only ] | 26 | - callhome [ S390 only ] |
27 | - cap_last_cap | ||
28 | - core_pattern | 27 | - core_pattern |
29 | - core_pipe_limit | 28 | - core_pipe_limit |
30 | - core_uses_pid | 29 | - core_uses_pid |
@@ -38,7 +37,6 @@ show up in /proc/sys/kernel: | |||
38 | - l2cr [ PPC only ] | 37 | - l2cr [ PPC only ] |
39 | - modprobe ==> Documentation/debugging-modules.txt | 38 | - modprobe ==> Documentation/debugging-modules.txt |
40 | - modules_disabled | 39 | - modules_disabled |
41 | - msg_next_id [ sysv ipc ] | ||
42 | - msgmax | 40 | - msgmax |
43 | - msgmnb | 41 | - msgmnb |
44 | - msgmni | 42 | - msgmni |
@@ -50,7 +48,6 @@ show up in /proc/sys/kernel: | |||
50 | - panic | 48 | - panic |
51 | - panic_on_oops | 49 | - panic_on_oops |
52 | - panic_on_unrecovered_nmi | 50 | - panic_on_unrecovered_nmi |
53 | - panic_on_stackoverflow | ||
54 | - pid_max | 51 | - pid_max |
55 | - powersave-nap [ PPC only ] | 52 | - powersave-nap [ PPC only ] |
56 | - printk | 53 | - printk |
@@ -63,9 +60,7 @@ show up in /proc/sys/kernel: | |||
63 | - rtsig-max | 60 | - rtsig-max |
64 | - rtsig-nr | 61 | - rtsig-nr |
65 | - sem | 62 | - sem |
66 | - sem_next_id [ sysv ipc ] | ||
67 | - sg-big-buff [ generic SCSI device (sg) ] | 63 | - sg-big-buff [ generic SCSI device (sg) ] |
68 | - shm_next_id [ sysv ipc ] | ||
69 | - shm_rmid_forced | 64 | - shm_rmid_forced |
70 | - shmall | 65 | - shmall |
71 | - shmmax [ sysv ipc ] | 66 | - shmmax [ sysv ipc ] |
@@ -160,13 +155,6 @@ on has a service contract with IBM. | |||
160 | 155 | ||
161 | ============================================================== | 156 | ============================================================== |
162 | 157 | ||
163 | cap_last_cap | ||
164 | |||
165 | Highest valid capability of the running kernel. Exports | ||
166 | CAP_LAST_CAP from the kernel. | ||
167 | |||
168 | ============================================================== | ||
169 | |||
170 | core_pattern: | 158 | core_pattern: |
171 | 159 | ||
172 | core_pattern is used to specify a core dumpfile pattern name. | 160 | core_pattern is used to specify a core dumpfile pattern name. |
@@ -184,8 +172,6 @@ core_pattern is used to specify a core dumpfile pattern name. | |||
184 | %p pid | 172 | %p pid |
185 | %u uid | 173 | %u uid |
186 | %g gid | 174 | %g gid |
187 | %d dump mode, matches PR_SET_DUMPABLE and | ||
188 | /proc/sys/fs/suid_dumpable | ||
189 | %s signal number | 175 | %s signal number |
190 | %t UNIX time of dump | 176 | %t UNIX time of dump |
191 | %h hostname | 177 | %h hostname |
@@ -323,22 +309,6 @@ to false. | |||
323 | 309 | ||
324 | ============================================================== | 310 | ============================================================== |
325 | 311 | ||
326 | msg_next_id, sem_next_id, and shm_next_id: | ||
327 | |||
328 | These three toggles allows to specify desired id for next allocated IPC | ||
329 | object: message, semaphore or shared memory respectively. | ||
330 | |||
331 | By default they are equal to -1, which means generic allocation logic. | ||
332 | Possible values to set are in range {0..INT_MAX}. | ||
333 | |||
334 | Notes: | ||
335 | 1) kernel doesn't guarantee, that new object will have desired id. So, | ||
336 | it's up to userspace, how to handle an object with "wrong" id. | ||
337 | 2) Toggle with non-default value will be set back to -1 by kernel after | ||
338 | successful IPC object allocation. | ||
339 | |||
340 | ============================================================== | ||
341 | |||
342 | nmi_watchdog: | 312 | nmi_watchdog: |
343 | 313 | ||
344 | Enables/Disables the NMI watchdog on x86 systems. When the value is | 314 | Enables/Disables the NMI watchdog on x86 systems. When the value is |
@@ -415,19 +385,6 @@ Controls the kernel's behaviour when an oops or BUG is encountered. | |||
415 | 385 | ||
416 | ============================================================== | 386 | ============================================================== |
417 | 387 | ||
418 | panic_on_stackoverflow: | ||
419 | |||
420 | Controls the kernel's behavior when detecting the overflows of | ||
421 | kernel, IRQ and exception stacks except a user stack. | ||
422 | This file shows up if CONFIG_DEBUG_STACKOVERFLOW is enabled. | ||
423 | |||
424 | 0: try to continue operation. | ||
425 | |||
426 | 1: panic immediately. | ||
427 | |||
428 | ============================================================== | ||
429 | |||
430 | |||
431 | pid_max: | 388 | pid_max: |
432 | 389 | ||
433 | PID allocation wrap value. When the kernel's next PID value | 390 | PID allocation wrap value. When the kernel's next PID value |
@@ -436,14 +393,6 @@ PIDs of value pid_max or larger are not allocated. | |||
436 | 393 | ||
437 | ============================================================== | 394 | ============================================================== |
438 | 395 | ||
439 | ns_last_pid: | ||
440 | |||
441 | The last pid allocated in the current (the one task using this sysctl | ||
442 | lives in) pid namespace. When selecting a pid for a next task on fork | ||
443 | kernel tries to allocate a number starting from this one. | ||
444 | |||
445 | ============================================================== | ||
446 | |||
447 | powersave-nap: (PPC only) | 396 | powersave-nap: (PPC only) |
448 | 397 | ||
449 | If set, Linux-PPC will use the 'nap' mode of powersaving, | 398 | If set, Linux-PPC will use the 'nap' mode of powersaving, |
@@ -561,19 +510,6 @@ are doing anyway :) | |||
561 | 510 | ||
562 | ============================================================== | 511 | ============================================================== |
563 | 512 | ||
564 | shmall: | ||
565 | |||
566 | This parameter sets the total amount of shared memory pages that | ||
567 | can be used system wide. Hence, SHMALL should always be at least | ||
568 | ceil(shmmax/PAGE_SIZE). | ||
569 | |||
570 | If you are not sure what the default PAGE_SIZE is on your Linux | ||
571 | system, you can run the following command: | ||
572 | |||
573 | # getconf PAGE_SIZE | ||
574 | |||
575 | ============================================================== | ||
576 | |||
577 | shmmax: | 513 | shmmax: |
578 | 514 | ||
579 | This value can be used to query and set the run time limit | 515 | This value can be used to query and set the run time limit |
@@ -635,8 +571,6 @@ can be ORed together: | |||
635 | instead of using the one provided by the hardware. | 571 | instead of using the one provided by the hardware. |
636 | 512 - A kernel warning has occurred. | 572 | 512 - A kernel warning has occurred. |
637 | 1024 - A module from drivers/staging was loaded. | 573 | 1024 - A module from drivers/staging was loaded. |
638 | 2048 - The system is working around a severe firmware bug. | ||
639 | 4096 - An out-of-tree module has been loaded. | ||
640 | 574 | ||
641 | ============================================================== | 575 | ============================================================== |
642 | 576 | ||
diff --git a/Documentation/sysctl/net.txt b/Documentation/sysctl/net.txt index 98335b7a533..3201a7097e4 100644 --- a/Documentation/sysctl/net.txt +++ b/Documentation/sysctl/net.txt | |||
@@ -43,13 +43,6 @@ Values : | |||
43 | 1 - enable the JIT | 43 | 1 - enable the JIT |
44 | 2 - enable the JIT and ask the compiler to emit traces on kernel log. | 44 | 2 - enable the JIT and ask the compiler to emit traces on kernel log. |
45 | 45 | ||
46 | dev_weight | ||
47 | -------------- | ||
48 | |||
49 | The maximum number of packets that kernel can handle on a NAPI interrupt, | ||
50 | it's a Per-CPU variable. | ||
51 | Default: 64 | ||
52 | |||
53 | rmem_default | 46 | rmem_default |
54 | ------------ | 47 | ------------ |
55 | 48 | ||
diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt index 078701fdbd4..96f0ee825be 100644 --- a/Documentation/sysctl/vm.txt +++ b/Documentation/sysctl/vm.txt | |||
@@ -42,6 +42,7 @@ Currently, these files are in /proc/sys/vm: | |||
42 | - mmap_min_addr | 42 | - mmap_min_addr |
43 | - nr_hugepages | 43 | - nr_hugepages |
44 | - nr_overcommit_hugepages | 44 | - nr_overcommit_hugepages |
45 | - nr_pdflush_threads | ||
45 | - nr_trim_pages (only if CONFIG_MMU=n) | 46 | - nr_trim_pages (only if CONFIG_MMU=n) |
46 | - numa_zonelist_order | 47 | - numa_zonelist_order |
47 | - oom_dump_tasks | 48 | - oom_dump_tasks |
@@ -76,8 +77,8 @@ huge pages although processes will also directly compact memory as required. | |||
76 | 77 | ||
77 | dirty_background_bytes | 78 | dirty_background_bytes |
78 | 79 | ||
79 | Contains the amount of dirty memory at which the background kernel | 80 | Contains the amount of dirty memory at which the pdflush background writeback |
80 | flusher threads will start writeback. | 81 | daemon will start writeback. |
81 | 82 | ||
82 | Note: dirty_background_bytes is the counterpart of dirty_background_ratio. Only | 83 | Note: dirty_background_bytes is the counterpart of dirty_background_ratio. Only |
83 | one of them may be specified at a time. When one sysctl is written it is | 84 | one of them may be specified at a time. When one sysctl is written it is |
@@ -89,7 +90,7 @@ other appears as 0 when read. | |||
89 | dirty_background_ratio | 90 | dirty_background_ratio |
90 | 91 | ||
91 | Contains, as a percentage of total system memory, the number of pages at which | 92 | Contains, as a percentage of total system memory, the number of pages at which |
92 | the background kernel flusher threads will start writing out dirty data. | 93 | the pdflush background writeback daemon will start writing out dirty data. |
93 | 94 | ||
94 | ============================================================== | 95 | ============================================================== |
95 | 96 | ||
@@ -112,9 +113,9 @@ retained. | |||
112 | dirty_expire_centisecs | 113 | dirty_expire_centisecs |
113 | 114 | ||
114 | This tunable is used to define when dirty data is old enough to be eligible | 115 | This tunable is used to define when dirty data is old enough to be eligible |
115 | for writeout by the kernel flusher threads. It is expressed in 100'ths | 116 | for writeout by the pdflush daemons. It is expressed in 100'ths of a second. |
116 | of a second. Data which has been dirty in-memory for longer than this | 117 | Data which has been dirty in-memory for longer than this interval will be |
117 | interval will be written out next time a flusher thread wakes up. | 118 | written out next time a pdflush daemon wakes up. |
118 | 119 | ||
119 | ============================================================== | 120 | ============================================================== |
120 | 121 | ||
@@ -128,7 +129,7 @@ data. | |||
128 | 129 | ||
129 | dirty_writeback_centisecs | 130 | dirty_writeback_centisecs |
130 | 131 | ||
131 | The kernel flusher threads will periodically wake up and write `old' data | 132 | The pdflush writeback daemons will periodically wake up and write `old' data |
132 | out to disk. This tunable expresses the interval between those wakeups, in | 133 | out to disk. This tunable expresses the interval between those wakeups, in |
133 | 100'ths of a second. | 134 | 100'ths of a second. |
134 | 135 | ||
@@ -425,6 +426,16 @@ See Documentation/vm/hugetlbpage.txt | |||
425 | 426 | ||
426 | ============================================================== | 427 | ============================================================== |
427 | 428 | ||
429 | nr_pdflush_threads | ||
430 | |||
431 | The current number of pdflush threads. This value is read-only. | ||
432 | The value changes according to the number of dirty pages in the system. | ||
433 | |||
434 | When necessary, additional pdflush threads are created, one per second, up to | ||
435 | nr_pdflush_threads_max. | ||
436 | |||
437 | ============================================================== | ||
438 | |||
428 | nr_trim_pages | 439 | nr_trim_pages |
429 | 440 | ||
430 | This is available only on NOMMU kernels. | 441 | This is available only on NOMMU kernels. |
@@ -491,10 +502,9 @@ oom_dump_tasks | |||
491 | 502 | ||
492 | Enables a system-wide task dump (excluding kernel threads) to be | 503 | Enables a system-wide task dump (excluding kernel threads) to be |
493 | produced when the kernel performs an OOM-killing and includes such | 504 | produced when the kernel performs an OOM-killing and includes such |
494 | information as pid, uid, tgid, vm size, rss, nr_ptes, swapents, | 505 | information as pid, uid, tgid, vm size, rss, cpu, oom_adj score, and |
495 | oom_score_adj score, and name. This is helpful to determine why the | 506 | name. This is helpful to determine why the OOM killer was invoked |
496 | OOM killer was invoked, to identify the rogue task that caused it, | 507 | and to identify the rogue task that caused it. |
497 | and to determine why the OOM killer chose the task it did to kill. | ||
498 | 508 | ||
499 | If this is set to zero, this information is suppressed. On very | 509 | If this is set to zero, this information is suppressed. On very |
500 | large systems with thousands of tasks it may not be feasible to dump | 510 | large systems with thousands of tasks it may not be feasible to dump |
@@ -564,24 +574,16 @@ of physical RAM. See above. | |||
564 | 574 | ||
565 | page-cluster | 575 | page-cluster |
566 | 576 | ||
567 | page-cluster controls the number of pages up to which consecutive pages | 577 | page-cluster controls the number of pages which are written to swap in |
568 | are read in from swap in a single attempt. This is the swap counterpart | 578 | a single attempt. The swap I/O size. |
569 | to page cache readahead. | ||
570 | The mentioned consecutivity is not in terms of virtual/physical addresses, | ||
571 | but consecutive on swap space - that means they were swapped out together. | ||
572 | 579 | ||
573 | It is a logarithmic value - setting it to zero means "1 page", setting | 580 | It is a logarithmic value - setting it to zero means "1 page", setting |
574 | it to 1 means "2 pages", setting it to 2 means "4 pages", etc. | 581 | it to 1 means "2 pages", setting it to 2 means "4 pages", etc. |
575 | Zero disables swap readahead completely. | ||
576 | 582 | ||
577 | The default value is three (eight pages at a time). There may be some | 583 | The default value is three (eight pages at a time). There may be some |
578 | small benefits in tuning this to a different value if your workload is | 584 | small benefits in tuning this to a different value if your workload is |
579 | swap-intensive. | 585 | swap-intensive. |
580 | 586 | ||
581 | Lower values mean lower latencies for initial faults, but at the same time | ||
582 | extra faults and I/O delays for following faults if they would have been part of | ||
583 | that consecutive pages readahead would have brought in. | ||
584 | |||
585 | ============================================================= | 587 | ============================================================= |
586 | 588 | ||
587 | panic_on_oom | 589 | panic_on_oom |