diff options
| author | Michal Sekletar <msekleta@redhat.com> | 2019-03-27 09:27:21 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2019-03-28 15:52:41 +0100 |
| commit | 48da47eeca7a58aecc3512346ab8d4064711c71d (patch) | |
| tree | 86e2aececabe976c91b7b24825f6b91b6fe32730 /src/cryptsetup/cryptsetup-generator.c | |
| parent | e8413b651ba2ca230d73a8df37471ac384979246 (diff) | |
| download | systemd-48da47eeca7a58aecc3512346ab8d4064711c71d.tar.gz | |
cryptsetup-generator: set high OOM score for systemd-cryptsetup instances
With new LUKS2 header format it is possible to use Argon2 key derivation
function. This function is "memory-hard" hence keyslot unlocking can
potentially use a lot of RAM as this increases resistance to massively
parallel GPU based password cracking.
However, when multiple systemd-cryptsetup binaries run at the same
time it is very likely that system using Argon2 (e.g. Fedora 30)
will encounter memory-pressure during early boot, following OOM killing
spree.
This patch aims to lower the damage done by OOM killer and sets OOMScore
for systemd-cryptsetup units to 500. Hopefully OOM killer will then
shoot us down and leave rest of the system services alone.
Diffstat (limited to 'src/cryptsetup/cryptsetup-generator.c')
| -rw-r--r-- | src/cryptsetup/cryptsetup-generator.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/cryptsetup/cryptsetup-generator.c b/src/cryptsetup/cryptsetup-generator.c index 5ae1fca2af..e9b21689c7 100644 --- a/src/cryptsetup/cryptsetup-generator.c +++ b/src/cryptsetup/cryptsetup-generator.c @@ -265,6 +265,7 @@ static int create_disk( "RemainAfterExit=yes\n" "TimeoutSec=0\n" /* the binary handles timeouts anyway */ "KeyringMode=shared\n" /* make sure we can share cached keys among instances */ + "OOMScoreAdjust=500\n" /* unlocking can allocate a lot of memory if Argon2 is used */ "ExecStart=" SYSTEMD_CRYPTSETUP_PATH " attach '%s' '%s' '%s' '%s'\n" "ExecStop=" SYSTEMD_CRYPTSETUP_PATH " detach '%s'\n", name_escaped, u_escaped, strempty(password_escaped), strempty(filtered_escaped), |