New answers tagged

0

I would discard SELinux for AppArmor only if I were using Ubuntu. (really quite difficult) LXC is not secure by itself If you need security you must use them via libvirt (based on SELinux MLS). Your problem is infinite so do not try to find any solution off the shelf and without infinite time, remember that even kernel.org was pwoned and very recently the ...


1

In short, some services spawn a lot of processes. With System V init system is not always possible to assign a process to the service that spawned it. Also service may not terminate correctly leaving some children alive. With systemd this problem is solved by placing each service in its own cgroup. Cgroups are used to corral and manage processes and are a ...


1

I have a feeling that this document will help you a lot (Sections 5.5 and 5.2 especially). I will try to summarize as best I can here. The best explaination that I have is that the numbers provided in memory.usage_in_bytes are not incredibly precise, but are intended to provide a general idea about the amount of memory something is using. memory.stat is ...


0

Yes, you can use cgroups and SELinux/AppArmor exclusively to monitor and control the arbitrary code that you will execute. With cgroups, you can do the following: Limit CPU core usage to 1 CPU with the cpuset subsystem Set memory usage limits with the memory subsystem, tracking even the forks. See https://github.com/gsauthof/cgmemtime for an example. ...


2

Cgroups are hierarhical and they are inherited by all subprocesses. So all processes must be in some cgroup. By default it's the root cgroup and by default it has 1024 shares which is twice as A and B in Your example. CPU time is shared betwean cgroups according to weight assigned to them in cpu.shares. If A had 1024 shares and B 512 and C 256 and D 256, ...



Top 50 recent answers are included