Re: [PATCH] Allow kernel to swap memory on high demand

[Michael Tremer <michael.tremer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 2771 bytes --]

Hello Tim,

welcome to the list and thanks for the patch.

On Tue, 2018-09-25 at 20:29 +0200, Peter Müller wrote:
> Hello Tim,
> 
> I am not sure about the side-effects introduced with this patch.
> 
> As far as I am aware, values for "vm.swappiness" range from 0
> (disable swapping entirely) to 100 (swap aggressively). Value 1
> means swapping is only used to avoid OOM situations.

No, 0 does not disable swapping entirely.

  https://git.ipfire.org/?p=thirdparty/kernel/linux.git;a=blob;f=Documentation/sysctl/vm.txt;hb=02214bfc89c71bcc5167f653994cfa5c57f10ff1#l808

> This raises three questions:
> (a) On some systems, I observer swap usage > 0% indeed, which
> should not happen if value 0 for this setting _disables_ swapping.

See above.

> (b) Since disk I/O is much slower than RAM access, I fear it
> might be a DoS vector to enable this (infected program running
> amok). On the other hand, if a systems might avoid running out
> of memory, this sounds good too.

Not swapping would cause the OOM killer to kill random processes. That also is a
DoS attack vector. Every OOM situation is. There is no way to recover from this.

> (c) How does the kernel treat anonymous pages after changing
> this setting?

Anonymous pages?

> However, these might be academic threats since the overall
> issue is already discussed in 
> https://bugzilla.ipfire.org/show_bug.cgi?id=11839 .
> Just some comments from my side... :-)

Not really. I guess what we really want is 1 here. There is usually no reason
for the firewall to swap. That only happens for the proxy or IDS (or an
application with a massive memory leak). Usually that can be configured away or
the amount of RAM in the machine has to be upgraded.

As long as there is enough memory available, we want to keep everything in
memory. There is no point in swapping out the IDS ruleset or proxy cache in
memory. We only will do this to keep the system alive if there is a peak in
memory usage and that is what vm.swappiness=1 is doing from my POV.

Best,
-Michael

> 
> Thanks, and best regards,
> Peter Müller
> 
> 
> > Signed-off-by: Tim FitzGeorge <ipfr at tfitzgeorge.me.uk>
> > Fixes: Bug 11839
> > ---
> >  config/etc/sysctl.conf | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf
> > index 345f8f52a..4066af767 100644
> > --- a/config/etc/sysctl.conf
> > +++ b/config/etc/sysctl.conf
> > @@ -27,7 +27,7 @@ net.ipv4.conf.all.accept_source_route = 0
> >  net.ipv4.conf.all.log_martians = 1
> >  
> >  kernel.printk = 1 4 1 7
> > -vm.swappiness=0
> > +vm.swappiness=1
> >  vm.mmap_min_addr = 4096
> >  vm.min_free_kbytes = 8192
> >  
> > 
> 
>