On Wed, Oct 17, 2007 at 09:56:01AM -0600, Dennis Muhlestein wrote:
> > exactly, and there is no problem as long as you pay attention of not
> > overloadig the host by consolidating too many cpu-hogging services
> > from X real servers into X vservers on one host :)
> Great, that helps validate what I'm doing. I've only got 1 guest w/ a
> real time priority process.. The other virtual guests are lower
> priority and can afford some lag in their operation.
let me point out once again the actual implications:
having SYS_NICE, the guest can ...
- alter process priorities
- use FIFO and RR (realtime) scheduling
- change cpu affinity
as realtime processes have higher priority than
the 'normal' processes (usually including daemons
like sshd) a single cpu hog running at realtime
priority will keep _all_ 'normal' processes from
being sheduled ever again ...
so to sumarize, do not (never ever) give that to
an untrusted (potentially hostile) guest, as it can
easily hang your entire host ....
note: no normal 'user' process (non root) will
ever get realtime priority :)
best,
Herbert
> Thanks
> Dennis
Received on Wed Oct 17 19:21:18 2007