diff --git a/docs/designs/qemu-deprivilege.md b/docs/designs/qemu-deprivilege.md index 067cf24762..f7444a434d 100644 --- a/docs/designs/qemu-deprivilege.md +++ b/docs/designs/qemu-deprivilege.md @@ -114,7 +114,6 @@ resources available to it. Limits that can be implemented immediately without much effort: - RLIMIT_FSIZE` (file size) to 256KiB. - - RLIMIT_NPROC (after uid changes to a unique uid) Probably not necessary but why not: - RLIMIT_CORE: 0 @@ -142,6 +141,9 @@ virtual memory which QEMU uses as a mapcache. xen-mapcache.c already fiddles with this; it would be straightforward to make it *set* the rlimit to what it thinks a sensible limit is. +RLIMIT_NPROC limits total number of processes or threads. QEMU uses +threads for some devices, so this would require some thought. + Other things that would take some cleverness / changes to QEMU to utilize due to ordering constrants: - RLIMIT_NOFILES (after all necessary files are opened) diff --git a/tools/libxl/libxl_linux.c b/tools/libxl/libxl_linux.c index 921051c0e6..6475cca64b 100644 --- a/tools/libxl/libxl_linux.c +++ b/tools/libxl/libxl_linux.c @@ -318,7 +318,6 @@ static struct { RLIMIT_ENTRY(RLIMIT_FSIZE, 256*1024), /* Shouldn't need any of these */ - RLIMIT_ENTRY(RLIMIT_NPROC, 0), RLIMIT_ENTRY(RLIMIT_CORE, 0), RLIMIT_ENTRY(RLIMIT_MSGQUEUE, 0), RLIMIT_ENTRY(RLIMIT_LOCKS, 0),