45497f4d3b
This should PID collisions a tiny bit less likely, and thus improve security and robustness. 2^22 isn't particularly a lot either, but it's the current kernel limitation. Bumping this limit was suggested by Linus himself: https://lwn.net/ml/linux-kernel/CAHk-=wiZ40LVjnXSi9iHLE_-ZBsWFGCgdmNiYZUXn1-V5YBg2g@mail.gmail.com/ Let's experiment with this in systemd upstream first. Downstreams and users can after all still comment this easily. Besides compat concern the most often heard issue with such high PIDs is usability, since they are potentially hard to type. I am not entirely sure though whether 4194304 (as largest new PID) is that much worse to type or to copy than 65563. This should also simplify management of per system tasks limits as by this move the sysctl /proc/sys/kernel/threads-max becomes the primary knob to control how many processes to have in parallel.
47 lines
1.4 KiB
Plaintext
47 lines
1.4 KiB
Plaintext
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
# See sysctl.d(5) and core(5) for documentation.
|
|
|
|
# To override settings in this file, create a local file in /etc
|
|
# (e.g. /etc/sysctl.d/90-override.conf), and put any assignments
|
|
# there.
|
|
|
|
# System Request functionality of the kernel (SYNC)
|
|
#
|
|
# Use kernel.sysrq = 1 to allow all keys.
|
|
# See https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html for a list
|
|
# of values and keys.
|
|
kernel.sysrq = 16
|
|
|
|
# Append the PID to the core filename
|
|
kernel.core_uses_pid = 1
|
|
|
|
# Source route verification
|
|
net.ipv4.conf.all.rp_filter = 2
|
|
|
|
# Do not accept source routing
|
|
net.ipv4.conf.all.accept_source_route = 0
|
|
|
|
# Promote secondary addresses when the primary address is removed
|
|
net.ipv4.conf.all.promote_secondaries = 1
|
|
|
|
# Fair Queue CoDel packet scheduler to fight bufferbloat
|
|
net.core.default_qdisc = fq_codel
|
|
|
|
# Enable hard and soft link protection
|
|
fs.protected_hardlinks = 1
|
|
fs.protected_symlinks = 1
|
|
|
|
# Enable regular file and FIFO protection
|
|
fs.protected_regular = 1
|
|
fs.protected_fifos = 1
|
|
|
|
# Bump the numeric PID range to its maximum of 2^22 (from the in-kernel default
|
|
# of 2^16), to make PID collisions less likely.
|
|
kernel.pid_max = 4194304
|