linux-kernel - Re: [PATCH] inotify: Increase default inotify.max_user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 29 Oct 2020 10:25:10 -0400
From:   Waiman Long <longman@...hat.com>
To:     Jan Kara <jack@...e.cz>
Cc:     Amir Goldstein <amir73il@...il.com>, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org, Luca BRUNO <lucab@...hat.com>
Subject: Re: [PATCH] inotify: Increase default inotify.max_user_watches limit
 to 1048576

On 10/27/20 12:00 PM, Jan Kara wrote:
> On Mon 26-10-20 16:44:18, Waiman Long wrote:
>> The default value of inotify.max_user_watches sysctl parameter was set
>> to 8192 since the introduction of the inotify feature in 2005 by
>> commit 0eeca28300df ("[PATCH] inotify"). Today this value is just too
>> small for many modern usage. As a result, users have to explicitly set
>> it to a larger value to make it work.
>>
>> After some searching around the web, these are the
>> inotify.max_user_watches values used by some projects:
>>   - vscode:  524288
>>   - dropbox support: 100000
>>   - users on stackexchange: 12228
>>   - lsyncd user: 2000000
>>   - code42 support: 1048576
>>   - monodevelop: 16384
>>   - tectonic: 524288
>>   - openshift origin: 65536
>>
>> Each watch point adds an inotify_inode_mark structure to an inode to be
>> watched. Modeled after the epoll.max_user_watches behavior to adjust the
>> default value according to the amount of addressable memory available,
>> make inotify.max_user_watches behave in a similar way to make it use
>> no more than 1% of addressable memory within the range [8192, 1048576].
>>
>> For 64-bit archs, inotify_inode_mark should have a size of 80 bytes. That
>> means a system with 8GB or more memory will have the maximum value of
>> 1048576 for inotify.max_user_watches. This default should be big enough
>> for most of the use cases.
>>
>> Signed-off-by: Waiman Long <longman@...hat.com>
> So I agree that 8192 watches seem to be a bit low today but what you
> propose seems to be way too much to me. OTOH I agree that having to tune
> this manually kind of sucks so I'm for auto-tuning of the default. If the
> computation takes into account the fact that a watch pins an inode as Amir
> properly notes (that's the main reason why the number of watches is
> limited), I think limiting to 1% of pinned memory should be bearable. The
> amount of space pinned by an inode is impossible to estimate exactly
> (differs for different filesystems) but about 1k for one inode is a sound
> estimate IMO.
>
> 								Honza

I will certainly do that. Will send out a v2 soon.

Cheers,
Longman