Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
polkitd eating up 100% cpu on hardened kernel w/o mprotect
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Desktop Environments
View previous topic :: View next topic  
Author Message
eminenz
Tux's lil' helper
Tux's lil' helper


Joined: 16 Jul 2006
Posts: 90

PostPosted: Fri May 10, 2013 9:38 pm    Post subject: polkitd eating up 100% cpu on hardened kernel w/o mprotect Reply with quote

Hi!

I probably have a very strange problem.
I upgraded to 3.7.5-hardened kernel and udev-200 recently, and did an emerge -e system afterwards.

Normal working was possible until I turned off grsecurity/pax MPROTECT feature in the kernel as I had several problems with it and recompiled the kernel.

Now, WITH LESS security restriction, polkit runs at 100% CPU.
There is only one polkit process if I'm logged in via console, it's many if I'm logged in graphically.


Code:

  PID  PPID %CPU USER      PR  NI  VIRT  RES  SHR S %MEM     TIME+ COMMAND                                             
 2741     1 11,6 polkitd   20   0  143m 7956 7076 R  0,4   8:17.06 polkitd                                             
 2764     1 11,6 polkitd   20   0  134m 7944 7076 R  0,4   8:11.68 polkitd                                             
 2795     1 11,6 polkitd   20   0 84440 7940 7076 R  0,4   8:03.26 polkitd                                             
 2791     1 11,2 polkitd   20   0  121m 7936 7076 R  0,4   8:07.24 polkitd                                             
 2809     1 11,2 polkitd   20   0  144m 7928 7076 R  0,4   8:00.03 polkitd                                             
 2699     1  3,3 eminenz   20   0  522m 154m  64m S  7,7   1:57.70 midori                                               
 2321  2317  2,3 root      20   0  226m  49m  15m S  2,4   1:12.26 X                                                   
 6879     1  1,3 eminenz   20   0  339m  25m  20m S  1,3   0:00.68 Terminal     


I have no idea why polkit goes rampage.

Some maybe relevant versions:
udisks 1.0.4-r5
upower 0.9.16
polkit-0.110


I don't even know where to start looking for the cause. I don't find anything relevant in syslog.
Back to top
View user's profile Send private message
steveL
Advocate
Advocate


Joined: 13 Sep 2006
Posts: 2160
Location: The Peanut Gallery

PostPosted: Sat May 11, 2013 3:11 am    Post subject: Reply with quote

It might sound stupid, but I just got rid of *kit in the end, as I'd already got rid of semantic-desktop on KDE and switched from KMail to mutt. There's a great write-up on removing *kit here.

Sorry if that's no help. I noticed you were using a lightweight browser, so might want a more lightweight desktop too. (KDE is now running as slickly as 3.5 used to. Combined with "Attach as Tab" in 4.9+ it's become a much better place to work again, thankfully.)
Back to top
View user's profile Send private message
eminenz
Tux's lil' helper
Tux's lil' helper


Joined: 16 Jul 2006
Posts: 90

PostPosted: Sat May 11, 2013 8:41 am    Post subject: Reply with quote

Thank you so much for that info!
Im using xfce4 and getting rid of *kit and u* and systemd right now :)

after playing around a little more i found

Code:
May 11 09:44:41 exitus kernel: [   88.565341] grsec: denied resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for /usr/libexec/upowerd[upowerd:2290] uid/euid:0/0 gid/egid:0/0, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0
May 11 09:44:41 exitus kernel: [   88.568888] grsec: denied resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for /usr/libexec/gvfs-gdu-volume-monitor[gvfs-gdu-volume:2294] uid/euid:1000/1000 gid/egid:100/100, parent /usr/bin/dbus-daemon[dbus-daemon:2293] uid/euid:1000/1000 gid/egid:100/100
May 11 09:44:41 exitus kernel: [   88.647071] grsec: denied resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for /usr/libexec/gdu-notification-daemon[gdu-notificatio:2255] uid/euid:1000/1000 gid/egid:100/100, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0
May 11 09:45:06 exitus kernel: [  113.629478] grsec: denied resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for /usr/libexec/gvfs-gdu-volume-monitor[gvfs-gdu-volume:2324] uid/euid:1000/1000 gid/egid:100/100, parent /usr/bin/dbus-daemon[dbus-daemon:2323] uid/euid:1000/1000 gid/egid:100/100
May 11 09:45:06 exitus kernel: [  113.633488] grsec: denied resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for /usr/libexec/upowerd[upowerd:2315] uid/euid:0/0 gid/egid:0/0, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0
May 11 09:45:31 exitus kernel: [  138.723748] grsec: denied resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for /usr/libexec/upowerd[upowerd:2334] uid/euid:0/0 gid/egid:0/0, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0
May 11 09:45:56 exitus kernel: [  163.793326] grsec: denied resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for /usr/libexec/upowerd[upowerd:2342] uid/euid:0/0 gid/egid:0/0, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0
May 11 09:47:11 exitus kernel: [  238.917634] grsec: denied resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for /usr/libexec/upowerd[upowerd:2359] uid/euid:0/0 gid/egid:0/0, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0


directly after a reboot.

As I don't think i'll have to deal with *kit and u{disk,power} any longer, it'll be resolved in an hour when that mess has left my system.

In case anybody else stumbles over this, it seems to be a limits.conf-related thing and is fixed there:
http://forums.gentoo.org/viewtopic-t-839738-highlight-limits+conf.html?sid=8ea2e3b8ee0c34e0d7361db319be42a2
Back to top
View user's profile Send private message
steveL
Advocate
Advocate


Joined: 13 Sep 2006
Posts: 2160
Location: The Peanut Gallery

PostPosted: Sun May 12, 2013 10:33 am    Post subject: Reply with quote

eminenz wrote:
Thank you so much for that info!
Im using xfce4 and getting rid of *kit and u* and systemd right now :)

Hey, that's great, you're very welcome :) I hope it works out for you: if not feel free to ask on that thread.

Just for future, it's better to make topic links with the topic tag:
Code:
[topic=839738]topic link[/topic]

That's better as the link is a lot shorter, and doesn't include your session-id.

In this case, you can use a post tag
Code:
[post=6473249]post tag[/post]
to link directly to the post which answers the issue. The url for those can be copied from the small envelope next to the "Posted: <date>" then you just delete everything but the id.

HTH,
steveL.
Back to top
View user's profile Send private message
mv
Advocate
Advocate


Joined: 20 Apr 2005
Posts: 3784

PostPosted: Sun May 12, 2013 11:02 am    Post subject: Reply with quote

eminenz wrote:
it seems to be a limits.conf-related thing

So it is essentially related with pam. Since you are using hardened, I am wondering why you use pam. Of course, if you need access over ldap or something similar there is probably no way around it, but otherwise: since you are just recompiling to get rid of *kit you might perhaps think about to get rid of pam as similarly to polkit it is essentially just an additional layer which thus might contain bugs...
Unofortunately lightdm does not seem to work without pam (at least, according to the ebuild) but kdm does.
Back to top
View user's profile Send private message
eminenz
Tux's lil' helper
Tux's lil' helper


Joined: 16 Jul 2006
Posts: 90

PostPosted: Sun May 12, 2013 9:12 pm    Post subject: Reply with quote

well it's a rather strange thing with my box and pam.

I managed to get along without pam quite a while until some change prevented locking the display on xscreensaver with setuid set), if xscreensaver was not compiled with pam.

I wrote a mail to the developer of xscreensaver who essentially said your situation is not the common xscreensaver situation and pam was designed to fix this, it's not an xscreensaver issue.
I didn't find another way to be able to lock my display again then to install pam (I tried multiple days...). I don't use it with any other application, though (global useflag -pam).
Back to top
View user's profile Send private message
steveL
Advocate
Advocate


Joined: 13 Sep 2006
Posts: 2160
Location: The Peanut Gallery

PostPosted: Mon May 13, 2013 7:20 pm    Post subject: Reply with quote

I'm much happier relying on pam than anything else. Combined with sudo (and a small amount of visudo), I really don't see the need for more on a desktop.

It's also much easier to put together a convenient setup for someone else, when the base is nice and simple in configuration, and doesn't change every 6 months.

Admins can also do a lot with pam for bigger setups, but that's not my use-case, nor is it whom most of the "convenience" layers are aimed at.
_________________
creaker wrote:
systemd. It is a really ass pain

update - "a most excellent portage wrapper"

#friendly-coders -- We're still here for you™ ;)
Back to top
View user's profile Send private message
mv
Advocate
Advocate


Joined: 20 Apr 2005
Posts: 3784

PostPosted: Thu May 16, 2013 12:54 pm    Post subject: Reply with quote

eminenz wrote:
I managed to get along without pam quite a while until some change prevented locking the display on xscreensaver with setuid set

I would say if you want screenlocking this is a valid use case for pam. Sure, the screenlocker could implement something, but I can understand if the developer says that this is better left to some standard tool.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Desktop Environments All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum