[systemd-devel] user slice changes for uid ranges

[Stijn De Weirdt]

hello mantas, jeremy, all,


wrt the pam script magic, i'm not a big fan, esp because it is optional.
i'd rather have those users not login than that they don't have the
constraints. (but obvioulsy, i really don't want to lock myself out, so
i totally see what you need the optional keyword)

wrt the generators, i'll have a look how those really work and what i
could do with them. i like the idea that the user slice settings are
only generated when needed (and maybe even cleaned upwhen there are too
many old ones to avoid performance issues)

searching for info on generators and user slices, i stumbled on
https://github.com/systemd/systemd/issues/2556 where this was also
mentioned. unfortunaltey, no examples, so if someone can share some
examples, that would be great !


anyway, thanks a lot,

stijn

On 9/29/19 4:07 PM, Jérémy ROSEN wrote:
> I don't have a complete solutions, but here are a couple of tools that you
> might be able to assemble into something that work
> * dropins,  you could do a dropin for every existing UID that sets the
> Slice= field
> * generators : could be used to generate those dropins....
> * also note that if a unit is named a-b-c.service, systemd will look for
> dropins named a-b-.service and a-.service... there might be something to do
> with that, but I havn't given it much thought
> 
> Le ven. 27 sept. 2019 à 18:28, Mantas Mikulėnas <grawity at gmail.com> a
> écrit :
> 
>> On Fri, Sep 27, 2019 at 5:03 PM Stijn De Weirdt <stijn.deweirdt at ugent.be>
>> wrote:
>>
>>> hi all,
>>>
>>> i'm looking for an "easy" way to set resource limits on a group of users.
>>>
>>> we are lucky enough that this group of users is within a (although
>>> large) high enough range, so a range of uids is ok for us.
>>>
>>> generating a user-<uid>.slice file for every user (or symlink them or
>>> whatever) looks a bit cumbersome, and probably not really performance
>>> friendly if the range is in eg 100k (possible) uids.
>>>
>>> e.g. if this range was 100k-200k, i was more looking for a way to do
>>> e.g. user-1XXXXX.slice or user-100000:200000.slice
>>>
>>
>> As far as I know there isn't a good systemd-native method for this, but
>> you can dynamically set slice parameters during PAM processing, as in this
>> blog post:
>> https://utcc.utoronto.ca/~cks/space/blog/linux/Ubuntu1804SystemdUserLimits
>>
>> --
>> Mantas Mikulėnas
>> _______________________________________________
>> systemd-devel mailing list
>> systemd-devel at lists.freedesktop.org
>> https://lists.freedesktop.org/mailman/listinfo/systemd-devel
> 
> 
>