Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

vault: disable_mlock option #84601

Closed
wants to merge 1 commit into from
Closed

vault: disable_mlock option #84601

wants to merge 1 commit into from

Conversation

amaxine
Copy link
Contributor

@amaxine amaxine commented Apr 7, 2020 •
edited

Motivation for this change

Implements a disable_mlock configuration option and sets capabilities based on whether it's set.
Motivated by official documentation: https://www.vaultproject.io/docs/configuration/#disable_mlock

Not sure if this is the best/right way to do this, but I'm still new to nix 😅

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@amaxine
vault: disable_mlock option
caf8206 
Since setcap is only necessary if disable_mlock is not enabled, now
we're only setting it with that option set to false.
See https://www.vaultproject.io/docs/configuration/#disable_mlock
@amaxine amaxine changed the title vault: disable_mlock option, setcap wrapper vault: disable_mlock option Apr 7, 2020
@grahamc
Copy link
Member

grahamc commented Apr 7, 2020

Looks pretty good, but under what circumstance would we want to disable it? I guess I'm wondering why would we want to make it easy for users to do this?

@Mic92
Copy link
Member

Mic92 commented Apr 7, 2020

https://www.vaultproject.io/docs/configuration/#disable_mlock

disable_mlock (bool: false) – Disables the server from executing the mlock syscall. mlock prevents memory from being swapped to disk. Disabling mlock is not recommended in production, but is fine for local development and testing.

Disabling mlock is not recommended unless the systems running Vault only use encrypted swap or do not use swap at all. Vault only supports memory locking on UNIX-like systems that support the mlock() syscall (Linux, FreeBSD, etc). Non UNIX-like systems (e.g. Windows, NaCL, Android) lack the primitives to keep a process's entire memory address space from spilling to disk and is therefore automatically disabled on unsupported platforms.

I would say skip the option until someone comes with good reason to have it.
(OT: It's funny that Android is listed as a non-Unix like system here.)

@amaxine
Copy link
Contributor Author

amaxine commented Apr 10, 2020

Valid. Was mostly doing this for completeness sake, but realistically unnecessary.

@amaxine amaxine closed this Apr 10, 2020
@amaxine amaxine deleted the vault_setcap branch September 10, 2020 08:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
6.topic: nixos 8.has: module (update) 10.rebuild-darwin: 0 10.rebuild-linux: 1-10 10.rebuild-linux: 1 12. first-time contribution
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@amaxine @grahamc @Mic92 @Janik-Haag