From 2b75b132a19c8d783b8c6faccd855c5dda3d9bef Mon Sep 17 00:00:00 2001 From: Morgan Jones Date: Fri, 11 Apr 2025 01:06:05 -0700 Subject: [PATCH] openssh: enable --with-linux-memlock-onfault This new configure option attempts to call the following as part of sshd startup, simply warning if it fails: `mlockall(MCL_CURRENT | MCL_FUTURE | MCL_ONFAULT)` From https://man7.org/linux/man-pages/man2/mlock.2.html: > Since Linux 2.6.9, no limits are placed on the amount of memory > that a privileged process can lock and the RLIMIT_MEMLOCK soft > resource limit instead defines a limit on how much memory an > unprivileged process may lock. Since sshd is run as root, locking all current and future pages also will not run into hypothetical OOM issues. --- pkgs/tools/networking/openssh/common.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix index e25993483f9d..015667740232 100644 --- a/pkgs/tools/networking/openssh/common.nix +++ b/pkgs/tools/networking/openssh/common.nix @@ -36,6 +36,8 @@ withSecurityKey ? !stdenv.hostPlatform.isStatic, withFIDO ? stdenv.hostPlatform.isUnix && !stdenv.hostPlatform.isMusl && withSecurityKey, withPAM ? stdenv.hostPlatform.isLinux, + # Attempts to mlock the entire sshd process on startup to prevent swapping. + withLinuxMemlock ? stdenv.hostPlatform.isLinux, dsaKeysSupport ? false, linkOpenssl ? true, isNixos ? stdenv.hostPlatform.isLinux, @@ -119,6 +121,7 @@ stdenv.mkDerivation (finalAttrs: { ++ lib.optional (!linkOpenssl) "--without-openssl" ++ lib.optional withLdns "--with-ldns" ++ lib.optional stdenv.hostPlatform.isOpenBSD "--with-bsd-auth" + ++ lib.optional withLinuxMemlock "--with-linux-memlock-onfault" ++ extraConfigureFlags; ${if stdenv.hostPlatform.isStatic then "NIX_LDFLAGS" else null} =