URL:
https://github.com/SSSD/sssd/pull/225
Title: #225: SECRETS: Apply separate quotas for cn=secrets and cn=kcm
jhrozek commented:
"""
On Mon, May 29, 2017 at 08:58:15AM -0700, Simo Sorce wrote:
Interesting, why maximum number of secrets instead of maximum size ?
We already have a maximum payload size of a secret:
```
max_payload_size (integer)
This option specifies the maximum payload size allowed
for a secret payload in kilobytes.
```
The intent here is to prevent a user, especially now with KCM to keep
adding ccaches in a loop and starve out the storage.
If we had a per-user max payload size, we'd have to either keep a
running total of the secret lengths or compute it during each write
operation.
Or maybe I just don't see some other solution, do you have
something else in mind?
btw we need to increase the default secret size quite a bit, because KCM
stores each ccache as a secret, so each secret contains multiple creds,
so just adding creds (by calling kvno in a loop) can explode the secret
size...in kernel keyring each cred is of type big_key which holds up to
1MB, but that's /per cred/ and in the secrets storage schema we can
store arbitrary number of creds..so I think the default should be raised
to megabytes in general and we need to make sure that the error messages
are easy to follow in case someone needed to increase the secret payload
size..
"""
See the full comment at
https://github.com/SSSD/sssd/pull/225#issuecomment-304704546