NAME

       memlockd - daemon to lock files in memory with mlock

SYNOPSIS

       memlockd [ -c config-file ] [ -d ] [ -f ] [ -u user ]

DESCRIPTION

       This manual page documents briefly the memlockd command.

       It is used to lock system programs and config files in memory so that if a DOS attack is experienced then
       the chance of the sys-admin regaining control of the system in a reasonable amount of time (and therefore
       having a reasonable chance of discovering the cause of the problem) is significantly increased.

OPTIONS

       The  -c  option is used to specify the fully-qualified path name to a config file that lists the names of
       files to lock, if the config file is not specified then it will  default  to  /etc/memlockd.cfg.  In  any
       situation  where a config file is used a directory can be used instead, for a directory every file ending
       in ".cfg" will be processed.

       The -d option specifies debugging mode, the program will not fork and will produce it's logging  messages
       on stderr instead of via syslog.

       The  -f  option  specifies  foreground  (non-daemon)  mode,  the program will not fork but will still log
       normally.

       The -u option specifies the name of a user to use for running ldd (for recursive operation).   Note  that
       locking  shared  objects that are writable by non-root is not safe, but using a different UID will reduce
       the risk.

       The config file will contain a number of fully qualified names of files to lock  in  RAM.   When  locking
       shared  objects  and  ELF  binaries it is possible to prefix the file name with a + character to indicate
       that memlockd should recursively lock all shared objects that the program requires and all shared objects
       that  those objects require. When a file not found error doesn't matter (EG you want a single config file
       to have the file names for multiple architectures or systems) you can prefix  the  file  name  with  a  ?
       character, in that case errors such as EPERM will still be logged.

       If  a  line in the config file starts with a % character it will be taken as the name of a config file or
       directory to process.  Currently only one level of recursion is accepted.

       SEE ALSO
              mlock(2), mmap(1).

AUTHOR

       memlockd was written by Russell Coker <russell@coker.com.au>

                                                                                                     memlockd(8)