Forked processes for Documents and Media preview generation should be configurable

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.0.X, 7.1.X, 7.2.X, Master
• Fix Version/s: 7.0.0 DXP FP94, 7.0.10.15 DXP SP15, 7.0.X, 7.1.10 DXP FP19, 7.1.10.5 SP5, 7.1.X, 7.2.10 DXP FP8, 7.2.10.3 DXP SP3, 7.2.X, 7.3.4 CE GA5, 7.3.5 CE GA6, 7.3.10 DXP GA1, Master
• Component/s: Documents & Media
• Labels:
  • ee-ts
  • liferay-dxp-70-sp15
  • liferay-dxp-71-sp5
  • liferay-dxp-72-sp3
  • liferay-fixpack-de-94-7010
  • liferay-fixpack-dxp-19-7110
  • liferay-fixpack-dxp-8-7210
• Branch Version/s:
  7.2.x, 7.1.x, 7.0.x
• Backported to Branch:
  Committed
• Git Pull Request: https://github.com/shuyangzhou/liferay-portal/pull/9298
• QA Test Name:
  • automated

Issue
Liferay, by default, generates forked processes for Documents and Media preview generation according to the following property:

    #
    # Set this to true if you want preview generation to use a separate Java
    # process. This will utilize extra resources from the operating system while
    # improving the portal's stability.
    #
    # Env: LIFERAY_DL_PERIOD_FILE_PERIOD_ENTRY_PERIOD_PREVIEW_PERIOD_FORK_PERIOD_PROCESS_PERIOD_ENABLED
    #
    dl.file.entry.preview.fork.process.enabled=true

The problem is that there is currently no way to configure these forked processes further rising to the potential of memory leaks or issues that could cause the OOM Killer to kill the application server process that is running Liferay.

We only have ways to adjust the timeout, and to enable or disable forked processes, but no ways to adjust for resource allocation for these forked processes.

Note: There are potential security ramifications of this issue. A malicious actor could potentially upload a well-designed PDF to force an OOM on the Liferay process side (especially true in a DXPC instance where the server is running in a kubernetes setup.)

Steps to Reproduce

1. Inspect portal.properties to check for any configurations that permit configuration of forked process resource allocation

Actual Result
We don't have the ability to limit or increase forked process resource allocation.

Expected Behavior
We need to have a way to limit or increase forked process resource allocation.

Reproduced in
7.1.X Commit: f0dafe25c37a657b2abd3b905ee5f79ab5cb2712
Master Commit: 438ede3ce637a64c6011615666f9b0d566573926