mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 11:19:37 +00:00
![Eric W. Biederman](/assets/img/avatar_default.png)
In the help text describing user namespaces recommend use of memory control groups. In many cases memory control groups are the only mechanism there is to limit how much memory a user who can create user namespaces can use. Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
14 lines
764 B
Text
14 lines
764 B
Text
There are a lot of kinds of objects in the kernel that don't have
|
|
individual limits or that have limits that are ineffective when a set
|
|
of processes is allowed to switch user ids. With user namespaces
|
|
enabled in a kernel for people who don't trust their users or their
|
|
users programs to play nice this problems becomes more acute.
|
|
|
|
Therefore it is recommended that memory control groups be enabled in
|
|
kernels that enable user namespaces, and it is further recommended
|
|
that userspace configure memory control groups to limit how much
|
|
memory user's they don't trust to play nice can use.
|
|
|
|
Memory control groups can be configured by installing the libcgroup
|
|
package present on most distros editing /etc/cgrules.conf,
|
|
/etc/cgconfig.conf and setting up libpam-cgroup.
|