On 01/28/2013 08:19 PM, Eric W. Biederman wrote: > Lord Glauber Costa of Sealand <glommer@xxxxxxxxxxxxx> writes: > >> On 01/28/2013 12:14 PM, Eric W. Biederman wrote: >>> Lord Glauber Costa of Sealand <glommer@xxxxxxxxxxxxx> writes: >>> >>>> I just saw in a later patch of yours that your concern here seems not >>>> limited to backed ram by tmpfs, but with things like the internal >>>> structures for userns , to avoid patterns in the form: 'for (;;) >>>> unshare(...)' >>>> >>>> Humm, it does seem sensible. The kernel memory controller aims to >>>> prevent exactly things like that. But they all exist already before >>>> userns: there are destructive patterns like that with sockets, dentries, >>>> processes, and pretty much every other resource in the kernel. So >>>> Although the recommendation per-se makes sense, I am wondering if it is >>>> worth it to mention anything in the user_ns config? >>> >>> The config might be overkill. However I have already gotten bug reports >>> about there being no limits. >>> >>> So someone needs to stop and connect the dots and say: >> Absolutely, and I am all for it >> >>> "If you care this is what you can do." >> >> How about we say it, then? >> >> The current text in quite cryptic in this aspect, in the sense that it >> doesn't give enough information for standard people about what are the >> problems involved. >> >> Of course, maybe the Kconfig text is not the best place for having all >> the info: but don't we have some place in Documentation/ where we could >> put this, and then refer people there from Kconfig ? > > At this point I have written the best text I can. > > Please feel free to look at my tree at: > git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace.git for-next > Will do soon, thanks for your effort. > and send me an patch on top of that to improve the wording. > > At this point I have done my best to connect the dots for people who > care, that the memory control group is what they need to limit what > people can do with user namespaces. > > My hope is that there is at least a passing mention in the next user > namespace article on lwn. It would definitely be helpful. Let's hope someone from there is reading! =) > > For two pieces of software that were designed to complement each other > I find it a bit surprising how many people (including myself) need the > connection made that memory control groups and user namespaces should go > together. Well, I've manifested many times in here that I am less than satisfied about the fact that the connection between namespaces and cgroups are so loose. There are many situations, like virtualizing the proc files and friends where I believe we could benefit from having the information about whether or not cgroups and namespaces are used at the same time. But since after considering a lot of alternatives, I could never come up with one that were really clean, I guess just communicating it extensively is the best we can do so far. _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
