Nikolay Borisov <kernel@xxxxxxxx> writes: > On 10/11/2016 10:36 AM, Nikolay Borisov wrote: >> This patchset converts inotify to using the newly introduced >> per-userns sysctl infrastructure. >> >> Currently the inotify instances/watches are being accounted in the >> user_struct structure. This means that in setups where multiple >> users in unprivileged containers map to the same underlying >> real user (i.e. pointing to the same user_struct) the inotify limits >> are going to be shared as well, allowing one user(or application) to exhaust >> all others limits. >> >> Fix this by switching the inotify sysctls to using the >> per-namespace/per-user limits. This will allow the server admin to >> set sensible global limits, which can further be tuned inside every >> individual user namespace. Additionally, in order to preserve the >> sysctl ABI make the existing inotify instances/watches sysctls >> modify the values of the initial user namespace. >> >> Signed-off-by: Nikolay Borisov <kernel@xxxxxxxx> >> --- >> >> So here is a revised version which retains the existing sysctls, >> and hooks them to the init_user_ns values. > > Gentle ping, now that rc1 has shipped and Jan's sysctl concern hopefully > resolved. I plan to give this a once over and merge this. I have a very funny pile of serious bug fixes that jumped on my at the beginning of this development cycle and a cold so I am getting to this more slowly than I would like. Eric _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
