Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1448012

[PATCH v2 00/10] userns: sysctl limits for namespaces

Show all headers | View raw

This patchset addresses two use cases:
- Implement a sane upper bound on the number of namespaces.
- Provide a way for sandboxes to limit the attack surface from
  namespaces.

The maximum sane case I can imagine is if every process is a fat
process, so I set the maximum number of namespaces to the maximum
number of threads.

I make these limits recursive and per user namespace so that a
usernamespace root can reduce the limits further.  If a user namespace
root raises the limit the limit in the parent namespace will be honored.

I have cut this implementation to the bare minimum needed to achieve
these objectives.

Does anyone know if there is a proper error code to return for resource
limit exceeded?  I am currently using -EUSERS or -ENFILE but both of
those feel a little wrong.

Assuming nothing problematic shows up in the review I will add these to
my user namespace tree.

These patches are also available at:
    git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace.git for-testing

Changes since v1:
- Compilation issues with !CONFIG_SYSCTL and !CONFIG_USER_NS have been addressed
- Comment improvements.
- A few names have been changed to be clearer.

Eric W. Biederman (10):
      sysctl: Stop implicitly passing current into sysctl_table_root.lookup
      userns: Add per user namespace sysctls.
      userns: Add a limit on the number of user namespaces
      userns: Generalize the user namespace count into ucount
      pidns: Add a limit on the number of pid namespaces
      utsns: Add a limit on the number of uts namespaces
      ipcns: Add a  limit on the number of ipc namespaces
      cgroupns: Add a limit on the number of cgroup namespaces
      netns: Add a limit on the number of net namespaces
      mntns: Add a limit on the number of mount namespaces.

 fs/namespace.c                 |  19 ++++-
 fs/proc/proc_sysctl.c          |  14 +--
 include/linux/sysctl.h         |   3 +-
 include/linux/user_namespace.h |  40 +++++++++
 ipc/namespace.c                |  42 ++++++---
 kernel/cgroup.c                |  15 ++++
 kernel/fork.c                  |   5 ++
 kernel/pid_namespace.c         |  22 ++++-
 kernel/user_namespace.c        | 188 ++++++++++++++++++++++++++++++++++++++---
 kernel/utsname.c               |  31 +++++--
 net/core/net_namespace.c       |  15 ++++
 net/sysctl_net.c               |   4 +-
 12 files changed, 355 insertions(+), 43 deletions(-)

Eric

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH v2 00/10] userns: sysctl limits for namespaces ebiederm@xmission.com (Eric W. Biederman) - 2016-07-21 19:00 +0200
  [PATCH v2 08/10] cgroupns: Add a limit on the number of cgroup namespaces "Eric W. Biederman" <ebiederm@xmission.com> - 2016-07-21 19:00 +0200
  [PATCH v2 10/10] mntns: Add a limit on the number of mount namespaces. "Eric W. Biederman" <ebiederm@xmission.com> - 2016-07-21 19:00 +0200
  [PATCH v2 07/10] ipcns: Add a  limit on the number of ipc namespaces "Eric W. Biederman" <ebiederm@xmission.com> - 2016-07-21 19:00 +0200
  [PATCH v2 01/10] sysctl: Stop implicitly passing current into sysctl_table_root.lookup "Eric W. Biederman" <ebiederm@xmission.com> - 2016-07-21 19:00 +0200
    [PATCH v2 03/10] userns: Add a limit on the number of user namespaces "Eric W. Biederman" <ebiederm@xmission.com> - 2016-07-21 19:00 +0200
  Re: [PATCH v2 00/10] userns: sysctl limits for namespaces Colin Walters <walters@verbum.org> - 2016-07-22 15:40 +0200
    Re: [PATCH v2 00/10] userns: sysctl limits for namespaces ebiederm@xmission.com (Eric W. Biederman) - 2016-07-22 21:00 +0200
      Re: [PATCH v2 00/10] userns: sysctl limits for namespaces Kees Cook <keescook@chromium.org> - 2016-07-22 23:50 +0200
        Re: [PATCH v2 00/10] userns: sysctl limits for namespaces ebiederm@xmission.com (Eric W. Biederman) - 2016-07-23 04:30 +0200

csiph-web