Re: [PATCH v2 02/10] userns: Add per user namespace sysctls.

From	ebiederm@xmission.com (Eric W. Biederman)
Newsgroups	linux.kernel
Subject	Re: [PATCH v2 02/10] userns: Add per user namespace sysctls.
Date	2016-07-26 06:20 +0200
Message-ID	<rZ20x-5Hp-1@gated-at.bofh.it> (permalink)
References	<rYYgi-3je-15@gated-at.bofh.it> <rYYpY-3ml-3@gated-at.bofh.it> <rYYT0-3wo-5@gated-at.bofh.it> <rZ0L7-4KQ-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

David Miller <davem@davemloft.net> writes:

> From: ebiederm@xmission.com (Eric W. Biederman)
> Date: Mon, 25 Jul 2016 19:44:50 -0500
>
>> User namespaces have enabled unprivileged users access to a lot more
>> data structures and so to catch programs that go crazy we need a lot
>> more limits.  I believe some of those limits make sense per namespace.
>> As it is easy in some cases to say any more than Y number of those
>> per namespace is excessive.   For example a limit of 1,000,000 ipv4
>> routes per network namespaces is a sanity check as there are
>> currently 621,649 ipv4 prefixes advertized in bgp.
>
> When we give a new namespace to unprivileged users, we honestly should
> make the sysctl settings we give to them become "limits".  They can
> further constrain the sysctl settings but may not raise them.

I won't disagree.  I was thinking in terms of global setting that
hold the limits for per namespace counters.  As we are talking sanity
check limits.

Perhaps we could get sophisticated and do something more but the simpler
we can make things and get the job done the better.

Eric

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH v2 02/10] userns: Add per user namespace sysctls. "Eric W. Biederman" <ebiederm@xmission.com> - 2016-07-21 19:00 +0200
  Re: [PATCH v2 02/10] userns: Add per user namespace sysctls. ebiederm@xmission.com (Eric W. Biederman) - 2016-07-26 02:20 +0200
    Re: [PATCH v2 02/10] userns: Add per user namespace sysctls. David Miller <davem@davemloft.net> - 2016-07-26 02:30 +0200
      Re: [PATCH v2 02/10] userns: Add per user namespace sysctls. ebiederm@xmission.com (Eric W. Biederman) - 2016-07-26 03:00 +0200
        Re: [PATCH v2 02/10] userns: Add per user namespace sysctls. David Miller <davem@davemloft.net> - 2016-07-26 05:00 +0200
          Re: [PATCH v2 02/10] userns: Add per user namespace sysctls. ebiederm@xmission.com (Eric W. Biederman) - 2016-07-26 06:20 +0200

csiph-web