Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1450523

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

Show all headers | View raw

Hello Eric,

On 07/21/2016 06:39 PM, Eric W. Biederman wrote:
>
> This patchset addresses two use cases:
> - Implement a sane upper bound on the number of namespaces.
> - Provide a way for sandboxes to limit the attack surface from
>   namespaces.
>
> The maximum sane case I can imagine is if every process is a fat
> process, so I set the maximum number of namespaces to the maximum
> number of threads.
>
> I make these limits recursive and per user namespace so that a
> usernamespace root can reduce the limits further.  If a user namespace
> root raises the limit the limit in the parent namespace will be honored.
>
> I have cut this implementation to the bare minimum needed to achieve
> these objectives.
>
> Does anyone know if there is a proper error code to return for resource
> limit exceeded?  I am currently using -EUSERS or -ENFILE but both of
> those feel a little wrong.

ENFILE certainly seems weird. I suppose my first question is: why two
different errors?

Some alternatives you might want to consider: E2BIG, EOVERFLOW,
or (maybe) ERANGE.

Cheers,

Michael

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-07-26 12:30 +0200
  Re: [PATCH v2 00/10] userns: sysctl limits for namespaces ebiederm@xmission.com (Eric W. Biederman) - 2016-07-26 17:30 +0200

csiph-web