tree d713cfca44e780cd30cc0929ae16acc67acf572d
parent 82ec6630f9fcd129ebd839a6c862d0dbffe9eafc
author Vasily Averin <vvs@virtuozzo.com> 1601024162 +0300
committer Pablo Neira Ayuso <pablo@netfilter.org> 1601838505 +0200

netfilter: ipset: enable memory accounting for ipset allocations

Currently netadmin inside non-trusted container can quickly allocate
whole node's memory via request of huge ipset hashtable.
Other ipset-related memory allocations should be restricted too.

v2: fixed typo ALLOC -> ACCOUNT

Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>