| Mauro Carvalho Chehab | 20a78ae | 2019-04-18 12:43:16 -0300 | [diff] [blame] | 1 | =========================== |
| 2 | Namespaces research control |
| 3 | =========================== |
| 4 | |
| Eric W. Biederman | e11f0ae | 2013-01-25 16:48:31 -0800 | [diff] [blame] | 5 | There are a lot of kinds of objects in the kernel that don't have |
| 6 | individual limits or that have limits that are ineffective when a set |
| 7 | of processes is allowed to switch user ids. With user namespaces |
| 8 | enabled in a kernel for people who don't trust their users or their |
| 9 | users programs to play nice this problems becomes more acute. |
| 10 | |
| 11 | Therefore it is recommended that memory control groups be enabled in |
| 12 | kernels that enable user namespaces, and it is further recommended |
| 13 | that userspace configure memory control groups to limit how much |
| 14 | memory user's they don't trust to play nice can use. |
| 15 | |
| 16 | Memory control groups can be configured by installing the libcgroup |
| 17 | package present on most distros editing /etc/cgrules.conf, |
| 18 | /etc/cgconfig.conf and setting up libpam-cgroup. |
