summaryrefslogtreecommitdiff
path: root/Documentation
diff options
context:
space:
mode:
authorEric W. Biederman <ebiederm@xmission.com>2013-01-26 04:48:31 +0400
committerEric W. Biederman <ebiederm@xmission.com>2013-01-27 10:20:06 +0400
commite11f0ae388f227d7ad03953e19034dec55286650 (patch)
tree10caa137fd9c8db3473f297ab43a8ae591235043 /Documentation
parent0bd14b4fd72afd5df41e9fd59f356740f22fceba (diff)
downloadlinux-e11f0ae388f227d7ad03953e19034dec55286650.tar.xz
userns: Recommend use of memory control groups.
In the help text describing user namespaces recommend use of memory control groups. In many cases memory control groups are the only mechanism there is to limit how much memory a user who can create user namespaces can use. Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Diffstat (limited to 'Documentation')
-rw-r--r--Documentation/namespaces/resource-control.txt14
1 files changed, 14 insertions, 0 deletions
diff --git a/Documentation/namespaces/resource-control.txt b/Documentation/namespaces/resource-control.txt
new file mode 100644
index 000000000000..abc13c394738
--- /dev/null
+++ b/Documentation/namespaces/resource-control.txt
@@ -0,0 +1,14 @@
+There are a lot of kinds of objects in the kernel that don't have
+individual limits or that have limits that are ineffective when a set
+of processes is allowed to switch user ids. With user namespaces
+enabled in a kernel for people who don't trust their users or their
+users programs to play nice this problems becomes more acute.
+
+Therefore it is recommended that memory control groups be enabled in
+kernels that enable user namespaces, and it is further recommended
+that userspace configure memory control groups to limit how much
+memory user's they don't trust to play nice can use.
+
+Memory control groups can be configured by installing the libcgroup
+package present on most distros editing /etc/cgrules.conf,
+/etc/cgconfig.conf and setting up libpam-cgroup.