From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ram Subject: Re: [RFC] User CLONE_NEWNS permission and rlimits Date: Tue, 19 Apr 2005 18:50:18 -0700 Message-ID: <1113961818.4920.90.camel@localhost> References: Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Cc: linux-fsdevel@vger.kernel.org, Al Viro Return-path: Received: from e35.co.us.ibm.com ([32.97.110.133]:50343 "EHLO e35.co.us.ibm.com") by vger.kernel.org with ESMTP id S261179AbVDTBup (ORCPT ); Tue, 19 Apr 2005 21:50:45 -0400 Received: from westrelay02.boulder.ibm.com (westrelay02.boulder.ibm.com [9.17.195.11]) by e35.co.us.ibm.com (8.12.10/8.12.9) with ESMTP id j3K1oeLg500948 for ; Tue, 19 Apr 2005 21:50:41 -0400 Received: from d03av02.boulder.ibm.com (d03av02.boulder.ibm.com [9.17.195.168]) by westrelay02.boulder.ibm.com (8.12.10/NCO/VER6.6) with ESMTP id j3K1oewv310774 for ; Tue, 19 Apr 2005 19:50:40 -0600 Received: from d03av02.boulder.ibm.com (loopback [127.0.0.1]) by d03av02.boulder.ibm.com (8.12.11/8.12.11) with ESMTP id j3K1od8K002502 for ; Tue, 19 Apr 2005 19:50:40 -0600 To: Eric Van Hensbergen In-Reply-To: Sender: linux-fsdevel-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org On Tue, 2005-04-19 at 18:24, Eric Van Hensbergen wrote: > This is again related to the FUSE permission thread, but a slightly > different idea and without a slimy hack patch. > > I really want to enable users to be able to create private namespaces, > but I want to try and avoid creating a venerability by allowing them > to abuse system resources. It looks like this can be done by adding > RLIMIT_NEWNS as a per-user resource limit, and tracking the number of > private namespaces a user has in the user_struct. Any time a user > creates a private namespace (either via clone with CLONE_NEWNS) or any > other method, this limit is checked and the per user count is > incremented (in copy_namespace). When namespaces are cleaned up (in > __put_namespace), the per-user count is decremented. > > Is this sufficient to cover any exposure? What's the correct solution > for the shared sub-trees RFC? Should there be something similar for > user mounts/binds? A new namespace in a shared subtree realm can create number-of- private-namespaces number of mounts or binds depending on the number of binds and mounts in the shared tree. for example if there were 10 shared vfsmounts in the original namespace, a new private namespace will duplicate 10 of these, and any mount or bind attempted in any of these vfsmounts will double the number of mounts and binds. Hence probably you may want to keep a tab on the number mounts and binds a user does, instead of keeping a tab on the number of namespaces a user creates. RP > > -eric > - > To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html