From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Van Hensbergen Subject: Re: [RFC] User CLONE_NEWNS permission and rlimits Date: Wed, 20 Apr 2005 07:47:55 -0500 Message-ID: References: <1113961818.4920.90.camel@localhost> Reply-To: Eric Van Hensbergen Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7BIT Cc: linux-fsdevel@vger.kernel.org, Al Viro Return-path: Received: from wproxy.gmail.com ([64.233.184.198]:21665 "EHLO wproxy.gmail.com") by vger.kernel.org with ESMTP id S261600AbVDTMr4 convert rfc822-to-8bit (ORCPT ); Wed, 20 Apr 2005 08:47:56 -0400 Received: by wproxy.gmail.com with SMTP id 68so136858wri for ; Wed, 20 Apr 2005 05:47:56 -0700 (PDT) To: Ram In-Reply-To: <1113961818.4920.90.camel@localhost> Content-Disposition: inline Sender: linux-fsdevel-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org On 4/19/05, Ram wrote: > On Tue, 2005-04-19 at 18:24, Eric Van Hensbergen wrote: > > > > Is this sufficient to cover any exposure? What's the correct solution > > for the shared sub-trees RFC? Should there be something similar for > > user mounts/binds? > > A new namespace in a shared subtree realm can create number-of- > private-namespaces number of mounts or binds depending on the number of > binds and mounts in the shared tree. > > for example if there were 10 shared vfsmounts in the original > namespace, a new private namespace will duplicate 10 of these, and > any mount or bind attempted in any of these vfsmounts will double the > number of mounts and binds. > > Hence probably you may want to keep a tab on the number mounts and > binds a user does, instead of keeping a tab on the number of namespaces > a user creates. > Yeah, that does make a lot more sense, I suppose in the worst case a user is guaranteed to not have more namespaces than processes anyways. So, should the count of mounts be inclusive of mounts the user inherits, or only the ones he creates? I suppose as a resource limit, it should probably cover both. -eric