| 1 | ====================================
|
| 2 | User namespaces and resource control
|
| 3 | ====================================
|
| 4 |
|
| 5 | The kernel contains many kinds of objects that either don't have
|
| 6 | individual limits or that have limits which are ineffective when
|
| 7 | a set of processes is allowed to switch their UID. On a system
|
| 8 | where the admins don't trust their users or their users' programs,
|
| 9 | user namespaces expose the system to potential misuse of resources.
|
| 10 |
|
| 11 | In order to mitigate this, we recommend that admins enable memory
|
| 12 | control groups on any system that enables user namespaces.
|
| 13 | Furthermore, we recommend that admins configure the memory control
|
| 14 | groups to limit the maximum memory usable by any untrusted user.
|
| 15 |
|
| 16 | Memory control groups can be configured by installing the libcgroup
|
| 17 | package present on most distros editing /etc/cgrules.conf,
|
| 18 | /etc/cgconfig.conf and setting up libpam-cgroup.
|