| ==================================== | |
| User namespaces and resource control | |
| ==================================== | |
| The kernel contains many kinds of objects that either don't have | |
| individual limits or that have limits which are ineffective when | |
| a set of processes is allowed to switch their UID. On a system | |
| where the admins don't trust their users or their users' programs, | |
| user namespaces expose the system to potential misuse of resources. | |
| In order to mitigate this, we recommend that admins enable memory | |
| control groups on any system that enables user namespaces. | |
| Furthermore, we recommend that admins configure the memory control | |
| groups to limit the maximum memory usable by any untrusted user. | |
| Memory control groups can be configured by installing the libcgroup | |
| package present on most distros editing /etc/cgrules.conf, | |
| /etc/cgconfig.conf and setting up libpam-cgroup. |