summaryrefslogtreecommitdiffstats
path: root/init
diff options
context:
space:
mode:
authorEric W. Biederman <ebiederm@xmission.com>2013-01-25 16:48:31 -0800
committerEric W. Biederman <ebiederm@xmission.com>2013-01-26 22:20:06 -0800
commite11f0ae388f227d7ad03953e19034dec55286650 (patch)
tree10caa137fd9c8db3473f297ab43a8ae591235043 /init
parent0bd14b4fd72afd5df41e9fd59f356740f22fceba (diff)
downloadop-kernel-dev-e11f0ae388f227d7ad03953e19034dec55286650.zip
op-kernel-dev-e11f0ae388f227d7ad03953e19034dec55286650.tar.gz
userns: Recommend use of memory control groups.
In the help text describing user namespaces recommend use of memory control groups. In many cases memory control groups are the only mechanism there is to limit how much memory a user who can create user namespaces can use. Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Diffstat (limited to 'init')
-rw-r--r--init/Kconfig7
1 files changed, 7 insertions, 0 deletions
diff --git a/init/Kconfig b/init/Kconfig
index 7d30240..c8c58bd 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1035,6 +1035,13 @@ config USER_NS
help
This allows containers, i.e. vservers, to use user namespaces
to provide different user info for different servers.
+
+ When user namespaces are enabled in the kernel it is
+ recommended that the MEMCG and MEMCG_KMEM options also be
+ enabled and that user-space use the memory control groups to
+ limit the amount of memory a memory unprivileged users can
+ use.
+
If unsure, say N.
config PID_NS
OpenPOWER on IntegriCloud