summaryrefslogtreecommitdiffstats
path: root/kernel
diff options
context:
space:
mode:
authorNikolay Borisov <n.borisov.lkml@gmail.com>2016-12-14 15:56:33 +0200
committerEric W. Biederman <ebiederm@xmission.com>2017-01-24 12:03:07 +1300
commit1cce1eea0aff51201753fcaca421df825b0813b6 (patch)
tree9717a36b5968a179942e2b2f62d21c3c05cc39c6 /kernel
parent880a38547ff08715ce4f1daf9a4bb30c87676e68 (diff)
downloadop-kernel-dev-1cce1eea0aff51201753fcaca421df825b0813b6.zip
op-kernel-dev-1cce1eea0aff51201753fcaca421df825b0813b6.tar.gz
inotify: Convert to using per-namespace limits
This patchset converts inotify to using the newly introduced per-userns sysctl infrastructure. Currently the inotify instances/watches are being accounted in the user_struct structure. This means that in setups where multiple users in unprivileged containers map to the same underlying real user (i.e. pointing to the same user_struct) the inotify limits are going to be shared as well, allowing one user(or application) to exhaust all others limits. Fix this by switching the inotify sysctls to using the per-namespace/per-user limits. This will allow the server admin to set sensible global limits, which can further be tuned inside every individual user namespace. Additionally, in order to preserve the sysctl ABI make the existing inotify instances/watches sysctls modify the values of the initial user namespace. Signed-off-by: Nikolay Borisov <n.borisov.lkml@gmail.com> Acked-by: Jan Kara <jack@suse.cz> Acked-by: Serge Hallyn <serge@hallyn.com> Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Diffstat (limited to 'kernel')
-rw-r--r--kernel/ucount.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/kernel/ucount.c b/kernel/ucount.c
index 4bbd38e..6871640 100644
--- a/kernel/ucount.c
+++ b/kernel/ucount.c
@@ -57,7 +57,7 @@ static struct ctl_table_root set_root = {
static int zero = 0;
static int int_max = INT_MAX;
-#define UCOUNT_ENTRY(name) \
+#define UCOUNT_ENTRY(name) \
{ \
.procname = name, \
.maxlen = sizeof(int), \
@@ -74,6 +74,10 @@ static struct ctl_table user_table[] = {
UCOUNT_ENTRY("max_net_namespaces"),
UCOUNT_ENTRY("max_mnt_namespaces"),
UCOUNT_ENTRY("max_cgroup_namespaces"),
+#ifdef CONFIG_INOTIFY_USER
+ UCOUNT_ENTRY("max_inotify_instances"),
+ UCOUNT_ENTRY("max_inotify_watches"),
+#endif
{ }
};
#endif /* CONFIG_SYSCTL */
OpenPOWER on IntegriCloud