On 4/18/25 8:29 AM, Joel Savitz wrote:
> Fix the document title and reword the phrasing to active voice.
>
> Signed-off-by: Joel Savitz <jsavitz@xxxxxxxxxx>
> ---
> .../namespaces/resource-control.rst | 24 +++++++++----------
> 1 file changed, 12 insertions(+), 12 deletions(-)
>
> diff --git a/Documentation/admin-guide/namespaces/resource-control.rst b/Documentation/admin-guide/namespaces/resource-control.rst
> index 369556e00f0c..624f4dceea46 100644
> --- a/Documentation/admin-guide/namespaces/resource-control.rst
> +++ b/Documentation/admin-guide/namespaces/resource-control.rst
> @@ -1,17 +1,17 @@
> -===========================
> -Namespaces research control
> -===========================
> +====================================
> +User namespaces and resoruce control
resource
> +====================================
>
> -There are a lot of kinds of objects in the kernel that don't have
> -individual limits or that have limits that are ineffective when a set
> -of processes is allowed to switch user ids. With user namespaces
> -enabled in a kernel for people who don't trust their users or their
> -users programs to play nice this problems becomes more acute.
> +The kernel contains many kinds of objects that either don't have
> +individual limits or that have limits which are ineffective when
> +a set of processes is allowed to switch their UID. On a system
> +where there admins don't trust their users or their users' programs,
> +user namespaces expose the system to potential misuse of resources.
>
> -Therefore it is recommended that memory control groups be enabled in
> -kernels that enable user namespaces, and it is further recommended
> -that userspace configure memory control groups to limit how much
> -memory user's they don't trust to play nice can use.
> +In order to mitigate this, we recommend that admins enable memory
> +control groups on any system that enables user namespaces.
> +Furthermore, we recommend that admins configure the memory control
> +groups to limit the maximum memory usable by any untrusted user.
>
> Memory control groups can be configured by installing the libcgroup
> package present on most distros editing /etc/cgrules.conf,
--
~Randy
