On Fri, Apr 18, 2025 at 3:38 PM Randy Dunlap <rdunlap@xxxxxxxxxxxxx> wrote: > > > > On 4/18/25 8:29 AM, Joel Savitz wrote: > > Fix the document title and reword the phrasing to active voice. > > > > Signed-off-by: Joel Savitz <jsavitz@xxxxxxxxxx> > > --- > > .../namespaces/resource-control.rst | 24 +++++++++---------- > > 1 file changed, 12 insertions(+), 12 deletions(-) > > > > diff --git a/Documentation/admin-guide/namespaces/resource-control.rst b/Documentation/admin-guide/namespaces/resource-control.rst > > index 369556e00f0c..624f4dceea46 100644 > > --- a/Documentation/admin-guide/namespaces/resource-control.rst > > +++ b/Documentation/admin-guide/namespaces/resource-control.rst > > @@ -1,17 +1,17 @@ > > -=========================== > > -Namespaces research control > > -=========================== > > +==================================== > > +User namespaces and resoruce control > > resource Oh, oops! > > > > +==================================== > > > > -There are a lot of kinds of objects in the kernel that don't have > > -individual limits or that have limits that are ineffective when a set > > -of processes is allowed to switch user ids. With user namespaces > > -enabled in a kernel for people who don't trust their users or their > > -users programs to play nice this problems becomes more acute. > > +The kernel contains many kinds of objects that either don't have > > +individual limits or that have limits which are ineffective when > > +a set of processes is allowed to switch their UID. On a system > > +where there admins don't trust their users or their users' programs, > > +user namespaces expose the system to potential misuse of resources. > > > > -Therefore it is recommended that memory control groups be enabled in > > -kernels that enable user namespaces, and it is further recommended > > -that userspace configure memory control groups to limit how much > > -memory user's they don't trust to play nice can use. > > +In order to mitigate this, we recommend that admins enable memory > > +control groups on any system that enables user namespaces. > > +Furthermore, we recommend that admins configure the memory control > > +groups to limit the maximum memory usable by any untrusted user. > > > > Memory control groups can be configured by installing the libcgroup > > package present on most distros editing /etc/cgrules.conf, > > -- > ~Randy >
