From: Christian Brauner <christian.brauner@ubuntu.com>
To: Alexey Gladkov <gladkov.alexey@gmail.com>
Cc: LKML <linux-kernel@vger.kernel.org>,
Linux Containers <containers@lists.linux-foundation.org>,
Kernel Hardening <kernel-hardening@lists.openwall.com>,
Alexey Gladkov <legion@kernel.org>,
"Eric W . Biederman" <ebiederm@xmission.com>,
Kees Cook <keescook@chromium.org>,
Christian Brauner <christian@brauner.io>
Subject: Re: [RFC PATCH v1 0/4] Per user namespace rlimits
Date: Mon, 2 Nov 2020 18:55:26 +0100 [thread overview]
Message-ID: <20201102175526.eu4npm4v2ggicvaf@wittgenstein> (raw)
In-Reply-To: <cover.1604335819.git.gladkov.alexey@gmail.com>
On Mon, Nov 02, 2020 at 05:50:29PM +0100, Alexey Gladkov wrote:
> Preface
> -------
> These patches are for binding the rlimits to a user in the user namespace.
> This patch set can be applied on top of:
>
> git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v5.8-2-g43e210d68200
>
> Problem
> -------
> Some rlimits are set per user: RLIMIT_NPROC, RLIMIT_MEMLOCK, RLIMIT_SIGPENDING,
> RLIMIT_MSGQUEUE. When several containers are created from one user then
> the processes inside the containers influence each other.
>
> Eric W. Biederman mentioned this issue [1][2][3].
>
> Introduced changes
> ------------------
> To fix this problem, you can bind the counter of the specified rlimits to the
> user within the user namespace. By default, to preserve backward compatibility,
> only the initial user namespace is used. This patch adds one more prctl
> parameter to change the binding to the user namespace.
>
> This will not cause the user to take more resources than allowed in the parent
> user namespace because it only virtualizes the rlimit counter. Limits in all
> parent user namespaces are taken into account.
>
> For example, this allows us to run multiple containers by the same user and
> set the RLIMIT_NPROC to 1 inside.
Thanks for picking this up and working on it. This would definitely fix
many issues for folks running unprivileged containers using a single id
map which is the default behavior for LXC/LXD and so very valuable to
us.
Christian
>
> ToDo
> ----
> * RLIMIT_MEMLOCK, RLIMIT_SIGPENDING and RLIMIT_MSGQUEUE are not implemented.
> * No documentation.
> * No tests.
>
> [1] https://lore.kernel.org/containers/87imd2incs.fsf@x220.int.ebiederm.org/
> [2] https://lists.linuxfoundation.org/pipermail/containers/2020-August/042096.html
> [3] https://lists.linuxfoundation.org/pipermail/containers/2020-October/042524.html
>
> Changelog
> ---------
> v1:
> * After discussion with Eric W. Biederman, I increased the size of ucounts to
> atomic_long_t.
> * Added ucount_max to avoid the fork bomb.
>
> --
>
> Alexey Gladkov (4):
> Increase size of ucounts to atomic_long_t
> Move the user's process counter to ucounts
> Do not allow fork if RLIMIT_NPROC is exceeded in the user namespace
> tree
> Allow to change the user namespace in which user rlimits are counted
>
> fs/exec.c | 13 ++++++---
> fs/io-wq.c | 25 +++++++++++++-----
> fs/io-wq.h | 1 +
> fs/io_uring.c | 1 +
> include/linux/cred.h | 8 ++++++
> include/linux/sched.h | 3 +++
> include/linux/sched/user.h | 1 -
> include/linux/user_namespace.h | 12 +++++++--
> include/uapi/linux/prctl.h | 5 ++++
> kernel/cred.c | 44 ++++++++++++++++++++++++-------
> kernel/exit.c | 2 +-
> kernel/fork.c | 13 ++++++---
> kernel/sys.c | 26 ++++++++++++++++--
> kernel/ucount.c | 48 +++++++++++++++++++++++++++++-----
> kernel/user.c | 3 ++-
> kernel/user_namespace.c | 3 +++
> 16 files changed, 171 insertions(+), 37 deletions(-)
>
> --
> 2.25.4
>
prev parent reply other threads:[~2020-11-02 17:55 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-02 16:50 [RFC PATCH v1 0/4] Per user namespace rlimits Alexey Gladkov
2020-11-02 16:50 ` [RFC PATCH v1 1/4] Increase size of ucounts to atomic_long_t Alexey Gladkov
2020-11-02 18:03 ` Christian Brauner
2020-11-02 21:23 ` Alexey Gladkov
2020-11-02 16:50 ` [RFC PATCH v1 2/4] Move the user's process counter to ucounts Alexey Gladkov
2020-11-02 16:50 ` [RFC PATCH v1 3/4] Do not allow fork if RLIMIT_NPROC is exceeded in the user namespace tree Alexey Gladkov
2020-11-02 16:50 ` [RFC PATCH v1 4/4] Allow to change the user namespace in which user rlimits are counted Alexey Gladkov
2020-11-02 17:10 ` Jann Horn
2020-11-02 17:30 ` Alexey Gladkov
2020-11-04 10:03 ` Sargun Dhillon
2020-11-04 16:21 ` Alexey Gladkov
2020-11-02 17:55 ` Christian Brauner [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201102175526.eu4npm4v2ggicvaf@wittgenstein \
--to=christian.brauner@ubuntu.com \
--cc=christian@brauner.io \
--cc=containers@lists.linux-foundation.org \
--cc=ebiederm@xmission.com \
--cc=gladkov.alexey@gmail.com \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=legion@kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).