From: Alexey Gladkov <gladkov.alexey@gmail.com>
To: LKML <linux-kernel@vger.kernel.org>,
Linux Containers <containers@lists.linux-foundation.org>,
Kernel Hardening <kernel-hardening@lists.openwall.com>
Cc: Alexey Gladkov <legion@kernel.org>,
"Eric W . Biederman" <ebiederm@xmission.com>,
Kees Cook <keescook@chromium.org>,
Christian Brauner <christian@brauner.io>
Subject: [RFC PATCH v1 0/4] Per user namespace rlimits
Date: Mon, 2 Nov 2020 17:50:29 +0100 [thread overview]
Message-ID: <cover.1604335819.git.gladkov.alexey@gmail.com> (raw)
Preface
-------
These patches are for binding the rlimits to a user in the user namespace.
This patch set can be applied on top of:
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v5.8-2-g43e210d68200
Problem
-------
Some rlimits are set per user: RLIMIT_NPROC, RLIMIT_MEMLOCK, RLIMIT_SIGPENDING,
RLIMIT_MSGQUEUE. When several containers are created from one user then
the processes inside the containers influence each other.
Eric W. Biederman mentioned this issue [1][2][3].
Introduced changes
------------------
To fix this problem, you can bind the counter of the specified rlimits to the
user within the user namespace. By default, to preserve backward compatibility,
only the initial user namespace is used. This patch adds one more prctl
parameter to change the binding to the user namespace.
This will not cause the user to take more resources than allowed in the parent
user namespace because it only virtualizes the rlimit counter. Limits in all
parent user namespaces are taken into account.
For example, this allows us to run multiple containers by the same user and
set the RLIMIT_NPROC to 1 inside.
ToDo
----
* RLIMIT_MEMLOCK, RLIMIT_SIGPENDING and RLIMIT_MSGQUEUE are not implemented.
* No documentation.
* No tests.
[1] https://lore.kernel.org/containers/87imd2incs.fsf@x220.int.ebiederm.org/
[2] https://lists.linuxfoundation.org/pipermail/containers/2020-August/042096.html
[3] https://lists.linuxfoundation.org/pipermail/containers/2020-October/042524.html
Changelog
---------
v1:
* After discussion with Eric W. Biederman, I increased the size of ucounts to
atomic_long_t.
* Added ucount_max to avoid the fork bomb.
--
Alexey Gladkov (4):
Increase size of ucounts to atomic_long_t
Move the user's process counter to ucounts
Do not allow fork if RLIMIT_NPROC is exceeded in the user namespace
tree
Allow to change the user namespace in which user rlimits are counted
fs/exec.c | 13 ++++++---
fs/io-wq.c | 25 +++++++++++++-----
fs/io-wq.h | 1 +
fs/io_uring.c | 1 +
include/linux/cred.h | 8 ++++++
include/linux/sched.h | 3 +++
include/linux/sched/user.h | 1 -
include/linux/user_namespace.h | 12 +++++++--
include/uapi/linux/prctl.h | 5 ++++
kernel/cred.c | 44 ++++++++++++++++++++++++-------
kernel/exit.c | 2 +-
kernel/fork.c | 13 ++++++---
kernel/sys.c | 26 ++++++++++++++++--
kernel/ucount.c | 48 +++++++++++++++++++++++++++++-----
kernel/user.c | 3 ++-
kernel/user_namespace.c | 3 +++
16 files changed, 171 insertions(+), 37 deletions(-)
--
2.25.4
next reply other threads:[~2020-11-02 16:52 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-02 16:50 Alexey Gladkov [this message]
2020-11-02 16:50 ` [RFC PATCH v1 1/4] Increase size of ucounts to atomic_long_t Alexey Gladkov
2020-11-02 18:03 ` Christian Brauner
2020-11-02 21:23 ` Alexey Gladkov
2020-11-02 16:50 ` [RFC PATCH v1 2/4] Move the user's process counter to ucounts Alexey Gladkov
2020-11-02 16:50 ` [RFC PATCH v1 3/4] Do not allow fork if RLIMIT_NPROC is exceeded in the user namespace tree Alexey Gladkov
2020-11-02 16:50 ` [RFC PATCH v1 4/4] Allow to change the user namespace in which user rlimits are counted Alexey Gladkov
2020-11-02 17:10 ` Jann Horn
2020-11-02 17:30 ` Alexey Gladkov
2020-11-04 10:03 ` Sargun Dhillon
2020-11-04 16:21 ` Alexey Gladkov
2020-11-02 17:55 ` [RFC PATCH v1 0/4] Per user namespace rlimits Christian Brauner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1604335819.git.gladkov.alexey@gmail.com \
--to=gladkov.alexey@gmail.com \
--cc=christian@brauner.io \
--cc=containers@lists.linux-foundation.org \
--cc=ebiederm@xmission.com \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=legion@kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).