Re: [PATCH v9 4/8] Reimplement RLIMIT_NPROC on top of ucounts

2021-04-07 Thread Eric W. Biederman
Alexey Gladkov writes: > On Mon, Apr 05, 2021 at 11:56:35AM -0500, Eric W. Biederman wrote: >> >> Also when setting ns->ucount_max[] in create_user_ns because one value >> is signed and the other is unsigned. Care should be taken so that >> rlimit_infinity is translated into the largest

Re: [PATCH v9 4/8] Reimplement RLIMIT_NPROC on top of ucounts

2021-04-06 Thread Alexey Gladkov
On Mon, Apr 05, 2021 at 11:56:35AM -0500, Eric W. Biederman wrote: > > Also when setting ns->ucount_max[] in create_user_ns because one value > is signed and the other is unsigned. Care should be taken so that > rlimit_infinity is translated into the largest positive value the > type can hold.

Re: [PATCH v9 4/8] Reimplement RLIMIT_NPROC on top of ucounts

2021-04-05 Thread Eric W. Biederman
Alexey Gladkov writes: > The rlimit counter is tied to uid in the user_namespace. This allows > rlimit values to be specified in userns even if they are already > globally exceeded by the user. However, the value of the previous > user_namespaces cannot be exceeded. > > To illustrate the impact