diff options
| author | Joel Savitz <jsavitz@redhat.com> | 2025-04-21 12:17:23 -0400 |
|---|---|---|
| committer | Jonathan Corbet <corbet@lwn.net> | 2025-04-28 18:00:06 -0600 |
| commit | c0fe189b590c754f69e0cb87c5b5674cad535cf6 (patch) | |
| tree | a5274d63a1c8dc22360df796c8c4e3f8bfdfb2a5 | |
| parent | 6c2f0b28d76e76c9879c030967e6587ebaeabce0 (diff) | |
docs: namespace: Tweak and reword resource control doc
Fix the document title and reword the phrasing to active voice.
Signed-off-by: Joel Savitz <jsavitz@redhat.com>
Message-ID: <20250421161723.1138903-1-jsavitz@redhat.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
| -rw-r--r-- | Documentation/admin-guide/namespaces/resource-control.rst | 24 |
1 files changed, 12 insertions, 12 deletions
diff --git a/Documentation/admin-guide/namespaces/resource-control.rst b/Documentation/admin-guide/namespaces/resource-control.rst index 369556e00f0c..553a44803231 100644 --- a/Documentation/admin-guide/namespaces/resource-control.rst +++ b/Documentation/admin-guide/namespaces/resource-control.rst @@ -1,17 +1,17 @@ -=========================== -Namespaces research control -=========================== +==================================== +User namespaces and resource control +==================================== -There are a lot of kinds of objects in the kernel that don't have -individual limits or that have limits that are ineffective when a set -of processes is allowed to switch user ids. With user namespaces -enabled in a kernel for people who don't trust their users or their -users programs to play nice this problems becomes more acute. +The kernel contains many kinds of objects that either don't have +individual limits or that have limits which are ineffective when +a set of processes is allowed to switch their UID. On a system +where the admins don't trust their users or their users' programs, +user namespaces expose the system to potential misuse of resources. -Therefore it is recommended that memory control groups be enabled in -kernels that enable user namespaces, and it is further recommended -that userspace configure memory control groups to limit how much -memory user's they don't trust to play nice can use. +In order to mitigate this, we recommend that admins enable memory +control groups on any system that enables user namespaces. +Furthermore, we recommend that admins configure the memory control +groups to limit the maximum memory usable by any untrusted user. Memory control groups can be configured by installing the libcgroup package present on most distros editing /etc/cgrules.conf, |