lkml.org 
[lkml]   [2016]   [Apr]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH 14/16] vfs: Implement mount_super_once
    From
    Date
    On 2016-04-19 23:27, Eric W. Biederman wrote:
    > "H. Peter Anvin" <hpa@zytor.com> writes:
    >
    >> On April 19, 2016 12:25:03 PM PDT, "H. Peter Anvin" <hpa@zytor.com> wrote:
    >>>
    >>> Perhaps a (privileged) option to exempt from the global limit, then.
    >>> Something we can implement if asked for.
    >>>
    >>> However, I wouldn't be 100% that the reserved pool isn't used. Someone
    >>> added it presumably for a reason. An administrator could say it and
    >>> we'd have no idea.
    >>
    >> ... and if I personally was running a container-hosting system, I
    >> would *absolutely* set it to make sure the administrator could not get
    >> locked out.
    >
    > That is likely easier done by setting:
    > echo RIDICULOUSLY_LARGE_NUMBER > /proc/sys/kernel/pty/max
    This may protect against administrative lockout on a sane system with
    responsible users, but it doesn't protect you from lockout due to a DoS
    attack, while the reserved pool does (or at least, it makes sure you can
    still allocate a few PTY's even when under attack).

    \
     
     \ /
      Last update: 2016-04-20 14:21    [W:3.980 / U:0.716 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site