Messages in this thread | | | Subject | Re: [PATCH 14/16] vfs: Implement mount_super_once | From | "Austin S. Hemmelgarn" <> | Date | Wed, 20 Apr 2016 07:50:53 -0400 |
| |
On 2016-04-19 23:27, Eric W. Biederman wrote: > "H. Peter Anvin" <hpa@zytor.com> writes: > >> On April 19, 2016 12:25:03 PM PDT, "H. Peter Anvin" <hpa@zytor.com> wrote: >>> >>> Perhaps a (privileged) option to exempt from the global limit, then. >>> Something we can implement if asked for. >>> >>> However, I wouldn't be 100% that the reserved pool isn't used. Someone >>> added it presumably for a reason. An administrator could say it and >>> we'd have no idea. >> >> ... and if I personally was running a container-hosting system, I >> would *absolutely* set it to make sure the administrator could not get >> locked out. > > That is likely easier done by setting: > echo RIDICULOUSLY_LARGE_NUMBER > /proc/sys/kernel/pty/max This may protect against administrative lockout on a sane system with responsible users, but it doesn't protect you from lockout due to a DoS attack, while the reserved pool does (or at least, it makes sure you can still allocate a few PTY's even when under attack).
| |