lkml.org 
[lkml]   [2022]   [Feb]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH v10 26/27] ima: Limit number of policy rules in non-init_ima_ns
From

On 2/23/22 15:59, Mimi Zohar wrote:
> On Wed, 2022-02-23 at 15:45 -0500, Stefan Berger wrote:
>
>> avoid huge kernel memory consumption in the case that a cgroup limit for
>> memory was not set up.
> Ok, that is the motivation for the this patch.
>
Any user can create several user namespaces and with that several IMA
namespaces and now we want to limit the number of rules inside an IMA
namespace to limit the amount of kernel memory the policy rules are
consuming. It isn't necessarily  related to cgroups but a hard limit on
the number of rules to avoid wasted of memory.

\
 
 \ /
  Last update: 2022-02-23 22:07    [W:0.133 / U:0.488 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site