1*20a78ae9SMauro Carvalho Chehab=========================== 2*20a78ae9SMauro Carvalho ChehabNamespaces research control 3*20a78ae9SMauro Carvalho Chehab=========================== 4*20a78ae9SMauro Carvalho Chehab 5e11f0ae3SEric W. BiedermanThere are a lot of kinds of objects in the kernel that don't have 6e11f0ae3SEric W. Biedermanindividual limits or that have limits that are ineffective when a set 7e11f0ae3SEric W. Biedermanof processes is allowed to switch user ids. With user namespaces 8e11f0ae3SEric W. Biedermanenabled in a kernel for people who don't trust their users or their 9e11f0ae3SEric W. Biedermanusers programs to play nice this problems becomes more acute. 10e11f0ae3SEric W. Biederman 11e11f0ae3SEric W. BiedermanTherefore it is recommended that memory control groups be enabled in 12e11f0ae3SEric W. Biedermankernels that enable user namespaces, and it is further recommended 13e11f0ae3SEric W. Biedermanthat userspace configure memory control groups to limit how much 14e11f0ae3SEric W. Biedermanmemory user's they don't trust to play nice can use. 15e11f0ae3SEric W. Biederman 16e11f0ae3SEric W. BiedermanMemory control groups can be configured by installing the libcgroup 17e11f0ae3SEric W. Biedermanpackage present on most distros editing /etc/cgrules.conf, 18e11f0ae3SEric W. Biederman/etc/cgconfig.conf and setting up libpam-cgroup. 19