Messages in this thread | | | Date | Wed, 21 Feb 2018 10:21:04 -0800 | From | Andi Kleen <> | Subject | Re: [PATCH 1/2] fs/efivarfs: restrict inode permissions |
| |
> But it should be fairly easy to just add a 'struct ratelimit_state' to > 'struct user_struct', and then you can easily just use > > '&file->f_cred->user->ratelimit' > > and you're done. Make sure the initial root user has it unlimited, and > limit it to something reasonable for all other user allocations.
How about uid name spaces? Someone untrusted in a container could create a lot of uids and switch between them.
A global rate limit seems better. While in theory it allows DoS it's probably not worse than a lot of others we have with other resources, and it's relatively harmless.
-Andi
| |