Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'ucount-rlimit-fixes-for-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
Pull ucounts fix from Eric Biederman:
"Etienne Dechamps recently found a regression caused by enforcing
RLIMIT_NPROC for root where the rlimit was not previously enforced.
Michal Koutný had previously pointed out the inconsistency in
enforcing the RLIMIT_NPROC that had been on the root owned process
after the root user creates a user namespace.
Which makes the fix for the regression simply removing the
inconsistency"
* 'ucount-rlimit-fixes-for-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:
ucounts: Fix systemd LimitNPROC with private users regression
+13
-1
+13
-1
kernel/user_namespace.c
+13
-1
kernel/user_namespace.c
···
58
58
cred->user_ns = user_ns;
59
59
}
60
60
61
+
static unsigned long enforced_nproc_rlimit(void)
62
+
{
63
+
unsigned long limit = RLIM_INFINITY;
64
+
65
+
/* Is RLIMIT_NPROC currently enforced? */
66
+
if (!uid_eq(current_uid(), GLOBAL_ROOT_UID) ||
67
+
(current_user_ns() != &init_user_ns))
68
+
limit = rlimit(RLIMIT_NPROC);
69
+
70
+
return limit;
71
+
}
72
+
61
73
/*
62
74
* Create a new user namespace, deriving the creator from the user in the
63
75
* passed credentials, and replacing that user with the new root user for the
···
134
122
for (i = 0; i < MAX_PER_NAMESPACE_UCOUNTS; i++) {
135
123
ns->ucount_max[i] = INT_MAX;
136
124
}
137
-
set_rlimit_ucount_max(ns, UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC));
125
+
set_rlimit_ucount_max(ns, UCOUNT_RLIMIT_NPROC, enforced_nproc_rlimit());
138
126
set_rlimit_ucount_max(ns, UCOUNT_RLIMIT_MSGQUEUE, rlimit(RLIMIT_MSGQUEUE));
139
127
set_rlimit_ucount_max(ns, UCOUNT_RLIMIT_SIGPENDING, rlimit(RLIMIT_SIGPENDING));
140
128
set_rlimit_ucount_max(ns, UCOUNT_RLIMIT_MEMLOCK, rlimit(RLIMIT_MEMLOCK));