From 909a3f0e9d8b0d8001cf6e99808f88eca8e44328 Mon Sep 17 00:00:00 2001 From: Cheng Lingfei Date: Mon, 24 Aug 2026 20:45:46 +0800 Subject: docs: cgroup-v2: fix misc.events key format description MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In misc cgroup, misc.events does not output a simple "max" key. Instead, each registered misc resource outputs a separate key suffixed with ".max" (i.e., ".max"). Update the documentation to clarify that the entry key is ".max". Suggested-by: Michal Koutný Signed-off-by: Cheng Lingfei Signed-off-by: Tejun Heo --- .../admin-guide/namespaces/resource-control.rst | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 Documentation/admin-guide/namespaces/resource-control.rst (limited to 'Documentation/admin-guide/namespaces/resource-control.rst') diff --git a/Documentation/admin-guide/namespaces/resource-control.rst b/Documentation/admin-guide/namespaces/resource-control.rst new file mode 100644 index 000000000..553a44803 --- /dev/null +++ b/Documentation/admin-guide/namespaces/resource-control.rst @@ -0,0 +1,18 @@ +==================================== +User namespaces and resource control +==================================== + +The kernel contains many kinds of objects that either don't have +individual limits or that have limits which are ineffective when +a set of processes is allowed to switch their UID. On a system +where the admins don't trust their users or their users' programs, +user namespaces expose the system to potential misuse of resources. + +In order to mitigate this, we recommend that admins enable memory +control groups on any system that enables user namespaces. +Furthermore, we recommend that admins configure the memory control +groups to limit the maximum memory usable by any untrusted user. + +Memory control groups can be configured by installing the libcgroup +package present on most distros editing /etc/cgrules.conf, +/etc/cgconfig.conf and setting up libpam-cgroup. -- cgit v1.3.1