Re: [RFC PATCH 0/4] Make inotify instance/watches be accounted per userns

2016-06-06 Thread Eric W. Biederman
Nikolay Borisov writes: > On 06/03/2016 11:41 PM, Eric W. Biederman wrote: >> Nikolay Borisov writes: >> >>> On 06/02/2016 07:58 PM, Eric W. Biederman wrote: Nikolay please see my question for you at the end. >> [snip] All of that said there is definitely a practical question th

Re: [RFC PATCH 0/4] Make inotify instance/watches be accounted per userns

2016-06-05 Thread Nikolay Borisov
On 06/03/2016 11:41 PM, Eric W. Biederman wrote: > Nikolay Borisov writes: > >> On 06/02/2016 07:58 PM, Eric W. Biederman wrote: >>> >>> Nikolay please see my question for you at the end. > [snip] >>> All of that said there is definitely a practical question that needs to >>> be asked. Nikola

Re: [RFC PATCH 0/4] Make inotify instance/watches be accounted per userns

2016-06-03 Thread Eric W. Biederman
Nikolay Borisov writes: > On 06/02/2016 07:58 PM, Eric W. Biederman wrote: >> >> Nikolay please see my question for you at the end. [snip] >> All of that said there is definitely a practical question that needs to >> be asked. Nikolay how did you get into this situation? A typical user >> nam

Re: [RFC PATCH 0/4] Make inotify instance/watches be accounted per userns

2016-06-03 Thread Nikolay Borisov
On 06/02/2016 07:58 PM, Eric W. Biederman wrote: > > Nikolay please see my question for you at the end. > > Jan Kara writes: > >> On Wed 01-06-16 11:00:06, Eric W. Biederman wrote: >>> Cc'd the containers list. >>> >>> Nikolay Borisov writes: >>> Currently the inotify instances/watches

Re: [RFC PATCH 0/4] Make inotify instance/watches be accounted per userns

2016-06-02 Thread Eric W. Biederman
Nikolay please see my question for you at the end. Jan Kara writes: > On Wed 01-06-16 11:00:06, Eric W. Biederman wrote: >> Cc'd the containers list. >> >> Nikolay Borisov writes: >> >> > Currently the inotify instances/watches are being accounted in the >> > user_struct structure. This mea

Re: [RFC PATCH 0/4] Make inotify instance/watches be accounted per userns

2016-06-02 Thread Eric W. Biederman
Nikolay Borisov writes: > On 06/01/2016 07:00 PM, Eric W. Biederman wrote: >> Cc'd the containers list. >> >> >> Nikolay Borisov writes: >> >>> Currently the inotify instances/watches are being accounted in the >>> user_struct structure. This means that in setups where multiple >>> users in

Re: [RFC PATCH 0/4] Make inotify instance/watches be accounted per userns

2016-06-02 Thread Jan Kara
On Wed 01-06-16 11:00:06, Eric W. Biederman wrote: > Cc'd the containers list. > > Nikolay Borisov writes: > > > Currently the inotify instances/watches are being accounted in the > > user_struct structure. This means that in setups where multiple > > users in unprivileged containers map to th

Re: [RFC PATCH 0/4] Make inotify instance/watches be accounted per userns

2016-06-01 Thread Nikolay Borisov
On 06/01/2016 07:00 PM, Eric W. Biederman wrote: > Cc'd the containers list. > > > Nikolay Borisov writes: > >> Currently the inotify instances/watches are being accounted in the >> user_struct structure. This means that in setups where multiple >> users in unprivileged containers map to th

Re: [RFC PATCH 0/4] Make inotify instance/watches be accounted per userns

2016-06-01 Thread Eric W. Biederman
Cc'd the containers list. Nikolay Borisov writes: > Currently the inotify instances/watches are being accounted in the > user_struct structure. This means that in setups where multiple > users in unprivileged containers map to the same underlying > real user (e.g. user_struct) the inotify li

[RFC PATCH 0/4] Make inotify instance/watches be accounted per userns

2016-06-01 Thread Nikolay Borisov
Currently the inotify instances/watches are being accounted in the user_struct structure. This means that in setups where multiple users in unprivileged containers map to the same underlying real user (e.g. user_struct) the inotify limits are going to be shared as well which can lead to unplesa