mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-08-28 04:03:23 -04:00
b604897764
An 'F' entry, and every interpreter a 'B' entry binds, holds a file open from registration until the entry goes away, pinning the file, its inode, the mount it came from and that mount's superblock. Nothing bounds how many of those a user namespace can hold. An entry binds at most BINFMT_MISC_INTERP_MAX interpreters, but nothing caps the entries. Charge each binding to the user namespace and uid that makes it against a new UCOUNT_BINFMT_MISC_INTERPRETERS. Going over budget causes -ENOSPC. A per-instance cap would suck. Instances are keyed on the user namespace. So any constant is multiplied by the number of namespaces the caller creates. Creating those is virtually free. A ucount charges the namespace and every one of its ancestors. And a namespace can raise only its own limit. So nesting buys nothing. The knob is /proc/sys/user/max_binfmt_misc_interpreters. Leave it at the max_threads/2 default fork_init() gives a new type. No existing configuration comes close to that. binfmt_misc is tristate, which makes it the first ucount user that can be built as a module. Export inc_ucount() and dec_ucount(); without them CONFIG_BINFMT_MISC=m fails to link. Export them to binfmt_misc alone: charging a ucount type is not something a module has any business doing in general, and the list is trivial to extend if a second user shows up. init_user_ns and init_binfmt_misc are already exported for the same module. Link: https://patch.msgid.link/20260803-work-binfmt_misc-interplimit-v1-1-4a2435500bd9@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>