Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Alexey Gladkov <legion@kernel.org>
To:     LKML <linux-kernel@vger.kernel.org>,
        Linux Containers <containers@lists.linux.dev>
Cc:     Andrew Morton <akpm@linux-foundation.org>,
        Christian Brauner <brauner@kernel.org>,
        "Eric W . Biederman" <ebiederm@xmission.com>,
        Kees Cook <keescook@chromium.org>,
        Manfred Spraul <manfred@colorfullife.com>
Subject: [PATCH v2 0/3] Allow to change ipc/mq sysctls inside ipc namespace
Date:   Tue, 20 Sep 2022 20:08:19 +0200
Message-Id: <cover.1663696560.git.legion@kernel.org>
In-Reply-To: <YynnI2ySUkpu9j6S@example.org>
References: <YynnI2ySUkpu9j6S@example.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

Right now ipc and mq limits count as per ipc namespace, but only real
root can change them. By default, the current values of these limits are
such that it can only be reduced. Since only root can change the values,
it is impossible to reduce these limits in the rootless container.

We can allow limit changes within ipc namespace because mq parameters
are limited by RLIMIT_MSGQUEUE and ipc parameters are not limited to
anything other than cgroups.

--

Alexey Gladkov (3):
  sysctl: Allow change system v ipc sysctls inside ipc namespace
  sysctl: Allow to change limits for posix messages queues
  docs: Add information about ipc sysctls limitations

 Documentation/admin-guide/sysctl/kernel.rst | 14 ++++++--
 ipc/ipc_sysctl.c                            | 34 ++++++++++++++++--
 ipc/mq_sysctl.c                             | 38 +++++++++++++++++++++
 3 files changed, 80 insertions(+), 6 deletions(-)

-- 
2.33.4