On April 19, 2016 12:25:03 PM PDT, "H. Peter Anvin" <h...@zytor.com> wrote: >On April 19, 2016 12:03:47 PM PDT, ebied...@xmission.com wrote: >>"H. Peter Anvin" <h...@zytor.com> writes: >> >>>>- Support for reserving ptys for the system devpts instance using >>>> /proc/sys/kernel/pty/reserve needs to be removed. >>>> >>>>Eric >>> >>> pty capping should probably be a devpts mount option >> >>There is a max option so pty capping is a per devpts option. >> >>> , and perhaps a >>> sufficiently privileged user could be allowed to set another mount >>> option to allow that instance to dip into the reserved pool or >exempt >>> it completely from the global limit as set in sysctl. >> >>I agree that we could keep the reserved pool, and add a new way to >>access it. However no piece of existing userspace could use it. So >>the >>simplest thing to do (unless something actually breaks), is to just >>remove the reserve pool. >> >>Eric > >Perhaps a (privileged) option to exempt from the global limit, then. >Something we can implement if asked for. > >However, I wouldn't be 100% that the reserved pool isn't used. Someone >added it presumably for a reason. An administrator could say it and >we'd have no idea.
... and if I personally was running a container-hosting system, I would *absolutely* set it to make sure the administrator could not get locked out. -- Sent from my Android device with K-9 Mail. Please excuse brevity and formatting.
