On April 20, 2016 4:50:53 AM PDT, "Austin S. Hemmelgarn" <ahferro...@gmail.com> wrote: >On 2016-04-19 23:27, Eric W. Biederman wrote: >> "H. Peter Anvin" <h...@zytor.com> writes: >> >>> On April 19, 2016 12:25:03 PM PDT, "H. Peter Anvin" <h...@zytor.com> >wrote: >>>> >>>> Perhaps a (privileged) option to exempt from the global limit, >then. >>>> Something we can implement if asked for. >>>> >>>> However, I wouldn't be 100% that the reserved pool isn't used. >Someone >>>> added it presumably for a reason. An administrator could say it >and >>>> we'd have no idea. >>> >>> ... and if I personally was running a container-hosting system, I >>> would *absolutely* set it to make sure the administrator could not >get >>> locked out. >> >> That is likely easier done by setting: >> echo RIDICULOUSLY_LARGE_NUMBER > /proc/sys/kernel/pty/max >This may protect against administrative lockout on a sane system with >responsible users, but it doesn't protect you from lockout due to a DoS > >attack, while the reserved pool does (or at least, it makes sure you >can >still allocate a few PTY's even when under attack).
... or even accidental due to some runaway script. (I may or may not have some first hand knowledge of a similar situation once in college...) -- Sent from my Android device with K-9 Mail. Please excuse brevity and formatting.
