From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932639AbcCKPeL (ORCPT ); Fri, 11 Mar 2016 10:34:11 -0500 Received: from Chamillionaire.breakpoint.cc ([80.244.247.6]:46474 "EHLO Chamillionaire.breakpoint.cc" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932410AbcCKPeK (ORCPT ); Fri, 11 Mar 2016 10:34:10 -0500 Date: Fri, 11 Mar 2016 16:34:06 +0100 From: Florian Westphal To: "Yuriy M. Kaminskiy" Cc: netdev@vger.kernel.org, containers@lists.osdl.org, linux-kernel@vger.kernel.org Subject: Re: userns, netns, and quick physical memory consumption by unprivileged user Message-ID: <20160311153406.GB6620@breakpoint.cc> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Yuriy M. Kaminskiy wrote: > BTW, all those hash/conntrack/etc default sizes was calculated from > physical memory size in assumption there will be only *one* instance of > those tables. Obviously, introduction of network namespaces (and > especially unprivileged user-ns) thrown this assumption in the window > (and here comes that "falling back to vmalloc" message again; in pre-netns > world, those tables were allocated *once* on early system startup, with > typically plenty of free and unfragmented memory). No idea how to fix this expect by removing conntrack support in net namespaces completely. I'd disallow all write accesses to skb->nfct (NAT, CONNMARK, CONNSECMARK, ...) and then no longer clear skb->nfct when forwarding packet from init_ns to container. Containers could then still test conntrack as seen from init namespace pov in PREROUTING/FORWARD/INPUT (but not OUTPUT, obviously). [ OUTPUT *might* be doable as well by allowing NEW creation in output but skipping nat and deferring the confirmation/commit of the new entry to the table until skb leaves initns ] We could key conntrack entries to initns conntrack table instead of adding one new table per netns, but seems like this only replaces one problem with a new one (filling/blocking initns table from another netns). Maybe we could go with a compromise and skip/disallow conntrack in unpriv userns only?