Re: [PATCH 14/16] vfs: Implement mount_super_once

[Austin S. Hemmelgarn]

On 2016-04-19 23:27, Eric W. Biederman wrote:
> "H. Peter Anvin" <hpa@xxxxxxxxx> writes:
>
> > On April 19, 2016 12:25:03 PM PDT, "H. Peter Anvin" <hpa@xxxxxxxxx> wrote:
> > > Perhaps a (privileged) option to exempt from the global limit, then.
> > > Something we can implement if asked for.
> > >
> > > However, I wouldn't be 100% that the reserved pool isn't used.  Someone
> > > added it presumably for a reason.  An administrator could say it and
> > > we'd have no idea.
> >
> > ... and if I personally was running a container-hosting system, I
> > would *absolutely* set it to make sure the administrator could not get
> > locked out.
>
> That is likely easier done by setting:
> echo RIDICULOUSLY_LARGE_NUMBER > /proc/sys/kernel/pty/max
This may protect against administrative lockout on a sane system with 
responsible users, but it doesn't protect you from lockout due to a DoS 
attack, while the reserved pool does (or at least, it makes sure you can 
still allocate a few PTY's even when under attack).