userns: Recommend use of memory control groups.

In the help text describing user namespaces recommend use of memory
control groups.  In many cases memory control groups are the only
mechanism there is to limit how much memory a user who can create
user namespaces can use.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>

1 files changed, 7 insertions, 0 deletions

diff --git a/init/Kconfig b/init/Kconfig
index 7d30240e5bfe..c8c58bddfed3 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1035,6 +1035,13 @@ config USER_NS
         help
           This allows containers, i.e. vservers, to use user namespaces
           to provide different user info for different servers.
+
+          When user namespaces are enabled in the kernel it is
+          recommended that the MEMCG and MEMCG_KMEM options also be
+          enabled and that user-space use the memory control groups to
+          limit the amount of memory a memory unprivileged users can
+          use.
+
           If unsure, say N.
 
 config PID_NS