Linux 5.7 To Support Spawning A Process In A Different Cgroup From Its Parent

[oiaohm]

A perfect example of not understanding this topic. Those 'secure' systems have no resource control? Then they're not secure at all.

There are quite a few secure systems used in drones flight computers that don't in fact have resource control instead have complete system audited kernel and applications. So its not quite as black and white as it first appears.

[Volta]

There are quite a few secure systems used in drones flight computers that don't in fact have resource control instead have complete system audited kernel and applications. So its not quite as black and white as it first appears.

I meant desktops and servers where they're for to DoS example exposed to DoS attacks.

[oiaohm]

I meant desktops and servers where they're for to DoS example exposed to DoS attacks.

There are ways of designing systems DoS attack resistant without resource controls in the OS its been done on some unikernel OS for server stuff as well the embedded. Resource controls are the easy not cost 1000-5000 dollars per line of code in Audit cost way. Yes I am not kidding the mathematical model proof to prove something is DoS attack resistant is going to run into that scary amount of money or you take the cheaper path of resource controls to limit the damage.

Desktops where you cannot limit to X audit-able applications in most cases resource control comes mandatory.

[SystemCrasher]

A perfect example of not understanding this topic. Those 'secure' systems have no resource control? Then they're not secure at all.

Quite a bold statement. Yet I don't get which laws of universe ensure it would happen this way, in such an unconditional manner. As counter-example, there is absolutely nothing in having e.g. HW and SW dedicated to single critical task as whole (like e.g. MCU and its firmware). And if you have no resources management, neither you could run out of resources, nor you would have latency penalties and jitter. It could be quite advantageous on its own. Yet, there is absolutely nothing about security of this system so far. It could be secure. Or not. Just like any other.

[SystemCrasher]

I meant desktops and servers where they're for to DoS example exposed to DoS attacks.

Desktop and server OSes are large and complicated enough to ensure someone can eventually spot some unexpected corner case. There're far more predictable and reliable things around - but they don't make it a good desktop or server to begin with. Nor desktops and servers are most demanding things around.