Commit 9dd776b6 authored by Eric W. Biederman's avatar Eric W. Biederman Committed by David S. Miller
Browse files

[NET]: Add network namespace clone & unshare support. 



This patch allows you to create a new network namespace
using sys_clone, or sys_unshare.

As the network namespace is still experimental and under development
clone and unshare support is only made available when CONFIG_NET_NS is
selected at compile time.

As this patch introduces network namespace support into code paths
that exist when the CONFIG_NET is not selected there are a few
additions made to net_namespace.h to allow a few more functions
to be used when the networking stack is not compiled in.

Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8b41d188

include/linux/sched.h

+1 −0
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ 
#define CLONE_NEWUTS		0x04000000	/* New utsname group? */

#define CLONE_NEWIPC		0x08000000	/* New ipcs */

#define CLONE_NEWUSER		0x10000000	/* New user namespace */

#define CLONE_NEWNET		0x20000000	/* New network namespace */



/*

 * Scheduling policies

include/net/net_namespace.h

+18 −0
Original line number Diff line number Diff line
@@ -38,11 +38,23 @@ extern struct net init_net; 


extern struct list_head net_namespace_list;



#ifdef CONFIG_NET

extern struct net *copy_net_ns(unsigned long flags, struct net *net_ns);

#else

static inline struct net *copy_net_ns(unsigned long flags, struct net *net_ns)

{

	/* There is nothing to copy so this is a noop */

	return net_ns;

}

#endif



extern void __put_net(struct net *net);



static inline struct net *get_net(struct net *net)

{

#ifdef CONFIG_NET

	atomic_inc(&net->count);

#endif

	return net;

}
@@ -60,19 +72,25 @@ static inline struct net *maybe_get_net(struct net *net) 


static inline void put_net(struct net *net)

{

#ifdef CONFIG_NET

	if (atomic_dec_and_test(&net->count))

		__put_net(net);

#endif

}



static inline struct net *hold_net(struct net *net)

{

#ifdef CONFIG_NET

	atomic_inc(&net->use_count);

#endif

	return net;

}



static inline void release_net(struct net *net)

{

#ifdef CONFIG_NET

	atomic_dec(&net->use_count);

#endif

}



extern void net_lock(void);

kernel/fork.c

+2 −1
Original line number Diff line number Diff line
@@ -1608,7 +1608,8 @@ asmlinkage long sys_unshare(unsigned long unshare_flags) 
	err = -EINVAL;

	if (unshare_flags & ~(CLONE_THREAD|CLONE_FS|CLONE_NEWNS|CLONE_SIGHAND|

				CLONE_VM|CLONE_FILES|CLONE_SYSVSEM|

				CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWUSER))

				CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWUSER|

				CLONE_NEWNET))

		goto bad_unshare_out;



	if ((err = unshare_thread(unshare_flags)))

kernel/nsproxy.c

+13 −2
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ 
#include <linux/mnt_namespace.h>

#include <linux/utsname.h>

#include <linux/pid_namespace.h>

#include <net/net_namespace.h>



static struct kmem_cache *nsproxy_cachep;
@@ -98,8 +99,17 @@ static struct nsproxy *create_new_namespaces(unsigned long flags, 
		goto out_user;

	}



	new_nsp->net_ns = copy_net_ns(flags, tsk->nsproxy->net_ns);

	if (IS_ERR(new_nsp->net_ns)) {

		err = PTR_ERR(new_nsp->net_ns);

		goto out_net;

	}



	return new_nsp;



out_net:

	if (new_nsp->user_ns)

		put_user_ns(new_nsp->user_ns);

out_user:

	if (new_nsp->pid_ns)

		put_pid_ns(new_nsp->pid_ns);
@@ -132,7 +142,7 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk) 


	get_nsproxy(old_ns);



	if (!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWUSER)))

	if (!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWUSER | CLONE_NEWNET)))

		return 0;



	if (!capable(CAP_SYS_ADMIN)) {
@@ -164,6 +174,7 @@ void free_nsproxy(struct nsproxy *ns) 
		put_pid_ns(ns->pid_ns);

	if (ns->user_ns)

		put_user_ns(ns->user_ns);

	put_net(ns->net_ns);

	kmem_cache_free(nsproxy_cachep, ns);

}
@@ -177,7 +188,7 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags, 
	int err = 0;



	if (!(unshare_flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |

			       CLONE_NEWUSER)))

			       CLONE_NEWUSER | CLONE_NEWNET)))

		return 0;



	if (!capable(CAP_SYS_ADMIN))

net/Kconfig

+8 −0
Original line number Diff line number Diff line
@@ -27,6 +27,14 @@ if NET 


menu "Networking options"



config NET_NS

	bool "Network namespace support"

	default n

	depends on EXPERIMENTAL && !SYSFS

	help

	  Allow user space to create what appear to be multiple instances

	  of the network stack.



source "net/packet/Kconfig"

source "net/unix/Kconfig"

source "net/xfrm/Kconfig"

CRA Git | Maintained and supported by SUSTech CRA and CCSE