userns: Add an explicit reference to the parent user namespace (aeb3ae9d) · Commits · 戴 / test

include/linux/user_namespace.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -12,6 +12,7 @@
		struct user_namespace {
		struct kref kref;
		struct hlist_head uidhash_table[UIDHASH_SZ];
		struct user_namespace *parent;
		struct user_struct *creator;
		struct work_struct destroyer;
		};

kernel/user_namespace.c

+6 −7

Original line number	Diff line number	Diff line
		@@ -45,6 +45,7 @@ int create_user_ns(struct cred *new)
		}

		/* set the new root user in the credentials under preparation */
		ns->parent = parent_ns;
		ns->creator = new->user;
		new->user = root_user;
		new->uid = new->euid = new->suid = new->fsuid = 0;
		@@ -60,8 +61,6 @@ int create_user_ns(struct cred *new)
		/* Leave the reference to our user_ns with the new cred */
		new->user_ns = ns;

		put_user_ns(parent_ns);

		return 0;
		}

		@@ -72,10 +71,12 @@ int create_user_ns(struct cred *new)
		*/
		static void free_user_ns_work(struct work_struct *work)
		{
		struct user_namespace *ns =
		struct user_namespace parent, ns =
		container_of(work, struct user_namespace, destroyer);
		parent = ns->parent;
		free_uid(ns->creator);
		kmem_cache_free(user_ns_cachep, ns);
		put_user_ns(parent);
		}

		void free_user_ns(struct kref *kref)
		@@ -99,8 +100,7 @@ uid_t user_ns_map_uid(struct user_namespace to, const struct cred cred, uid_t
		/* Is cred->user the creator of the target user_ns
		* or the creator of one of it's parents?
		*/
		for ( tmp = to; tmp != &init_user_ns;
		tmp = tmp->creator->user_ns ) {
		for ( tmp = to; tmp != &init_user_ns; tmp = tmp->parent ) {
		if (cred->user == tmp->creator) {
		return (uid_t)0;
		}
		@@ -120,8 +120,7 @@ gid_t user_ns_map_gid(struct user_namespace to, const struct cred cred, gid_t
		/* Is cred->user the creator of the target user_ns
		* or the creator of one of it's parents?
		*/
		for ( tmp = to; tmp != &init_user_ns;
		tmp = tmp->creator->user_ns ) {
		for ( tmp = to; tmp != &init_user_ns; tmp = tmp->parent ) {
		if (cred->user == tmp->creator) {
		return (gid_t)0;
		}

security/commoncap.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -92,7 +92,7 @@ int cap_capable(const struct cred cred, struct user_namespace targ_ns,
		*If you have a capability in a parent user ns, then you have
		* it over all children user namespaces as well.
		*/
		targ_ns = targ_ns->creator->user_ns;
		targ_ns = targ_ns->parent;
		}

		/* We never get here */

Admin message