Commit bcac25a5 authored by Andrey Vagin's avatar Andrey Vagin Committed by Eric W. Biederman
Browse files

kernel: add a helper to get an owning user namespace for a namespace 



Return -EPERM if an owning user namespace is outside of a process
current user namespace.

v2: In a first version ns_get_owner returned ENOENT for init_user_ns.
    This special cases was removed from this version. There is nothing
    outside of init_user_ns, so we can return EPERM.
v3: rename ns->get_owner() to ns->owner(). get_* usually means that it
grabs a reference.

Acked-by: default avatarSerge Hallyn <serge@hallyn.com>
Signed-off-by: default avatarAndrei Vagin <avagin@openvz.org>
Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
parent 29b4817d

fs/namespace.c

+6 −0
Original line number Diff line number Diff line
@@ -3348,10 +3348,16 @@ static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns) 
	return 0;

}



static struct user_namespace *mntns_owner(struct ns_common *ns)

{

	return to_mnt_ns(ns)->user_ns;

}



const struct proc_ns_operations mntns_operations = {

	.name		= "mnt",

	.type		= CLONE_NEWNS,

	.get		= mntns_get,

	.put		= mntns_put,

	.install	= mntns_install,

	.owner		= mntns_owner,

};

include/linux/proc_ns.h

+1 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ struct proc_ns_operations { 
	struct ns_common *(*get)(struct task_struct *task);

	void (*put)(struct ns_common *ns);

	int (*install)(struct nsproxy *nsproxy, struct ns_common *ns);

	struct user_namespace *(*owner)(struct ns_common *ns);

};



extern const struct proc_ns_operations netns_operations;

include/linux/user_namespace.h

+7 −0
Original line number Diff line number Diff line
@@ -73,6 +73,8 @@ extern ssize_t proc_setgroups_write(struct file *, const char __user *, size_t, 
extern int proc_setgroups_show(struct seq_file *m, void *v);

extern bool userns_may_setgroups(const struct user_namespace *ns);

extern bool current_in_userns(const struct user_namespace *target_ns);



struct ns_common *ns_get_owner(struct ns_common *ns);

#else



static inline struct user_namespace *get_user_ns(struct user_namespace *ns)
@@ -106,6 +108,11 @@ static inline bool current_in_userns(const struct user_namespace *target_ns) 
{

	return true;

}



static inline struct ns_common *ns_get_owner(struct ns_common *ns)

{

	return ERR_PTR(-EPERM);

}

#endif



#endif /* _LINUX_USER_H */

ipc/namespace.c

+6 −0
Original line number Diff line number Diff line
@@ -165,10 +165,16 @@ static int ipcns_install(struct nsproxy *nsproxy, struct ns_common *new) 
	return 0;

}



static struct user_namespace *ipcns_owner(struct ns_common *ns)

{

	return to_ipc_ns(ns)->user_ns;

}



const struct proc_ns_operations ipcns_operations = {

	.name		= "ipc",

	.type		= CLONE_NEWIPC,

	.get		= ipcns_get,

	.put		= ipcns_put,

	.install	= ipcns_install,

	.owner		= ipcns_owner,

};

kernel/cgroup.c

+6 −0
Original line number Diff line number Diff line
@@ -6403,12 +6403,18 @@ static void cgroupns_put(struct ns_common *ns) 
	put_cgroup_ns(to_cg_ns(ns));

}



static struct user_namespace *cgroupns_owner(struct ns_common *ns)

{

	return to_cg_ns(ns)->user_ns;

}



const struct proc_ns_operations cgroupns_operations = {

	.name		= "cgroup",

	.type		= CLONE_NEWCGROUP,

	.get		= cgroupns_get,

	.put		= cgroupns_put,

	.install	= cgroupns_install,

	.owner		= cgroupns_owner,

};



static __init int cgroup_namespaces_init(void)

CRA Git | Maintained and supported by SUSTech CRA and CCSE