Home » Mailing lists » Devel » [patch -mm 00/17] new namespaces and related syscalls
[patch -mm 02/17] user namespace: add the framework [message #16804 is a reply to message #16802] |
Tue, 05 December 2006 10:27 ![Go to previous message Go to previous message](/theme/ovz3/images/up.png) ![Go to next message Go to previous message](/theme/ovz3/images/down.png) |
Cedric Le Goater
Messages: 443 Registered: February 2006
|
Senior Member |
|
|
From: Cedric Le Goater <clg@fr.ibm.com>
This patch adds the user namespace struct and framework
Basically, it will allow a process to unshare its user_struct table,
resetting at the same time its own user_struct and all the associated
accounting.
A new root user (uid == 0) is added to the user namespace upon
creation. Such root users have full privileges and it seems that
theses privileges should be controlled through some means (process
capabilities ?)
The unshare is not included in this patch.
Changes since [try #3]:
- moved struct user_namespace to files user_namespace.{c,h}
Changes since [try #2]:
- removed struct user_namespace* argument from find_user()
Changes since [try #1]:
- removed struct user_namespace* argument from find_user()
- added a root_user per user namespace
Signed-off-by: Cedric Le Goater <clg@fr.ibm.com>
---
include/linux/init_task.h | 2 +
include/linux/nsproxy.h | 2 +
include/linux/sched.h | 3 +-
include/linux/user_namespace.h | 49 +++++++++++++++++++++++++++++++++++++++++
init/Kconfig | 8 ++++++
kernel/Makefile | 2 -
kernel/fork.c | 2 -
kernel/nsproxy.c | 11 +++++++++
kernel/sys.c | 5 ++--
kernel/user.c | 18 +++++++--------
kernel/user_namespace.c | 44 ++++++++++++++++++++++++++++++++++++
11 files changed, 132 insertions(+), 14 deletions(-)
Index: 2.6.19-rc6-mm2/kernel/user.c
===================================================================
--- 2.6.19-rc6-mm2.orig/kernel/user.c
+++ 2.6.19-rc6-mm2/kernel/user.c
@@ -14,20 +14,19 @@
#include <linux/bitops.h>
#include <linux/key.h>
#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/user_namespace.h>
/*
* UID task count cache, to get fast user lookup in "alloc_uid"
* when changing user ID's (ie setuid() and friends).
*/
-#define UIDHASH_BITS (CONFIG_BASE_SMALL ? 3 : 8)
-#define UIDHASH_SZ (1 << UIDHASH_BITS)
#define UIDHASH_MASK (UIDHASH_SZ - 1)
#define __uidhashfn(uid) (((uid >> UIDHASH_BITS) + uid) & UIDHASH_MASK)
-#define uidhashentry(uid) (uidhash_table + __uidhashfn((uid)))
+#define uidhashentry(ns, uid) ((ns)->uidhash_table + __uidhashfn((uid)))
static kmem_cache_t *uid_cachep;
-static struct list_head uidhash_table[UIDHASH_SZ];
/*
* The uidhash_lock is mostly taken from process context, but it is
@@ -94,9 +93,10 @@ struct user_struct *find_user(uid_t uid)
{
struct user_struct *ret;
unsigned long flags;
+ struct user_namespace *ns = current->nsproxy->user_ns;
spin_lock_irqsave(&uidhash_lock, flags);
- ret = uid_hash_find(uid, uidhashentry(uid));
+ ret = uid_hash_find(uid, uidhashentry(ns, uid));
spin_unlock_irqrestore(&uidhash_lock, flags);
return ret;
}
@@ -120,9 +120,9 @@ void free_uid(struct user_struct *up)
}
}
-struct user_struct * alloc_uid(uid_t uid)
+struct user_struct * alloc_uid(struct user_namespace *ns, uid_t uid)
{
- struct list_head *hashent = uidhashentry(uid);
+ struct list_head *hashent = uidhashentry(ns, uid);
struct user_struct *up;
spin_lock_irq(&uidhash_lock);
@@ -211,11 +211,11 @@ static int __init uid_cache_init(void)
0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
for(n = 0; n < UIDHASH_SZ; ++n)
- INIT_LIST_HEAD(uidhash_table + n);
+ INIT_LIST_HEAD(init_user_ns.uidhash_table + n);
/* Insert the root user immediately (init already runs as root) */
spin_lock_irq(&uidhash_lock);
- uid_hash_insert(&root_user, uidhashentry(0));
+ uid_hash_insert(&root_user, uidhashentry(&init_user_ns, 0));
spin_unlock_irq(&uidhash_lock);
return 0;
Index: 2.6.19-rc6-mm2/include/linux/nsproxy.h
===================================================================
--- 2.6.19-rc6-mm2.orig/include/linux/nsproxy.h
+++ 2.6.19-rc6-mm2/include/linux/nsproxy.h
@@ -9,6 +9,7 @@ struct uts_namespace;
struct ipc_namespace;
struct pid_namespace;
struct net_namespace;
+struct user_namespace;
/*
* A structure to contain pointers to all per-process
@@ -31,6 +32,7 @@ struct nsproxy {
struct mnt_namespace *mnt_ns;
struct pid_namespace *pid_ns;
struct net_namespace *net_ns;
+ struct user_namespace *user_ns;
};
extern struct nsproxy init_nsproxy;
Index: 2.6.19-rc6-mm2/include/linux/sched.h
===================================================================
--- 2.6.19-rc6-mm2.orig/include/linux/sched.h
+++ 2.6.19-rc6-mm2/include/linux/sched.h
@@ -252,6 +252,7 @@ extern signed long schedule_timeout_unin
asmlinkage void schedule(void);
struct nsproxy;
+struct user_namespace;
/* Maximum number of active map areas.. This is a random (large) number */
#define DEFAULT_MAX_MAP_COUNT 65536
@@ -1286,7 +1287,7 @@ extern struct task_struct *find_task_by_
extern void __set_special_pids(pid_t session, pid_t pgrp);
/* per-UID process charging. */
-extern struct user_struct * alloc_uid(uid_t);
+extern struct user_struct * alloc_uid(struct user_namespace *, uid_t);
static inline struct user_struct *get_uid(struct user_struct *u)
{
atomic_inc(&u->__count);
Index: 2.6.19-rc6-mm2/include/linux/init_task.h
===================================================================
--- 2.6.19-rc6-mm2.orig/include/linux/init_task.h
+++ 2.6.19-rc6-mm2/include/linux/init_task.h
@@ -9,6 +9,7 @@
#include <linux/ipc.h>
#include <linux/pid_namespace.h>
#include <linux/net_namespace.h>
+#include <linux/user_namespace.h>
#define INIT_FDTABLE \
{ \
@@ -81,6 +82,7 @@ extern struct nsproxy init_nsproxy;
.mnt_ns = NULL, \
INIT_NET_NS(net_ns) \
INIT_IPC_NS(ipc_ns) \
+ .user_ns = &init_user_ns, \
}
#define INIT_SIGHAND(sighand) { \
Index: 2.6.19-rc6-mm2/kernel/sys.c
===================================================================
--- 2.6.19-rc6-mm2.orig/kernel/sys.c
+++ 2.6.19-rc6-mm2/kernel/sys.c
@@ -33,6 +33,7 @@
#include <linux/compat.h>
#include <linux/syscalls.h>
#include <linux/kprobes.h>
+#include <linux/user_namespace.h>
#include <asm/uaccess.h>
#include <asm/io.h>
@@ -1062,13 +1063,13 @@ static int set_user(uid_t new_ruid, int
{
struct user_struct *new_user;
- new_user = alloc_uid(new_ruid);
+ new_user = alloc_uid(current->nsproxy->user_ns, new_ruid);
if (!new_user)
return -EAGAIN;
if (atomic_read(&new_user->processes) >=
current->signal->rlim[RLIMIT_NPROC].rlim_cur &&
- new_user != &root_user) {
+ new_user != current->nsproxy->user_ns->root_user) {
free_uid(new_user);
return -EAGAIN;
}
Index: 2.6.19-rc6-mm2/kernel/fork.c
===================================================================
--- 2.6.19-rc6-mm2.orig/kernel/fork.c
+++ 2.6.19-rc6-mm2/kernel/fork.c
@@ -996,7 +996,7 @@ static struct task_struct *copy_process(
if (atomic_read(&p->user->processes) >=
p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
- p->user != &root_user)
+ p->user != current->nsproxy->user_ns->root_user)
goto bad_fork_free;
}
Index: 2.6.19-rc6-mm2/kernel/nsproxy.c
===================================================================
--- 2.6.19-rc6-mm2.orig/kernel/nsproxy.c
+++ 2.6.19-rc6-mm2/kernel/nsproxy.c
@@ -74,6 +74,8 @@ struct nsproxy *dup_namespaces(struct ns
get_pid_ns(ns->pid_ns);
if (ns->net_ns)
get_net_ns(ns->net_ns);
+ if (ns->user_ns)
+ get_user_ns(ns->user_ns);
}
return ns;
@@ -125,10 +127,17 @@ int copy_namespaces(int flags, struct ta
if (err)
goto out_net;
+ err = copy_user_ns(flags, tsk);
+ if (err)
+ goto out_user;
+
out:
put_nsproxy(old_ns);
return err;
+out_user:
+ if (new_ns->net_ns)
+ put_net_ns(new_ns->net_ns);
out_net:
if (new_ns->pid_ns)
put_pid_ns(new_ns->pid_ns);
@@ -159,5 +168,7 @@ void free_nsproxy(struct nsproxy *ns)
put_pid_ns(ns->pid_ns);
if (ns->net_ns)
put_net_ns(ns->net_ns);
+ if (ns->user_ns)
+ put_user_ns(ns->user_ns);
kfree(ns);
}
Index: 2.6.19-rc6-mm2/init/Kconfig
===================================================================
--- 2.6.19-rc6-mm2.orig/init/Kconfig
+++ 2.6.19-rc6-mm2/init/Kconfig
@@ -222,6 +222,14 @@ config UTS_NS
vservers, to use uts namespaces to provide different
uts info for different servers. If unsure, say N.
+config USER_NS
+ bool "User Namespaces"
+ default n
+ help
+ Support user namespaces. This allows containers, i.e.
+ vservers, to use user namespaces to provide different
+ user info for different servers. If unsure, say N.
+
config AUDIT
bool "Auditing support"
depends on NET
Index: 2.6.19-rc6-mm2/include/linux/user_namespace.h
===================================================================
--- /dev/null
+++ 2.6.19-rc6-mm2/include/linux/user_namespace.h
@@ -0,0 +1,49 @@
+#ifndef _LINUX_USER_NAMESPACE_H
+#define _LINUX_USER_NAMESPACE_H
+
+#include <linux/kref.h>
+#include <linux/nsproxy.h>
+
+#define UIDHASH_BITS (CONFIG_BASE_SMALL ? 3 : 8)
+#define UIDHASH_SZ (1 << UIDHASH_BITS)
+
+struct user_namespace {
+ struct kref kref;
+ struct list_head uidhash_table[UIDHASH_SZ];
+ struct user_struct *root_user;
+};
+
+extern struct user_namespace init_user_ns;
+
+#ifdef CONFIG_USER_NS
+
+static inline void get_user_ns(struct user_namespace *ns)
+{
+ kref_get(&ns->kref);
+}
+
+extern int copy_user_ns(int flags, struct task_struct *tsk);
+extern void free_user_ns(struct kref *kref);
+
+static inline void put_user_ns(struct user_namespace *ns)
+{
+ kref_put(&ns->kref, free_user_ns);
+}
+
+#else
+
+static inline void get_user_ns(struct user_namespace *ns)
+{
+}
+
+static inline int copy_user_ns(int flags, struct task_struct *tsk)
+{
+ retu
...
|
|
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 00/17] new namespaces and related syscalls
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 01/17] net namespace: empty framework
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 02/17] user namespace: add the framework
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 03/17] namespace : export unshare of namespace and fs_struct
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 04/17] nsproxy: externalizes exit_task_namespaces
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 04/17] nsproxy: externalizes exit_task_namespaces
By: ebiederm on Fri, 08 December 2006 20:16
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 04/17] nsproxy: externalizes exit_task_namespaces
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 05/17] ipc namespace : externalizes unshare_ipcs
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 05/17] ipc namespace : externalizes unshare_ipcs
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 05/17] ipc namespace : externalizes unshare_ipcs
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 06/17] nsproxy: add extern to nsproxy functions
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 07/17] nsproxy: make put_nsproxy an extern
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Fri, 08 December 2006 19:30
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Fri, 08 December 2006 19:53
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Fri, 08 December 2006 20:57
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Sat, 09 December 2006 07:54
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Mon, 11 December 2006 15:29
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Mon, 11 December 2006 15:56
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Mon, 11 December 2006 19:35
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Mon, 11 December 2006 20:03
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Mon, 11 December 2006 20:34
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Mon, 11 December 2006 22:01
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Wed, 20 December 2006 06:12
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Mon, 11 December 2006 22:18
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Tue, 12 December 2006 03:28
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Tue, 12 December 2006 15:29
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Tue, 12 December 2006 15:45
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: dev on Tue, 12 December 2006 08:43
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Tue, 12 December 2006 07:52
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Tue, 12 December 2006 08:37
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Tue, 12 December 2006 08:57
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Wed, 13 December 2006 18:53
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Thu, 14 December 2006 21:08
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 09/17] nsproxy: add namespace flags
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 09/17] nsproxy: add namespace flags
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 09/17] nsproxy: add namespace flags
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 09/17] nsproxy: add namespace flags
By: ebiederm on Fri, 08 December 2006 19:40
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 09/17] nsproxy: add namespace flags
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 09/17] nsproxy: add namespace flags
By: ebiederm on Mon, 11 December 2006 20:02
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 10/17] nsproxy: add unshare_ns and bind_ns syscalls
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 10/17] nsproxy: add unshare_ns and bind_ns syscalls
By: ebiederm on Fri, 08 December 2006 19:26
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 10/17] nsproxy: add unshare_ns and bind_ns syscalls
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 10/17] nsproxy: add unshare_ns and bind_ns syscalls
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 10/17] nsproxy: add unshare_ns and bind_ns syscalls
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 10/17] nsproxy: add unshare_ns and bind_ns syscalls
By: ebiederm on Sat, 09 December 2006 07:40
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 10/17] nsproxy: add unshare_ns and bind_ns syscalls
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 11/17] user namespace: add user_namespace ptr to vfsmount
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 11/17] user namespace: add user_namespace ptr to vfsmount
By: serue on Tue, 05 December 2006 18:27
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 12/17] user namespace: hook permission
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 13/17] user namespace: implement shared mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 14/17] user namespace: maintain user ns for priv_userns mounts to vfsmount
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 15/17] pid namespace: add unshare
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 16/17] net namespace: add unshare
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 17/17] user namespace: add unshare
|
Goto Forum:
Current Time: Sun Sep 01 09:41:37 GMT 2024
Total time taken to generate the page: 0.06345 seconds
|