lkml.org 
[lkml]   [2012]   [Apr]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 08/43] userns: Add an explicit reference to the parent user namespace
    From: Eric W. Biederman <ebiederm@xmission.com>

    I am about to remove the struct user_namespace reference from struct user_struct.
    So keep an explicit track of the parent user namespace.

    Take advantage of this new reference and replace instances of user_ns->creator->user_ns
    with user_ns->parent.

    Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
    Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
    ---
    include/linux/user_namespace.h | 1 +
    kernel/user_namespace.c | 13 ++++++-------
    security/commoncap.c | 2 +-
    3 files changed, 8 insertions(+), 8 deletions(-)

    diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
    index faf4679..dc2d85a 100644
    --- a/include/linux/user_namespace.h
    +++ b/include/linux/user_namespace.h
    @@ -12,6 +12,7 @@
    struct user_namespace {
    struct kref kref;
    struct hlist_head uidhash_table[UIDHASH_SZ];
    + struct user_namespace *parent;
    struct user_struct *creator;
    struct work_struct destroyer;
    };
    diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
    index 58bb878..c15e533 100644
    --- a/kernel/user_namespace.c
    +++ b/kernel/user_namespace.c
    @@ -45,6 +45,7 @@ int create_user_ns(struct cred *new)
    }

    /* set the new root user in the credentials under preparation */
    + ns->parent = parent_ns;
    ns->creator = new->user;
    new->user = root_user;
    new->uid = new->euid = new->suid = new->fsuid = 0;
    @@ -60,8 +61,6 @@ int create_user_ns(struct cred *new)
    /* Leave the reference to our user_ns with the new cred */
    new->user_ns = ns;

    - put_user_ns(parent_ns);
    -
    return 0;
    }

    @@ -72,10 +71,12 @@ int create_user_ns(struct cred *new)
    */
    static void free_user_ns_work(struct work_struct *work)
    {
    - struct user_namespace *ns =
    + struct user_namespace *parent, *ns =
    container_of(work, struct user_namespace, destroyer);
    + parent = ns->parent;
    free_uid(ns->creator);
    kmem_cache_free(user_ns_cachep, ns);
    + put_user_ns(parent);
    }

    void free_user_ns(struct kref *kref)
    @@ -99,8 +100,7 @@ uid_t user_ns_map_uid(struct user_namespace *to, const struct cred *cred, uid_t
    /* Is cred->user the creator of the target user_ns
    * or the creator of one of it's parents?
    */
    - for ( tmp = to; tmp != &init_user_ns;
    - tmp = tmp->creator->user_ns ) {
    + for ( tmp = to; tmp != &init_user_ns; tmp = tmp->parent ) {
    if (cred->user == tmp->creator) {
    return (uid_t)0;
    }
    @@ -120,8 +120,7 @@ gid_t user_ns_map_gid(struct user_namespace *to, const struct cred *cred, gid_t
    /* Is cred->user the creator of the target user_ns
    * or the creator of one of it's parents?
    */
    - for ( tmp = to; tmp != &init_user_ns;
    - tmp = tmp->creator->user_ns ) {
    + for ( tmp = to; tmp != &init_user_ns; tmp = tmp->parent ) {
    if (cred->user == tmp->creator) {
    return (gid_t)0;
    }
    diff --git a/security/commoncap.c b/security/commoncap.c
    index 8b3e10e..435d074 100644
    --- a/security/commoncap.c
    +++ b/security/commoncap.c
    @@ -92,7 +92,7 @@ int cap_capable(const struct cred *cred, struct user_namespace *targ_ns,
    *If you have a capability in a parent user ns, then you have
    * it over all children user namespaces as well.
    */
    - targ_ns = targ_ns->creator->user_ns;
    + targ_ns = targ_ns->parent;
    }

    /* We never get here */
    --
    1.7.2.5


    \
     
     \ /
      Last update: 2012-04-08 07:23    [W:4.322 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site