lkml.org 
[lkml]   [2007]   [Jan]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [PATCH -mm 0/8] user ns: Introduction
Quoting Serge E. Hallyn (serue@us.ibm.com):
> Quoting Andrew Morton (akpm@osdl.org):
> > On Thu, 4 Jan 2007 12:06:35 -0600
> > "Serge E. Hallyn" <serue@us.ibm.com> wrote:
> >
> > > This patchset adds a user namespace, which allows a process to
> > > unshare its user_struct table, allowing for separate accounting
> > > per user namespace.
> >
> > With these patches applied and with CONFIG_USER_NS=n, my selinux-enabled
> > standard FC5 machine throws a complete fit:
...
> >
> > Setting CONFIG_USER_NS=y fixes this.
>
> Ok, I see. The CONFIG_USER_NS split is absolutely horrible. Should
> really get rid of the user_ns pointers altogether when !CONFIG_USER_NS.
> I'll try to fix it up without putting ifdefs all over - planning to send
> a patch tomorrow.

Actually it's not that bad. Following patch fixes what I believe is
the underlying problem, and in any case was a definite bug.

thanks,
-serge

From: Serge E. Hallyn <serue@us.ibm.com>
Subject: [PATCH 1/1] user ns: fix !CONFIG_USER_NS mount denial

Don't do user_ns permission checks when !CONFIG_USER_NS.

Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
---
fs/namespace.c | 6 ++----
include/linux/sched.h | 8 ++++++++
include/linux/user_namespace.h | 15 +++++++++++++++
3 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/fs/namespace.c b/fs/namespace.c
index 2ed89d4..664c6f2 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -236,10 +236,8 @@ static struct vfsmount *clone_mnt(struct
struct super_block *sb = old->mnt_sb;
struct vfsmount *mnt;

- if (!(old->mnt_flags & MNT_SHARE_NS)) {
- if (old->mnt_user_ns != current->nsproxy->user_ns)
- return ERR_PTR(-EPERM);
- }
+ if (!clone_mnt_userns_permission(old))
+ return ERR_PTR(-EPERM);

mnt = alloc_vfsmnt(old->mnt_devname);

diff --git a/include/linux/sched.h b/include/linux/sched.h
index 55ecf81..0542f34 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1588,6 +1588,7 @@ extern int cond_resched(void);
extern int cond_resched_lock(spinlock_t * lock);
extern int cond_resched_softirq(void);

+#ifdef CONFIG_USER_NS
/*
* Check whether a task and a vfsmnt belong to the same uidns.
* Since the initial namespace is exempt from these checks,
@@ -1606,6 +1607,13 @@ static inline int task_mnt_same_uidns(st
return 1;
return 0;
}
+#else
+static inline int task_mnt_same_uidns(struct task_struct *tsk,
+ struct vfsmount *mnt)
+{
+ return 1;
+}
+#endif


/*
diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
index be3e484..e4ce9cb 100644
--- a/include/linux/user_namespace.h
+++ b/include/linux/user_namespace.h
@@ -35,6 +35,16 @@ static inline void put_user_ns(struct us
kref_put(&ns->kref, free_user_ns);
}

+static inline int clone_mnt_userns_permission(struct vfsmount *old)
+{
+ if (!(old->mnt_flags & MNT_SHARE_NS)) {
+ if (old->mnt_user_ns != current->nsproxy->user_ns)
+ return 0;
+ }
+
+ return 1;
+}
+
#else

static inline struct user_namespace *get_user_ns(struct user_namespace *ns)
@@ -59,6 +69,11 @@ static inline int copy_user_ns(int flags
static inline void put_user_ns(struct user_namespace *ns)
{
}
+
+static inline int clone_mnt_userns_permission(struct vfsmount *old)
+{
+ return 1;
+}
#endif

#endif /* _LINUX_USER_H */
--
1.4.1
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2007-01-05 08:05    [W:0.458 / U:0.336 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site