Root/
1 | /* |
2 | * This program is free software; you can redistribute it and/or |
3 | * modify it under the terms of the GNU General Public License as |
4 | * published by the Free Software Foundation, version 2 of the |
5 | * License. |
6 | */ |
7 | |
8 | #include <linux/export.h> |
9 | #include <linux/nsproxy.h> |
10 | #include <linux/slab.h> |
11 | #include <linux/user_namespace.h> |
12 | #include <linux/proc_ns.h> |
13 | #include <linux/highuid.h> |
14 | #include <linux/cred.h> |
15 | #include <linux/securebits.h> |
16 | #include <linux/keyctl.h> |
17 | #include <linux/key-type.h> |
18 | #include <keys/user-type.h> |
19 | #include <linux/seq_file.h> |
20 | #include <linux/fs.h> |
21 | #include <linux/uaccess.h> |
22 | #include <linux/ctype.h> |
23 | #include <linux/projid.h> |
24 | #include <linux/fs_struct.h> |
25 | |
26 | static struct kmem_cache *user_ns_cachep __read_mostly; |
27 | |
28 | static bool new_idmap_permitted(const struct file *file, |
29 | struct user_namespace *ns, int cap_setid, |
30 | struct uid_gid_map *map); |
31 | |
32 | static void set_cred_user_ns(struct cred *cred, struct user_namespace *user_ns) |
33 | { |
34 | /* Start with the same capabilities as init but useless for doing |
35 | * anything as the capabilities are bound to the new user namespace. |
36 | */ |
37 | cred->securebits = SECUREBITS_DEFAULT; |
38 | cred->cap_inheritable = CAP_EMPTY_SET; |
39 | cred->cap_permitted = CAP_FULL_SET; |
40 | cred->cap_effective = CAP_FULL_SET; |
41 | cred->cap_bset = CAP_FULL_SET; |
42 | #ifdef CONFIG_KEYS |
43 | key_put(cred->request_key_auth); |
44 | cred->request_key_auth = NULL; |
45 | #endif |
46 | /* tgcred will be cleared in our caller bc CLONE_THREAD won't be set */ |
47 | cred->user_ns = user_ns; |
48 | } |
49 | |
50 | /* |
51 | * Create a new user namespace, deriving the creator from the user in the |
52 | * passed credentials, and replacing that user with the new root user for the |
53 | * new namespace. |
54 | * |
55 | * This is called by copy_creds(), which will finish setting the target task's |
56 | * credentials. |
57 | */ |
58 | int create_user_ns(struct cred *new) |
59 | { |
60 | struct user_namespace *ns, *parent_ns = new->user_ns; |
61 | kuid_t owner = new->euid; |
62 | kgid_t group = new->egid; |
63 | int ret; |
64 | |
65 | if (parent_ns->level > 32) |
66 | return -EUSERS; |
67 | |
68 | /* |
69 | * Verify that we can not violate the policy of which files |
70 | * may be accessed that is specified by the root directory, |
71 | * by verifing that the root directory is at the root of the |
72 | * mount namespace which allows all files to be accessed. |
73 | */ |
74 | if (current_chrooted()) |
75 | return -EPERM; |
76 | |
77 | /* The creator needs a mapping in the parent user namespace |
78 | * or else we won't be able to reasonably tell userspace who |
79 | * created a user_namespace. |
80 | */ |
81 | if (!kuid_has_mapping(parent_ns, owner) || |
82 | !kgid_has_mapping(parent_ns, group)) |
83 | return -EPERM; |
84 | |
85 | ns = kmem_cache_zalloc(user_ns_cachep, GFP_KERNEL); |
86 | if (!ns) |
87 | return -ENOMEM; |
88 | |
89 | ret = proc_alloc_inum(&ns->proc_inum); |
90 | if (ret) { |
91 | kmem_cache_free(user_ns_cachep, ns); |
92 | return ret; |
93 | } |
94 | |
95 | atomic_set(&ns->count, 1); |
96 | /* Leave the new->user_ns reference with the new user namespace. */ |
97 | ns->parent = parent_ns; |
98 | ns->level = parent_ns->level + 1; |
99 | ns->owner = owner; |
100 | ns->group = group; |
101 | |
102 | set_cred_user_ns(new, ns); |
103 | |
104 | return 0; |
105 | } |
106 | |
107 | int unshare_userns(unsigned long unshare_flags, struct cred **new_cred) |
108 | { |
109 | struct cred *cred; |
110 | int err = -ENOMEM; |
111 | |
112 | if (!(unshare_flags & CLONE_NEWUSER)) |
113 | return 0; |
114 | |
115 | cred = prepare_creds(); |
116 | if (cred) { |
117 | err = create_user_ns(cred); |
118 | if (err) |
119 | put_cred(cred); |
120 | else |
121 | *new_cred = cred; |
122 | } |
123 | |
124 | return err; |
125 | } |
126 | |
127 | void free_user_ns(struct user_namespace *ns) |
128 | { |
129 | struct user_namespace *parent; |
130 | |
131 | do { |
132 | parent = ns->parent; |
133 | proc_free_inum(ns->proc_inum); |
134 | kmem_cache_free(user_ns_cachep, ns); |
135 | ns = parent; |
136 | } while (atomic_dec_and_test(&parent->count)); |
137 | } |
138 | EXPORT_SYMBOL(free_user_ns); |
139 | |
140 | static u32 map_id_range_down(struct uid_gid_map *map, u32 id, u32 count) |
141 | { |
142 | unsigned idx, extents; |
143 | u32 first, last, id2; |
144 | |
145 | id2 = id + count - 1; |
146 | |
147 | /* Find the matching extent */ |
148 | extents = map->nr_extents; |
149 | smp_read_barrier_depends(); |
150 | for (idx = 0; idx < extents; idx++) { |
151 | first = map->extent[idx].first; |
152 | last = first + map->extent[idx].count - 1; |
153 | if (id >= first && id <= last && |
154 | (id2 >= first && id2 <= last)) |
155 | break; |
156 | } |
157 | /* Map the id or note failure */ |
158 | if (idx < extents) |
159 | id = (id - first) + map->extent[idx].lower_first; |
160 | else |
161 | id = (u32) -1; |
162 | |
163 | return id; |
164 | } |
165 | |
166 | static u32 map_id_down(struct uid_gid_map *map, u32 id) |
167 | { |
168 | unsigned idx, extents; |
169 | u32 first, last; |
170 | |
171 | /* Find the matching extent */ |
172 | extents = map->nr_extents; |
173 | smp_read_barrier_depends(); |
174 | for (idx = 0; idx < extents; idx++) { |
175 | first = map->extent[idx].first; |
176 | last = first + map->extent[idx].count - 1; |
177 | if (id >= first && id <= last) |
178 | break; |
179 | } |
180 | /* Map the id or note failure */ |
181 | if (idx < extents) |
182 | id = (id - first) + map->extent[idx].lower_first; |
183 | else |
184 | id = (u32) -1; |
185 | |
186 | return id; |
187 | } |
188 | |
189 | static u32 map_id_up(struct uid_gid_map *map, u32 id) |
190 | { |
191 | unsigned idx, extents; |
192 | u32 first, last; |
193 | |
194 | /* Find the matching extent */ |
195 | extents = map->nr_extents; |
196 | smp_read_barrier_depends(); |
197 | for (idx = 0; idx < extents; idx++) { |
198 | first = map->extent[idx].lower_first; |
199 | last = first + map->extent[idx].count - 1; |
200 | if (id >= first && id <= last) |
201 | break; |
202 | } |
203 | /* Map the id or note failure */ |
204 | if (idx < extents) |
205 | id = (id - first) + map->extent[idx].first; |
206 | else |
207 | id = (u32) -1; |
208 | |
209 | return id; |
210 | } |
211 | |
212 | /** |
213 | * make_kuid - Map a user-namespace uid pair into a kuid. |
214 | * @ns: User namespace that the uid is in |
215 | * @uid: User identifier |
216 | * |
217 | * Maps a user-namespace uid pair into a kernel internal kuid, |
218 | * and returns that kuid. |
219 | * |
220 | * When there is no mapping defined for the user-namespace uid |
221 | * pair INVALID_UID is returned. Callers are expected to test |
222 | * for and handle handle INVALID_UID being returned. INVALID_UID |
223 | * may be tested for using uid_valid(). |
224 | */ |
225 | kuid_t make_kuid(struct user_namespace *ns, uid_t uid) |
226 | { |
227 | /* Map the uid to a global kernel uid */ |
228 | return KUIDT_INIT(map_id_down(&ns->uid_map, uid)); |
229 | } |
230 | EXPORT_SYMBOL(make_kuid); |
231 | |
232 | /** |
233 | * from_kuid - Create a uid from a kuid user-namespace pair. |
234 | * @targ: The user namespace we want a uid in. |
235 | * @kuid: The kernel internal uid to start with. |
236 | * |
237 | * Map @kuid into the user-namespace specified by @targ and |
238 | * return the resulting uid. |
239 | * |
240 | * There is always a mapping into the initial user_namespace. |
241 | * |
242 | * If @kuid has no mapping in @targ (uid_t)-1 is returned. |
243 | */ |
244 | uid_t from_kuid(struct user_namespace *targ, kuid_t kuid) |
245 | { |
246 | /* Map the uid from a global kernel uid */ |
247 | return map_id_up(&targ->uid_map, __kuid_val(kuid)); |
248 | } |
249 | EXPORT_SYMBOL(from_kuid); |
250 | |
251 | /** |
252 | * from_kuid_munged - Create a uid from a kuid user-namespace pair. |
253 | * @targ: The user namespace we want a uid in. |
254 | * @kuid: The kernel internal uid to start with. |
255 | * |
256 | * Map @kuid into the user-namespace specified by @targ and |
257 | * return the resulting uid. |
258 | * |
259 | * There is always a mapping into the initial user_namespace. |
260 | * |
261 | * Unlike from_kuid from_kuid_munged never fails and always |
262 | * returns a valid uid. This makes from_kuid_munged appropriate |
263 | * for use in syscalls like stat and getuid where failing the |
264 | * system call and failing to provide a valid uid are not an |
265 | * options. |
266 | * |
267 | * If @kuid has no mapping in @targ overflowuid is returned. |
268 | */ |
269 | uid_t from_kuid_munged(struct user_namespace *targ, kuid_t kuid) |
270 | { |
271 | uid_t uid; |
272 | uid = from_kuid(targ, kuid); |
273 | |
274 | if (uid == (uid_t) -1) |
275 | uid = overflowuid; |
276 | return uid; |
277 | } |
278 | EXPORT_SYMBOL(from_kuid_munged); |
279 | |
280 | /** |
281 | * make_kgid - Map a user-namespace gid pair into a kgid. |
282 | * @ns: User namespace that the gid is in |
283 | * @uid: group identifier |
284 | * |
285 | * Maps a user-namespace gid pair into a kernel internal kgid, |
286 | * and returns that kgid. |
287 | * |
288 | * When there is no mapping defined for the user-namespace gid |
289 | * pair INVALID_GID is returned. Callers are expected to test |
290 | * for and handle INVALID_GID being returned. INVALID_GID may be |
291 | * tested for using gid_valid(). |
292 | */ |
293 | kgid_t make_kgid(struct user_namespace *ns, gid_t gid) |
294 | { |
295 | /* Map the gid to a global kernel gid */ |
296 | return KGIDT_INIT(map_id_down(&ns->gid_map, gid)); |
297 | } |
298 | EXPORT_SYMBOL(make_kgid); |
299 | |
300 | /** |
301 | * from_kgid - Create a gid from a kgid user-namespace pair. |
302 | * @targ: The user namespace we want a gid in. |
303 | * @kgid: The kernel internal gid to start with. |
304 | * |
305 | * Map @kgid into the user-namespace specified by @targ and |
306 | * return the resulting gid. |
307 | * |
308 | * There is always a mapping into the initial user_namespace. |
309 | * |
310 | * If @kgid has no mapping in @targ (gid_t)-1 is returned. |
311 | */ |
312 | gid_t from_kgid(struct user_namespace *targ, kgid_t kgid) |
313 | { |
314 | /* Map the gid from a global kernel gid */ |
315 | return map_id_up(&targ->gid_map, __kgid_val(kgid)); |
316 | } |
317 | EXPORT_SYMBOL(from_kgid); |
318 | |
319 | /** |
320 | * from_kgid_munged - Create a gid from a kgid user-namespace pair. |
321 | * @targ: The user namespace we want a gid in. |
322 | * @kgid: The kernel internal gid to start with. |
323 | * |
324 | * Map @kgid into the user-namespace specified by @targ and |
325 | * return the resulting gid. |
326 | * |
327 | * There is always a mapping into the initial user_namespace. |
328 | * |
329 | * Unlike from_kgid from_kgid_munged never fails and always |
330 | * returns a valid gid. This makes from_kgid_munged appropriate |
331 | * for use in syscalls like stat and getgid where failing the |
332 | * system call and failing to provide a valid gid are not options. |
333 | * |
334 | * If @kgid has no mapping in @targ overflowgid is returned. |
335 | */ |
336 | gid_t from_kgid_munged(struct user_namespace *targ, kgid_t kgid) |
337 | { |
338 | gid_t gid; |
339 | gid = from_kgid(targ, kgid); |
340 | |
341 | if (gid == (gid_t) -1) |
342 | gid = overflowgid; |
343 | return gid; |
344 | } |
345 | EXPORT_SYMBOL(from_kgid_munged); |
346 | |
347 | /** |
348 | * make_kprojid - Map a user-namespace projid pair into a kprojid. |
349 | * @ns: User namespace that the projid is in |
350 | * @projid: Project identifier |
351 | * |
352 | * Maps a user-namespace uid pair into a kernel internal kuid, |
353 | * and returns that kuid. |
354 | * |
355 | * When there is no mapping defined for the user-namespace projid |
356 | * pair INVALID_PROJID is returned. Callers are expected to test |
357 | * for and handle handle INVALID_PROJID being returned. INVALID_PROJID |
358 | * may be tested for using projid_valid(). |
359 | */ |
360 | kprojid_t make_kprojid(struct user_namespace *ns, projid_t projid) |
361 | { |
362 | /* Map the uid to a global kernel uid */ |
363 | return KPROJIDT_INIT(map_id_down(&ns->projid_map, projid)); |
364 | } |
365 | EXPORT_SYMBOL(make_kprojid); |
366 | |
367 | /** |
368 | * from_kprojid - Create a projid from a kprojid user-namespace pair. |
369 | * @targ: The user namespace we want a projid in. |
370 | * @kprojid: The kernel internal project identifier to start with. |
371 | * |
372 | * Map @kprojid into the user-namespace specified by @targ and |
373 | * return the resulting projid. |
374 | * |
375 | * There is always a mapping into the initial user_namespace. |
376 | * |
377 | * If @kprojid has no mapping in @targ (projid_t)-1 is returned. |
378 | */ |
379 | projid_t from_kprojid(struct user_namespace *targ, kprojid_t kprojid) |
380 | { |
381 | /* Map the uid from a global kernel uid */ |
382 | return map_id_up(&targ->projid_map, __kprojid_val(kprojid)); |
383 | } |
384 | EXPORT_SYMBOL(from_kprojid); |
385 | |
386 | /** |
387 | * from_kprojid_munged - Create a projiid from a kprojid user-namespace pair. |
388 | * @targ: The user namespace we want a projid in. |
389 | * @kprojid: The kernel internal projid to start with. |
390 | * |
391 | * Map @kprojid into the user-namespace specified by @targ and |
392 | * return the resulting projid. |
393 | * |
394 | * There is always a mapping into the initial user_namespace. |
395 | * |
396 | * Unlike from_kprojid from_kprojid_munged never fails and always |
397 | * returns a valid projid. This makes from_kprojid_munged |
398 | * appropriate for use in syscalls like stat and where |
399 | * failing the system call and failing to provide a valid projid are |
400 | * not an options. |
401 | * |
402 | * If @kprojid has no mapping in @targ OVERFLOW_PROJID is returned. |
403 | */ |
404 | projid_t from_kprojid_munged(struct user_namespace *targ, kprojid_t kprojid) |
405 | { |
406 | projid_t projid; |
407 | projid = from_kprojid(targ, kprojid); |
408 | |
409 | if (projid == (projid_t) -1) |
410 | projid = OVERFLOW_PROJID; |
411 | return projid; |
412 | } |
413 | EXPORT_SYMBOL(from_kprojid_munged); |
414 | |
415 | |
416 | static int uid_m_show(struct seq_file *seq, void *v) |
417 | { |
418 | struct user_namespace *ns = seq->private; |
419 | struct uid_gid_extent *extent = v; |
420 | struct user_namespace *lower_ns; |
421 | uid_t lower; |
422 | |
423 | lower_ns = seq_user_ns(seq); |
424 | if ((lower_ns == ns) && lower_ns->parent) |
425 | lower_ns = lower_ns->parent; |
426 | |
427 | lower = from_kuid(lower_ns, KUIDT_INIT(extent->lower_first)); |
428 | |
429 | seq_printf(seq, "%10u %10u %10u\n", |
430 | extent->first, |
431 | lower, |
432 | extent->count); |
433 | |
434 | return 0; |
435 | } |
436 | |
437 | static int gid_m_show(struct seq_file *seq, void *v) |
438 | { |
439 | struct user_namespace *ns = seq->private; |
440 | struct uid_gid_extent *extent = v; |
441 | struct user_namespace *lower_ns; |
442 | gid_t lower; |
443 | |
444 | lower_ns = seq_user_ns(seq); |
445 | if ((lower_ns == ns) && lower_ns->parent) |
446 | lower_ns = lower_ns->parent; |
447 | |
448 | lower = from_kgid(lower_ns, KGIDT_INIT(extent->lower_first)); |
449 | |
450 | seq_printf(seq, "%10u %10u %10u\n", |
451 | extent->first, |
452 | lower, |
453 | extent->count); |
454 | |
455 | return 0; |
456 | } |
457 | |
458 | static int projid_m_show(struct seq_file *seq, void *v) |
459 | { |
460 | struct user_namespace *ns = seq->private; |
461 | struct uid_gid_extent *extent = v; |
462 | struct user_namespace *lower_ns; |
463 | projid_t lower; |
464 | |
465 | lower_ns = seq_user_ns(seq); |
466 | if ((lower_ns == ns) && lower_ns->parent) |
467 | lower_ns = lower_ns->parent; |
468 | |
469 | lower = from_kprojid(lower_ns, KPROJIDT_INIT(extent->lower_first)); |
470 | |
471 | seq_printf(seq, "%10u %10u %10u\n", |
472 | extent->first, |
473 | lower, |
474 | extent->count); |
475 | |
476 | return 0; |
477 | } |
478 | |
479 | static void *m_start(struct seq_file *seq, loff_t *ppos, struct uid_gid_map *map) |
480 | { |
481 | struct uid_gid_extent *extent = NULL; |
482 | loff_t pos = *ppos; |
483 | |
484 | if (pos < map->nr_extents) |
485 | extent = &map->extent[pos]; |
486 | |
487 | return extent; |
488 | } |
489 | |
490 | static void *uid_m_start(struct seq_file *seq, loff_t *ppos) |
491 | { |
492 | struct user_namespace *ns = seq->private; |
493 | |
494 | return m_start(seq, ppos, &ns->uid_map); |
495 | } |
496 | |
497 | static void *gid_m_start(struct seq_file *seq, loff_t *ppos) |
498 | { |
499 | struct user_namespace *ns = seq->private; |
500 | |
501 | return m_start(seq, ppos, &ns->gid_map); |
502 | } |
503 | |
504 | static void *projid_m_start(struct seq_file *seq, loff_t *ppos) |
505 | { |
506 | struct user_namespace *ns = seq->private; |
507 | |
508 | return m_start(seq, ppos, &ns->projid_map); |
509 | } |
510 | |
511 | static void *m_next(struct seq_file *seq, void *v, loff_t *pos) |
512 | { |
513 | (*pos)++; |
514 | return seq->op->start(seq, pos); |
515 | } |
516 | |
517 | static void m_stop(struct seq_file *seq, void *v) |
518 | { |
519 | return; |
520 | } |
521 | |
522 | struct seq_operations proc_uid_seq_operations = { |
523 | .start = uid_m_start, |
524 | .stop = m_stop, |
525 | .next = m_next, |
526 | .show = uid_m_show, |
527 | }; |
528 | |
529 | struct seq_operations proc_gid_seq_operations = { |
530 | .start = gid_m_start, |
531 | .stop = m_stop, |
532 | .next = m_next, |
533 | .show = gid_m_show, |
534 | }; |
535 | |
536 | struct seq_operations proc_projid_seq_operations = { |
537 | .start = projid_m_start, |
538 | .stop = m_stop, |
539 | .next = m_next, |
540 | .show = projid_m_show, |
541 | }; |
542 | |
543 | static bool mappings_overlap(struct uid_gid_map *new_map, struct uid_gid_extent *extent) |
544 | { |
545 | u32 upper_first, lower_first, upper_last, lower_last; |
546 | unsigned idx; |
547 | |
548 | upper_first = extent->first; |
549 | lower_first = extent->lower_first; |
550 | upper_last = upper_first + extent->count - 1; |
551 | lower_last = lower_first + extent->count - 1; |
552 | |
553 | for (idx = 0; idx < new_map->nr_extents; idx++) { |
554 | u32 prev_upper_first, prev_lower_first; |
555 | u32 prev_upper_last, prev_lower_last; |
556 | struct uid_gid_extent *prev; |
557 | |
558 | prev = &new_map->extent[idx]; |
559 | |
560 | prev_upper_first = prev->first; |
561 | prev_lower_first = prev->lower_first; |
562 | prev_upper_last = prev_upper_first + prev->count - 1; |
563 | prev_lower_last = prev_lower_first + prev->count - 1; |
564 | |
565 | /* Does the upper range intersect a previous extent? */ |
566 | if ((prev_upper_first <= upper_last) && |
567 | (prev_upper_last >= upper_first)) |
568 | return true; |
569 | |
570 | /* Does the lower range intersect a previous extent? */ |
571 | if ((prev_lower_first <= lower_last) && |
572 | (prev_lower_last >= lower_first)) |
573 | return true; |
574 | } |
575 | return false; |
576 | } |
577 | |
578 | |
579 | static DEFINE_MUTEX(id_map_mutex); |
580 | |
581 | static ssize_t map_write(struct file *file, const char __user *buf, |
582 | size_t count, loff_t *ppos, |
583 | int cap_setid, |
584 | struct uid_gid_map *map, |
585 | struct uid_gid_map *parent_map) |
586 | { |
587 | struct seq_file *seq = file->private_data; |
588 | struct user_namespace *ns = seq->private; |
589 | struct uid_gid_map new_map; |
590 | unsigned idx; |
591 | struct uid_gid_extent *extent = NULL; |
592 | unsigned long page = 0; |
593 | char *kbuf, *pos, *next_line; |
594 | ssize_t ret = -EINVAL; |
595 | |
596 | /* |
597 | * The id_map_mutex serializes all writes to any given map. |
598 | * |
599 | * Any map is only ever written once. |
600 | * |
601 | * An id map fits within 1 cache line on most architectures. |
602 | * |
603 | * On read nothing needs to be done unless you are on an |
604 | * architecture with a crazy cache coherency model like alpha. |
605 | * |
606 | * There is a one time data dependency between reading the |
607 | * count of the extents and the values of the extents. The |
608 | * desired behavior is to see the values of the extents that |
609 | * were written before the count of the extents. |
610 | * |
611 | * To achieve this smp_wmb() is used on guarantee the write |
612 | * order and smp_read_barrier_depends() is guaranteed that we |
613 | * don't have crazy architectures returning stale data. |
614 | * |
615 | */ |
616 | mutex_lock(&id_map_mutex); |
617 | |
618 | ret = -EPERM; |
619 | /* Only allow one successful write to the map */ |
620 | if (map->nr_extents != 0) |
621 | goto out; |
622 | |
623 | /* |
624 | * Adjusting namespace settings requires capabilities on the target. |
625 | */ |
626 | if (cap_valid(cap_setid) && !file_ns_capable(file, ns, CAP_SYS_ADMIN)) |
627 | goto out; |
628 | |
629 | /* Get a buffer */ |
630 | ret = -ENOMEM; |
631 | page = __get_free_page(GFP_TEMPORARY); |
632 | kbuf = (char *) page; |
633 | if (!page) |
634 | goto out; |
635 | |
636 | /* Only allow <= page size writes at the beginning of the file */ |
637 | ret = -EINVAL; |
638 | if ((*ppos != 0) || (count >= PAGE_SIZE)) |
639 | goto out; |
640 | |
641 | /* Slurp in the user data */ |
642 | ret = -EFAULT; |
643 | if (copy_from_user(kbuf, buf, count)) |
644 | goto out; |
645 | kbuf[count] = '\0'; |
646 | |
647 | /* Parse the user data */ |
648 | ret = -EINVAL; |
649 | pos = kbuf; |
650 | new_map.nr_extents = 0; |
651 | for (;pos; pos = next_line) { |
652 | extent = &new_map.extent[new_map.nr_extents]; |
653 | |
654 | /* Find the end of line and ensure I don't look past it */ |
655 | next_line = strchr(pos, '\n'); |
656 | if (next_line) { |
657 | *next_line = '\0'; |
658 | next_line++; |
659 | if (*next_line == '\0') |
660 | next_line = NULL; |
661 | } |
662 | |
663 | pos = skip_spaces(pos); |
664 | extent->first = simple_strtoul(pos, &pos, 10); |
665 | if (!isspace(*pos)) |
666 | goto out; |
667 | |
668 | pos = skip_spaces(pos); |
669 | extent->lower_first = simple_strtoul(pos, &pos, 10); |
670 | if (!isspace(*pos)) |
671 | goto out; |
672 | |
673 | pos = skip_spaces(pos); |
674 | extent->count = simple_strtoul(pos, &pos, 10); |
675 | if (*pos && !isspace(*pos)) |
676 | goto out; |
677 | |
678 | /* Verify there is not trailing junk on the line */ |
679 | pos = skip_spaces(pos); |
680 | if (*pos != '\0') |
681 | goto out; |
682 | |
683 | /* Verify we have been given valid starting values */ |
684 | if ((extent->first == (u32) -1) || |
685 | (extent->lower_first == (u32) -1 )) |
686 | goto out; |
687 | |
688 | /* Verify count is not zero and does not cause the extent to wrap */ |
689 | if ((extent->first + extent->count) <= extent->first) |
690 | goto out; |
691 | if ((extent->lower_first + extent->count) <= extent->lower_first) |
692 | goto out; |
693 | |
694 | /* Do the ranges in extent overlap any previous extents? */ |
695 | if (mappings_overlap(&new_map, extent)) |
696 | goto out; |
697 | |
698 | new_map.nr_extents++; |
699 | |
700 | /* Fail if the file contains too many extents */ |
701 | if ((new_map.nr_extents == UID_GID_MAP_MAX_EXTENTS) && |
702 | (next_line != NULL)) |
703 | goto out; |
704 | } |
705 | /* Be very certaint the new map actually exists */ |
706 | if (new_map.nr_extents == 0) |
707 | goto out; |
708 | |
709 | ret = -EPERM; |
710 | /* Validate the user is allowed to use user id's mapped to. */ |
711 | if (!new_idmap_permitted(file, ns, cap_setid, &new_map)) |
712 | goto out; |
713 | |
714 | /* Map the lower ids from the parent user namespace to the |
715 | * kernel global id space. |
716 | */ |
717 | for (idx = 0; idx < new_map.nr_extents; idx++) { |
718 | u32 lower_first; |
719 | extent = &new_map.extent[idx]; |
720 | |
721 | lower_first = map_id_range_down(parent_map, |
722 | extent->lower_first, |
723 | extent->count); |
724 | |
725 | /* Fail if we can not map the specified extent to |
726 | * the kernel global id space. |
727 | */ |
728 | if (lower_first == (u32) -1) |
729 | goto out; |
730 | |
731 | extent->lower_first = lower_first; |
732 | } |
733 | |
734 | /* Install the map */ |
735 | memcpy(map->extent, new_map.extent, |
736 | new_map.nr_extents*sizeof(new_map.extent[0])); |
737 | smp_wmb(); |
738 | map->nr_extents = new_map.nr_extents; |
739 | |
740 | *ppos = count; |
741 | ret = count; |
742 | out: |
743 | mutex_unlock(&id_map_mutex); |
744 | if (page) |
745 | free_page(page); |
746 | return ret; |
747 | } |
748 | |
749 | ssize_t proc_uid_map_write(struct file *file, const char __user *buf, size_t size, loff_t *ppos) |
750 | { |
751 | struct seq_file *seq = file->private_data; |
752 | struct user_namespace *ns = seq->private; |
753 | struct user_namespace *seq_ns = seq_user_ns(seq); |
754 | |
755 | if (!ns->parent) |
756 | return -EPERM; |
757 | |
758 | if ((seq_ns != ns) && (seq_ns != ns->parent)) |
759 | return -EPERM; |
760 | |
761 | return map_write(file, buf, size, ppos, CAP_SETUID, |
762 | &ns->uid_map, &ns->parent->uid_map); |
763 | } |
764 | |
765 | ssize_t proc_gid_map_write(struct file *file, const char __user *buf, size_t size, loff_t *ppos) |
766 | { |
767 | struct seq_file *seq = file->private_data; |
768 | struct user_namespace *ns = seq->private; |
769 | struct user_namespace *seq_ns = seq_user_ns(seq); |
770 | |
771 | if (!ns->parent) |
772 | return -EPERM; |
773 | |
774 | if ((seq_ns != ns) && (seq_ns != ns->parent)) |
775 | return -EPERM; |
776 | |
777 | return map_write(file, buf, size, ppos, CAP_SETGID, |
778 | &ns->gid_map, &ns->parent->gid_map); |
779 | } |
780 | |
781 | ssize_t proc_projid_map_write(struct file *file, const char __user *buf, size_t size, loff_t *ppos) |
782 | { |
783 | struct seq_file *seq = file->private_data; |
784 | struct user_namespace *ns = seq->private; |
785 | struct user_namespace *seq_ns = seq_user_ns(seq); |
786 | |
787 | if (!ns->parent) |
788 | return -EPERM; |
789 | |
790 | if ((seq_ns != ns) && (seq_ns != ns->parent)) |
791 | return -EPERM; |
792 | |
793 | /* Anyone can set any valid project id no capability needed */ |
794 | return map_write(file, buf, size, ppos, -1, |
795 | &ns->projid_map, &ns->parent->projid_map); |
796 | } |
797 | |
798 | static bool new_idmap_permitted(const struct file *file, |
799 | struct user_namespace *ns, int cap_setid, |
800 | struct uid_gid_map *new_map) |
801 | { |
802 | /* Allow mapping to your own filesystem ids */ |
803 | if ((new_map->nr_extents == 1) && (new_map->extent[0].count == 1)) { |
804 | u32 id = new_map->extent[0].lower_first; |
805 | if (cap_setid == CAP_SETUID) { |
806 | kuid_t uid = make_kuid(ns->parent, id); |
807 | if (uid_eq(uid, file->f_cred->fsuid)) |
808 | return true; |
809 | } |
810 | else if (cap_setid == CAP_SETGID) { |
811 | kgid_t gid = make_kgid(ns->parent, id); |
812 | if (gid_eq(gid, file->f_cred->fsgid)) |
813 | return true; |
814 | } |
815 | } |
816 | |
817 | /* Allow anyone to set a mapping that doesn't require privilege */ |
818 | if (!cap_valid(cap_setid)) |
819 | return true; |
820 | |
821 | /* Allow the specified ids if we have the appropriate capability |
822 | * (CAP_SETUID or CAP_SETGID) over the parent user namespace. |
823 | * And the opener of the id file also had the approprpiate capability. |
824 | */ |
825 | if (ns_capable(ns->parent, cap_setid) && |
826 | file_ns_capable(file, ns->parent, cap_setid)) |
827 | return true; |
828 | |
829 | return false; |
830 | } |
831 | |
832 | static void *userns_get(struct task_struct *task) |
833 | { |
834 | struct user_namespace *user_ns; |
835 | |
836 | rcu_read_lock(); |
837 | user_ns = get_user_ns(__task_cred(task)->user_ns); |
838 | rcu_read_unlock(); |
839 | |
840 | return user_ns; |
841 | } |
842 | |
843 | static void userns_put(void *ns) |
844 | { |
845 | put_user_ns(ns); |
846 | } |
847 | |
848 | static int userns_install(struct nsproxy *nsproxy, void *ns) |
849 | { |
850 | struct user_namespace *user_ns = ns; |
851 | struct cred *cred; |
852 | |
853 | /* Don't allow gaining capabilities by reentering |
854 | * the same user namespace. |
855 | */ |
856 | if (user_ns == current_user_ns()) |
857 | return -EINVAL; |
858 | |
859 | /* Threaded processes may not enter a different user namespace */ |
860 | if (atomic_read(¤t->mm->mm_users) > 1) |
861 | return -EINVAL; |
862 | |
863 | if (current->fs->users != 1) |
864 | return -EINVAL; |
865 | |
866 | if (!ns_capable(user_ns, CAP_SYS_ADMIN)) |
867 | return -EPERM; |
868 | |
869 | cred = prepare_creds(); |
870 | if (!cred) |
871 | return -ENOMEM; |
872 | |
873 | put_user_ns(cred->user_ns); |
874 | set_cred_user_ns(cred, get_user_ns(user_ns)); |
875 | |
876 | return commit_creds(cred); |
877 | } |
878 | |
879 | static unsigned int userns_inum(void *ns) |
880 | { |
881 | struct user_namespace *user_ns = ns; |
882 | return user_ns->proc_inum; |
883 | } |
884 | |
885 | const struct proc_ns_operations userns_operations = { |
886 | .name = "user", |
887 | .type = CLONE_NEWUSER, |
888 | .get = userns_get, |
889 | .put = userns_put, |
890 | .install = userns_install, |
891 | .inum = userns_inum, |
892 | }; |
893 | |
894 | static __init int user_namespaces_init(void) |
895 | { |
896 | user_ns_cachep = KMEM_CACHE(user_namespace, SLAB_PANIC); |
897 | return 0; |
898 | } |
899 | module_init(user_namespaces_init); |
900 |
Branches:
ben-wpan
ben-wpan-stefan
javiroman/ks7010
jz-2.6.34
jz-2.6.34-rc5
jz-2.6.34-rc6
jz-2.6.34-rc7
jz-2.6.35
jz-2.6.36
jz-2.6.37
jz-2.6.38
jz-2.6.39
jz-3.0
jz-3.1
jz-3.11
jz-3.12
jz-3.13
jz-3.15
jz-3.16
jz-3.18-dt
jz-3.2
jz-3.3
jz-3.4
jz-3.5
jz-3.6
jz-3.6-rc2-pwm
jz-3.9
jz-3.9-clk
jz-3.9-rc8
jz47xx
jz47xx-2.6.38
master
Tags:
od-2011-09-04
od-2011-09-18
v2.6.34-rc5
v2.6.34-rc6
v2.6.34-rc7
v3.9