1 /*
2 * This program is free software; you can redistribute it and/or
3 * modify it under the terms of the GNU General Public License as
4 * published by the Free Software Foundation, version 2 of the
5 * License.
6 */
8 #include <linux/export.h>
9 #include <linux/nsproxy.h>
10 #include <linux/slab.h>
11 #include <linux/user_namespace.h>
12 #include <linux/proc_fs.h>
13 #include <linux/highuid.h>
14 #include <linux/cred.h>
15 #include <linux/securebits.h>
16 #include <linux/keyctl.h>
17 #include <linux/key-type.h>
18 #include <keys/user-type.h>
19 #include <linux/seq_file.h>
20 #include <linux/fs.h>
21 #include <linux/uaccess.h>
22 #include <linux/ctype.h>
23 #include <linux/projid.h>
24 #include <linux/fs_struct.h>
26 static struct kmem_cache *user_ns_cachep __read_mostly;
28 static bool new_idmap_permitted(const struct file *file,
29 struct user_namespace *ns, int cap_setid,
30 struct uid_gid_map *map);
32 static void set_cred_user_ns(struct cred *cred, struct user_namespace *user_ns)
33 {
34 /* Start with the same capabilities as init but useless for doing
35 * anything as the capabilities are bound to the new user namespace.
36 */
37 cred->securebits = SECUREBITS_DEFAULT;
38 cred->cap_inheritable = CAP_EMPTY_SET;
39 cred->cap_permitted = CAP_FULL_SET;
40 cred->cap_effective = CAP_FULL_SET;
41 cred->cap_bset = CAP_FULL_SET;
42 #ifdef CONFIG_KEYS
43 key_put(cred->request_key_auth);
44 cred->request_key_auth = NULL;
45 #endif
46 /* tgcred will be cleared in our caller bc CLONE_THREAD won't be set */
47 cred->user_ns = user_ns;
48 }
50 /*
51 * Create a new user namespace, deriving the creator from the user in the
52 * passed credentials, and replacing that user with the new root user for the
53 * new namespace.
54 *
55 * This is called by copy_creds(), which will finish setting the target task's
56 * credentials.
57 */
58 int create_user_ns(struct cred *new)
59 {
60 struct user_namespace *ns, *parent_ns = new->user_ns;
61 kuid_t owner = new->euid;
62 kgid_t group = new->egid;
63 int ret;
65 /*
66 * Verify that we can not violate the policy of which files
67 * may be accessed that is specified by the root directory,
68 * by verifing that the root directory is at the root of the
69 * mount namespace which allows all files to be accessed.
70 */
71 if (current_chrooted())
72 return -EPERM;
74 /* The creator needs a mapping in the parent user namespace
75 * or else we won't be able to reasonably tell userspace who
76 * created a user_namespace.
77 */
78 if (!kuid_has_mapping(parent_ns, owner) ||
79 !kgid_has_mapping(parent_ns, group))
80 return -EPERM;
82 ns = kmem_cache_zalloc(user_ns_cachep, GFP_KERNEL);
83 if (!ns)
84 return -ENOMEM;
86 ret = proc_alloc_inum(&ns->proc_inum);
87 if (ret) {
88 kmem_cache_free(user_ns_cachep, ns);
89 return ret;
90 }
92 kref_init(&ns->kref);
93 /* Leave the new->user_ns reference with the new user namespace. */
94 ns->parent = parent_ns;
95 ns->owner = owner;
96 ns->group = group;
98 set_cred_user_ns(new, ns);
100 update_mnt_policy(ns);
102 return 0;
103 }
105 int unshare_userns(unsigned long unshare_flags, struct cred **new_cred)
106 {
107 struct cred *cred;
109 if (!(unshare_flags & CLONE_NEWUSER))
110 return 0;
112 cred = prepare_creds();
113 if (!cred)
114 return -ENOMEM;
116 *new_cred = cred;
117 return create_user_ns(cred);
118 }
120 void free_user_ns(struct kref *kref)
121 {
122 struct user_namespace *parent, *ns =
123 container_of(kref, struct user_namespace, kref);
125 parent = ns->parent;
126 proc_free_inum(ns->proc_inum);
127 kmem_cache_free(user_ns_cachep, ns);
128 put_user_ns(parent);
129 }
130 EXPORT_SYMBOL(free_user_ns);
132 static u32 map_id_range_down(struct uid_gid_map *map, u32 id, u32 count)
133 {
134 unsigned idx, extents;
135 u32 first, last, id2;
137 id2 = id + count - 1;
139 /* Find the matching extent */
140 extents = map->nr_extents;
141 smp_read_barrier_depends();
142 for (idx = 0; idx < extents; idx++) {
143 first = map->extent[idx].first;
144 last = first + map->extent[idx].count - 1;
145 if (id >= first && id <= last &&
146 (id2 >= first && id2 <= last))
147 break;
148 }
149 /* Map the id or note failure */
150 if (idx < extents)
151 id = (id - first) + map->extent[idx].lower_first;
152 else
153 id = (u32) -1;
155 return id;
156 }
158 static u32 map_id_down(struct uid_gid_map *map, u32 id)
159 {
160 unsigned idx, extents;
161 u32 first, last;
163 /* Find the matching extent */
164 extents = map->nr_extents;
165 smp_read_barrier_depends();
166 for (idx = 0; idx < extents; idx++) {
167 first = map->extent[idx].first;
168 last = first + map->extent[idx].count - 1;
169 if (id >= first && id <= last)
170 break;
171 }
172 /* Map the id or note failure */
173 if (idx < extents)
174 id = (id - first) + map->extent[idx].lower_first;
175 else
176 id = (u32) -1;
178 return id;
179 }
181 static u32 map_id_up(struct uid_gid_map *map, u32 id)
182 {
183 unsigned idx, extents;
184 u32 first, last;
186 /* Find the matching extent */
187 extents = map->nr_extents;
188 smp_read_barrier_depends();
189 for (idx = 0; idx < extents; idx++) {
190 first = map->extent[idx].lower_first;
191 last = first + map->extent[idx].count - 1;
192 if (id >= first && id <= last)
193 break;
194 }
195 /* Map the id or note failure */
196 if (idx < extents)
197 id = (id - first) + map->extent[idx].first;
198 else
199 id = (u32) -1;
201 return id;
202 }
204 /**
205 * make_kuid - Map a user-namespace uid pair into a kuid.
206 * @ns: User namespace that the uid is in
207 * @uid: User identifier
208 *
209 * Maps a user-namespace uid pair into a kernel internal kuid,
210 * and returns that kuid.
211 *
212 * When there is no mapping defined for the user-namespace uid
213 * pair INVALID_UID is returned. Callers are expected to test
214 * for and handle handle INVALID_UID being returned. INVALID_UID
215 * may be tested for using uid_valid().
216 */
217 kuid_t make_kuid(struct user_namespace *ns, uid_t uid)
218 {
219 /* Map the uid to a global kernel uid */
220 return KUIDT_INIT(map_id_down(&ns->uid_map, uid));
221 }
222 EXPORT_SYMBOL(make_kuid);
224 /**
225 * from_kuid - Create a uid from a kuid user-namespace pair.
226 * @targ: The user namespace we want a uid in.
227 * @kuid: The kernel internal uid to start with.
228 *
229 * Map @kuid into the user-namespace specified by @targ and
230 * return the resulting uid.
231 *
232 * There is always a mapping into the initial user_namespace.
233 *
234 * If @kuid has no mapping in @targ (uid_t)-1 is returned.
235 */
236 uid_t from_kuid(struct user_namespace *targ, kuid_t kuid)
237 {
238 /* Map the uid from a global kernel uid */
239 return map_id_up(&targ->uid_map, __kuid_val(kuid));
240 }
241 EXPORT_SYMBOL(from_kuid);
243 /**
244 * from_kuid_munged - Create a uid from a kuid user-namespace pair.
245 * @targ: The user namespace we want a uid in.
246 * @kuid: The kernel internal uid to start with.
247 *
248 * Map @kuid into the user-namespace specified by @targ and
249 * return the resulting uid.
250 *
251 * There is always a mapping into the initial user_namespace.
252 *
253 * Unlike from_kuid from_kuid_munged never fails and always
254 * returns a valid uid. This makes from_kuid_munged appropriate
255 * for use in syscalls like stat and getuid where failing the
256 * system call and failing to provide a valid uid are not an
257 * options.
258 *
259 * If @kuid has no mapping in @targ overflowuid is returned.
260 */
261 uid_t from_kuid_munged(struct user_namespace *targ, kuid_t kuid)
262 {
263 uid_t uid;
264 uid = from_kuid(targ, kuid);
266 if (uid == (uid_t) -1)
267 uid = overflowuid;
268 return uid;
269 }
270 EXPORT_SYMBOL(from_kuid_munged);
272 /**
273 * make_kgid - Map a user-namespace gid pair into a kgid.
274 * @ns: User namespace that the gid is in
275 * @uid: group identifier
276 *
277 * Maps a user-namespace gid pair into a kernel internal kgid,
278 * and returns that kgid.
279 *
280 * When there is no mapping defined for the user-namespace gid
281 * pair INVALID_GID is returned. Callers are expected to test
282 * for and handle INVALID_GID being returned. INVALID_GID may be
283 * tested for using gid_valid().
284 */
285 kgid_t make_kgid(struct user_namespace *ns, gid_t gid)
286 {
287 /* Map the gid to a global kernel gid */
288 return KGIDT_INIT(map_id_down(&ns->gid_map, gid));
289 }
290 EXPORT_SYMBOL(make_kgid);
292 /**
293 * from_kgid - Create a gid from a kgid user-namespace pair.
294 * @targ: The user namespace we want a gid in.
295 * @kgid: The kernel internal gid to start with.
296 *
297 * Map @kgid into the user-namespace specified by @targ and
298 * return the resulting gid.
299 *
300 * There is always a mapping into the initial user_namespace.
301 *
302 * If @kgid has no mapping in @targ (gid_t)-1 is returned.
303 */
304 gid_t from_kgid(struct user_namespace *targ, kgid_t kgid)
305 {
306 /* Map the gid from a global kernel gid */
307 return map_id_up(&targ->gid_map, __kgid_val(kgid));
308 }
309 EXPORT_SYMBOL(from_kgid);
311 /**
312 * from_kgid_munged - Create a gid from a kgid user-namespace pair.
313 * @targ: The user namespace we want a gid in.
314 * @kgid: The kernel internal gid to start with.
315 *
316 * Map @kgid into the user-namespace specified by @targ and
317 * return the resulting gid.
318 *
319 * There is always a mapping into the initial user_namespace.
320 *
321 * Unlike from_kgid from_kgid_munged never fails and always
322 * returns a valid gid. This makes from_kgid_munged appropriate
323 * for use in syscalls like stat and getgid where failing the
324 * system call and failing to provide a valid gid are not options.
325 *
326 * If @kgid has no mapping in @targ overflowgid is returned.
327 */
328 gid_t from_kgid_munged(struct user_namespace *targ, kgid_t kgid)
329 {
330 gid_t gid;
331 gid = from_kgid(targ, kgid);
333 if (gid == (gid_t) -1)
334 gid = overflowgid;
335 return gid;
336 }
337 EXPORT_SYMBOL(from_kgid_munged);
339 /**
340 * make_kprojid - Map a user-namespace projid pair into a kprojid.
341 * @ns: User namespace that the projid is in
342 * @projid: Project identifier
343 *
344 * Maps a user-namespace uid pair into a kernel internal kuid,
345 * and returns that kuid.
346 *
347 * When there is no mapping defined for the user-namespace projid
348 * pair INVALID_PROJID is returned. Callers are expected to test
349 * for and handle handle INVALID_PROJID being returned. INVALID_PROJID
350 * may be tested for using projid_valid().
351 */
352 kprojid_t make_kprojid(struct user_namespace *ns, projid_t projid)
353 {
354 /* Map the uid to a global kernel uid */
355 return KPROJIDT_INIT(map_id_down(&ns->projid_map, projid));
356 }
357 EXPORT_SYMBOL(make_kprojid);
359 /**
360 * from_kprojid - Create a projid from a kprojid user-namespace pair.
361 * @targ: The user namespace we want a projid in.
362 * @kprojid: The kernel internal project identifier to start with.
363 *
364 * Map @kprojid into the user-namespace specified by @targ and
365 * return the resulting projid.
366 *
367 * There is always a mapping into the initial user_namespace.
368 *
369 * If @kprojid has no mapping in @targ (projid_t)-1 is returned.
370 */
371 projid_t from_kprojid(struct user_namespace *targ, kprojid_t kprojid)
372 {
373 /* Map the uid from a global kernel uid */
374 return map_id_up(&targ->projid_map, __kprojid_val(kprojid));
375 }
376 EXPORT_SYMBOL(from_kprojid);
378 /**
379 * from_kprojid_munged - Create a projiid from a kprojid user-namespace pair.
380 * @targ: The user namespace we want a projid in.
381 * @kprojid: The kernel internal projid to start with.
382 *
383 * Map @kprojid into the user-namespace specified by @targ and
384 * return the resulting projid.
385 *
386 * There is always a mapping into the initial user_namespace.
387 *
388 * Unlike from_kprojid from_kprojid_munged never fails and always
389 * returns a valid projid. This makes from_kprojid_munged
390 * appropriate for use in syscalls like stat and where
391 * failing the system call and failing to provide a valid projid are
392 * not an options.
393 *
394 * If @kprojid has no mapping in @targ OVERFLOW_PROJID is returned.
395 */
396 projid_t from_kprojid_munged(struct user_namespace *targ, kprojid_t kprojid)
397 {
398 projid_t projid;
399 projid = from_kprojid(targ, kprojid);
401 if (projid == (projid_t) -1)
402 projid = OVERFLOW_PROJID;
403 return projid;
404 }
405 EXPORT_SYMBOL(from_kprojid_munged);
408 static int uid_m_show(struct seq_file *seq, void *v)
409 {
410 struct user_namespace *ns = seq->private;
411 struct uid_gid_extent *extent = v;
412 struct user_namespace *lower_ns;
413 uid_t lower;
415 lower_ns = seq_user_ns(seq);
416 if ((lower_ns == ns) && lower_ns->parent)
417 lower_ns = lower_ns->parent;
419 lower = from_kuid(lower_ns, KUIDT_INIT(extent->lower_first));
421 seq_printf(seq, "%10u %10u %10u\n",
422 extent->first,
423 lower,
424 extent->count);
426 return 0;
427 }
429 static int gid_m_show(struct seq_file *seq, void *v)
430 {
431 struct user_namespace *ns = seq->private;
432 struct uid_gid_extent *extent = v;
433 struct user_namespace *lower_ns;
434 gid_t lower;
436 lower_ns = seq_user_ns(seq);
437 if ((lower_ns == ns) && lower_ns->parent)
438 lower_ns = lower_ns->parent;
440 lower = from_kgid(lower_ns, KGIDT_INIT(extent->lower_first));
442 seq_printf(seq, "%10u %10u %10u\n",
443 extent->first,
444 lower,
445 extent->count);
447 return 0;
448 }
450 static int projid_m_show(struct seq_file *seq, void *v)
451 {
452 struct user_namespace *ns = seq->private;
453 struct uid_gid_extent *extent = v;
454 struct user_namespace *lower_ns;
455 projid_t lower;
457 lower_ns = seq_user_ns(seq);
458 if ((lower_ns == ns) && lower_ns->parent)
459 lower_ns = lower_ns->parent;
461 lower = from_kprojid(lower_ns, KPROJIDT_INIT(extent->lower_first));
463 seq_printf(seq, "%10u %10u %10u\n",
464 extent->first,
465 lower,
466 extent->count);
468 return 0;
469 }
471 static void *m_start(struct seq_file *seq, loff_t *ppos, struct uid_gid_map *map)
472 {
473 struct uid_gid_extent *extent = NULL;
474 loff_t pos = *ppos;
476 if (pos < map->nr_extents)
477 extent = &map->extent[pos];
479 return extent;
480 }
482 static void *uid_m_start(struct seq_file *seq, loff_t *ppos)
483 {
484 struct user_namespace *ns = seq->private;
486 return m_start(seq, ppos, &ns->uid_map);
487 }
489 static void *gid_m_start(struct seq_file *seq, loff_t *ppos)
490 {
491 struct user_namespace *ns = seq->private;
493 return m_start(seq, ppos, &ns->gid_map);
494 }
496 static void *projid_m_start(struct seq_file *seq, loff_t *ppos)
497 {
498 struct user_namespace *ns = seq->private;
500 return m_start(seq, ppos, &ns->projid_map);
501 }
503 static void *m_next(struct seq_file *seq, void *v, loff_t *pos)
504 {
505 (*pos)++;
506 return seq->op->start(seq, pos);
507 }
509 static void m_stop(struct seq_file *seq, void *v)
510 {
511 return;
512 }
514 struct seq_operations proc_uid_seq_operations = {
515 .start = uid_m_start,
516 .stop = m_stop,
517 .next = m_next,
518 .show = uid_m_show,
519 };
521 struct seq_operations proc_gid_seq_operations = {
522 .start = gid_m_start,
523 .stop = m_stop,
524 .next = m_next,
525 .show = gid_m_show,
526 };
528 struct seq_operations proc_projid_seq_operations = {
529 .start = projid_m_start,
530 .stop = m_stop,
531 .next = m_next,
532 .show = projid_m_show,
533 };
535 static DEFINE_MUTEX(id_map_mutex);
537 static ssize_t map_write(struct file *file, const char __user *buf,
538 size_t count, loff_t *ppos,
539 int cap_setid,
540 struct uid_gid_map *map,
541 struct uid_gid_map *parent_map)
542 {
543 struct seq_file *seq = file->private_data;
544 struct user_namespace *ns = seq->private;
545 struct uid_gid_map new_map;
546 unsigned idx;
547 struct uid_gid_extent *extent, *last = NULL;
548 unsigned long page = 0;
549 char *kbuf, *pos, *next_line;
550 ssize_t ret = -EINVAL;
552 /*
553 * The id_map_mutex serializes all writes to any given map.
554 *
555 * Any map is only ever written once.
556 *
557 * An id map fits within 1 cache line on most architectures.
558 *
559 * On read nothing needs to be done unless you are on an
560 * architecture with a crazy cache coherency model like alpha.
561 *
562 * There is a one time data dependency between reading the
563 * count of the extents and the values of the extents. The
564 * desired behavior is to see the values of the extents that
565 * were written before the count of the extents.
566 *
567 * To achieve this smp_wmb() is used on guarantee the write
568 * order and smp_read_barrier_depends() is guaranteed that we
569 * don't have crazy architectures returning stale data.
570 *
571 */
572 mutex_lock(&id_map_mutex);
574 ret = -EPERM;
575 /* Only allow one successful write to the map */
576 if (map->nr_extents != 0)
577 goto out;
579 /*
580 * Adjusting namespace settings requires capabilities on the target.
581 */
582 if (cap_valid(cap_setid) && !file_ns_capable(file, ns, CAP_SYS_ADMIN))
583 goto out;
585 /* Get a buffer */
586 ret = -ENOMEM;
587 page = __get_free_page(GFP_TEMPORARY);
588 kbuf = (char *) page;
589 if (!page)
590 goto out;
592 /* Only allow <= page size writes at the beginning of the file */
593 ret = -EINVAL;
594 if ((*ppos != 0) || (count >= PAGE_SIZE))
595 goto out;
597 /* Slurp in the user data */
598 ret = -EFAULT;
599 if (copy_from_user(kbuf, buf, count))
600 goto out;
601 kbuf[count] = '\0';
603 /* Parse the user data */
604 ret = -EINVAL;
605 pos = kbuf;
606 new_map.nr_extents = 0;
607 for (;pos; pos = next_line) {
608 extent = &new_map.extent[new_map.nr_extents];
610 /* Find the end of line and ensure I don't look past it */
611 next_line = strchr(pos, '\n');
612 if (next_line) {
613 *next_line = '\0';
614 next_line++;
615 if (*next_line == '\0')
616 next_line = NULL;
617 }
619 pos = skip_spaces(pos);
620 extent->first = simple_strtoul(pos, &pos, 10);
621 if (!isspace(*pos))
622 goto out;
624 pos = skip_spaces(pos);
625 extent->lower_first = simple_strtoul(pos, &pos, 10);
626 if (!isspace(*pos))
627 goto out;
629 pos = skip_spaces(pos);
630 extent->count = simple_strtoul(pos, &pos, 10);
631 if (*pos && !isspace(*pos))
632 goto out;
634 /* Verify there is not trailing junk on the line */
635 pos = skip_spaces(pos);
636 if (*pos != '\0')
637 goto out;
639 /* Verify we have been given valid starting values */
640 if ((extent->first == (u32) -1) ||
641 (extent->lower_first == (u32) -1 ))
642 goto out;
644 /* Verify count is not zero and does not cause the extent to wrap */
645 if ((extent->first + extent->count) <= extent->first)
646 goto out;
647 if ((extent->lower_first + extent->count) <= extent->lower_first)
648 goto out;
650 /* For now only accept extents that are strictly in order */
651 if (last &&
652 (((last->first + last->count) > extent->first) ||
653 ((last->lower_first + last->count) > extent->lower_first)))
654 goto out;
656 new_map.nr_extents++;
657 last = extent;
659 /* Fail if the file contains too many extents */
660 if ((new_map.nr_extents == UID_GID_MAP_MAX_EXTENTS) &&
661 (next_line != NULL))
662 goto out;
663 }
664 /* Be very certaint the new map actually exists */
665 if (new_map.nr_extents == 0)
666 goto out;
668 ret = -EPERM;
669 /* Validate the user is allowed to use user id's mapped to. */
670 if (!new_idmap_permitted(file, ns, cap_setid, &new_map))
671 goto out;
673 /* Map the lower ids from the parent user namespace to the
674 * kernel global id space.
675 */
676 for (idx = 0; idx < new_map.nr_extents; idx++) {
677 u32 lower_first;
678 extent = &new_map.extent[idx];
680 lower_first = map_id_range_down(parent_map,
681 extent->lower_first,
682 extent->count);
684 /* Fail if we can not map the specified extent to
685 * the kernel global id space.
686 */
687 if (lower_first == (u32) -1)
688 goto out;
690 extent->lower_first = lower_first;
691 }
693 /* Install the map */
694 memcpy(map->extent, new_map.extent,
695 new_map.nr_extents*sizeof(new_map.extent[0]));
696 smp_wmb();
697 map->nr_extents = new_map.nr_extents;
699 *ppos = count;
700 ret = count;
701 out:
702 mutex_unlock(&id_map_mutex);
703 if (page)
704 free_page(page);
705 return ret;
706 }
708 ssize_t proc_uid_map_write(struct file *file, const char __user *buf, size_t size, loff_t *ppos)
709 {
710 struct seq_file *seq = file->private_data;
711 struct user_namespace *ns = seq->private;
712 struct user_namespace *seq_ns = seq_user_ns(seq);
714 if (!ns->parent)
715 return -EPERM;
717 if ((seq_ns != ns) && (seq_ns != ns->parent))
718 return -EPERM;
720 return map_write(file, buf, size, ppos, CAP_SETUID,
721 &ns->uid_map, &ns->parent->uid_map);
722 }
724 ssize_t proc_gid_map_write(struct file *file, const char __user *buf, size_t size, loff_t *ppos)
725 {
726 struct seq_file *seq = file->private_data;
727 struct user_namespace *ns = seq->private;
728 struct user_namespace *seq_ns = seq_user_ns(seq);
730 if (!ns->parent)
731 return -EPERM;
733 if ((seq_ns != ns) && (seq_ns != ns->parent))
734 return -EPERM;
736 return map_write(file, buf, size, ppos, CAP_SETGID,
737 &ns->gid_map, &ns->parent->gid_map);
738 }
740 ssize_t proc_projid_map_write(struct file *file, const char __user *buf, size_t size, loff_t *ppos)
741 {
742 struct seq_file *seq = file->private_data;
743 struct user_namespace *ns = seq->private;
744 struct user_namespace *seq_ns = seq_user_ns(seq);
746 if (!ns->parent)
747 return -EPERM;
749 if ((seq_ns != ns) && (seq_ns != ns->parent))
750 return -EPERM;
752 /* Anyone can set any valid project id no capability needed */
753 return map_write(file, buf, size, ppos, -1,
754 &ns->projid_map, &ns->parent->projid_map);
755 }
757 static bool new_idmap_permitted(const struct file *file,
758 struct user_namespace *ns, int cap_setid,
759 struct uid_gid_map *new_map)
760 {
761 /* Allow mapping to your own filesystem ids */
762 if ((new_map->nr_extents == 1) && (new_map->extent[0].count == 1)) {
763 u32 id = new_map->extent[0].lower_first;
764 if (cap_setid == CAP_SETUID) {
765 kuid_t uid = make_kuid(ns->parent, id);
766 if (uid_eq(uid, file->f_cred->fsuid))
767 return true;
768 }
769 else if (cap_setid == CAP_SETGID) {
770 kgid_t gid = make_kgid(ns->parent, id);
771 if (gid_eq(gid, file->f_cred->fsgid))
772 return true;
773 }
774 }
776 /* Allow anyone to set a mapping that doesn't require privilege */
777 if (!cap_valid(cap_setid))
778 return true;
780 /* Allow the specified ids if we have the appropriate capability
781 * (CAP_SETUID or CAP_SETGID) over the parent user namespace.
782 * And the opener of the id file also had the approprpiate capability.
783 */
784 if (ns_capable(ns->parent, cap_setid) &&
785 file_ns_capable(file, ns->parent, cap_setid))
786 return true;
788 return false;
789 }
791 static void *userns_get(struct task_struct *task)
792 {
793 struct user_namespace *user_ns;
795 rcu_read_lock();
796 user_ns = get_user_ns(__task_cred(task)->user_ns);
797 rcu_read_unlock();
799 return user_ns;
800 }
802 static void userns_put(void *ns)
803 {
804 put_user_ns(ns);
805 }
807 static int userns_install(struct nsproxy *nsproxy, void *ns)
808 {
809 struct user_namespace *user_ns = ns;
810 struct cred *cred;
812 /* Don't allow gaining capabilities by reentering
813 * the same user namespace.
814 */
815 if (user_ns == current_user_ns())
816 return -EINVAL;
818 /* Threaded processes may not enter a different user namespace */
819 if (atomic_read(¤t->mm->mm_users) > 1)
820 return -EINVAL;
822 if (current->fs->users != 1)
823 return -EINVAL;
825 if (!ns_capable(user_ns, CAP_SYS_ADMIN))
826 return -EPERM;
828 cred = prepare_creds();
829 if (!cred)
830 return -ENOMEM;
832 put_user_ns(cred->user_ns);
833 set_cred_user_ns(cred, get_user_ns(user_ns));
835 return commit_creds(cred);
836 }
838 static unsigned int userns_inum(void *ns)
839 {
840 struct user_namespace *user_ns = ns;
841 return user_ns->proc_inum;
842 }
844 const struct proc_ns_operations userns_operations = {
845 .name = "user",
846 .type = CLONE_NEWUSER,
847 .get = userns_get,
848 .put = userns_put,
849 .install = userns_install,
850 .inum = userns_inum,
851 };
853 static __init int user_namespaces_init(void)
854 {
855 user_ns_cachep = KMEM_CACHE(user_namespace, SLAB_PANIC);
856 return 0;
857 }
858 module_init(user_namespaces_init);