Commit 6786741d authored by Andrey Vagin's avatar Andrey Vagin Committed by Eric W. Biederman

nsfs: add ioctl to get an owning user namespace for ns file descriptor

Each namespace has an owning user namespace and now there is not way
to discover these relationships.

Understending namespaces relationships allows to answer the question:
what capability does process X have to perform operations on a resource
governed by namespace Y?

After a long discussion, Eric W. Biederman proposed to use ioctl-s for
this purpose.

The NS_GET_USERNS ioctl returns a file descriptor to an owning user
namespace.
It returns EPERM if a target namespace is outside of a current user
namespace.

v2: rename parent to relative

v3: Add a missing mntput when returning -EAGAIN --EWB
Acked-by: default avatarSerge Hallyn <serge@hallyn.com>
Link: https://lkml.org/lkml/2016/7/6/158Signed-off-by: default avatarAndrei Vagin <avagin@openvz.org>
Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
parent bcac25a5
...@@ -5,11 +5,16 @@ ...@@ -5,11 +5,16 @@
#include <linux/magic.h> #include <linux/magic.h>
#include <linux/ktime.h> #include <linux/ktime.h>
#include <linux/seq_file.h> #include <linux/seq_file.h>
#include <linux/user_namespace.h>
#include <linux/nsfs.h>
static struct vfsmount *nsfs_mnt; static struct vfsmount *nsfs_mnt;
static long ns_ioctl(struct file *filp, unsigned int ioctl,
unsigned long arg);
static const struct file_operations ns_file_operations = { static const struct file_operations ns_file_operations = {
.llseek = no_llseek, .llseek = no_llseek,
.unlocked_ioctl = ns_ioctl,
}; };
static char *ns_dname(struct dentry *dentry, char *buffer, int buflen) static char *ns_dname(struct dentry *dentry, char *buffer, int buflen)
...@@ -44,22 +49,14 @@ static void nsfs_evict(struct inode *inode) ...@@ -44,22 +49,14 @@ static void nsfs_evict(struct inode *inode)
ns->ops->put(ns); ns->ops->put(ns);
} }
void *ns_get_path(struct path *path, struct task_struct *task, static void *__ns_get_path(struct path *path, struct ns_common *ns)
const struct proc_ns_operations *ns_ops)
{ {
struct vfsmount *mnt = mntget(nsfs_mnt); struct vfsmount *mnt = mntget(nsfs_mnt);
struct qstr qname = { .name = "", }; struct qstr qname = { .name = "", };
struct dentry *dentry; struct dentry *dentry;
struct inode *inode; struct inode *inode;
struct ns_common *ns;
unsigned long d; unsigned long d;
again:
ns = ns_ops->get(task);
if (!ns) {
mntput(mnt);
return ERR_PTR(-ENOENT);
}
rcu_read_lock(); rcu_read_lock();
d = atomic_long_read(&ns->stashed); d = atomic_long_read(&ns->stashed);
if (!d) if (!d)
...@@ -68,7 +65,7 @@ void *ns_get_path(struct path *path, struct task_struct *task, ...@@ -68,7 +65,7 @@ void *ns_get_path(struct path *path, struct task_struct *task,
if (!lockref_get_not_dead(&dentry->d_lockref)) if (!lockref_get_not_dead(&dentry->d_lockref))
goto slow; goto slow;
rcu_read_unlock(); rcu_read_unlock();
ns_ops->put(ns); ns->ops->put(ns);
got_it: got_it:
path->mnt = mnt; path->mnt = mnt;
path->dentry = dentry; path->dentry = dentry;
...@@ -77,7 +74,7 @@ void *ns_get_path(struct path *path, struct task_struct *task, ...@@ -77,7 +74,7 @@ void *ns_get_path(struct path *path, struct task_struct *task,
rcu_read_unlock(); rcu_read_unlock();
inode = new_inode_pseudo(mnt->mnt_sb); inode = new_inode_pseudo(mnt->mnt_sb);
if (!inode) { if (!inode) {
ns_ops->put(ns); ns->ops->put(ns);
mntput(mnt); mntput(mnt);
return ERR_PTR(-ENOMEM); return ERR_PTR(-ENOMEM);
} }
...@@ -95,17 +92,90 @@ void *ns_get_path(struct path *path, struct task_struct *task, ...@@ -95,17 +92,90 @@ void *ns_get_path(struct path *path, struct task_struct *task,
return ERR_PTR(-ENOMEM); return ERR_PTR(-ENOMEM);
} }
d_instantiate(dentry, inode); d_instantiate(dentry, inode);
dentry->d_fsdata = (void *)ns_ops; dentry->d_fsdata = (void *)ns->ops;
d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry); d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry);
if (d) { if (d) {
d_delete(dentry); /* make sure ->d_prune() does nothing */ d_delete(dentry); /* make sure ->d_prune() does nothing */
dput(dentry); dput(dentry);
mntput(mnt);
cpu_relax(); cpu_relax();
goto again; return ERR_PTR(-EAGAIN);
} }
goto got_it; goto got_it;
} }
void *ns_get_path(struct path *path, struct task_struct *task,
const struct proc_ns_operations *ns_ops)
{
struct ns_common *ns;
void *ret;
again:
ns = ns_ops->get(task);
if (!ns)
return ERR_PTR(-ENOENT);
ret = __ns_get_path(path, ns);
if (IS_ERR(ret) && PTR_ERR(ret) == -EAGAIN)
goto again;
return ret;
}
static int open_related_ns(struct ns_common *ns,
struct ns_common *(*get_ns)(struct ns_common *ns))
{
struct path path = {};
struct file *f;
void *err;
int fd;
fd = get_unused_fd_flags(O_CLOEXEC);
if (fd < 0)
return fd;
while (1) {
struct ns_common *relative;
relative = get_ns(ns);
if (IS_ERR(relative)) {
put_unused_fd(fd);
return PTR_ERR(relative);
}
err = __ns_get_path(&path, relative);
if (IS_ERR(err) && PTR_ERR(err) == -EAGAIN)
continue;
break;
}
if (IS_ERR(err)) {
put_unused_fd(fd);
return PTR_ERR(err);
}
f = dentry_open(&path, O_RDONLY, current_cred());
path_put(&path);
if (IS_ERR(f)) {
put_unused_fd(fd);
fd = PTR_ERR(f);
} else
fd_install(fd, f);
return fd;
}
static long ns_ioctl(struct file *filp, unsigned int ioctl,
unsigned long arg)
{
struct ns_common *ns = get_proc_ns(file_inode(filp));
switch (ioctl) {
case NS_GET_USERNS:
return open_related_ns(ns, ns_get_owner);
default:
return -ENOTTY;
}
}
int ns_get_name(char *buf, size_t size, struct task_struct *task, int ns_get_name(char *buf, size_t size, struct task_struct *task,
const struct proc_ns_operations *ns_ops) const struct proc_ns_operations *ns_ops)
{ {
......
#ifndef __LINUX_NSFS_H
#define __LINUX_NSFS_H
#include <linux/ioctl.h>
#define NSIO 0xb7
/* Returns a file descriptor that refers to an owning user namespace */
#define NS_GET_USERNS _IO(NSIO, 0x1)
#endif /* __LINUX_NSFS_H */
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment