1. 15 Aug, 2016 3 commits
    • Dmitry Torokhov's avatar
      net: make net namespace sysctls belong to container's owner · e79c6a4f
      Dmitry Torokhov authored
      If net namespace is attached to a user namespace let's make container's
      root owner of sysctls affecting said network namespace instead of global
      root.
      
      This also allows us to clean up net_ctl_permissions() because we do not
      need to fudge permissions anymore for the container's owner since it now
      owns the objects in question.
      Acked-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e79c6a4f
    • Dmitry Torokhov's avatar
      proc: make proc entries inherit ownership from parent · c110486f
      Dmitry Torokhov authored
      There are certain parameters that belong to net namespace and that are
      exported in /proc. They should be controllable by the container's owner,
      but are currently owned by global root and thus not available.
      
      Let's change proc code to inherit ownership of parent entry, and when
      create per-ns "net" proc entry set it up as owned by container's owner.
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c110486f
    • Dmitry Torokhov's avatar
      netns: do not call pernet ops for not yet set up init_net namespace · f8c46cb3
      Dmitry Torokhov authored
      When CONFIG_NET_NS is disabled, registering pernet operations causes
      init() to be called immediately with init_net as an argument. Unfortunately
      this leads to some pernet ops, such as proc_net_ns_init() to be called too
      early, when init_net namespace has not been fully initialized. This causes
      issues when we want to change pernet ops to use more data from the net
      namespace in question, for example reference user namespace that owns our
      network namespace.
      
      To fix this we could either play game of musical chairs and rearrange init
      order, or we could do the same as when CONFIG_NET_NS is enabled, and
      postpone calling pernet ops->init() until namespace is set up properly.
      
      Note that we can not simply undo commit ed160e83 ("[NET]: Cleanup
      pernet operation without CONFIG_NET_NS") and use the same implementations
      for __register_pernet_operations() and __unregister_pernet_operations(),
      because many pernet ops are marked as __net_initdata and will be discarded,
      which wreaks havoc on our ops lists. Here we rely on the fact that we only
      use lists until init_net is fully initialized, which happens much earlier
      than discarding __net_initdata sections.
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f8c46cb3
  2. 13 Aug, 2016 37 commits