From: ebiederm@xmission•com (Eric W. Biederman)
To: Greg Kroah-Hartman <gregkh@suse•de>,
Andrew Morton <akpm@linux-foundation•org>
Cc: Tejun Heo <htejun@gmail•com>,
Daniel Lezcano <dlezcano@fr•ibm.com>,
linux-kernel@vger•kernel.org, Al Viro <viro@ftp•linux.org.uk>,
Linux Containers <containers@lists•osdl.org>,
Benjamin Thery <benjamin.thery@bull•net>,
<netdev@vger•kernel.org>
Subject: [PATCH 15/15] sysfs: user namespaces: fix bug with clone(CLONE_NEWUSER) with fairsched
Date: Thu, 03 Jul 2008 18:23:35 -0700 [thread overview]
Message-ID: <m14p76h27c.fsf_-_@frodo.ebiederm.org> (raw)
In-Reply-To: <m18wwih290.fsf_-_@frodo.ebiederm.org> (Eric W. Biederman's message of "Thu, 03 Jul 2008 18:22:35 -0700")
Mark the /sys/kernel/uids directory to be tagged so that processes in
different user namespaces can remount /sys and see their own uid
listings.
Without this patch, having CONFIG_FAIR_SCHED=y makes user namespaces
unusable, because when you
clone(CLONE_NEWUSER)
it will auto-create the root userid and try to create
/sys/kernel/uids/0. Since that already exists from the parent user
namespace, the create fails, and the clone misleadingly ends up
returning -ENOMEM.
This patch fixes the issue by allowing each user namespace to remount
/sys, and having /sys filter the /sys/kernel/uid/ entries by user
namespace.
Changelong:
v2 - Reworked for the updated sysfs api
Signed-off-by: Serge Hallyn <serue@us•ibm.com>
Signed-off-by: Benjamin Thery <benjamin.thery@bull•net>
Signed-off-by: Daniel Lezcano <dlezcano@fr•ibm.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission•com>
---
include/linux/sched.h | 1 +
include/linux/sysfs.h | 1 +
kernel/user.c | 22 ++++++++++++++++++++++
kernel/user_namespace.c | 1 +
4 files changed, 25 insertions(+), 0 deletions(-)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index c5d3f84..d2be6a5 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -598,6 +598,7 @@ struct user_struct {
/* Hash table maintenance information */
struct hlist_node uidhash_node;
uid_t uid;
+ struct user_namespace *user_ns;
#ifdef CONFIG_USER_SCHED
struct task_group *tg;
diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
index 1ed31bb..ecb942c 100644
--- a/include/linux/sysfs.h
+++ b/include/linux/sysfs.h
@@ -81,6 +81,7 @@ struct sysfs_ops {
enum sysfs_tag_type {
SYSFS_TAG_TYPE_NONE = 0,
SYSFS_TAG_TYPE_NETNS,
+ SYSFS_TAG_TYPE_USERNS,
SYSFS_TAG_TYPES
};
diff --git a/kernel/user.c b/kernel/user.c
index 865ecf5..ca29fbc 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -53,6 +53,7 @@ struct user_struct root_user = {
.files = ATOMIC_INIT(0),
.sigpending = ATOMIC_INIT(0),
.locked_shm = 0,
+ .user_ns = &init_user_ns,
#ifdef CONFIG_USER_SCHED
.tg = &init_task_group,
#endif
@@ -230,16 +231,33 @@ static struct attribute *uids_attributes[] = {
NULL
};
+static const void *uids_mount_tag(void)
+{
+ return current->nsproxy->user_ns;
+}
+
+static struct sysfs_tag_type_operations uids_tag_type_operations = {
+ .mount_tag = uids_mount_tag,
+};
+
/* the lifetime of user_struct is not managed by the core (now) */
static void uids_release(struct kobject *kobj)
{
return;
}
+static const void *uids_sysfs_tag(struct kobject *kobj)
+{
+ struct user_struct *up;
+ up = container_of(kobj, struct user_struct, kobj);
+ return up->user_ns;
+}
+
static struct kobj_type uids_ktype = {
.sysfs_ops = &kobj_sysfs_ops,
.default_attrs = uids_attributes,
.release = uids_release,
+ .sysfs_tag = uids_sysfs_tag,
};
/* create /sys/kernel/uids/<uid>/cpu_share file for this user */
@@ -272,6 +290,9 @@ int __init uids_sysfs_init(void)
if (!uids_kset)
return -ENOMEM;
+ sysfs_register_tag_type(SYSFS_TAG_TYPE_USERNS, &uids_tag_type_operations);
+ sysfs_make_tagged_dir(&uids_kset->kobj, SYSFS_TAG_TYPE_USERNS);
+
return uids_user_create(&root_user);
}
@@ -405,6 +426,7 @@ struct user_struct *alloc_uid(struct user_namespace *ns, uid_t uid)
new->uid = uid;
atomic_set(&new->__count, 1);
+ new->user_ns = ns;
if (sched_create_user(new) < 0)
goto out_free_user;
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index a9ab059..f67bbe0 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -71,6 +71,7 @@ void free_user_ns(struct kref *kref)
struct user_namespace *ns;
ns = container_of(kref, struct user_namespace, kref);
+ sysfs_exit_tag(SYSFS_TAG_TYPE_USERNS, ns);
release_uids(ns);
kfree(ns);
}
--
1.5.3.rc6.17.g1911
next prev parent reply other threads:[~2008-07-04 1:29 UTC|newest]
Thread overview: 80+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20080618170729.808539948@theryb.frec.bull.fr>
[not found] ` <20080618170731.002784342@theryb.frec.bull.fr>
[not found] ` <485F04E1.70204@gmail.com>
[not found] ` <m1y74svtff.fsf@frodo.ebiederm.org>
[not found] ` <486706C9.9040303@gmail.com>
[not found] ` <m18wwmsqdv.fsf@frodo.ebiederm.org>
[not found] ` <4869D314.5030403@gmail.com>
[not found] ` <m1ej6enep7.fsf@frodo.ebiederm.org>
[not found] ` <486A0751.9080602@gmail.com>
[not found] ` <m1wsk5hjm0.fsf@frodo.ebiederm.org>
[not found] ` <486AF4FA.8020805@gmail.com>
[not found] ` <m1ej6d9c2r.fsf@frodo.ebiederm.org>
[not found] ` <486B060C.7030607@gmail.com>
[not found] ` <m14p78s02q.fsf@frodo.ebiederm.org>
[not found] ` <486C4515.1070007@gmail.com>
[not found] ` <m1hcb7o8lv.fsf@frodo.ebiederm.org>
[not found] ` <486CB051.5000507@fr.ibm.com>
[not found] ` <m14p77m9uy.fsf@frodo.ebiederm.org>
[not found] ` <486CF71F.5090405@gmail.com>
2008-07-04 0:48 ` [PATCH 00/15] sysfs support for namespaces Eric W. Biederman
2008-07-04 1:05 ` [PATCH 01/15] kobject: Cleanup kobject_rename and !CONFIG_SYSFS Eric W. Biederman
2008-07-04 1:07 ` [PATCH 02/15] sysfs: Support for preventing unmounts Eric W. Biederman
2008-07-04 1:08 ` [PATCH 03/15] sysfs: sysfs_get_dentry add a sb parameter Eric W. Biederman
2008-07-04 1:09 ` [PATCH 04/15] sysfs: Implement __sysfs_get_dentry Eric W. Biederman
2008-07-04 1:10 ` [PATCH 05/15] sysfs: Rename Support multiple superblocks Eric W. Biederman
2008-07-04 1:11 ` [PATCH 06/15] Introduce sysfs_sd_setattr and fix sysfs_chmod Eric W. Biederman
2008-07-04 1:13 ` [PATCH 07/15] sysfs: sysfs_chmod_file handle multiple superblocks Eric W. Biederman
2008-07-04 1:14 ` [PATCH 08/15] sysfs: Make sysfs_mount static once again Eric W. Biederman
2008-07-04 1:16 ` [PATCH 09/15] sysfs: Implement sysfs tagged directory support Eric W. Biederman
2008-07-04 1:17 ` [PATCH 10/15] sysfs: Merge sysfs_rename_dir and sysfs_move_dir Eric W. Biederman
2008-07-04 1:18 ` [PATCH 11/15] sysfs: Implement sysfs_delete_link and sysfs_rename_link Eric W. Biederman
2008-07-04 1:20 ` [PATCH 12/15] driver core: Implement tagged directory support for device classes Eric W. Biederman
2008-07-04 1:21 ` [PATCH 13/15] Revert "netns: Fix device renaming for sysfs" Eric W. Biederman
2008-07-04 1:22 ` [PATCH 14/15] netns: Enable tagging for net_class directories in sysfs Eric W. Biederman
2008-07-04 1:23 ` Eric W. Biederman [this message]
2008-07-04 7:50 ` [PATCH 12/15] driver core: Implement tagged directory support for device classes Tejun Heo
2008-07-04 13:31 ` Eric W. Biederman
2008-07-04 13:57 ` Tejun Heo
2008-07-04 16:12 ` Greg KH
2008-07-04 21:49 ` Eric W. Biederman
2008-07-14 1:54 ` Eric W. Biederman
2008-07-16 3:25 ` Tejun Heo
2008-07-16 5:41 ` Eric W. Biederman
2008-07-16 5:50 ` Tejun Heo
2008-07-16 6:32 ` Eric W. Biederman
2008-07-16 6:48 ` Tejun Heo
2008-07-16 7:02 ` Tejun Heo
2008-07-16 19:07 ` Eric W. Biederman
2008-07-16 21:09 ` Eric W. Biederman
2008-07-17 23:08 ` Greg KH
2008-07-18 12:41 ` Tejun Heo
2008-07-18 18:49 ` Greg KH
2008-07-18 20:19 ` Eric W. Biederman
2008-07-19 1:07 ` Tejun Heo
2008-08-03 6:59 ` Eric W. Biederman
2008-07-04 22:00 ` Eric W. Biederman
2008-08-20 2:17 ` [PATCH 09/15] sysfs: Implement sysfs tagged directory support Greg KH
2008-08-20 6:58 ` Eric W. Biederman
2008-08-21 6:31 ` [PATCH 0/8] sysfs namespace support Eric W. Biederman
2008-08-21 6:33 ` [PATCH 1/8] sysfs: Implement sysfs tagged directory support Eric W. Biederman
2008-08-21 6:34 ` [PATCH 2/8] sysfs: Merge sysfs_rename_dir and sysfs_move_dir Eric W. Biederman
2008-08-21 6:35 ` [PATCH 3/8] sysfs: Implement sysfs_delete_link and sysfs_rename_link Eric W. Biederman
2008-08-21 6:36 ` [PATCH 5/8] sysfs: Remove sysfs_create_link_nowarn Eric W. Biederman
2008-08-21 6:38 ` [PATCH 6/8] Revert "netns: Fix device renaming for sysfs" Eric W. Biederman
2008-08-21 6:39 ` [PATCH 7/8] netns: Enable tagging for net_class directories in sysfs Eric W. Biederman
2008-08-21 6:40 ` [PATCH 8/8] sysfs: user namespaces: fix bug with clone(CLONE_NEWUSER) with fairsched Eric W. Biederman
2008-08-21 6:47 ` [PATCH 7/8] netns: Enable tagging for net_class directories in sysfs David Miller
2008-08-21 6:47 ` [PATCH 6/8] Revert "netns: Fix device renaming for sysfs" David Miller
2008-08-21 6:37 ` [PATCH 4/8] driver core: Implement tagged directory support for device classes Eric W. Biederman
2008-08-27 15:18 ` [PATCH 1/8] sysfs: Implement sysfs tagged directory support Benjamin Thery
2008-09-02 13:54 ` Mark Ryden
2008-09-02 14:03 ` Benjamin Thery
2008-09-02 17:01 ` Greg KH
2008-09-04 5:33 ` David Shwatrz
2008-09-04 6:44 ` Benjamin Thery
2008-09-08 18:39 ` Mark Ryden
2008-10-07 16:39 ` Mark Ryden
2008-10-07 16:48 ` Greg KH
2008-10-07 20:31 ` Eric W. Biederman
2008-10-07 21:09 ` Greg KH
2008-10-07 22:27 ` Eric W. Biederman
2008-10-08 13:00 ` Christoph Hellwig
2008-10-14 3:20 ` Eric W. Biederman
2008-10-07 16:52 ` Daniel Lezcano
2008-08-21 6:37 ` [PATCH 0/8] sysfs namespace support David Miller
2008-07-04 6:44 ` [PATCH 08/15] sysfs: Make sysfs_mount static once again Tejun Heo
2008-07-04 6:44 ` [PATCH 07/15] sysfs: sysfs_chmod_file handle multiple superblocks Tejun Heo
2008-08-20 2:16 ` patch sysfs-sysfs_chmod_file-handle-multiple-superblocks.patch added to gregkh-2.6 tree gregkh
2008-07-04 6:40 ` [PATCH 06/15] Introduce sysfs_sd_setattr and fix sysfs_chmod Tejun Heo
2008-08-20 2:16 ` patch sysfs-introduce-sysfs_sd_setattr-and-fix-sysfs_chmod.patch added to gregkh-2.6 tree gregkh
2008-08-20 2:16 ` patch sysfs-rename-support-multiple-superblocks.patch " gregkh
2008-08-20 2:16 ` patch sysfs-implement-__sysfs_get_dentry.patch " gregkh
2008-08-20 2:16 ` patch sysfs-sysfs_get_dentry-add-a-sb-parameter.patch " gregkh
2008-07-04 6:33 ` [PATCH 01/15] kobject: Cleanup kobject_rename and !CONFIG_SYSFS Tejun Heo
2008-08-20 1:48 ` patch kobject-cleanup-kobject_rename-and-config_sysfs.patch added to gregkh-2.6 tree gregkh
2008-07-04 1:27 ` [PATCH 00/15] sysfs support for namespaces Eric W. Biederman
2008-07-06 4:42 ` Eric W. Biederman
2008-07-07 11:41 ` Cornelia Huck
2008-07-07 12:22 ` Eric W. Biederman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=m14p76h27c.fsf_-_@frodo.ebiederm.org \
--to=ebiederm@xmission$(echo .)com \
--cc=akpm@linux-foundation$(echo .)org \
--cc=benjamin.thery@bull$(echo .)net \
--cc=containers@lists$(echo .)osdl.org \
--cc=dlezcano@fr$(echo .)ibm.com \
--cc=gregkh@suse$(echo .)de \
--cc=htejun@gmail$(echo .)com \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=viro@ftp$(echo .)linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox