2 * This program is free software; you can redistribute it and/or
3 * modify it under the terms of the GNU General Public License as
4 * published by the Free Software Foundation, version 2 of the
8 #include <linux/export.h>
9 #include <linux/nsproxy.h>
10 #include <linux/slab.h>
11 #include <linux/user_namespace.h>
12 #include <linux/highuid.h>
13 #include <linux/cred.h>
15 static struct kmem_cache
*user_ns_cachep __read_mostly
;
18 * Create a new user namespace, deriving the creator from the user in the
19 * passed credentials, and replacing that user with the new root user for the
22 * This is called by copy_creds(), which will finish setting the target task's
25 int create_user_ns(struct cred
*new)
27 struct user_namespace
*ns
, *parent_ns
= new->user_ns
;
28 struct user_struct
*root_user
;
31 ns
= kmem_cache_alloc(user_ns_cachep
, GFP_KERNEL
);
37 for (n
= 0; n
< UIDHASH_SZ
; ++n
)
38 INIT_HLIST_HEAD(ns
->uidhash_table
+ n
);
40 /* Alloc new root user. */
41 root_user
= alloc_uid(ns
, 0);
43 kmem_cache_free(user_ns_cachep
, ns
);
47 /* set the new root user in the credentials under preparation */
48 ns
->parent
= parent_ns
;
49 ns
->creator
= new->user
;
50 new->user
= root_user
;
51 new->uid
= new->euid
= new->suid
= new->fsuid
= 0;
52 new->gid
= new->egid
= new->sgid
= new->fsgid
= 0;
53 put_group_info(new->group_info
);
54 new->group_info
= get_group_info(&init_groups
);
56 key_put(new->request_key_auth
);
57 new->request_key_auth
= NULL
;
59 /* tgcred will be cleared in our caller bc CLONE_THREAD won't be set */
61 /* Leave the reference to our user_ns with the new cred */
68 * Deferred destructor for a user namespace. This is required because
69 * free_user_ns() may be called with uidhash_lock held, but we need to call
70 * back to free_uid() which will want to take the lock again.
72 static void free_user_ns_work(struct work_struct
*work
)
74 struct user_namespace
*parent
, *ns
=
75 container_of(work
, struct user_namespace
, destroyer
);
77 free_uid(ns
->creator
);
78 kmem_cache_free(user_ns_cachep
, ns
);
82 void free_user_ns(struct kref
*kref
)
84 struct user_namespace
*ns
=
85 container_of(kref
, struct user_namespace
, kref
);
87 INIT_WORK(&ns
->destroyer
, free_user_ns_work
);
88 schedule_work(&ns
->destroyer
);
90 EXPORT_SYMBOL(free_user_ns
);
92 uid_t
user_ns_map_uid(struct user_namespace
*to
, const struct cred
*cred
, uid_t uid
)
94 struct user_namespace
*tmp
;
96 if (likely(to
== cred
->user_ns
))
100 /* Is cred->user the creator of the target user_ns
101 * or the creator of one of it's parents?
103 for ( tmp
= to
; tmp
!= &init_user_ns
; tmp
= tmp
->parent
) {
104 if (cred
->user
== tmp
->creator
) {
109 /* No useful relationship so no mapping */
113 gid_t
user_ns_map_gid(struct user_namespace
*to
, const struct cred
*cred
, gid_t gid
)
115 struct user_namespace
*tmp
;
117 if (likely(to
== cred
->user_ns
))
120 /* Is cred->user the creator of the target user_ns
121 * or the creator of one of it's parents?
123 for ( tmp
= to
; tmp
!= &init_user_ns
; tmp
= tmp
->parent
) {
124 if (cred
->user
== tmp
->creator
) {
129 /* No useful relationship so no mapping */
133 static __init
int user_namespaces_init(void)
135 user_ns_cachep
= KMEM_CACHE(user_namespace
, SLAB_PANIC
);
138 module_init(user_namespaces_init
);