Message ID | 1468548742-32136-4-git-send-email-avagin@openvz.org (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
Andrey Vagin <avagin@openvz.org> writes: > diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c > index 3529a03..a63adfb 100644 > --- a/kernel/pid_namespace.c > +++ b/kernel/pid_namespace.c > @@ -388,12 +388,38 @@ static int pidns_install(struct nsproxy *nsproxy, struct ns_common *ns) > return 0; > } > > +static struct ns_common *pidns_get_parent(struct ns_common *ns) > +{ > + struct pid_namespace *active = task_active_pid_ns(current); > + struct pid_namespace *pid_ns, *p; > + > + pid_ns = to_pid_ns(ns); > + if (pid_ns == &init_pid_ns) { > + if (capable(CAP_SYS_ADMIN)) > + return ERR_PTR(-ENOENT); > + return ERR_PTR(-EPERM); > + } > + > + pid_ns = p = pid_ns->parent; > + > + for (;;) { > + if (p == active) > + break; > + if (p == &init_pid_ns) > + return ERR_PTR(-EPERM); > + p = p->parent; > + } Similarly to the user namespace issue the permission check here needs to be: if (!ns_capable(pid_ns->user_ns, CAP_SYS_ADMIN) return ERR_PTR(-EPERM); > + > + return &get_pid_ns(pid_ns)->ns; > +} > + > const struct proc_ns_operations pidns_operations = { > .name = "pid", > .type = CLONE_NEWPID, > .get = pidns_get, > .put = pidns_put, > .install = pidns_install, > + .get_parent = pidns_get_parent, > }; > Eric -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/nsfs.c b/fs/nsfs.c index 1e5d2d0..b607a42 100644 --- a/fs/nsfs.c +++ b/fs/nsfs.c @@ -169,6 +169,10 @@ static long ns_ioctl(struct file *filp, unsigned int ioctl, switch (ioctl) { case NS_GET_USERNS: return open_related_ns(ns, ns_get_owner); + case NS_GET_PARENT: + if (!ns->ops->get_parent) + return -EINVAL; + return open_related_ns(ns, ns->ops->get_parent); default: return -ENOTTY; } diff --git a/include/linux/proc_ns.h b/include/linux/proc_ns.h index de0e771..1c9f720 100644 --- a/include/linux/proc_ns.h +++ b/include/linux/proc_ns.h @@ -18,6 +18,7 @@ struct proc_ns_operations { struct ns_common *(*get)(struct task_struct *task); void (*put)(struct ns_common *ns); int (*install)(struct nsproxy *nsproxy, struct ns_common *ns); + struct ns_common *(*get_parent)(struct ns_common *ns); }; extern const struct proc_ns_operations netns_operations; diff --git a/include/uapi/linux/nsfs.h b/include/uapi/linux/nsfs.h index 7a09ede..88098ea 100644 --- a/include/uapi/linux/nsfs.h +++ b/include/uapi/linux/nsfs.h @@ -5,5 +5,6 @@ #define NSIO 0xb7 #define NS_GET_USERNS _IO(NSIO, 0x1) +#define NS_GET_PARENT _IO(NSIO, 0x2) #endif /* __LINUX_NSFS_H */ diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c index 3529a03..a63adfb 100644 --- a/kernel/pid_namespace.c +++ b/kernel/pid_namespace.c @@ -388,12 +388,38 @@ static int pidns_install(struct nsproxy *nsproxy, struct ns_common *ns) return 0; } +static struct ns_common *pidns_get_parent(struct ns_common *ns) +{ + struct pid_namespace *active = task_active_pid_ns(current); + struct pid_namespace *pid_ns, *p; + + pid_ns = to_pid_ns(ns); + if (pid_ns == &init_pid_ns) { + if (capable(CAP_SYS_ADMIN)) + return ERR_PTR(-ENOENT); + return ERR_PTR(-EPERM); + } + + pid_ns = p = pid_ns->parent; + + for (;;) { + if (p == active) + break; + if (p == &init_pid_ns) + return ERR_PTR(-EPERM); + p = p->parent; + } + + return &get_pid_ns(pid_ns)->ns; +} + const struct proc_ns_operations pidns_operations = { .name = "pid", .type = CLONE_NEWPID, .get = pidns_get, .put = pidns_put, .install = pidns_install, + .get_parent = pidns_get_parent, }; static __init int pid_namespaces_init(void) diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index 6382e5e..d6ba0b8 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -1024,6 +1024,7 @@ const struct proc_ns_operations userns_operations = { .get = userns_get, .put = userns_put, .install = userns_install, + .get_parent = ns_get_owner, }; static __init int user_namespaces_init(void)
Pid and user namepaces are hierarchical. There is no way to discover parent-child relationships. In a future we will use this interface to dump and restore nested namespaces. Signed-off-by: Andrey Vagin <avagin@openvz.org> --- fs/nsfs.c | 4 ++++ include/linux/proc_ns.h | 1 + include/uapi/linux/nsfs.h | 1 + kernel/pid_namespace.c | 26 ++++++++++++++++++++++++++ kernel/user_namespace.c | 1 + 5 files changed, 33 insertions(+)