From patchwork Tue Jul 26 18:58:29 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Serge E. Hallyn" X-Patchwork-Id: 106916 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id DFF70B6F83 for ; Wed, 27 Jul 2011 05:06:50 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753000Ab1GZTGr (ORCPT ); Tue, 26 Jul 2011 15:06:47 -0400 Received: from 50-56-35-84.static.cloud-ips.com ([50.56.35.84]:50588 "EHLO mail" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751900Ab1GZTGk (ORCPT ); Tue, 26 Jul 2011 15:06:40 -0400 Received: by mail (Postfix, from userid 1000) id 881C6100EF4; Tue, 26 Jul 2011 18:58:46 +0000 (UTC) From: Serge Hallyn To: linux-kernel@vger.kernel.org Cc: dhowells@redhat.com, ebiederm@xmission.com, containers@lists.linux-foundation.org, netdev@vger.kernel.org, akpm@osdl.org, "Serge E. Hallyn" Subject: [PATCH 06/14] user namespace: make each net (net_ns) belong to a user_ns Date: Tue, 26 Jul 2011 18:58:29 +0000 Message-Id: <1311706717-7398-7-git-send-email-serge@hallyn.com> X-Mailer: git-send-email 1.7.0.4 In-Reply-To: <1311706717-7398-1-git-send-email-serge@hallyn.com> References: <1311706717-7398-1-git-send-email-serge@hallyn.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Serge E. Hallyn This way we can target capabilites at the user_ns which created the net ns. Changelog: jul 8: nsproxy: don't assign netns->userns if not cloning. Signed-off-by: Serge E. Hallyn Cc: Eric W. Biederman --- include/net/net_namespace.h | 2 ++ kernel/nsproxy.c | 2 ++ net/core/net_namespace.c | 3 +++ 3 files changed, 7 insertions(+), 0 deletions(-) diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h index 1ab1aec..38a5154 100644 --- a/include/net/net_namespace.h +++ b/include/net/net_namespace.h @@ -29,6 +29,7 @@ struct ctl_table_header; struct net_generic; struct sock; struct netns_ipvs; +struct user_namespace; #define NETDEV_HASHBITS 8 @@ -101,6 +102,7 @@ struct net { struct netns_xfrm xfrm; #endif struct netns_ipvs *ipvs; + struct user_namespace *user_ns; }; diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c index f50542d..e616904 100644 --- a/kernel/nsproxy.c +++ b/kernel/nsproxy.c @@ -95,6 +95,8 @@ static struct nsproxy *create_new_namespaces(unsigned long flags, err = PTR_ERR(new_nsp->net_ns); goto out_net; } + if (flags & CLONE_NEWNET) + new_nsp->net_ns->user_ns = get_user_ns(task_cred_xxx(tsk, user_ns)); return new_nsp; diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c index 5bbdbf0..791c19c 100644 --- a/net/core/net_namespace.c +++ b/net/core/net_namespace.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include @@ -209,6 +210,7 @@ static void net_free(struct net *net) } #endif kfree(net->gen); + put_user_ns(net->user_ns); kmem_cache_free(net_cachep, net); } @@ -389,6 +391,7 @@ static int __init net_ns_init(void) rcu_assign_pointer(init_net.gen, ng); mutex_lock(&net_mutex); + init_net.user_ns = &init_user_ns; if (setup_net(&init_net)) panic("Could not setup the initial network namespace");