2 * This program is free software; you can redistribute it and/or
3 * modify it under the terms of the GNU General Public License as
4 * published by the Free Software Foundation, version 2 of the
8 #include <linux/export.h>
9 #include <linux/nsproxy.h>
10 #include <linux/slab.h>
11 #include <linux/sched/signal.h>
12 #include <linux/user_namespace.h>
13 #include <linux/proc_ns.h>
14 #include <linux/highuid.h>
15 #include <linux/cred.h>
16 #include <linux/securebits.h>
17 #include <linux/keyctl.h>
18 #include <linux/key-type.h>
19 #include <keys/user-type.h>
20 #include <linux/seq_file.h>
22 #include <linux/uaccess.h>
23 #include <linux/ctype.h>
24 #include <linux/projid.h>
25 #include <linux/fs_struct.h>
27 static struct kmem_cache *user_ns_cachep __read_mostly;
28 static DEFINE_MUTEX(userns_state_mutex);
30 static bool new_idmap_permitted(const struct file *file,
31 struct user_namespace *ns, int cap_setid,
32 struct uid_gid_map *map);
33 static void free_user_ns(struct work_struct *work);
35 static struct ucounts *inc_user_namespaces(struct user_namespace *ns, kuid_t uid)
37 return inc_ucount(ns, uid, UCOUNT_USER_NAMESPACES);
40 static void dec_user_namespaces(struct ucounts *ucounts)
42 return dec_ucount(ucounts, UCOUNT_USER_NAMESPACES);
45 static void set_cred_user_ns(struct cred *cred, struct user_namespace *user_ns)
47 /* Start with the same capabilities as init but useless for doing
48 * anything as the capabilities are bound to the new user namespace.
50 cred->securebits = SECUREBITS_DEFAULT;
51 cred->cap_inheritable = CAP_EMPTY_SET;
52 cred->cap_permitted = CAP_FULL_SET;
53 cred->cap_effective = CAP_FULL_SET;
54 cred->cap_ambient = CAP_EMPTY_SET;
55 cred->cap_bset = CAP_FULL_SET;
57 key_put(cred->request_key_auth);
58 cred->request_key_auth = NULL;
60 /* tgcred will be cleared in our caller bc CLONE_THREAD won't be set */
61 cred->user_ns = user_ns;
65 * Create a new user namespace, deriving the creator from the user in the
66 * passed credentials, and replacing that user with the new root user for the
69 * This is called by copy_creds(), which will finish setting the target task's
72 int create_user_ns(struct cred *new)
74 struct user_namespace *ns, *parent_ns = new->user_ns;
75 kuid_t owner = new->euid;
76 kgid_t group = new->egid;
77 struct ucounts *ucounts;
81 if (parent_ns->level > 32)
84 ucounts = inc_user_namespaces(parent_ns, owner);
89 * Verify that we can not violate the policy of which files
90 * may be accessed that is specified by the root directory,
91 * by verifing that the root directory is at the root of the
92 * mount namespace which allows all files to be accessed.
95 if (current_chrooted())
98 /* The creator needs a mapping in the parent user namespace
99 * or else we won't be able to reasonably tell userspace who
100 * created a user_namespace.
103 if (!kuid_has_mapping(parent_ns, owner) ||
104 !kgid_has_mapping(parent_ns, group))
108 ns = kmem_cache_zalloc(user_ns_cachep, GFP_KERNEL);
112 ret = ns_alloc_inum(&ns->ns);
115 ns->ns.ops = &userns_operations;
117 atomic_set(&ns->count, 1);
118 /* Leave the new->user_ns reference with the new user namespace. */
119 ns->parent = parent_ns;
120 ns->level = parent_ns->level + 1;
123 INIT_WORK(&ns->work, free_user_ns);
124 for (i = 0; i < UCOUNT_COUNTS; i++) {
125 ns->ucount_max[i] = INT_MAX;
127 ns->ucounts = ucounts;
129 /* Inherit USERNS_SETGROUPS_ALLOWED from our parent */
130 mutex_lock(&userns_state_mutex);
131 ns->flags = parent_ns->flags;
132 mutex_unlock(&userns_state_mutex);
134 #ifdef CONFIG_PERSISTENT_KEYRINGS
135 init_rwsem(&ns->persistent_keyring_register_sem);
138 if (!setup_userns_sysctls(ns))
141 set_cred_user_ns(new, ns);
144 #ifdef CONFIG_PERSISTENT_KEYRINGS
145 key_put(ns->persistent_keyring_register);
147 ns_free_inum(&ns->ns);
149 kmem_cache_free(user_ns_cachep, ns);
151 dec_user_namespaces(ucounts);
156 int unshare_userns(unsigned long unshare_flags, struct cred **new_cred)
161 if (!(unshare_flags & CLONE_NEWUSER))
164 cred = prepare_creds();
166 err = create_user_ns(cred);
176 static void free_user_ns(struct work_struct *work)
178 struct user_namespace *parent, *ns =
179 container_of(work, struct user_namespace, work);
182 struct ucounts *ucounts = ns->ucounts;
184 retire_userns_sysctls(ns);
185 #ifdef CONFIG_PERSISTENT_KEYRINGS
186 key_put(ns->persistent_keyring_register);
188 ns_free_inum(&ns->ns);
189 kmem_cache_free(user_ns_cachep, ns);
190 dec_user_namespaces(ucounts);
192 } while (atomic_dec_and_test(&parent->count));
195 void __put_user_ns(struct user_namespace *ns)
197 schedule_work(&ns->work);
199 EXPORT_SYMBOL(__put_user_ns);
201 static u32 map_id_range_down(struct uid_gid_map *map, u32 id, u32 count)
203 unsigned idx, extents;
204 u32 first, last, id2;
206 id2 = id + count - 1;
208 /* Find the matching extent */
209 extents = map->nr_extents;
211 for (idx = 0; idx < extents; idx++) {
212 first = map->extent[idx].first;
213 last = first + map->extent[idx].count - 1;
214 if (id >= first && id <= last &&
215 (id2 >= first && id2 <= last))
218 /* Map the id or note failure */
220 id = (id - first) + map->extent[idx].lower_first;
227 static u32 map_id_down(struct uid_gid_map *map, u32 id)
229 unsigned idx, extents;
232 /* Find the matching extent */
233 extents = map->nr_extents;
235 for (idx = 0; idx < extents; idx++) {
236 first = map->extent[idx].first;
237 last = first + map->extent[idx].count - 1;
238 if (id >= first && id <= last)
241 /* Map the id or note failure */
243 id = (id - first) + map->extent[idx].lower_first;
250 static u32 map_id_up(struct uid_gid_map *map, u32 id)
252 unsigned idx, extents;
255 /* Find the matching extent */
256 extents = map->nr_extents;
258 for (idx = 0; idx < extents; idx++) {
259 first = map->extent[idx].lower_first;
260 last = first + map->extent[idx].count - 1;
261 if (id >= first && id <= last)
264 /* Map the id or note failure */
266 id = (id - first) + map->extent[idx].first;
274 * make_kuid - Map a user-namespace uid pair into a kuid.
275 * @ns: User namespace that the uid is in
276 * @uid: User identifier
278 * Maps a user-namespace uid pair into a kernel internal kuid,
279 * and returns that kuid.
281 * When there is no mapping defined for the user-namespace uid
282 * pair INVALID_UID is returned. Callers are expected to test
283 * for and handle INVALID_UID being returned. INVALID_UID
284 * may be tested for using uid_valid().
286 kuid_t make_kuid(struct user_namespace *ns, uid_t uid)
288 /* Map the uid to a global kernel uid */
289 return KUIDT_INIT(map_id_down(&ns->uid_map, uid));
291 EXPORT_SYMBOL(make_kuid);
294 * from_kuid - Create a uid from a kuid user-namespace pair.
295 * @targ: The user namespace we want a uid in.
296 * @kuid: The kernel internal uid to start with.
298 * Map @kuid into the user-namespace specified by @targ and
299 * return the resulting uid.
301 * There is always a mapping into the initial user_namespace.
303 * If @kuid has no mapping in @targ (uid_t)-1 is returned.
305 uid_t from_kuid(struct user_namespace *targ, kuid_t kuid)
307 /* Map the uid from a global kernel uid */
308 return map_id_up(&targ->uid_map, __kuid_val(kuid));
310 EXPORT_SYMBOL(from_kuid);
313 * from_kuid_munged - Create a uid from a kuid user-namespace pair.
314 * @targ: The user namespace we want a uid in.
315 * @kuid: The kernel internal uid to start with.
317 * Map @kuid into the user-namespace specified by @targ and
318 * return the resulting uid.
320 * There is always a mapping into the initial user_namespace.
322 * Unlike from_kuid from_kuid_munged never fails and always
323 * returns a valid uid. This makes from_kuid_munged appropriate
324 * for use in syscalls like stat and getuid where failing the
325 * system call and failing to provide a valid uid are not an
328 * If @kuid has no mapping in @targ overflowuid is returned.
330 uid_t from_kuid_munged(struct user_namespace *targ, kuid_t kuid)
333 uid = from_kuid(targ, kuid);
335 if (uid == (uid_t) -1)
339 EXPORT_SYMBOL(from_kuid_munged);
342 * make_kgid - Map a user-namespace gid pair into a kgid.
343 * @ns: User namespace that the gid is in
344 * @gid: group identifier
346 * Maps a user-namespace gid pair into a kernel internal kgid,
347 * and returns that kgid.
349 * When there is no mapping defined for the user-namespace gid
350 * pair INVALID_GID is returned. Callers are expected to test
351 * for and handle INVALID_GID being returned. INVALID_GID may be
352 * tested for using gid_valid().
354 kgid_t make_kgid(struct user_namespace *ns, gid_t gid)
356 /* Map the gid to a global kernel gid */
357 return KGIDT_INIT(map_id_down(&ns->gid_map, gid));
359 EXPORT_SYMBOL(make_kgid);
362 * from_kgid - Create a gid from a kgid user-namespace pair.
363 * @targ: The user namespace we want a gid in.
364 * @kgid: The kernel internal gid to start with.
366 * Map @kgid into the user-namespace specified by @targ and
367 * return the resulting gid.
369 * There is always a mapping into the initial user_namespace.
371 * If @kgid has no mapping in @targ (gid_t)-1 is returned.
373 gid_t from_kgid(struct user_namespace *targ, kgid_t kgid)
375 /* Map the gid from a global kernel gid */
376 return map_id_up(&targ->gid_map, __kgid_val(kgid));
378 EXPORT_SYMBOL(from_kgid);
381 * from_kgid_munged - Create a gid from a kgid user-namespace pair.
382 * @targ: The user namespace we want a gid in.
383 * @kgid: The kernel internal gid to start with.
385 * Map @kgid into the user-namespace specified by @targ and
386 * return the resulting gid.
388 * There is always a mapping into the initial user_namespace.
390 * Unlike from_kgid from_kgid_munged never fails and always
391 * returns a valid gid. This makes from_kgid_munged appropriate
392 * for use in syscalls like stat and getgid where failing the
393 * system call and failing to provide a valid gid are not options.
395 * If @kgid has no mapping in @targ overflowgid is returned.
397 gid_t from_kgid_munged(struct user_namespace *targ, kgid_t kgid)
400 gid = from_kgid(targ, kgid);
402 if (gid == (gid_t) -1)
406 EXPORT_SYMBOL(from_kgid_munged);
409 * make_kprojid - Map a user-namespace projid pair into a kprojid.
410 * @ns: User namespace that the projid is in
411 * @projid: Project identifier
413 * Maps a user-namespace uid pair into a kernel internal kuid,
414 * and returns that kuid.
416 * When there is no mapping defined for the user-namespace projid
417 * pair INVALID_PROJID is returned. Callers are expected to test
418 * for and handle handle INVALID_PROJID being returned. INVALID_PROJID
419 * may be tested for using projid_valid().
421 kprojid_t make_kprojid(struct user_namespace *ns, projid_t projid)
423 /* Map the uid to a global kernel uid */
424 return KPROJIDT_INIT(map_id_down(&ns->projid_map, projid));
426 EXPORT_SYMBOL(make_kprojid);
429 * from_kprojid - Create a projid from a kprojid user-namespace pair.
430 * @targ: The user namespace we want a projid in.
431 * @kprojid: The kernel internal project identifier to start with.
433 * Map @kprojid into the user-namespace specified by @targ and
434 * return the resulting projid.
436 * There is always a mapping into the initial user_namespace.
438 * If @kprojid has no mapping in @targ (projid_t)-1 is returned.
440 projid_t from_kprojid(struct user_namespace *targ, kprojid_t kprojid)
442 /* Map the uid from a global kernel uid */
443 return map_id_up(&targ->projid_map, __kprojid_val(kprojid));
445 EXPORT_SYMBOL(from_kprojid);
448 * from_kprojid_munged - Create a projiid from a kprojid user-namespace pair.
449 * @targ: The user namespace we want a projid in.
450 * @kprojid: The kernel internal projid to start with.
452 * Map @kprojid into the user-namespace specified by @targ and
453 * return the resulting projid.
455 * There is always a mapping into the initial user_namespace.
457 * Unlike from_kprojid from_kprojid_munged never fails and always
458 * returns a valid projid. This makes from_kprojid_munged
459 * appropriate for use in syscalls like stat and where
460 * failing the system call and failing to provide a valid projid are
463 * If @kprojid has no mapping in @targ OVERFLOW_PROJID is returned.
465 projid_t from_kprojid_munged(struct user_namespace *targ, kprojid_t kprojid)
468 projid = from_kprojid(targ, kprojid);
470 if (projid == (projid_t) -1)
471 projid = OVERFLOW_PROJID;
474 EXPORT_SYMBOL(from_kprojid_munged);
477 static int uid_m_show(struct seq_file *seq, void *v)
479 struct user_namespace *ns = seq->private;
480 struct uid_gid_extent *extent = v;
481 struct user_namespace *lower_ns;
484 lower_ns = seq_user_ns(seq);
485 if ((lower_ns == ns) && lower_ns->parent)
486 lower_ns = lower_ns->parent;
488 lower = from_kuid(lower_ns, KUIDT_INIT(extent->lower_first));
490 seq_printf(seq, "%10u %10u %10u\n",
498 static int gid_m_show(struct seq_file *seq, void *v)
500 struct user_namespace *ns = seq->private;
501 struct uid_gid_extent *extent = v;
502 struct user_namespace *lower_ns;
505 lower_ns = seq_user_ns(seq);
506 if ((lower_ns == ns) && lower_ns->parent)
507 lower_ns = lower_ns->parent;
509 lower = from_kgid(lower_ns, KGIDT_INIT(extent->lower_first));
511 seq_printf(seq, "%10u %10u %10u\n",
519 static int projid_m_show(struct seq_file *seq, void *v)
521 struct user_namespace *ns = seq->private;
522 struct uid_gid_extent *extent = v;
523 struct user_namespace *lower_ns;
526 lower_ns = seq_user_ns(seq);
527 if ((lower_ns == ns) && lower_ns->parent)
528 lower_ns = lower_ns->parent;
530 lower = from_kprojid(lower_ns, KPROJIDT_INIT(extent->lower_first));
532 seq_printf(seq, "%10u %10u %10u\n",
540 static void *m_start(struct seq_file *seq, loff_t *ppos,
541 struct uid_gid_map *map)
543 struct uid_gid_extent *extent = NULL;
546 if (pos < map->nr_extents)
547 extent = &map->extent[pos];
552 static void *uid_m_start(struct seq_file *seq, loff_t *ppos)
554 struct user_namespace *ns = seq->private;
556 return m_start(seq, ppos, &ns->uid_map);
559 static void *gid_m_start(struct seq_file *seq, loff_t *ppos)
561 struct user_namespace *ns = seq->private;
563 return m_start(seq, ppos, &ns->gid_map);
566 static void *projid_m_start(struct seq_file *seq, loff_t *ppos)
568 struct user_namespace *ns = seq->private;
570 return m_start(seq, ppos, &ns->projid_map);
573 static void *m_next(struct seq_file *seq, void *v, loff_t *pos)
576 return seq->op->start(seq, pos);
579 static void m_stop(struct seq_file *seq, void *v)
584 const struct seq_operations proc_uid_seq_operations = {
585 .start = uid_m_start,
591 const struct seq_operations proc_gid_seq_operations = {
592 .start = gid_m_start,
598 const struct seq_operations proc_projid_seq_operations = {
599 .start = projid_m_start,
602 .show = projid_m_show,
605 static bool mappings_overlap(struct uid_gid_map *new_map,
606 struct uid_gid_extent *extent)
608 u32 upper_first, lower_first, upper_last, lower_last;
611 upper_first = extent->first;
612 lower_first = extent->lower_first;
613 upper_last = upper_first + extent->count - 1;
614 lower_last = lower_first + extent->count - 1;
616 for (idx = 0; idx < new_map->nr_extents; idx++) {
617 u32 prev_upper_first, prev_lower_first;
618 u32 prev_upper_last, prev_lower_last;
619 struct uid_gid_extent *prev;
621 prev = &new_map->extent[idx];
623 prev_upper_first = prev->first;
624 prev_lower_first = prev->lower_first;
625 prev_upper_last = prev_upper_first + prev->count - 1;
626 prev_lower_last = prev_lower_first + prev->count - 1;
628 /* Does the upper range intersect a previous extent? */
629 if ((prev_upper_first <= upper_last) &&
630 (prev_upper_last >= upper_first))
633 /* Does the lower range intersect a previous extent? */
634 if ((prev_lower_first <= lower_last) &&
635 (prev_lower_last >= lower_first))
641 static ssize_t map_write(struct file *file, const char __user *buf,
642 size_t count, loff_t *ppos,
644 struct uid_gid_map *map,
645 struct uid_gid_map *parent_map)
647 struct seq_file *seq = file->private_data;
648 struct user_namespace *ns = seq->private;
649 struct uid_gid_map new_map;
651 struct uid_gid_extent *extent = NULL;
652 char *kbuf = NULL, *pos, *next_line;
655 /* Only allow < page size writes at the beginning of the file */
656 if ((*ppos != 0) || (count >= PAGE_SIZE))
659 /* Slurp in the user data */
660 kbuf = memdup_user_nul(buf, count);
662 return PTR_ERR(kbuf);
665 * The userns_state_mutex serializes all writes to any given map.
667 * Any map is only ever written once.
669 * An id map fits within 1 cache line on most architectures.
671 * On read nothing needs to be done unless you are on an
672 * architecture with a crazy cache coherency model like alpha.
674 * There is a one time data dependency between reading the
675 * count of the extents and the values of the extents. The
676 * desired behavior is to see the values of the extents that
677 * were written before the count of the extents.
679 * To achieve this smp_wmb() is used on guarantee the write
680 * order and smp_rmb() is guaranteed that we don't have crazy
681 * architectures returning stale data.
683 mutex_lock(&userns_state_mutex);
686 /* Only allow one successful write to the map */
687 if (map->nr_extents != 0)
691 * Adjusting namespace settings requires capabilities on the target.
693 if (cap_valid(cap_setid) && !file_ns_capable(file, ns, CAP_SYS_ADMIN))
696 /* Parse the user data */
699 new_map.nr_extents = 0;
700 for (; pos; pos = next_line) {
701 extent = &new_map.extent[new_map.nr_extents];
703 /* Find the end of line and ensure I don't look past it */
704 next_line = strchr(pos, '\n');
708 if (*next_line == '\0')
712 pos = skip_spaces(pos);
713 extent->first = simple_strtoul(pos, &pos, 10);
717 pos = skip_spaces(pos);
718 extent->lower_first = simple_strtoul(pos, &pos, 10);
722 pos = skip_spaces(pos);
723 extent->count = simple_strtoul(pos, &pos, 10);
724 if (*pos && !isspace(*pos))
727 /* Verify there is not trailing junk on the line */
728 pos = skip_spaces(pos);
732 /* Verify we have been given valid starting values */
733 if ((extent->first == (u32) -1) ||
734 (extent->lower_first == (u32) -1))
737 /* Verify count is not zero and does not cause the
740 if ((extent->first + extent->count) <= extent->first)
742 if ((extent->lower_first + extent->count) <=
746 /* Do the ranges in extent overlap any previous extents? */
747 if (mappings_overlap(&new_map, extent))
750 new_map.nr_extents++;
752 /* Fail if the file contains too many extents */
753 if ((new_map.nr_extents == UID_GID_MAP_MAX_EXTENTS) &&
757 /* Be very certaint the new map actually exists */
758 if (new_map.nr_extents == 0)
762 /* Validate the user is allowed to use user id's mapped to. */
763 if (!new_idmap_permitted(file, ns, cap_setid, &new_map))
766 /* Map the lower ids from the parent user namespace to the
767 * kernel global id space.
769 for (idx = 0; idx < new_map.nr_extents; idx++) {
771 extent = &new_map.extent[idx];
773 lower_first = map_id_range_down(parent_map,
777 /* Fail if we can not map the specified extent to
778 * the kernel global id space.
780 if (lower_first == (u32) -1)
783 extent->lower_first = lower_first;
786 /* Install the map */
787 memcpy(map->extent, new_map.extent,
788 new_map.nr_extents*sizeof(new_map.extent[0]));
790 map->nr_extents = new_map.nr_extents;
795 mutex_unlock(&userns_state_mutex);
800 ssize_t proc_uid_map_write(struct file *file, const char __user *buf,
801 size_t size, loff_t *ppos)
803 struct seq_file *seq = file->private_data;
804 struct user_namespace *ns = seq->private;
805 struct user_namespace *seq_ns = seq_user_ns(seq);
810 if ((seq_ns != ns) && (seq_ns != ns->parent))
813 return map_write(file, buf, size, ppos, CAP_SETUID,
814 &ns->uid_map, &ns->parent->uid_map);
817 ssize_t proc_gid_map_write(struct file *file, const char __user *buf,
818 size_t size, loff_t *ppos)
820 struct seq_file *seq = file->private_data;
821 struct user_namespace *ns = seq->private;
822 struct user_namespace *seq_ns = seq_user_ns(seq);
827 if ((seq_ns != ns) && (seq_ns != ns->parent))
830 return map_write(file, buf, size, ppos, CAP_SETGID,
831 &ns->gid_map, &ns->parent->gid_map);
834 ssize_t proc_projid_map_write(struct file *file, const char __user *buf,
835 size_t size, loff_t *ppos)
837 struct seq_file *seq = file->private_data;
838 struct user_namespace *ns = seq->private;
839 struct user_namespace *seq_ns = seq_user_ns(seq);
844 if ((seq_ns != ns) && (seq_ns != ns->parent))
847 /* Anyone can set any valid project id no capability needed */
848 return map_write(file, buf, size, ppos, -1,
849 &ns->projid_map, &ns->parent->projid_map);
852 static bool new_idmap_permitted(const struct file *file,
853 struct user_namespace *ns, int cap_setid,
854 struct uid_gid_map *new_map)
856 const struct cred *cred = file->f_cred;
857 /* Don't allow mappings that would allow anything that wouldn't
858 * be allowed without the establishment of unprivileged mappings.
860 if ((new_map->nr_extents == 1) && (new_map->extent[0].count == 1) &&
861 uid_eq(ns->owner, cred->euid)) {
862 u32 id = new_map->extent[0].lower_first;
863 if (cap_setid == CAP_SETUID) {
864 kuid_t uid = make_kuid(ns->parent, id);
865 if (uid_eq(uid, cred->euid))
867 } else if (cap_setid == CAP_SETGID) {
868 kgid_t gid = make_kgid(ns->parent, id);
869 if (!(ns->flags & USERNS_SETGROUPS_ALLOWED) &&
870 gid_eq(gid, cred->egid))
875 /* Allow anyone to set a mapping that doesn't require privilege */
876 if (!cap_valid(cap_setid))
879 /* Allow the specified ids if we have the appropriate capability
880 * (CAP_SETUID or CAP_SETGID) over the parent user namespace.
881 * And the opener of the id file also had the approprpiate capability.
883 if (ns_capable(ns->parent, cap_setid) &&
884 file_ns_capable(file, ns->parent, cap_setid))
890 int proc_setgroups_show(struct seq_file *seq, void *v)
892 struct user_namespace *ns = seq->private;
893 unsigned long userns_flags = ACCESS_ONCE(ns->flags);
895 seq_printf(seq, "%s\n",
896 (userns_flags & USERNS_SETGROUPS_ALLOWED) ?
901 ssize_t proc_setgroups_write(struct file *file, const char __user *buf,
902 size_t count, loff_t *ppos)
904 struct seq_file *seq = file->private_data;
905 struct user_namespace *ns = seq->private;
907 bool setgroups_allowed;
910 /* Only allow a very narrow range of strings to be written */
912 if ((*ppos != 0) || (count >= sizeof(kbuf)))
915 /* What was written? */
917 if (copy_from_user(kbuf, buf, count))
922 /* What is being requested? */
924 if (strncmp(pos, "allow", 5) == 0) {
926 setgroups_allowed = true;
928 else if (strncmp(pos, "deny", 4) == 0) {
930 setgroups_allowed = false;
935 /* Verify there is not trailing junk on the line */
936 pos = skip_spaces(pos);
941 mutex_lock(&userns_state_mutex);
942 if (setgroups_allowed) {
943 /* Enabling setgroups after setgroups has been disabled
946 if (!(ns->flags & USERNS_SETGROUPS_ALLOWED))
949 /* Permanently disabling setgroups after setgroups has
950 * been enabled by writing the gid_map is not allowed.
952 if (ns->gid_map.nr_extents != 0)
954 ns->flags &= ~USERNS_SETGROUPS_ALLOWED;
956 mutex_unlock(&userns_state_mutex);
958 /* Report a successful write */
964 mutex_unlock(&userns_state_mutex);
968 bool userns_may_setgroups(const struct user_namespace *ns)
972 mutex_lock(&userns_state_mutex);
973 /* It is not safe to use setgroups until a gid mapping in
974 * the user namespace has been established.
976 allowed = ns->gid_map.nr_extents != 0;
977 /* Is setgroups allowed? */
978 allowed = allowed && (ns->flags & USERNS_SETGROUPS_ALLOWED);
979 mutex_unlock(&userns_state_mutex);
985 * Returns true if @child is the same namespace or a descendant of
988 bool in_userns(const struct user_namespace *ancestor,
989 const struct user_namespace *child)
991 const struct user_namespace *ns;
992 for (ns = child; ns->level > ancestor->level; ns = ns->parent)
994 return (ns == ancestor);
997 bool current_in_userns(const struct user_namespace *target_ns)
999 return in_userns(target_ns, current_user_ns());
1002 static inline struct user_namespace *to_user_ns(struct ns_common *ns)
1004 return container_of(ns, struct user_namespace, ns);
1007 static struct ns_common *userns_get(struct task_struct *task)
1009 struct user_namespace *user_ns;
1012 user_ns = get_user_ns(__task_cred(task)->user_ns);
1015 return user_ns ? &user_ns->ns : NULL;
1018 static void userns_put(struct ns_common *ns)
1020 put_user_ns(to_user_ns(ns));
1023 static int userns_install(struct nsproxy *nsproxy, struct ns_common *ns)
1025 struct user_namespace *user_ns = to_user_ns(ns);
1028 /* Don't allow gaining capabilities by reentering
1029 * the same user namespace.
1031 if (user_ns == current_user_ns())
1034 /* Tasks that share a thread group must share a user namespace */
1035 if (!thread_group_empty(current))
1038 if (current->fs->users != 1)
1041 if (!ns_capable(user_ns, CAP_SYS_ADMIN))
1044 cred = prepare_creds();
1048 put_user_ns(cred->user_ns);
1049 set_cred_user_ns(cred, get_user_ns(user_ns));
1051 return commit_creds(cred);
1054 struct ns_common *ns_get_owner(struct ns_common *ns)
1056 struct user_namespace *my_user_ns = current_user_ns();
1057 struct user_namespace *owner, *p;
1059 /* See if the owner is in the current user namespace */
1060 owner = p = ns->ops->owner(ns);
1063 return ERR_PTR(-EPERM);
1064 if (p == my_user_ns)
1069 return &get_user_ns(owner)->ns;
1072 static struct user_namespace *userns_owner(struct ns_common *ns)
1074 return to_user_ns(ns)->parent;
1077 const struct proc_ns_operations userns_operations = {
1079 .type = CLONE_NEWUSER,
1082 .install = userns_install,
1083 .owner = userns_owner,
1084 .get_parent = ns_get_owner,
1087 static __init int user_namespaces_init(void)
1089 user_ns_cachep = KMEM_CACHE(user_namespace, SLAB_PANIC);
1092 subsys_initcall(user_namespaces_init);