2 * This program is free software; you can redistribute it and/or
3 * modify it under the terms of the GNU General Public License as
4 * published by the Free Software Foundation, version 2 of the
8 #include <linux/export.h>
9 #include <linux/nsproxy.h>
10 #include <linux/slab.h>
11 #include <linux/user_namespace.h>
12 #include <linux/highuid.h>
13 #include <linux/cred.h>
14 #include <linux/securebits.h>
16 static struct kmem_cache
*user_ns_cachep __read_mostly
;
19 * Create a new user namespace, deriving the creator from the user in the
20 * passed credentials, and replacing that user with the new root user for the
23 * This is called by copy_creds(), which will finish setting the target task's
26 int create_user_ns(struct cred
*new)
28 struct user_namespace
*ns
, *parent_ns
= new->user_ns
;
29 struct user_struct
*root_user
;
31 ns
= kmem_cache_alloc(user_ns_cachep
, GFP_KERNEL
);
37 /* Alloc new root user. */
38 root_user
= alloc_uid(make_kuid(ns
, 0));
40 kmem_cache_free(user_ns_cachep
, ns
);
44 /* set the new root user in the credentials under preparation */
45 ns
->parent
= parent_ns
;
46 ns
->creator
= new->user
;
47 new->user
= root_user
;
48 new->uid
= new->euid
= new->suid
= new->fsuid
= 0;
49 new->gid
= new->egid
= new->sgid
= new->fsgid
= 0;
50 put_group_info(new->group_info
);
51 new->group_info
= get_group_info(&init_groups
);
52 /* Start with the same capabilities as init but useless for doing
53 * anything as the capabilities are bound to the new user namespace.
55 new->securebits
= SECUREBITS_DEFAULT
;
56 new->cap_inheritable
= CAP_EMPTY_SET
;
57 new->cap_permitted
= CAP_FULL_SET
;
58 new->cap_effective
= CAP_FULL_SET
;
59 new->cap_bset
= CAP_FULL_SET
;
61 key_put(new->request_key_auth
);
62 new->request_key_auth
= NULL
;
64 /* tgcred will be cleared in our caller bc CLONE_THREAD won't be set */
66 /* Leave the reference to our user_ns with the new cred */
73 * Deferred destructor for a user namespace. This is required because
74 * free_user_ns() may be called with uidhash_lock held, but we need to call
75 * back to free_uid() which will want to take the lock again.
77 static void free_user_ns_work(struct work_struct
*work
)
79 struct user_namespace
*parent
, *ns
=
80 container_of(work
, struct user_namespace
, destroyer
);
82 free_uid(ns
->creator
);
83 kmem_cache_free(user_ns_cachep
, ns
);
87 void free_user_ns(struct kref
*kref
)
89 struct user_namespace
*ns
=
90 container_of(kref
, struct user_namespace
, kref
);
92 INIT_WORK(&ns
->destroyer
, free_user_ns_work
);
93 schedule_work(&ns
->destroyer
);
95 EXPORT_SYMBOL(free_user_ns
);
97 uid_t
user_ns_map_uid(struct user_namespace
*to
, const struct cred
*cred
, uid_t uid
)
99 struct user_namespace
*tmp
;
101 if (likely(to
== cred
->user_ns
))
105 /* Is cred->user the creator of the target user_ns
106 * or the creator of one of it's parents?
108 for ( tmp
= to
; tmp
!= &init_user_ns
; tmp
= tmp
->parent
) {
109 if (cred
->user
== tmp
->creator
) {
114 /* No useful relationship so no mapping */
118 gid_t
user_ns_map_gid(struct user_namespace
*to
, const struct cred
*cred
, gid_t gid
)
120 struct user_namespace
*tmp
;
122 if (likely(to
== cred
->user_ns
))
125 /* Is cred->user the creator of the target user_ns
126 * or the creator of one of it's parents?
128 for ( tmp
= to
; tmp
!= &init_user_ns
; tmp
= tmp
->parent
) {
129 if (cred
->user
== tmp
->creator
) {
134 /* No useful relationship so no mapping */
138 static __init
int user_namespaces_init(void)
140 user_ns_cachep
= KMEM_CACHE(user_namespace
, SLAB_PANIC
);
143 module_init(user_namespaces_init
);