From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Serge E. Hallyn" Subject: Re: [PATCH v2 10/10] mntns: Add a limit on the number of mount namespaces. Date: Mon, 25 Jul 2016 18:15:22 -0500 Message-ID: <20160725231522.GH26841@mail.hallyn.com> References: <87d1m754jc.fsf@x220.int.ebiederm.org> <20160721164014.17534-1-ebiederm@xmission.com> <20160721164014.17534-10-ebiederm@xmission.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <20160721164014.17534-10-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: "Eric W. Biederman" Cc: Kees Cook , netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Linux Containers , linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Andy Lutomirski , Seth Forshee , Nikolay Borisov , linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Jann Horn List-Id: containers.vger.kernel.org Quoting Eric W. Biederman (ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org): > Signed-off-by: "Eric W. Biederman" Acked-by: Serge Hallyn Thanks, Eric. > --- > fs/namespace.c | 19 ++++++++++++++++++- > include/linux/user_namespace.h | 1 + > kernel/user_namespace.c | 1 + > 3 files changed, 20 insertions(+), 1 deletion(-) > > diff --git a/fs/namespace.c b/fs/namespace.c > index aabe8e397fc3..3942ae6c34f5 100644 > --- a/fs/namespace.c > +++ b/fs/namespace.c > @@ -2718,9 +2718,20 @@ dput_out: > return retval; > } > > +static bool inc_mnt_namespaces(struct user_namespace *ns) > +{ > + return inc_ucount(ns, UCOUNT_MNT_NAMESPACES); > +} > + > +static void dec_mnt_namespaces(struct user_namespace *ns) > +{ > + dec_ucount(ns, UCOUNT_MNT_NAMESPACES); > +} > + > static void free_mnt_ns(struct mnt_namespace *ns) > { > ns_free_inum(&ns->ns); > + dec_mnt_namespaces(ns->user_ns); > put_user_ns(ns->user_ns); > kfree(ns); > } > @@ -2739,12 +2750,18 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns) > struct mnt_namespace *new_ns; > int ret; > > + if (!inc_mnt_namespaces(user_ns)) > + return ERR_PTR(-ENFILE); > + > new_ns = kmalloc(sizeof(struct mnt_namespace), GFP_KERNEL); > - if (!new_ns) > + if (!new_ns) { > + dec_mnt_namespaces(user_ns); > return ERR_PTR(-ENOMEM); > + } > ret = ns_alloc_inum(&new_ns->ns); > if (ret) { > kfree(new_ns); > + dec_mnt_namespaces(user_ns); > return ERR_PTR(ret); > } > new_ns->ns.ops = &mntns_operations; > diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h > index f86afa536baf..ee0e9d7b2e67 100644 > --- a/include/linux/user_namespace.h > +++ b/include/linux/user_namespace.h > @@ -28,6 +28,7 @@ enum ucounts { > UCOUNT_UTS_NAMESPACES, > UCOUNT_IPC_NAMESPACES, > UCOUNT_NET_NAMESPACES, > + UCOUNT_MNT_NAMESPACES, > UCOUNT_CGROUP_NAMESPACES, > UCOUNT_COUNTS, > }; > diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c > index e326ca722ae0..f6702d84afab 100644 > --- a/kernel/user_namespace.c > +++ b/kernel/user_namespace.c > @@ -81,6 +81,7 @@ static struct ctl_table userns_table[] = { > UCOUNT_ENTRY("max_uts_namespaces"), > UCOUNT_ENTRY("max_ipc_namespaces"), > UCOUNT_ENTRY("max_net_namespaces"), > + UCOUNT_ENTRY("max_mnt_namespaces"), > UCOUNT_ENTRY("max_cgroup_namespaces"), > { } > }; > -- > 2.8.3 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754295AbcGYXPd (ORCPT ); Mon, 25 Jul 2016 19:15:33 -0400 Received: from h2.hallyn.com ([78.46.35.8]:54600 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753961AbcGYXPZ (ORCPT ); Mon, 25 Jul 2016 19:15:25 -0400 Date: Mon, 25 Jul 2016 18:15:22 -0500 From: "Serge E. Hallyn" To: "Eric W. Biederman" Cc: Linux Containers , Andy Lutomirski , Jann Horn , Kees Cook , Nikolay Borisov , "Serge E. Hallyn" , Seth Forshee , linux-fsdevel@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-api@vger.kernel.org Subject: Re: [PATCH v2 10/10] mntns: Add a limit on the number of mount namespaces. Message-ID: <20160725231522.GH26841@mail.hallyn.com> References: <87d1m754jc.fsf@x220.int.ebiederm.org> <20160721164014.17534-1-ebiederm@xmission.com> <20160721164014.17534-10-ebiederm@xmission.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20160721164014.17534-10-ebiederm@xmission.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Quoting Eric W. Biederman (ebiederm@xmission.com): > Signed-off-by: "Eric W. Biederman" Acked-by: Serge Hallyn Thanks, Eric. > --- > fs/namespace.c | 19 ++++++++++++++++++- > include/linux/user_namespace.h | 1 + > kernel/user_namespace.c | 1 + > 3 files changed, 20 insertions(+), 1 deletion(-) > > diff --git a/fs/namespace.c b/fs/namespace.c > index aabe8e397fc3..3942ae6c34f5 100644 > --- a/fs/namespace.c > +++ b/fs/namespace.c > @@ -2718,9 +2718,20 @@ dput_out: > return retval; > } > > +static bool inc_mnt_namespaces(struct user_namespace *ns) > +{ > + return inc_ucount(ns, UCOUNT_MNT_NAMESPACES); > +} > + > +static void dec_mnt_namespaces(struct user_namespace *ns) > +{ > + dec_ucount(ns, UCOUNT_MNT_NAMESPACES); > +} > + > static void free_mnt_ns(struct mnt_namespace *ns) > { > ns_free_inum(&ns->ns); > + dec_mnt_namespaces(ns->user_ns); > put_user_ns(ns->user_ns); > kfree(ns); > } > @@ -2739,12 +2750,18 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns) > struct mnt_namespace *new_ns; > int ret; > > + if (!inc_mnt_namespaces(user_ns)) > + return ERR_PTR(-ENFILE); > + > new_ns = kmalloc(sizeof(struct mnt_namespace), GFP_KERNEL); > - if (!new_ns) > + if (!new_ns) { > + dec_mnt_namespaces(user_ns); > return ERR_PTR(-ENOMEM); > + } > ret = ns_alloc_inum(&new_ns->ns); > if (ret) { > kfree(new_ns); > + dec_mnt_namespaces(user_ns); > return ERR_PTR(ret); > } > new_ns->ns.ops = &mntns_operations; > diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h > index f86afa536baf..ee0e9d7b2e67 100644 > --- a/include/linux/user_namespace.h > +++ b/include/linux/user_namespace.h > @@ -28,6 +28,7 @@ enum ucounts { > UCOUNT_UTS_NAMESPACES, > UCOUNT_IPC_NAMESPACES, > UCOUNT_NET_NAMESPACES, > + UCOUNT_MNT_NAMESPACES, > UCOUNT_CGROUP_NAMESPACES, > UCOUNT_COUNTS, > }; > diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c > index e326ca722ae0..f6702d84afab 100644 > --- a/kernel/user_namespace.c > +++ b/kernel/user_namespace.c > @@ -81,6 +81,7 @@ static struct ctl_table userns_table[] = { > UCOUNT_ENTRY("max_uts_namespaces"), > UCOUNT_ENTRY("max_ipc_namespaces"), > UCOUNT_ENTRY("max_net_namespaces"), > + UCOUNT_ENTRY("max_mnt_namespaces"), > UCOUNT_ENTRY("max_cgroup_namespaces"), > { } > }; > -- > 2.8.3