From: Benjamin Thery <benjamin.thery@bull.net>
To: Greg Kroah-Hartman <gregkh@suse.de>,
Andrew Morton <akpm@linux-foundation.org>
Cc: Eric Biederman <ebiederm@xmission.com>,
Daniel Lezcano <dlezcano@fr.ibm.com>,
Serge Hallyn <serue@us.ibm.com>,
linux-kernel@vger.kernel.org, Tejun Heo <htejun@gmail.com>,
Al Viro <viro@ftp.linux.org.uk>,
Linux Containers <containers@lists.osdl.org>,
Benjamin Thery <benjamin.thery@bull.net>
Subject: [PATCH 11/11] sysfs: user namespaces: fix bug with clone(CLONE_NEWUSER) with fairsched
Date: Wed, 18 Jun 2008 19:09:19 +0200 [thread overview]
Message-ID: <20080618170731.746054454@theryb.frec.bull.fr> (raw)
In-Reply-To: 20080618170729.808539948@theryb.frec.bull.fr
Mark the /sys/kernel/uids directory to be tagged so that processes in
different user namespaces can remount /sys and see their own uid
listings.
Without this patch, having CONFIG_FAIR_SCHED=y makes user namespaces
unusable, because when you
clone(CLONE_NEWUSER)
it will auto-create the root userid and try to create
/sys/kernel/uids/0. Since that already exists from the parent user
namespace, the create fails, and the clone misleadingly ends up
returning -ENOMEM.
This patch fixes the issue by allowing each user namespace to remount
/sys, and having /sys filter the /sys/kernel/uid/ entries by user
namespace.
Signed-off-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: Benjamin Thery <benjamin.thery@bull.net>
---
fs/sysfs/mount.c | 3 +++
include/linux/sched.h | 1 +
include/linux/sysfs.h | 2 ++
kernel/user.c | 21 +++++++++++++++++++++
kernel/user_namespace.c | 13 ++++++++++++-
5 files changed, 39 insertions(+), 1 deletion(-)
Index: linux-mm/fs/sysfs/mount.c
===================================================================
--- linux-mm.orig/fs/sysfs/mount.c
+++ linux-mm/fs/sysfs/mount.c
@@ -81,6 +81,7 @@ static int sysfs_fill_super(struct super
sb->s_root = root;
sb->s_fs_info = info;
info->tag.net_ns = hold_net(current->nsproxy->net_ns);
+ info->tag.user_ns = current->nsproxy->user_ns;
return 0;
out_err:
@@ -100,6 +101,8 @@ static int sysfs_test_super(struct super
if (task->nsproxy->net_ns != info->tag.net_ns)
found = 0;
+ if (task->nsproxy->user_ns != info->tag.user_ns)
+ found = 0;
return found;
}
Index: linux-mm/include/linux/sched.h
===================================================================
--- linux-mm.orig/include/linux/sched.h
+++ linux-mm/include/linux/sched.h
@@ -604,6 +604,7 @@ struct user_struct {
/* Hash table maintenance information */
struct hlist_node uidhash_node;
uid_t uid;
+ struct user_namespace *user_ns;
#ifdef CONFIG_USER_SCHED
struct task_group *tg;
Index: linux-mm/include/linux/sysfs.h
===================================================================
--- linux-mm.orig/include/linux/sysfs.h
+++ linux-mm/include/linux/sysfs.h
@@ -20,6 +20,7 @@
struct kobject;
struct module;
struct net;
+struct user_namespace;
extern int kobject_set_name(struct kobject *kobj, const char *name, ...)
__attribute__((format(printf, 2, 3)));
@@ -83,6 +84,7 @@ struct sysfs_ops {
struct sysfs_tag_info {
struct net *net_ns;
+ struct user_namespace *user_ns;
};
struct sysfs_tagged_dir_operations {
Index: linux-mm/kernel/user.c
===================================================================
--- linux-mm.orig/kernel/user.c
+++ linux-mm/kernel/user.c
@@ -53,6 +53,7 @@ struct user_struct root_user = {
.files = ATOMIC_INIT(0),
.sigpending = ATOMIC_INIT(0),
.locked_shm = 0,
+ .user_ns = &init_user_ns,
#ifdef CONFIG_USER_SCHED
.tg = &init_task_group,
#endif
@@ -236,6 +237,23 @@ static void uids_release(struct kobject
return;
}
+static const void *userns_sb_tag(struct sysfs_tag_info *info)
+{
+ return info->user_ns;
+}
+
+static const void *userns_kobject_tag(struct kobject *kobj)
+{
+ struct user_struct *up;
+ up = container_of(kobj, struct user_struct, kobj);
+ return up->user_ns;
+}
+
+static struct sysfs_tagged_dir_operations userns_tagged_dir_operations = {
+ .sb_tag = userns_sb_tag,
+ .kobject_tag = userns_kobject_tag,
+};
+
static struct kobj_type uids_ktype = {
.sysfs_ops = &kobj_sysfs_ops,
.default_attrs = uids_attributes,
@@ -272,6 +290,8 @@ int __init uids_sysfs_init(void)
if (!uids_kset)
return -ENOMEM;
+ sysfs_enable_tagging(&uids_kset->kobj, &userns_tagged_dir_operations);
+
return uids_user_create(&root_user);
}
@@ -404,6 +424,7 @@ struct user_struct *alloc_uid(struct use
goto out_unlock;
new->uid = uid;
+ new->user_ns = ns;
atomic_set(&new->__count, 1);
if (sched_create_user(new) < 0)
Index: linux-mm/kernel/user_namespace.c
===================================================================
--- linux-mm.orig/kernel/user_namespace.c
+++ linux-mm/kernel/user_namespace.c
@@ -22,7 +22,7 @@ static struct user_namespace *clone_user
struct user_struct *new_user;
int n;
- ns = kmalloc(sizeof(struct user_namespace), GFP_KERNEL);
+ ns = kzalloc(sizeof(struct user_namespace), GFP_KERNEL);
if (!ns)
return ERR_PTR(-ENOMEM);
@@ -66,11 +66,22 @@ struct user_namespace * copy_user_ns(int
return new_ns;
}
+/* clear sysfs tag when user namespace exits */
+static void sysfs_userns_exit(struct sysfs_tag_info *tag_info, void *data)
+{
+ struct user_namespace *ns = (struct user_namespace *)data;
+
+ if (tag_info->user_ns != ns)
+ return;
+ tag_info->user_ns = NULL;
+}
+
void free_user_ns(struct kref *kref)
{
struct user_namespace *ns;
ns = container_of(kref, struct user_namespace, kref);
+ sysfs_ns_exit(sysfs_userns_exit, ns);
release_uids(ns);
kfree(ns);
}
--
next prev parent reply other threads:[~2008-06-18 17:12 UTC|newest]
Thread overview: 138+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-06-18 17:07 [PATCH 00/11] sysfs tagged directories V6 Benjamin Thery
2008-06-18 17:07 ` [PATCH 01/11] sysfs: Support for preventing unmounts Benjamin Thery
2008-06-18 17:44 ` Dave Hansen
2008-06-18 20:12 ` Eric W. Biederman
2008-06-19 8:54 ` Benjamin Thery
2008-06-19 16:32 ` Dave Hansen
2008-06-19 20:19 ` Benjamin Thery
2008-06-18 17:07 ` [PATCH 02/11] sysfs: sysfs_get_dentry add a sb parameter Benjamin Thery
2008-06-18 17:07 ` [PATCH 03/11] sysfs: Implement __sysfs_get_dentry Benjamin Thery
2008-06-18 17:08 ` [PATCH 04/11] sysfs: Rename Support multiple superblocks Benjamin Thery
2008-06-18 17:08 ` [PATCH 05/11] sysfs: sysfs_chmod_file handle " Benjamin Thery
2008-06-22 4:46 ` Tejun Heo
2008-06-23 21:42 ` Daniel Lezcano
2008-06-24 4:45 ` Tejun Heo
2008-06-24 10:39 ` Daniel Lezcano
2008-06-24 13:37 ` Daniel Lezcano
2008-06-25 12:31 ` Tejun Heo
2008-06-18 17:08 ` [PATCH 06/11] sysfs: Implement sysfs tagged directory support Benjamin Thery
2008-06-23 2:05 ` Tejun Heo
2008-06-26 20:21 ` Eric W. Biederman
2008-06-29 3:51 ` Tejun Heo
2008-06-30 18:56 ` Eric W. Biederman
2008-06-30 21:44 ` Serge E. Hallyn
2008-07-01 7:50 ` Eric W. Biederman
2008-07-01 6:47 ` Tejun Heo
2008-07-01 9:20 ` Eric W. Biederman
2008-07-01 10:30 ` Tejun Heo
2008-07-01 12:30 ` Eric W. Biederman
2008-07-02 3:24 ` Tejun Heo
2008-07-02 3:53 ` Eric W. Biederman
2008-07-02 4:37 ` Tejun Heo
2008-07-02 16:49 ` Eric W. Biederman
2008-07-03 0:15 ` Greg KH
2008-07-03 3:18 ` Tejun Heo
2008-07-03 5:11 ` Eric W. Biederman
2008-07-03 10:56 ` Daniel Lezcano
2008-07-03 12:27 ` Eric W. Biederman
2008-07-03 12:37 ` Benjamin Thery
2008-07-03 19:57 ` Eric W. Biederman
2008-07-03 12:55 ` Daniel Lezcano
2008-07-03 15:58 ` Tejun Heo
2008-07-03 18:29 ` Daniel Lezcano
2008-07-03 20:08 ` Eric W. Biederman
2008-07-04 0:48 ` [PATCH 00/15] sysfs support for namespaces Eric W. Biederman
2008-07-04 1:05 ` [PATCH 01/15] kobject: Cleanup kobject_rename and !CONFIG_SYSFS Eric W. Biederman
2008-07-04 1:07 ` [PATCH 02/15] sysfs: Support for preventing unmounts Eric W. Biederman
2008-07-04 1:08 ` [PATCH 03/15] sysfs: sysfs_get_dentry add a sb parameter Eric W. Biederman
2008-07-04 1:09 ` [PATCH 04/15] sysfs: Implement __sysfs_get_dentry Eric W. Biederman
2008-07-04 1:10 ` [PATCH 05/15] sysfs: Rename Support multiple superblocks Eric W. Biederman
2008-07-04 1:11 ` [PATCH 06/15] Introduce sysfs_sd_setattr and fix sysfs_chmod Eric W. Biederman
2008-07-04 1:13 ` [PATCH 07/15] sysfs: sysfs_chmod_file handle multiple superblocks Eric W. Biederman
2008-07-04 1:14 ` [PATCH 08/15] sysfs: Make sysfs_mount static once again Eric W. Biederman
2008-07-04 1:16 ` [PATCH 09/15] sysfs: Implement sysfs tagged directory support Eric W. Biederman
2008-07-04 1:17 ` [PATCH 10/15] sysfs: Merge sysfs_rename_dir and sysfs_move_dir Eric W. Biederman
2008-07-04 1:18 ` [PATCH 11/15] sysfs: Implement sysfs_delete_link and sysfs_rename_link Eric W. Biederman
2008-07-04 1:20 ` [PATCH 12/15] driver core: Implement tagged directory support for device classes Eric W. Biederman
2008-07-04 1:21 ` [PATCH 13/15] Revert "netns: Fix device renaming for sysfs" Eric W. Biederman
2008-07-04 1:22 ` [PATCH 14/15] netns: Enable tagging for net_class directories in sysfs Eric W. Biederman
2008-07-04 1:23 ` [PATCH 15/15] sysfs: user namespaces: fix bug with clone(CLONE_NEWUSER) with fairsched Eric W. Biederman
2008-07-04 7:50 ` [PATCH 12/15] driver core: Implement tagged directory support for device classes Tejun Heo
2008-07-04 13:31 ` Eric W. Biederman
2008-07-04 13:57 ` Tejun Heo
2008-07-04 16:12 ` Greg KH
2008-07-04 21:49 ` Eric W. Biederman
2008-07-14 1:54 ` Eric W. Biederman
2008-07-16 3:25 ` Tejun Heo
2008-07-16 5:41 ` Eric W. Biederman
2008-07-16 5:50 ` Tejun Heo
2008-07-16 6:32 ` Eric W. Biederman
2008-07-16 6:48 ` Tejun Heo
2008-07-16 7:02 ` Tejun Heo
2008-07-16 19:07 ` Eric W. Biederman
2008-07-16 21:09 ` Eric W. Biederman
2008-07-17 23:08 ` Greg KH
2008-07-18 12:41 ` Tejun Heo
2008-07-18 18:49 ` Greg KH
2008-07-18 20:19 ` Eric W. Biederman
2008-07-19 1:07 ` Tejun Heo
2008-08-03 6:59 ` Eric W. Biederman
2008-09-11 12:45 ` Jiri Slaby
2008-09-11 13:05 ` Benjamin Thery
2008-09-12 6:32 ` Jiri Slaby
2008-07-04 22:00 ` Eric W. Biederman
2008-08-20 2:17 ` [PATCH 09/15] sysfs: Implement sysfs tagged directory support Greg KH
2008-08-20 6:58 ` Eric W. Biederman
2008-08-21 6:31 ` [PATCH 0/8] sysfs namespace support Eric W. Biederman
2008-08-21 6:33 ` [PATCH 1/8] sysfs: Implement sysfs tagged directory support Eric W. Biederman
2008-08-21 6:34 ` [PATCH 2/8] sysfs: Merge sysfs_rename_dir and sysfs_move_dir Eric W. Biederman
2008-08-21 6:35 ` [PATCH 3/8] sysfs: Implement sysfs_delete_link and sysfs_rename_link Eric W. Biederman
2008-08-21 6:36 ` [PATCH 5/8] sysfs: Remove sysfs_create_link_nowarn Eric W. Biederman
2008-08-21 6:38 ` [PATCH 6/8] Revert "netns: Fix device renaming for sysfs" Eric W. Biederman
2008-08-21 6:39 ` [PATCH 7/8] netns: Enable tagging for net_class directories in sysfs Eric W. Biederman
2008-08-21 6:40 ` [PATCH 8/8] sysfs: user namespaces: fix bug with clone(CLONE_NEWUSER) with fairsched Eric W. Biederman
2008-08-21 6:47 ` [PATCH 7/8] netns: Enable tagging for net_class directories in sysfs David Miller
2008-08-21 6:47 ` [PATCH 6/8] Revert "netns: Fix device renaming for sysfs" David Miller
2008-08-21 6:37 ` [PATCH 4/8] driver core: Implement tagged directory support for device classes Eric W. Biederman
2008-08-27 15:18 ` [PATCH 1/8] sysfs: Implement sysfs tagged directory support Benjamin Thery
2008-09-02 13:54 ` Mark Ryden
2008-09-02 14:03 ` Benjamin Thery
2008-09-02 17:01 ` Greg KH
2008-09-04 5:33 ` David Shwatrz
2008-09-04 6:44 ` Benjamin Thery
2008-09-08 18:39 ` Mark Ryden
2008-10-07 16:39 ` Mark Ryden
2008-10-07 16:48 ` Greg KH
2008-10-07 20:31 ` Eric W. Biederman
2008-10-07 21:09 ` Greg KH
2008-10-07 22:27 ` Eric W. Biederman
2008-10-08 13:00 ` Christoph Hellwig
2008-10-14 3:20 ` Eric W. Biederman
2008-10-07 16:52 ` Daniel Lezcano
2008-08-21 6:37 ` [PATCH 0/8] sysfs namespace support David Miller
2008-07-04 6:44 ` [PATCH 08/15] sysfs: Make sysfs_mount static once again Tejun Heo
2008-07-04 6:44 ` [PATCH 07/15] sysfs: sysfs_chmod_file handle multiple superblocks Tejun Heo
2008-07-04 6:40 ` [PATCH 06/15] Introduce sysfs_sd_setattr and fix sysfs_chmod Tejun Heo
2008-07-04 6:33 ` [PATCH 01/15] kobject: Cleanup kobject_rename and !CONFIG_SYSFS Tejun Heo
2008-07-04 1:27 ` [PATCH 00/15] sysfs support for namespaces Eric W. Biederman
2008-07-06 4:42 ` Eric W. Biederman
2008-07-07 11:41 ` Cornelia Huck
2008-07-07 12:22 ` Eric W. Biederman
2008-06-18 17:08 ` [PATCH 07/11] sysfs: Implement sysfs_delete_link and sysfs_rename_link Benjamin Thery
2008-06-23 2:13 ` Tejun Heo
2008-06-26 20:24 ` Eric W. Biederman
2008-06-29 3:35 ` Tejun Heo
2008-06-30 3:02 ` Eric W. Biederman
2008-06-18 17:08 ` [PATCH 08/11] driver core: Implement tagged directory support for device classes Benjamin Thery
2008-06-18 17:08 ` [PATCH 09/11] sysfs: add sysfs_ns_exit routine Benjamin Thery
2008-06-18 20:19 ` Eric W. Biederman
2008-06-23 2:16 ` Tejun Heo
2008-06-18 17:09 ` [PATCH 10/11] netns: Enable tagging for net_class directories in sysfs Benjamin Thery
2008-06-23 2:18 ` Tejun Heo
2008-06-18 17:09 ` Benjamin Thery [this message]
2008-06-23 2:18 ` [PATCH 11/11] sysfs: user namespaces: fix bug with clone(CLONE_NEWUSER) with fairsched Tejun Heo
2008-06-25 18:44 ` Serge E. Hallyn
2008-06-25 21:11 ` Eric W. Biederman
2008-06-26 13:07 ` Serge E. Hallyn
-- strict thread matches above, loose matches on Subject: below --
2008-06-06 15:46 [PATCH 00/11] sysfs tagged directories V5 Benjamin Thery
2008-06-06 15:48 ` [PATCH 11/11] sysfs: user namespaces: fix bug with clone(CLONE_NEWUSER) with fairsched Benjamin Thery
2008-06-10 22:41 ` Serge E. Hallyn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080618170731.746054454@theryb.frec.bull.fr \
--to=benjamin.thery@bull.net \
--cc=akpm@linux-foundation.org \
--cc=containers@lists.osdl.org \
--cc=dlezcano@fr.ibm.com \
--cc=ebiederm@xmission.com \
--cc=gregkh@suse.de \
--cc=htejun@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=serue@us.ibm.com \
--cc=viro@ftp.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).