From: "Serge E. Hallyn" <serge@hallyn.com>
To: Andrey Vagin <avagin@openvz.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>,
Serge Hallyn <serge.hallyn@canonical.com>,
Linux API <linux-api@vger.kernel.org>,
Linux Containers <containers@lists.linux-foundation.org>,
LKML <linux-kernel@vger.kernel.org>,
Alexander Viro <viro@zeniv.linux.org.uk>,
James Bottomley <James.Bottomley@hansenpartnership.com>,
"Eric W. Biederman" <ebiederm@xmission.com>,
linux-fsdevel <linux-fsdevel@vger.kernel.org>,
"Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com>
Subject: Re: [PATCH 1/4] kernel: add a helper to get an owning user namespace for a namespace
Date: Thu, 1 Sep 2016 00:12:54 -0500 [thread overview]
Message-ID: <20160901051254.GA5893@mail.hallyn.com> (raw)
In-Reply-To: <CANaxB-zz=tnCSFMsHuGbmhiHa20DGbybWo=xdeeiDwJyoMxmYQ@mail.gmail.com>
On Wed, Aug 31, 2016 at 01:38:35PM -0700, Andrey Vagin wrote:
> On Tue, Aug 30, 2016 at 7:56 PM, Serge E. Hallyn <serge@hallyn.com> wrote:
> > On Fri, Aug 26, 2016 at 04:08:08PM -0700, Andrei Vagin wrote:
> >> +struct ns_common *ns_get_owner(struct ns_common *ns)
> >> +{
> >> + struct user_namespace *my_user_ns = current_user_ns();
> >> + struct user_namespace *owner, *p;
> >> +
> >> + /* See if the owner is in the current user namespace */
> >> + owner = p = ns->ops->get_owner(ns);
> >> + for (;;) {
> >> + if (!p)
> >> + return ERR_PTR(-EPERM);
> >> + if (p == my_user_ns)
> >> + break;
> >> + p = p->parent;
> >> + }
> >> +
> >> + return &get_user_ns(owner)->ns;
> >
> > get_user_ns() bumps the owner's refcount. I don't see where
> > this is being dropped, especially when ns_ioctl() uses it in
> > the next patch.
>
> It is dropped in __ns_get_path if a namespace has a dentry, otherwise
> it is dropped from nsfs_evict.
>
> static void *__ns_get_path(struct path *path, struct ns_common *ns)
> | return -EPERM;
> ...
> ns->ops->put(ns); |
> got_it:
> | /* See if the owner is in the current user namespace
> */
> path->mnt = mnt;
> | owner = p = ns->ops->get_owner(ns);
> path->dentry = dentry;
> | for (;;) {
> return NULL;
> ...
>
> static void nsfs_evict(struct inode *inode) |
> {
> | if (!ns_capable(user_ns, CAP_SYS_ADMIN))
> struct ns_common *ns = inode->i_private;
> | return -EPERM;
> clear_inode(inode); |
> ns->ops->put(ns);
> | cred = prepare_creds();
> }
Gotcha, thanks.
next prev parent reply other threads:[~2016-09-01 5:12 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-08-26 23:08 [PATCH 0/4 v2] Add an interface to discover relationships between namespaces Andrei Vagin
2016-08-26 23:08 ` [PATCH 1/4] kernel: add a helper to get an owning user namespace for a namespace Andrei Vagin
2016-08-31 2:41 ` Serge E. Hallyn
2016-08-31 21:12 ` Andrey Vagin
2016-08-31 21:59 ` Serge E. Hallyn
2016-08-31 2:56 ` Serge E. Hallyn
2016-08-31 20:38 ` Andrey Vagin
2016-09-01 5:12 ` Serge E. Hallyn [this message]
2016-08-26 23:08 ` [PATCH 2/4] nsfs: add ioctl to get an owning user namespace for ns file descriptor Andrei Vagin
2016-08-26 23:08 ` [PATCH 3/4] nsfs: add ioctl to get a parent namespace Andrei Vagin
2016-08-26 23:08 ` [PATCH 4/4] tools/testing: add a test to check nsfs ioctl-s Andrei Vagin
2016-09-06 7:47 [PATCH 0/4 v3] Add an interface to discover relationships between namespaces Andrei Vagin
2016-09-06 7:47 ` [PATCH 1/4] kernel: add a helper to get an owning user namespace for a namespace Andrei Vagin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160901051254.GA5893@mail.hallyn.com \
--to=serge@hallyn.com \
--cc=James.Bottomley@hansenpartnership.com \
--cc=avagin@openvz.org \
--cc=containers@lists.linux-foundation.org \
--cc=ebiederm@xmission.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mtk.manpages@gmail.com \
--cc=serge.hallyn@canonical.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).