From: Andrey Vagin <avagin@openvz.org>
To: "Serge E. Hallyn" <serge@hallyn.com>
Cc: Serge Hallyn <serge.hallyn@canonical.com>,
Linux API <linux-api@vger.kernel.org>,
Linux Containers <containers@lists.linux-foundation.org>,
LKML <linux-kernel@vger.kernel.org>,
Alexander Viro <viro@zeniv.linux.org.uk>,
James Bottomley <James.Bottomley@hansenpartnership.com>,
"Eric W. Biederman" <ebiederm@xmission.com>,
linux-fsdevel <linux-fsdevel@vger.kernel.org>,
"Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com>
Subject: Re: [PATCH 1/4] kernel: add a helper to get an owning user namespace for a namespace
Date: Wed, 31 Aug 2016 13:38:35 -0700 [thread overview]
Message-ID: <CANaxB-zz=tnCSFMsHuGbmhiHa20DGbybWo=xdeeiDwJyoMxmYQ@mail.gmail.com> (raw)
In-Reply-To: <20160831025605.GA21788@mail.hallyn.com>
On Tue, Aug 30, 2016 at 7:56 PM, Serge E. Hallyn <serge@hallyn.com> wrote:
> On Fri, Aug 26, 2016 at 04:08:08PM -0700, Andrei Vagin wrote:
>> +struct ns_common *ns_get_owner(struct ns_common *ns)
>> +{
>> + struct user_namespace *my_user_ns = current_user_ns();
>> + struct user_namespace *owner, *p;
>> +
>> + /* See if the owner is in the current user namespace */
>> + owner = p = ns->ops->get_owner(ns);
>> + for (;;) {
>> + if (!p)
>> + return ERR_PTR(-EPERM);
>> + if (p == my_user_ns)
>> + break;
>> + p = p->parent;
>> + }
>> +
>> + return &get_user_ns(owner)->ns;
>
> get_user_ns() bumps the owner's refcount. I don't see where
> this is being dropped, especially when ns_ioctl() uses it in
> the next patch.
It is dropped in __ns_get_path if a namespace has a dentry, otherwise
it is dropped from nsfs_evict.
static void *__ns_get_path(struct path *path, struct ns_common *ns)
| return -EPERM;
...
ns->ops->put(ns); |
got_it:
| /* See if the owner is in the current user namespace
*/
path->mnt = mnt;
| owner = p = ns->ops->get_owner(ns);
path->dentry = dentry;
| for (;;) {
return NULL;
...
static void nsfs_evict(struct inode *inode) |
{
| if (!ns_capable(user_ns, CAP_SYS_ADMIN))
struct ns_common *ns = inode->i_private;
| return -EPERM;
clear_inode(inode); |
ns->ops->put(ns);
| cred = prepare_creds();
}
> _______________________________________________
> Containers mailing list
> Containers@lists.linux-foundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/containers
next prev parent reply other threads:[~2016-08-31 20:38 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-08-26 23:08 [PATCH 0/4 v2] Add an interface to discover relationships between namespaces Andrei Vagin
2016-08-26 23:08 ` [PATCH 1/4] kernel: add a helper to get an owning user namespace for a namespace Andrei Vagin
2016-08-31 2:41 ` Serge E. Hallyn
2016-08-31 21:12 ` Andrey Vagin
2016-08-31 21:59 ` Serge E. Hallyn
2016-08-31 2:56 ` Serge E. Hallyn
2016-08-31 20:38 ` Andrey Vagin [this message]
2016-09-01 5:12 ` Serge E. Hallyn
2016-08-26 23:08 ` [PATCH 2/4] nsfs: add ioctl to get an owning user namespace for ns file descriptor Andrei Vagin
2016-08-26 23:08 ` [PATCH 3/4] nsfs: add ioctl to get a parent namespace Andrei Vagin
2016-08-26 23:08 ` [PATCH 4/4] tools/testing: add a test to check nsfs ioctl-s Andrei Vagin
2016-09-06 7:47 [PATCH 0/4 v3] Add an interface to discover relationships between namespaces Andrei Vagin
2016-09-06 7:47 ` [PATCH 1/4] kernel: add a helper to get an owning user namespace for a namespace Andrei Vagin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CANaxB-zz=tnCSFMsHuGbmhiHa20DGbybWo=xdeeiDwJyoMxmYQ@mail.gmail.com' \
--to=avagin@openvz.org \
--cc=James.Bottomley@hansenpartnership.com \
--cc=containers@lists.linux-foundation.org \
--cc=ebiederm@xmission.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mtk.manpages@gmail.com \
--cc=serge.hallyn@canonical.com \
--cc=serge@hallyn.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).