diff options
author | Eric W. Biederman <ebiederm@xmission.com> | 2010-06-13 03:28:03 +0000 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2010-06-16 14:55:34 -0700 |
commit | 5c1469de7545a35a16ff2b902e217044a7d2f8a5 (patch) | |
tree | 2a3b48da4dab1516234633ee5e71766801210e49 /kernel/user_namespace.c | |
parent | 812e876e842488221aa54cb4587a8a33445cfa9e (diff) | |
download | kernel_goldelico_gta04-5c1469de7545a35a16ff2b902e217044a7d2f8a5.zip kernel_goldelico_gta04-5c1469de7545a35a16ff2b902e217044a7d2f8a5.tar.gz kernel_goldelico_gta04-5c1469de7545a35a16ff2b902e217044a7d2f8a5.tar.bz2 |
user_ns: Introduce user_nsmap_uid and user_ns_map_gid.
Define what happens when a we view a uid from one user_namespace
in another user_namepece.
- If the user namespaces are the same no mapping is necessary.
- For most cases of difference use overflowuid and overflowgid,
the uid and gid currently used for 16bit apis when we have a 32bit uid
that does fit in 16bits. Effectively the situation is the same,
we want to return a uid or gid that is not assigned to any user.
- For the case when we happen to be mapping the uid or gid of the
creator of the target user namespace use uid 0 and gid as confusing
that user with root is not a problem.
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Acked-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'kernel/user_namespace.c')
-rw-r--r-- | kernel/user_namespace.c | 44 |
1 files changed, 44 insertions, 0 deletions
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index b2d70d3..2591583 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -9,6 +9,7 @@ #include <linux/nsproxy.h> #include <linux/slab.h> #include <linux/user_namespace.h> +#include <linux/highuid.h> #include <linux/cred.h> /* @@ -82,3 +83,46 @@ void free_user_ns(struct kref *kref) schedule_work(&ns->destroyer); } EXPORT_SYMBOL(free_user_ns); + +uid_t user_ns_map_uid(struct user_namespace *to, const struct cred *cred, uid_t uid) +{ + struct user_namespace *tmp; + + if (likely(to == cred->user->user_ns)) + return uid; + + + /* Is cred->user the creator of the target user_ns + * or the creator of one of it's parents? + */ + for ( tmp = to; tmp != &init_user_ns; + tmp = tmp->creator->user_ns ) { + if (cred->user == tmp->creator) { + return (uid_t)0; + } + } + + /* No useful relationship so no mapping */ + return overflowuid; +} + +gid_t user_ns_map_gid(struct user_namespace *to, const struct cred *cred, gid_t gid) +{ + struct user_namespace *tmp; + + if (likely(to == cred->user->user_ns)) + return gid; + + /* Is cred->user the creator of the target user_ns + * or the creator of one of it's parents? + */ + for ( tmp = to; tmp != &init_user_ns; + tmp = tmp->creator->user_ns ) { + if (cred->user == tmp->creator) { + return (gid_t)0; + } + } + + /* No useful relationship so no mapping */ + return overflowgid; +} |