xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

userns: make each net (net_ns) belong to a user_ns

Browse Source 
The user namespace which creates a new network namespace owns that
namespace and all resources created in it.  This way we can target
capability checks for privileged operations against network resources to
the user_ns which created the network namespace in which the resource
lives.  Privilege to the user namespace which owns the network
namespace, or any parent user namespace thereof, provides the same
privilege to the network resource.

This patch is reworked from a version originally by
Serge E. Hallyn <serge.hallyn@canonical.com>

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
This commit is contained in:
Eric W. Biederman
2012-06-14 02:31:10 -07:00
parent d727abcb23
commit 038e7332b8
3 changed files with 20 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
include/net/net_namespace.h
View File

@@ -23,6 +23,7 @@
#endif
#include <net/netns/xfrm.h>
struct user_namespace;
struct proc_dir_entry;
struct net_device;
struct sock;
@@ -53,6 +54,8 @@ struct net {
struct list_head cleanup_list; /* namespaces on death row */
struct list_head exit_list; /* Use only net_mutex */
struct user_namespace *user_ns; /* Owning user namespace */
struct proc_dir_entry *proc_net;
struct proc_dir_entry *proc_net_stat;
@@ -127,12 +130,14 @@ struct net {
extern struct net init_net;
#ifdef CONFIG_NET_NS
extern struct net *copy_net_ns(unsigned long flags, struct net *net_ns);
extern struct net *copy_net_ns(unsigned long flags,
struct user_namespace *user_ns, struct net *old_net);
#else /* CONFIG_NET_NS */
#include <linux/sched.h>
#include <linux/nsproxy.h>
static inline struct net *copy_net_ns(unsigned long flags, struct net *old_net)
static inline struct net *copy_net_ns(unsigned long flags,
struct user_namespace *user_ns, struct net *old_net)
{
if (flags & CLONE_NEWNET)
return ERR_PTR(-EINVAL);