blob: 79084311ee5779a1e12b411ff37a5f04da08e360 [file] [log] [blame]
Cedric Le Goateracce2922007-07-15 23:40:59 -07001/*
2 * This program is free software; you can redistribute it and/or
3 * modify it under the terms of the GNU General Public License as
4 * published by the Free Software Foundation, version 2 of the
5 * License.
6 */
7
8#include <linux/module.h>
Cedric Le Goateracce2922007-07-15 23:40:59 -07009#include <linux/nsproxy.h>
Robert P. J. Day1aeb2722008-04-29 00:59:25 -070010#include <linux/slab.h>
Cedric Le Goateracce2922007-07-15 23:40:59 -070011#include <linux/user_namespace.h>
Serge Hallyn18b6e042008-10-15 16:38:45 -050012#include <linux/cred.h>
Cedric Le Goateracce2922007-07-15 23:40:59 -070013
Serge E. Hallyn77ec7392007-07-15 23:41:01 -070014/*
Serge Hallyn18b6e042008-10-15 16:38:45 -050015 * Create a new user namespace, deriving the creator from the user in the
16 * passed credentials, and replacing that user with the new root user for the
17 * new namespace.
18 *
19 * This is called by copy_creds(), which will finish setting the target task's
20 * credentials.
Serge E. Hallyn77ec7392007-07-15 23:41:01 -070021 */
Serge Hallyn18b6e042008-10-15 16:38:45 -050022int create_user_ns(struct cred *new)
Serge E. Hallyn77ec7392007-07-15 23:41:01 -070023{
24 struct user_namespace *ns;
Serge Hallyn18b6e042008-10-15 16:38:45 -050025 struct user_struct *root_user;
Serge E. Hallyn77ec7392007-07-15 23:41:01 -070026 int n;
27
28 ns = kmalloc(sizeof(struct user_namespace), GFP_KERNEL);
29 if (!ns)
Serge Hallyn18b6e042008-10-15 16:38:45 -050030 return -ENOMEM;
Serge E. Hallyn77ec7392007-07-15 23:41:01 -070031
32 kref_init(&ns->kref);
33
34 for (n = 0; n < UIDHASH_SZ; ++n)
Pavel Emelyanov735de222007-09-18 22:46:44 -070035 INIT_HLIST_HEAD(ns->uidhash_table + n);
Serge E. Hallyn77ec7392007-07-15 23:41:01 -070036
Serge Hallyn18b6e042008-10-15 16:38:45 -050037 /* Alloc new root user. */
38 root_user = alloc_uid(ns, 0);
39 if (!root_user) {
Serge E. Hallyn77ec7392007-07-15 23:41:01 -070040 kfree(ns);
Serge Hallyn18b6e042008-10-15 16:38:45 -050041 return -ENOMEM;
Serge E. Hallyn77ec7392007-07-15 23:41:01 -070042 }
43
Serge Hallyn18b6e042008-10-15 16:38:45 -050044 /* set the new root user in the credentials under preparation */
45 ns->creator = new->user;
46 new->user = root_user;
47 new->uid = new->euid = new->suid = new->fsuid = 0;
48 new->gid = new->egid = new->sgid = new->fsgid = 0;
49 put_group_info(new->group_info);
50 new->group_info = get_group_info(&init_groups);
51#ifdef CONFIG_KEYS
52 key_put(new->request_key_auth);
53 new->request_key_auth = NULL;
54#endif
55 /* tgcred will be cleared in our caller bc CLONE_THREAD won't be set */
Serge E. Hallyn77ec7392007-07-15 23:41:01 -070056
Serge Hallyn18b6e042008-10-15 16:38:45 -050057 /* alloc_uid() incremented the userns refcount. Just set it to 1 */
58 kref_set(&ns->kref, 1);
Serge E. Hallyn77ec7392007-07-15 23:41:01 -070059
Serge Hallyn18b6e042008-10-15 16:38:45 -050060 return 0;
Cedric Le Goateracce2922007-07-15 23:40:59 -070061}
62
63void free_user_ns(struct kref *kref)
64{
65 struct user_namespace *ns;
66
67 ns = container_of(kref, struct user_namespace, kref);
Serge Hallyn18b6e042008-10-15 16:38:45 -050068 free_uid(ns->creator);
Cedric Le Goateracce2922007-07-15 23:40:59 -070069 kfree(ns);
70}
Michael Halcrow6a3fd922008-04-29 00:59:52 -070071EXPORT_SYMBOL(free_user_ns);