diff options
| author | Serge E. Hallyn <serue@us.ibm.com> | 2007-07-15 23:41:01 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-07-16 09:05:47 -0700 |
| commit | 77ec739d8d0979477fc91f530403805afa2581a4 (patch) | |
| tree | 0cefb80a7ff8d57a8f735954fdeb88e9efbaf05c /include/linux | |
| parent | acce292c82d4d82d35553b928df2b0597c3a9c78 (diff) | |
user namespace: add unshare
This patch enables the unshare of user namespaces.
It adds a new clone flag CLONE_NEWUSER and implements copy_user_ns() which
resets the current user_struct and adds a new root user (uid == 0)
For now, unsharing the user namespace allows a process to reset its
user_struct accounting and uid 0 in the new user namespace should be contained
using appropriate means, for instance selinux
The plan, when the full support is complete (all uid checks covered), is to
keep the original user's rights in the original namespace, and let a process
become uid 0 in the new namespace, with full capabilities to the new
namespace.
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Cedric Le Goater <clg@fr.ibm.com>
Acked-by: Pavel Emelianov <xemul@openvz.org>
Cc: Herbert Poetzl <herbert@13thfloor.at>
Cc: Kirill Korotaev <dev@sw.ru>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Andrew Morgan <agm@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/sched.h | 1 | ||||
| -rw-r--r-- | include/linux/user_namespace.h | 4 |
2 files changed, 5 insertions, 0 deletions
diff --git a/include/linux/sched.h b/include/linux/sched.h index c667255d70db..731edaca8ffd 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -26,6 +26,7 @@ #define CLONE_STOPPED 0x02000000 /* Start in stopped state */ #define CLONE_NEWUTS 0x04000000 /* New utsname group? */ #define CLONE_NEWIPC 0x08000000 /* New ipcs */ +#define CLONE_NEWUSER 0x10000000 /* New user namespace */ /* * Scheduling policies diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h index 92a45867ecfb..bb320573bb9e 100644 --- a/include/linux/user_namespace.h +++ b/include/linux/user_namespace.h @@ -4,6 +4,7 @@ #include <linux/kref.h> #include <linux/nsproxy.h> #include <linux/sched.h> +#include <linux/err.h> #define UIDHASH_BITS (CONFIG_BASE_SMALL ? 3 : 8) #define UIDHASH_SZ (1 << UIDHASH_BITS) @@ -45,6 +46,9 @@ static inline struct user_namespace *get_user_ns(struct user_namespace *ns) static inline struct user_namespace *copy_user_ns(int flags, struct user_namespace *old_ns) { + if (flags & CLONE_NEWUSER) + return ERR_PTR(-EINVAL); + return NULL; } |