Re: [PATCH] userns,pidns: Verify the userns for new pid namespaces

From	ebiederm@xmission.com (Eric W. Biederman)
Newsgroups	linux.kernel
Subject	Re: [PATCH] userns,pidns: Verify the userns for new pid namespaces
Date	2017-05-02 22:50 +0200
Message-ID	<tCMUa-3a8-13@gated-at.bofh.it> (permalink)
References	(4 earlier) <tBG4q-1Ko-3@gated-at.bofh.it> <tBG4q-1Ko-1@gated-at.bofh.it> <tBGnM-1QW-25@gated-at.bofh.it> <tCMUa-3a8-15@gated-at.bofh.it> <tCMUa-3a8-17@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Kirill Tkhai <ktkhai@virtuozzo.com> writes:
>>> diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
>>> index 2f735cbe05e8..7d8658fbabc8 100644
>>> --- a/kernel/user_namespace.c
>>> +++ b/kernel/user_namespace.c
>>> @@ -986,19 +986,25 @@ bool userns_may_setgroups(const struct user_namespace *ns)
>>>  }
>>>  
>>>  /*
>>> - * Returns true if @ns is the same namespace as or a descendant of
>>> - * @target_ns.
>>> + * Returns true if @child is the same namespace or a descendant of
>>> + * @ancestor.
>>>   */
>>> -bool current_in_userns(const struct user_namespace *target_ns)
>>> +bool in_userns(const struct user_namespace *ancestor,
>>> +	       const struct user_namespace *child)
>>>  {
>>> -	struct user_namespace *ns;
>>> -	for (ns = current_user_ns(); ns; ns = ns->parent) {
>>> -		if (ns == target_ns)
>>> +	const struct user_namespace *ns;
>>> +	for (ns = child; ns; ns = ns->parent) {
>>> +		if (ns == ancestor)
>>>  			return true;
>>>  	}
>>>  	return false;
>>>  }
>> 
>> We have user_namespace::level, so it's possible to stop iterations earlier
>> and save some cpu cycles:
>> 
>> 	for (ns = child; ns->level >= ancestor->level; ns = ns->parent)
>
> Just ">" here.
>
>> 		;
>> 	return (ns == ancestor);

Good observation.  Thank you.

Eric

Thread

Re: [PATCH v3] pid_ns: Introduce ioctl to set vector of ns_last_pid's on ns hierarhy ebiederm@xmission.com (Eric W. Biederman) - 2017-04-27 17:30 +0200
  Re: [PATCH v3] pid_ns: Introduce ioctl to set vector of ns_last_pid's on ns hierarhy ebiederm@xmission.com (Eric W. Biederman) - 2017-04-27 18:20 +0200
    Re: [PATCH v3] pid_ns: Introduce ioctl to set vector of ns_last_pid's on ns hierarhy ebiederm@xmission.com (Eric W. Biederman) - 2017-04-29 21:20 +0200
      [PATCH] userns,pidns: Verify the userns for new pid namespaces ebiederm@xmission.com (Eric W. Biederman) - 2017-04-29 21:40 +0200
        Re: [PATCH] userns,pidns: Verify the userns for new pid namespaces "Serge E. Hallyn" <serge@hallyn.com> - 2017-04-29 23:00 +0200
          Re: [PATCH] userns,pidns: Verify the userns for new pid namespaces ebiederm@xmission.com (Eric W. Biederman) - 2017-04-30 06:50 +0200
          Re: [PATCH] userns,pidns: Verify the userns for new pid namespaces ebiederm@xmission.com (Eric W. Biederman) - 2017-04-30 06:50 +0200
        Re: [PATCH] userns,pidns: Verify the userns for new pid namespaces ebiederm@xmission.com (Eric W. Biederman) - 2017-05-02 22:50 +0200
      Re: [PATCH v3] pid_ns: Introduce ioctl to set vector of ns_last_pid's on ns hierarhy ebiederm@xmission.com (Eric W. Biederman) - 2017-05-02 23:40 +0200

csiph-web