Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1460010 > unrolled thread

[PATCH v2 0/3] Make /proc per net namespace objects belong to container

Back to article view | Back to linux.kernel

Contents

  [PATCH v2 0/3] Make /proc per net namespace objects belong to container Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-08-10 23:40 +0200
    [PATCH v2 2/3] proc: make proc entries inherit ownership from parent Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-08-10 23:40 +0200
    Re: [PATCH v2 0/3] Make /proc per net namespace objects belong to  container David Miller <davem@davemloft.net> - 2016-08-15 06:10 +0200

#1460010 — [PATCH v2 0/3] Make /proc per net namespace objects belong to container

Currently [almost] all /proc objects belong to the global root, even if
data belongs to a given namespace within a container and (at least for
sysctls) we work around permssions checks to allow container's root to
access the data.

This series changes ownership of net namespace /proc objects
(/proc/net/self/* and /proc/sys/net/*) to be container's root and not
global root when there exists mapping for container's root in user
namespace.

This helps when running Android CTS in a container, but I think it makes
sense regardless.

Changes from V1:

- added fix for crash when !CONFIG_NET_NS (new patch #1)
- addressed Eric'c comments for error handling style in patch #3 and
  added his Ack
- adjusted patch #2 to use the same style of erro handling
- sent out as series instead of separate patches

Dmitry Torokhov (3):
  netns: do not call pernet ops for not yet set up init_net namespace
  proc: make proc entries inherit ownership from parent
  net: make net namespace sysctls belong to container's owner

 fs/proc/generic.c        |  2 ++
 fs/proc/proc_net.c       | 13 +++++++++++++
 fs/proc/proc_sysctl.c    |  5 +++++
 include/linux/sysctl.h   |  4 ++++
 net/core/net_namespace.c | 21 +++++++++++++++++----
 net/sysctl_net.c         | 29 ++++++++++++++++++++---------
 6 files changed, 61 insertions(+), 13 deletions(-)

-- 
2.8.0.rc3.226.g39d4020

[toc] | [next] | [standalone]

#1460013 — [PATCH v2 2/3] proc: make proc entries inherit ownership from parent

There are certain parameters that belong to net namespace and that are
exported in /proc. They should be controllable by the container's owner,
but are currently owned by global root and thus not available.

Let's change proc code to inherit ownership of parent entry, and when
create per-ns "net" proc entry set it up as owned by container's owner.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 fs/proc/generic.c  |  2 ++
 fs/proc/proc_net.c | 13 +++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index c633476..bca66d8 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -390,6 +390,8 @@ static struct proc_dir_entry *__proc_create(struct proc_dir_entry **parent,
 	atomic_set(&ent->count, 1);
 	spin_lock_init(&ent->pde_unload_lock);
 	INIT_LIST_HEAD(&ent->pde_openers);
+	proc_set_user(ent, (*parent)->uid, (*parent)->gid);
+
 out:
 	return ent;
 }
diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
index c8bbc68..7ae6b1d 100644
--- a/fs/proc/proc_net.c
+++ b/fs/proc/proc_net.c
@@ -21,6 +21,7 @@
 #include <linux/bitops.h>
 #include <linux/mount.h>
 #include <linux/nsproxy.h>
+#include <linux/uidgid.h>
 #include <net/net_namespace.h>
 #include <linux/seq_file.h>
 
@@ -185,6 +186,8 @@ const struct file_operations proc_net_operations = {
 static __net_init int proc_net_ns_init(struct net *net)
 {
 	struct proc_dir_entry *netd, *net_statd;
+	kuid_t uid;
+	kgid_t gid;
 	int err;
 
 	err = -ENOMEM;
@@ -199,6 +202,16 @@ static __net_init int proc_net_ns_init(struct net *net)
 	netd->parent = &proc_root;
 	memcpy(netd->name, "net", 4);
 
+	uid = make_kuid(net->user_ns, 0);
+	if (!uid_valid(uid))
+		uid = netd->uid;
+
+	gid = make_kgid(net->user_ns, 0);
+	if (!gid_valid(gid))
+		gid = netd->gid;
+
+	proc_set_user(netd, uid, gid);
+
 	err = -EEXIST;
 	net_statd = proc_net_mkdir(net, "stat", netd);
 	if (!net_statd)
-- 
2.8.0.rc3.226.g39d4020

[toc] | [prev] | [next] | [standalone]

#1462543 — Re: [PATCH v2 0/3] Make /proc per net namespace objects belong to container

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: Wed, 10 Aug 2016 14:35:59 -0700

> Currently [almost] all /proc objects belong to the global root, even if
> data belongs to a given namespace within a container and (at least for
> sysctls) we work around permssions checks to allow container's root to
> access the data.
> 
> This series changes ownership of net namespace /proc objects
> (/proc/net/self/* and /proc/sys/net/*) to be container's root and not
> global root when there exists mapping for container's root in user
> namespace.
> 
> This helps when running Android CTS in a container, but I think it makes
> sense regardless.
> 
> Changes from V1:
> 
> - added fix for crash when !CONFIG_NET_NS (new patch #1)
> - addressed Eric'c comments for error handling style in patch #3 and
>   added his Ack
> - adjusted patch #2 to use the same style of erro handling
> - sent out as series instead of separate patches

Series applied to net-next, thanks.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web