4 files changed, 20 insertions, 18 deletions

diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 4a8acedf4b7d..08d947fc4c59 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -473,6 +473,7 @@ struct mm_struct {
          */
         struct task_struct __rcu *owner;
 #endif
+        struct user_namespace *user_ns;
 
         /* store ref to file /proc/<pid>/exe symlink points to */
         struct file __rcu *exe_file;
diff --git a/kernel/fork.c b/kernel/fork.c
index 997ac1d584f7..ba8a01564985 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -745,7 +745,8 @@ static void mm_init_owner(struct mm_struct *mm, struct task_struct *p)
 #endif
 }
 
-static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p)
+static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,
+        struct user_namespace *user_ns)
 {
         mm->mmap = NULL;
         mm->mm_rb = RB_ROOT;
@@ -785,6 +786,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p)
         if (init_new_context(p, mm))
                 goto fail_nocontext;
 
+        mm->user_ns = get_user_ns(user_ns);
         return mm;
 
 fail_nocontext:
@@ -830,7 +832,7 @@ struct mm_struct *mm_alloc(void)
                 return NULL;
 
         memset(mm, 0, sizeof(*mm));
-        return mm_init(mm, current);
+        return mm_init(mm, current, current_user_ns());
 }
 
 /*
@@ -845,6 +847,7 @@ void __mmdrop(struct mm_struct *mm)
         destroy_context(mm);
         mmu_notifier_mm_destroy(mm);
         check_mm(mm);
+        put_user_ns(mm->user_ns);
         free_mm(mm);
 }
 EXPORT_SYMBOL_GPL(__mmdrop);
@@ -1126,7 +1129,7 @@ static struct mm_struct *dup_mm(struct task_struct *tsk)
 
         memcpy(mm, oldmm, sizeof(*mm));
 
-        if (!mm_init(mm, tsk))
+        if (!mm_init(mm, tsk, mm->user_ns))
                 goto fail_nomem;
 
         err = dup_mmap(mm, oldmm);
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index e6474f7272ec..282821557183 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -220,7 +220,7 @@ static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
 static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
 {
         const struct cred *cred = current_cred(), *tcred;
-        int dumpable = 0;
+        struct mm_struct *mm;
         kuid_t caller_uid;
         kgid_t caller_gid;
 
@@ -271,16 +271,11 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
         return -EPERM;
 ok:
         rcu_read_unlock();
-        smp_rmb();
-        if (task->mm)
-                dumpable = get_dumpable(task->mm);
-        rcu_read_lock();
-        if (dumpable != SUID_DUMP_USER &&
-            !ptrace_has_cap(__task_cred(task)->user_ns, mode)) {
-                rcu_read_unlock();
-                return -EPERM;
-        }
-        rcu_read_unlock();
+        mm = task->mm;
+        if (mm &&
+            ((get_dumpable(mm) != SUID_DUMP_USER) &&
+             !ptrace_has_cap(mm->user_ns, mode)))
+            return -EPERM;
 
         return security_ptrace_access_check(task, mode);
 }
@@ -331,6 +326,11 @@ static int ptrace_attach(struct task_struct *task, long request,
 
         task_lock(task);
         retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH_REALCREDS);
+        if (!retval) {
+                struct mm_struct *mm = task->mm;
+                if (mm && ns_capable(mm->user_ns, CAP_SYS_PTRACE))
+                        flags |= PT_PTRACE_CAP;
+        }
         task_unlock(task);
         if (retval)
                 goto unlock_creds;
@@ -344,10 +344,6 @@ static int ptrace_attach(struct task_struct *task, long request,
 
         if (seize)
                 flags |= PT_SEIZED;
-        rcu_read_lock();
-        if (ns_capable(__task_cred(task)->user_ns, CAP_SYS_PTRACE))
-                flags |= PT_PTRACE_CAP;
-        rcu_read_unlock();
         task->ptrace = flags;
 
         __ptrace_link(task, current);
diff --git a/mm/init-mm.c b/mm/init-mm.c
index a56a851908d2..975e49f00f34 100644
--- a/mm/init-mm.c
+++ b/mm/init-mm.c
@@ -6,6 +6,7 @@
 #include <linux/cpumask.h>
 
 #include <linux/atomic.h>
+#include <linux/user_namespace.h>
 #include <asm/pgtable.h>
 #include <asm/mmu.h>
 
@@ -21,5 +22,6 @@ struct mm_struct init_mm = {
         .mmap_sem       = __RWSEM_INITIALIZER(init_mm.mmap_sem),
         .page_table_lock =  __SPIN_LOCK_UNLOCKED(init_mm.page_table_lock),
         .mmlist         = LIST_HEAD_INIT(init_mm.mmlist),
+        .user_ns        = &init_user_ns,
         INIT_MM_CONTEXT(init_mm)
 };