aboutsummaryrefslogtreecommitdiffstats
path: root/init
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2012-10-02 14:11:09 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2012-10-02 14:11:09 -0400
commit437589a74b6a590d175f86cf9f7b2efcee7765e7 (patch)
tree37bf8635b1356d80ef002b00e84f3faf3d555a63 /init
parent68d47a137c3bef754923bccf73fb639c9b0bbd5e (diff)
parent72235465864d84cedb2d9f26f8e1de824ee20339 (diff)
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
Pull user namespace changes from Eric Biederman: "This is a mostly modest set of changes to enable basic user namespace support. This allows the code to code to compile with user namespaces enabled and removes the assumption there is only the initial user namespace. Everything is converted except for the most complex of the filesystems: autofs4, 9p, afs, ceph, cifs, coda, fuse, gfs2, ncpfs, nfs, ocfs2 and xfs as those patches need a bit more review. The strategy is to push kuid_t and kgid_t values are far down into subsystems and filesystems as reasonable. Leaving the make_kuid and from_kuid operations to happen at the edge of userspace, as the values come off the disk, and as the values come in from the network. Letting compile type incompatible compile errors (present when user namespaces are enabled) guide me to find the issues. The most tricky areas have been the places where we had an implicit union of uid and gid values and were storing them in an unsigned int. Those places were converted into explicit unions. I made certain to handle those places with simple trivial patches. Out of that work I discovered we have generic interfaces for storing quota by projid. I had never heard of the project identifiers before. Adding full user namespace support for project identifiers accounts for most of the code size growth in my git tree. Ultimately there will be work to relax privlige checks from "capable(FOO)" to "ns_capable(user_ns, FOO)" where it is safe allowing root in a user names to do those things that today we only forbid to non-root users because it will confuse suid root applications. While I was pushing kuid_t and kgid_t changes deep into the audit code I made a few other cleanups. I capitalized on the fact we process netlink messages in the context of the message sender. I removed usage of NETLINK_CRED, and started directly using current->tty. Some of these patches have also made it into maintainer trees, with no problems from identical code from different trees showing up in linux-next. After reading through all of this code I feel like I might be able to win a game of kernel trivial pursuit." Fix up some fairly trivial conflicts in netfilter uid/git logging code. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: (107 commits) userns: Convert the ufs filesystem to use kuid/kgid where appropriate userns: Convert the udf filesystem to use kuid/kgid where appropriate userns: Convert ubifs to use kuid/kgid userns: Convert squashfs to use kuid/kgid where appropriate userns: Convert reiserfs to use kuid and kgid where appropriate userns: Convert jfs to use kuid/kgid where appropriate userns: Convert jffs2 to use kuid and kgid where appropriate userns: Convert hpfs to use kuid and kgid where appropriate userns: Convert btrfs to use kuid/kgid where appropriate userns: Convert bfs to use kuid/kgid where appropriate userns: Convert affs to use kuid/kgid wherwe appropriate userns: On alpha modify linux_to_osf_stat to use convert from kuids and kgids userns: On ia64 deal with current_uid and current_gid being kuid and kgid userns: On ppc convert current_uid from a kuid before printing. userns: Convert s390 getting uid and gid system calls to use kuid and kgid userns: Convert s390 hypfs to use kuid and kgid where appropriate userns: Convert binder ipc to use kuids userns: Teach security_path_chown to take kuids and kgids userns: Add user namespace support to IMA userns: Convert EVM to deal with kuids and kgids in it's hmac computation ...
Diffstat (limited to 'init')
-rw-r--r--init/Kconfig89
1 files changed, 0 insertions, 89 deletions
diff --git a/init/Kconfig b/init/Kconfig
index 73e4adfa91dc..cb003a3c9122 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -986,113 +986,24 @@ config UIDGID_CONVERTED
986 bool 986 bool
987 default y 987 default y
988 988
989 # List of kernel pieces that need user namespace work
990 # Features
991 depends on SYSVIPC = n
992 depends on IMA = n
993 depends on EVM = n
994 depends on KEYS = n
995 depends on AUDIT = n
996 depends on AUDITSYSCALL = n
997 depends on TASKSTATS = n
998 depends on TRACING = n
999 depends on FS_POSIX_ACL = n
1000 depends on QUOTA = n
1001 depends on QUOTACTL = n
1002 depends on DEBUG_CREDENTIALS = n
1003 depends on BSD_PROCESS_ACCT = n
1004 depends on DRM = n
1005 depends on PROC_EVENTS = n
1006
1007 # Networking 989 # Networking
1008 depends on NET = n
1009 depends on NET_9P = n 990 depends on NET_9P = n
1010 depends on IPX = n
1011 depends on PHONET = n
1012 depends on NET_CLS_FLOW = n
1013 depends on NETFILTER_XT_MATCH_OWNER = n
1014 depends on NETFILTER_XT_MATCH_RECENT = n
1015 depends on NETFILTER_XT_TARGET_LOG = n
1016 depends on NETFILTER_NETLINK_LOG = n
1017 depends on INET = n
1018 depends on IPV6 = n
1019 depends on IP_SCTP = n
1020 depends on AF_RXRPC = n
1021 depends on LLC2 = n
1022 depends on NET_KEY = n
1023 depends on INET_DIAG = n
1024 depends on DNS_RESOLVER = n
1025 depends on AX25 = n
1026 depends on ATALK = n
1027 991
1028 # Filesystems 992 # Filesystems
1029 depends on USB_DEVICEFS = n
1030 depends on USB_GADGETFS = n
1031 depends on USB_FUNCTIONFS = n
1032 depends on DEVTMPFS = n
1033 depends on XENFS = n
1034
1035 depends on 9P_FS = n 993 depends on 9P_FS = n
1036 depends on ADFS_FS = n
1037 depends on AFFS_FS = n
1038 depends on AFS_FS = n 994 depends on AFS_FS = n
1039 depends on AUTOFS4_FS = n 995 depends on AUTOFS4_FS = n
1040 depends on BEFS_FS = n
1041 depends on BFS_FS = n
1042 depends on BTRFS_FS = n
1043 depends on CEPH_FS = n 996 depends on CEPH_FS = n
1044 depends on CIFS = n 997 depends on CIFS = n
1045 depends on CODA_FS = n 998 depends on CODA_FS = n
1046 depends on CONFIGFS_FS = n
1047 depends on CRAMFS = n
1048 depends on DEBUG_FS = n
1049 depends on ECRYPT_FS = n
1050 depends on EFS_FS = n
1051 depends on EXOFS_FS = n
1052 depends on FAT_FS = n
1053 depends on FUSE_FS = n 999 depends on FUSE_FS = n
1054 depends on GFS2_FS = n 1000 depends on GFS2_FS = n
1055 depends on HFS_FS = n
1056 depends on HFSPLUS_FS = n
1057 depends on HPFS_FS = n
1058 depends on HUGETLBFS = n
1059 depends on ISO9660_FS = n
1060 depends on JFFS2_FS = n
1061 depends on JFS_FS = n
1062 depends on LOGFS = n
1063 depends on MINIX_FS = n
1064 depends on NCP_FS = n 1001 depends on NCP_FS = n
1065 depends on NFSD = n 1002 depends on NFSD = n
1066 depends on NFS_FS = n 1003 depends on NFS_FS = n
1067 depends on NILFS2_FS = n
1068 depends on NTFS_FS = n
1069 depends on OCFS2_FS = n 1004 depends on OCFS2_FS = n
1070 depends on OMFS_FS = n
1071 depends on QNX4FS_FS = n
1072 depends on QNX6FS_FS = n
1073 depends on REISERFS_FS = n
1074 depends on SQUASHFS = n
1075 depends on SYSV_FS = n
1076 depends on UBIFS_FS = n
1077 depends on UDF_FS = n
1078 depends on UFS_FS = n
1079 depends on VXFS_FS = n
1080 depends on XFS_FS = n 1005 depends on XFS_FS = n
1081 1006
1082 depends on !UML || HOSTFS = n
1083
1084 # The rare drivers that won't build
1085 depends on AIRO = n
1086 depends on AIRO_CS = n
1087 depends on TUN = n
1088 depends on INFINIBAND_QIB = n
1089 depends on BLK_DEV_LOOP = n
1090 depends on ANDROID_BINDER_IPC = n
1091
1092 # Security modules
1093 depends on SECURITY_TOMOYO = n
1094 depends on SECURITY_APPARMOR = n
1095
1096config UIDGID_STRICT_TYPE_CHECKS 1007config UIDGID_STRICT_TYPE_CHECKS
1097 bool "Require conversions between uid/gids and their internal representation" 1008 bool "Require conversions between uid/gids and their internal representation"
1098 depends on UIDGID_CONVERTED 1009 depends on UIDGID_CONVERTED