[PATCH] namespaces: add nsproxy

This patch adds a nsproxy structure to the task struct.  Later patches will
move the fs namespace pointer into this structure, and introduce a new utsname
namespace into the nsproxy.

The vserver and openvz functionality, then, would be implemented in large part
by virtualizing/isolating more and more resources into namespaces, each
contained in the nsproxy.

[akpm@osdl.org: build fix]
Signed-off-by: Serge Hallyn <serue@us.ibm.com>
Cc: Kirill Korotaev <dev@openvz.org>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Herbert Poetzl <herbert@13thfloor.at>
Cc: Andrey Savochkin <saw@sw.ru>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

4 files changed, 102 insertions, 2 deletions

diff --git a/kernel/Makefile b/kernel/Makefile
index aacaafb28b9d..6ec53009b866 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -8,7 +8,7 @@ obj-y     = sched.o fork.o exec_domain.o panic.o printk.o profile.o \
             signal.o sys.o kmod.o workqueue.o pid.o \
             rcupdate.o extable.o params.o posix-timers.o \
             kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \
-            hrtimer.o rwsem.o latency.o
+            hrtimer.o rwsem.o latency.o nsproxy.o
 
 obj-$(CONFIG_STACKTRACE) += stacktrace.o
 obj-y += time/
diff --git a/kernel/exit.c b/kernel/exit.c
index 3b47f26985f2..1d0e9ea1fa05 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -21,6 +21,7 @@
 #include <linux/tsacct_kern.h>
 #include <linux/file.h>
 #include <linux/binfmts.h>
+#include <linux/nsproxy.h>
 #include <linux/ptrace.h>
 #include <linux/profile.h>
 #include <linux/mount.h>
@@ -397,9 +398,14 @@ void daemonize(const char *name, ...)
         fs = init_task.fs;
         current->fs = fs;
         atomic_inc(&fs->count);
+
         exit_namespace(current);
+        exit_task_namespaces(current);
         current->namespace = init_task.namespace;
+        current->nsproxy = init_task.nsproxy;
         get_namespace(current->namespace);
+        get_task_namespaces(current);
+
         exit_files(current);
         current->files = init_task.files;
         atomic_inc(&current->files->count);
@@ -918,6 +924,7 @@ fastcall NORET_TYPE void do_exit(long code)
         __exit_files(tsk);
         __exit_fs(tsk);
         exit_namespace(tsk);
+        exit_task_namespaces(tsk);
         exit_thread();
         cpuset_exit(tsk);
         exit_keys(tsk);
diff --git a/kernel/fork.c b/kernel/fork.c
index 89f666491d1f..c9e660ae47aa 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -27,6 +27,7 @@
 #include <linux/binfmts.h>
 #include <linux/mman.h>
 #include <linux/fs.h>
+#include <linux/nsproxy.h>
 #include <linux/capability.h>
 #include <linux/cpu.h>
 #include <linux/cpuset.h>
@@ -1116,8 +1117,10 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                 goto bad_fork_cleanup_signal;
         if ((retval = copy_keys(clone_flags, p)))
                 goto bad_fork_cleanup_mm;
-        if ((retval = copy_namespace(clone_flags, p)))
+        if ((retval = copy_namespaces(clone_flags, p)))
                 goto bad_fork_cleanup_keys;
+        if ((retval = copy_namespace(clone_flags, p)))
+                goto bad_fork_cleanup_namespaces;
         retval = copy_thread(0, clone_flags, stack_start, stack_size, p, regs);
         if (retval)
                 goto bad_fork_cleanup_namespace;
@@ -1262,6 +1265,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 
 bad_fork_cleanup_namespace:
         exit_namespace(p);
+bad_fork_cleanup_namespaces:
+        exit_task_namespaces(p);
 bad_fork_cleanup_keys:
         exit_keys(p);
 bad_fork_cleanup_mm:
@@ -1606,6 +1611,7 @@ asmlinkage long sys_unshare(unsigned long unshare_flags)
         struct mm_struct *mm, *new_mm = NULL, *active_mm = NULL;
         struct files_struct *fd, *new_fd = NULL;
         struct sem_undo_list *new_ulist = NULL;
+        struct nsproxy *new_nsproxy, *old_nsproxy;
 
         check_unshare_flags(&unshare_flags);
 
@@ -1632,7 +1638,15 @@ asmlinkage long sys_unshare(unsigned long unshare_flags)
 
         if (new_fs || new_ns || new_sigh || new_mm || new_fd || new_ulist) {
 
+                old_nsproxy = current->nsproxy;
+                new_nsproxy = dup_namespaces(old_nsproxy);
+                if (!new_nsproxy) {
+                        err = -ENOMEM;
+                        goto bad_unshare_cleanup_semundo;
+                }
+
                 task_lock(current);
+                current->nsproxy = new_nsproxy;
 
                 if (new_fs) {
                         fs = current->fs;
@@ -1668,8 +1682,10 @@ asmlinkage long sys_unshare(unsigned long unshare_flags)
                 }
 
                 task_unlock(current);
+                put_nsproxy(old_nsproxy);
         }
 
+bad_unshare_cleanup_semundo:
 bad_unshare_cleanup_fd:
         if (new_fd)
                 put_files_struct(new_fd);
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
new file mode 100644
index 000000000000..ad9508865473
--- /dev/null
+++ b/kernel/nsproxy.c
@@ -0,0 +1,77 @@
+/*
+ *  Copyright (C) 2006 IBM Corporation
+ *
+ *  Author: Serge Hallyn <serue@us.ibm.com>
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License as
+ *  published by the Free Software Foundation, version 2 of the
+ *  License.
+ */
+
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/nsproxy.h>
+
+static inline void get_nsproxy(struct nsproxy *ns)
+{
+        atomic_inc(&ns->count);
+}
+
+void get_task_namespaces(struct task_struct *tsk)
+{
+        struct nsproxy *ns = tsk->nsproxy;
+        if (ns) {
+                get_nsproxy(ns);
+        }
+}
+
+/*
+ * creates a copy of "orig" with refcount 1.
+ * This does not grab references to the contained namespaces,
+ * so that needs to be done by dup_namespaces.
+ */
+static inline struct nsproxy *clone_namespaces(struct nsproxy *orig)
+{
+        struct nsproxy *ns;
+
+        ns = kmalloc(sizeof(struct nsproxy), GFP_KERNEL);
+        if (ns) {
+                memcpy(ns, orig, sizeof(struct nsproxy));
+                atomic_set(&ns->count, 1);
+        }
+        return ns;
+}
+
+/*
+ * copies the nsproxy, setting refcount to 1, and grabbing a
+ * reference to all contained namespaces.  Called from
+ * sys_unshare()
+ */
+struct nsproxy *dup_namespaces(struct nsproxy *orig)
+{
+        struct nsproxy *ns = clone_namespaces(orig);
+
+        return ns;
+}
+
+/*
+ * called from clone.  This now handles copy for nsproxy and all
+ * namespaces therein.
+ */
+int copy_namespaces(int flags, struct task_struct *tsk)
+{
+        struct nsproxy *old_ns = tsk->nsproxy;
+
+        if (!old_ns)
+                return 0;
+
+        get_nsproxy(old_ns);
+
+        return 0;
+}
+
+void free_nsproxy(struct nsproxy *ns)
+{
+                kfree(ns);
+}