[NET]: Add network namespace clone & unshare support.

This patch allows you to create a new network namespace
using sys_clone, or sys_unshare.

As the network namespace is still experimental and under development
clone and unshare support is only made available when CONFIG_NET_NS is
selected at compile time.

As this patch introduces network namespace support into code paths
that exist when the CONFIG_NET is not selected there are a few
additions made to net_namespace.h to allow a few more functions
to be used when the networking stack is not compiled in.

Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 15 insertions, 3 deletions

diff --git a/kernel/fork.c b/kernel/fork.c
index 33f12f48684a..5e67f90a1694 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1608,7 +1608,8 @@ asmlinkage long sys_unshare(unsigned long unshare_flags)
         err = -EINVAL;
         if (unshare_flags & ~(CLONE_THREAD|CLONE_FS|CLONE_NEWNS|CLONE_SIGHAND|
                                 CLONE_VM|CLONE_FILES|CLONE_SYSVSEM|
-                                CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWUSER))
+                                CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWUSER|
+                                CLONE_NEWNET))
                 goto bad_unshare_out;
 
         if ((err = unshare_thread(unshare_flags)))
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index a4fb7d46971f..f1decd21a534 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -20,6 +20,7 @@
 #include <linux/mnt_namespace.h>
 #include <linux/utsname.h>
 #include <linux/pid_namespace.h>
+#include <net/net_namespace.h>
 
 static struct kmem_cache *nsproxy_cachep;
 
@@ -98,8 +99,17 @@ static struct nsproxy *create_new_namespaces(unsigned long flags,
                 goto out_user;
         }
 
+        new_nsp->net_ns = copy_net_ns(flags, tsk->nsproxy->net_ns);
+        if (IS_ERR(new_nsp->net_ns)) {
+                err = PTR_ERR(new_nsp->net_ns);
+                goto out_net;
+        }
+
         return new_nsp;
 
+out_net:
+        if (new_nsp->user_ns)
+                put_user_ns(new_nsp->user_ns);
 out_user:
         if (new_nsp->pid_ns)
                 put_pid_ns(new_nsp->pid_ns);
@@ -132,7 +142,7 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk)
 
         get_nsproxy(old_ns);
 
-        if (!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWUSER)))
+        if (!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWUSER | CLONE_NEWNET)))
                 return 0;
 
         if (!capable(CAP_SYS_ADMIN)) {
@@ -164,6 +174,7 @@ void free_nsproxy(struct nsproxy *ns)
                 put_pid_ns(ns->pid_ns);
         if (ns->user_ns)
                 put_user_ns(ns->user_ns);
+        put_net(ns->net_ns);
         kmem_cache_free(nsproxy_cachep, ns);
 }
 
@@ -177,7 +188,7 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags,
         int err = 0;
 
         if (!(unshare_flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
-                               CLONE_NEWUSER)))
+                               CLONE_NEWUSER | CLONE_NEWNET)))
                 return 0;
 
         if (!capable(CAP_SYS_ADMIN))