Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

Pull user namespace and namespace infrastructure changes from Eric W Biederman:
 "This set of changes starts with a few small enhnacements to the user
  namespace.  reboot support, allowing more arbitrary mappings, and
  support for mounting devpts, ramfs, tmpfs, and mqueuefs as just the
  user namespace root.

  I do my best to document that if you care about limiting your
  unprivileged users that when you have the user namespace support
  enabled you will need to enable memory control groups.

  There is a minor bug fix to prevent overflowing the stack if someone
  creates way too many user namespaces.

  The bulk of the changes are a continuation of the kuid/kgid push down
  work through the filesystems.  These changes make using uids and gids
  typesafe which ensures that these filesystems are safe to use when
  multiple user namespaces are in use.  The filesystems converted for
  3.9 are ceph, 9p, afs, ocfs2, gfs2, ncpfs, nfs, nfsd, and cifs.  The
  changes for these filesystems were a little more involved so I split
  the changes into smaller hopefully obviously correct changes.

  XFS is the only filesystem that remains.  I was hoping I could get
  that in this release so that user namespace support would be enabled
  with an allyesconfig or an allmodconfig but it looks like the xfs
  changes need another couple of days before it they are ready."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: (93 commits)
  cifs: Enable building with user namespaces enabled.
  cifs: Convert struct cifs_ses to use a kuid_t and a kgid_t
  cifs: Convert struct cifs_sb_info to use kuids and kgids
  cifs: Modify struct smb_vol to use kuids and kgids
  cifs: Convert struct cifsFileInfo to use a kuid
  cifs: Convert struct cifs_fattr to use kuid and kgids
  cifs: Convert struct tcon_link to use a kuid.
  cifs: Modify struct cifs_unix_set_info_args to hold a kuid_t and a kgid_t
  cifs: Convert from a kuid before printing current_fsuid
  cifs: Use kuids and kgids SID to uid/gid mapping
  cifs: Pass GLOBAL_ROOT_UID and GLOBAL_ROOT_GID to keyring_alloc
  cifs: Use BUILD_BUG_ON to validate uids and gids are the same size
  cifs: Override unmappable incoming uids and gids
  nfsd: Enable building with user namespaces enabled.
  nfsd: Properly compare and initialize kuids and kgids
  nfsd: Store ex_anon_uid and ex_anon_gid as kuids and kgids
  nfsd: Modify nfsd4_cb_sec to use kuids and kgids
  nfsd: Handle kuids and kgids in the nfs4acl to posix_acl conversion
  nfsd: Convert nfsxdr to use kuids and kgids
  nfsd: Convert nfs3xdr to use kuids and kgids
  ...

2 files changed, 69 insertions, 23 deletions

diff --git a/net/9p/client.c b/net/9p/client.c
index 34d417670935..8eb75425e6e6 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -1100,7 +1100,7 @@ void p9_client_begin_disconnect(struct p9_client *clnt)
 EXPORT_SYMBOL(p9_client_begin_disconnect);
 
 struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
-        char *uname, u32 n_uname, char *aname)
+        char *uname, kuid_t n_uname, char *aname)
 {
         int err = 0;
         struct p9_req_t *req;
@@ -1117,7 +1117,7 @@ struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
                 goto error;
         }
 
-        req = p9_client_rpc(clnt, P9_TATTACH, "ddss?d", fid->fid,
+        req = p9_client_rpc(clnt, P9_TATTACH, "ddss?u", fid->fid,
                         afid ? afid->fid : P9_NOFID, uname, aname, n_uname);
         if (IS_ERR(req)) {
                 err = PTR_ERR(req);
@@ -1270,7 +1270,7 @@ error:
 EXPORT_SYMBOL(p9_client_open);
 
 int p9_client_create_dotl(struct p9_fid *ofid, char *name, u32 flags, u32 mode,
-                gid_t gid, struct p9_qid *qid)
+                kgid_t gid, struct p9_qid *qid)
 {
         int err = 0;
         struct p9_client *clnt;
@@ -1279,13 +1279,14 @@ int p9_client_create_dotl(struct p9_fid *ofid, char *name, u32 flags, u32 mode,
 
         p9_debug(P9_DEBUG_9P,
                         ">>> TLCREATE fid %d name %s flags %d mode %d gid %d\n",
-                        ofid->fid, name, flags, mode, gid);
+                        ofid->fid, name, flags, mode,
+                        from_kgid(&init_user_ns, gid));
         clnt = ofid->clnt;
 
         if (ofid->mode != -1)
                 return -EINVAL;
 
-        req = p9_client_rpc(clnt, P9_TLCREATE, "dsddd", ofid->fid, name, flags,
+        req = p9_client_rpc(clnt, P9_TLCREATE, "dsddg", ofid->fid, name, flags,
                         mode, gid);
         if (IS_ERR(req)) {
                 err = PTR_ERR(req);
@@ -1358,7 +1359,7 @@ error:
 }
 EXPORT_SYMBOL(p9_client_fcreate);
 
-int p9_client_symlink(struct p9_fid *dfid, char *name, char *symtgt, gid_t gid,
+int p9_client_symlink(struct p9_fid *dfid, char *name, char *symtgt, kgid_t gid,
                 struct p9_qid *qid)
 {
         int err = 0;
@@ -1369,7 +1370,7 @@ int p9_client_symlink(struct p9_fid *dfid, char *name, char *symtgt, gid_t gid,
                         dfid->fid, name, symtgt);
         clnt = dfid->clnt;
 
-        req = p9_client_rpc(clnt, P9_TSYMLINK, "dssd", dfid->fid, name, symtgt,
+        req = p9_client_rpc(clnt, P9_TSYMLINK, "dssg", dfid->fid, name, symtgt,
                         gid);
         if (IS_ERR(req)) {
                 err = PTR_ERR(req);
@@ -1710,7 +1711,9 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
                 (unsigned long long)ret->qid.path, ret->qid.version, ret->mode,
                 ret->atime, ret->mtime, (unsigned long long)ret->length,
                 ret->name, ret->uid, ret->gid, ret->muid, ret->extension,
-                ret->n_uid, ret->n_gid, ret->n_muid);
+                from_kuid(&init_user_ns, ret->n_uid),
+                from_kgid(&init_user_ns, ret->n_gid),
+                from_kuid(&init_user_ns, ret->n_muid));
 
         p9_free_req(clnt, req);
         return ret;
@@ -1764,8 +1767,10 @@ struct p9_stat_dotl *p9_client_getattr_dotl(struct p9_fid *fid,
                 "<<< st_btime_sec=%lld st_btime_nsec=%lld\n"
                 "<<< st_gen=%lld st_data_version=%lld",
                 ret->st_result_mask, ret->qid.type, ret->qid.path,
-                ret->qid.version, ret->st_mode, ret->st_nlink, ret->st_uid,
-                ret->st_gid, ret->st_rdev, ret->st_size, ret->st_blksize,
+                ret->qid.version, ret->st_mode, ret->st_nlink,
+                from_kuid(&init_user_ns, ret->st_uid),
+                from_kgid(&init_user_ns, ret->st_gid),
+                ret->st_rdev, ret->st_size, ret->st_blksize,
                 ret->st_blocks, ret->st_atime_sec, ret->st_atime_nsec,
                 ret->st_mtime_sec, ret->st_mtime_nsec, ret->st_ctime_sec,
                 ret->st_ctime_nsec, ret->st_btime_sec, ret->st_btime_nsec,
@@ -1828,7 +1833,9 @@ int p9_client_wstat(struct p9_fid *fid, struct p9_wstat *wst)
                 (unsigned long long)wst->qid.path, wst->qid.version, wst->mode,
                 wst->atime, wst->mtime, (unsigned long long)wst->length,
                 wst->name, wst->uid, wst->gid, wst->muid, wst->extension,
-                wst->n_uid, wst->n_gid, wst->n_muid);
+                from_kuid(&init_user_ns, wst->n_uid),
+                from_kgid(&init_user_ns, wst->n_gid),
+                from_kuid(&init_user_ns, wst->n_muid));
 
         req = p9_client_rpc(clnt, P9_TWSTAT, "dwS", fid->fid, wst->size+2, wst);
         if (IS_ERR(req)) {
@@ -1857,7 +1864,9 @@ int p9_client_setattr(struct p9_fid *fid, struct p9_iattr_dotl *p9attr)
                 "    valid=%x mode=%x uid=%d gid=%d size=%lld\n"
                 "    atime_sec=%lld atime_nsec=%lld\n"
                 "    mtime_sec=%lld mtime_nsec=%lld\n",
-                p9attr->valid, p9attr->mode, p9attr->uid, p9attr->gid,
+                p9attr->valid, p9attr->mode,
+                from_kuid(&init_user_ns, p9attr->uid),
+                from_kgid(&init_user_ns, p9attr->gid),
                 p9attr->size, p9attr->atime_sec, p9attr->atime_nsec,
                 p9attr->mtime_sec, p9attr->mtime_nsec);
 
@@ -2106,7 +2115,7 @@ error:
 EXPORT_SYMBOL(p9_client_readdir);
 
 int p9_client_mknod_dotl(struct p9_fid *fid, char *name, int mode,
-                        dev_t rdev, gid_t gid, struct p9_qid *qid)
+                        dev_t rdev, kgid_t gid, struct p9_qid *qid)
 {
         int err;
         struct p9_client *clnt;
@@ -2116,7 +2125,7 @@ int p9_client_mknod_dotl(struct p9_fid *fid, char *name, int mode,
         clnt = fid->clnt;
         p9_debug(P9_DEBUG_9P, ">>> TMKNOD fid %d name %s mode %d major %d "
                 "minor %d\n", fid->fid, name, mode, MAJOR(rdev), MINOR(rdev));
-        req = p9_client_rpc(clnt, P9_TMKNOD, "dsdddd", fid->fid, name, mode,
+        req = p9_client_rpc(clnt, P9_TMKNOD, "dsdddg", fid->fid, name, mode,
                 MAJOR(rdev), MINOR(rdev), gid);
         if (IS_ERR(req))
                 return PTR_ERR(req);
@@ -2137,7 +2146,7 @@ error:
 EXPORT_SYMBOL(p9_client_mknod_dotl);
 
 int p9_client_mkdir_dotl(struct p9_fid *fid, char *name, int mode,
-                                gid_t gid, struct p9_qid *qid)
+                                kgid_t gid, struct p9_qid *qid)
 {
         int err;
         struct p9_client *clnt;
@@ -2146,8 +2155,8 @@ int p9_client_mkdir_dotl(struct p9_fid *fid, char *name, int mode,
         err = 0;
         clnt = fid->clnt;
         p9_debug(P9_DEBUG_9P, ">>> TMKDIR fid %d name %s mode %d gid %d\n",
-                 fid->fid, name, mode, gid);
-        req = p9_client_rpc(clnt, P9_TMKDIR, "dsdd", fid->fid, name, mode,
+                 fid->fid, name, mode, from_kgid(&init_user_ns, gid));
+        req = p9_client_rpc(clnt, P9_TMKDIR, "dsdg", fid->fid, name, mode,
                 gid);
         if (IS_ERR(req))
                 return PTR_ERR(req);
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 3d33ecf13327..ab9127ec5b7a 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -85,6 +85,8 @@ pdu_write_u(struct p9_fcall *pdu, const char __user *udata, size_t size)
         d - int32_t
         q - int64_t
         s - string
+        u - numeric uid
+        g - numeric gid
         S - stat
         Q - qid
         D - data blob (int32_t size followed by void *, results are not freed)
@@ -163,6 +165,26 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                         (*sptr)[len] = 0;
                         }
                         break;
+                case 'u': {
+                                kuid_t *uid = va_arg(ap, kuid_t *);
+                                __le32 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
+                                        errcode = -EFAULT;
+                                        break;
+                                }
+                                *uid = make_kuid(&init_user_ns,
+                                                 le32_to_cpu(le_val));
+                        } break;
+                case 'g': {
+                                kgid_t *gid = va_arg(ap, kgid_t *);
+                                __le32 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
+                                        errcode = -EFAULT;
+                                        break;
+                                }
+                                *gid = make_kgid(&init_user_ns,
+                                                 le32_to_cpu(le_val));
+                        } break;
                 case 'Q':{
                                 struct p9_qid *qid =
                                     va_arg(ap, struct p9_qid *);
@@ -177,11 +199,12 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                     va_arg(ap, struct p9_wstat *);
 
                                 memset(stbuf, 0, sizeof(struct p9_wstat));
-                                stbuf->n_uid = stbuf->n_gid = stbuf->n_muid =
-                                                                        -1;
+                                stbuf->n_uid = stbuf->n_muid = INVALID_UID;
+                                stbuf->n_gid = INVALID_GID;
+
                                 errcode =
                                     p9pdu_readf(pdu, proto_version,
-                                                "wwdQdddqssss?sddd",
+                                                "wwdQdddqssss?sugu",
                                                 &stbuf->size, &stbuf->type,
                                                 &stbuf->dev, &stbuf->qid,
                                                 &stbuf->mode, &stbuf->atime,
@@ -294,7 +317,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                 memset(stbuf, 0, sizeof(struct p9_stat_dotl));
                                 errcode =
                                     p9pdu_readf(pdu, proto_version,
-                                        "qQdddqqqqqqqqqqqqqqq",
+                                        "qQdugqqqqqqqqqqqqqqq",
                                         &stbuf->st_result_mask,
                                         &stbuf->qid,
                                         &stbuf->st_mode,
@@ -377,6 +400,20 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                         errcode = -EFAULT;
                         }
                         break;
+                case 'u': {
+                                kuid_t uid = va_arg(ap, kuid_t);
+                                __le32 val = cpu_to_le32(
+                                                from_kuid(&init_user_ns, uid));
+                                if (pdu_write(pdu, &val, sizeof(val)))
+                                        errcode = -EFAULT;
+                        } break;
+                case 'g': {
+                                kgid_t gid = va_arg(ap, kgid_t);
+                                __le32 val = cpu_to_le32(
+                                                from_kgid(&init_user_ns, gid));
+                                if (pdu_write(pdu, &val, sizeof(val)))
+                                        errcode = -EFAULT;
+                        } break;
                 case 'Q':{
                                 const struct p9_qid *qid =
                                     va_arg(ap, const struct p9_qid *);
@@ -390,7 +427,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                     va_arg(ap, const struct p9_wstat *);
                                 errcode =
                                     p9pdu_writef(pdu, proto_version,
-                                                 "wwdQdddqssss?sddd",
+                                                 "wwdQdddqssss?sugu",
                                                  stbuf->size, stbuf->type,
                                                  stbuf->dev, &stbuf->qid,
                                                  stbuf->mode, stbuf->atime,
@@ -468,7 +505,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                                         struct p9_iattr_dotl *);
 
                                 errcode = p9pdu_writef(pdu, proto_version,
-                                                        "ddddqqqqq",
+                                                        "ddugqqqqq",
                                                         p9attr->valid,
                                                         p9attr->mode,
                                                         p9attr->uid,