6 files changed, 76 insertions, 99 deletions

diff --git a/kernel/cred.c b/kernel/cred.c
index 13697ca2bb38..ff7bc071991c 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -274,6 +274,7 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
         struct thread_group_cred *tgcred;
 #endif
         struct cred *new;
+        int ret;
 
         mutex_init(&p->cred_exec_mutex);
 
@@ -293,6 +294,12 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
         if (!new)
                 return -ENOMEM;
 
+        if (clone_flags & CLONE_NEWUSER) {
+                ret = create_user_ns(new);
+                if (ret < 0)
+                        goto error_put;
+        }
+
 #ifdef CONFIG_KEYS
         /* new threads get their own thread keyrings if their parent already
          * had one */
@@ -309,8 +316,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
         if (!(clone_flags & CLONE_THREAD)) {
                 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
                 if (!tgcred) {
-                        put_cred(new);
-                        return -ENOMEM;
+                        ret = -ENOMEM;
+                        goto error_put;
                 }
                 atomic_set(&tgcred->usage, 1);
                 spin_lock_init(&tgcred->lock);
@@ -325,6 +332,10 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
         atomic_inc(&new->user->processes);
         p->cred = p->real_cred = get_cred(new);
         return 0;
+
+error_put:
+        put_cred(new);
+        return ret;
 }
 
 /**
diff --git a/kernel/fork.c b/kernel/fork.c
index 29c18c14812d..1dd89451fae4 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -976,7 +976,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         if (atomic_read(&p->real_cred->user->processes) >=
                         p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
                 if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
-                    p->real_cred->user != current->nsproxy->user_ns->root_user)
+                    p->real_cred->user != INIT_USER)
                         goto bad_fork_free;
         }
 
@@ -1335,6 +1335,20 @@ long do_fork(unsigned long clone_flags,
         long nr;
 
         /*
+         * Do some preliminary argument and permissions checking before we
+         * actually start allocating stuff
+         */
+        if (clone_flags & CLONE_NEWUSER) {
+                if (clone_flags & CLONE_THREAD)
+                        return -EINVAL;
+                /* hopefully this check will go away when userns support is
+                 * complete
+                 */
+                if (!capable(CAP_SYS_ADMIN))
+                        return -EPERM;
+        }
+
+        /*
          * We hope to recycle these flags after 2.6.26
          */
         if (unlikely(clone_flags & CLONE_STOPPED)) {
@@ -1581,8 +1595,7 @@ asmlinkage long sys_unshare(unsigned long unshare_flags)
         err = -EINVAL;
         if (unshare_flags & ~(CLONE_THREAD|CLONE_FS|CLONE_NEWNS|CLONE_SIGHAND|
                                 CLONE_VM|CLONE_FILES|CLONE_SYSVSEM|
-                                CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWUSER|
-                                CLONE_NEWNET))
+                                CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWNET))
                 goto bad_unshare_out;
 
         /*
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index 1d3ef29a2583..63598dca2d0c 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -80,12 +80,6 @@ static struct nsproxy *create_new_namespaces(unsigned long flags,
                 goto out_pid;
         }
 
-        new_nsp->user_ns = copy_user_ns(flags, tsk->nsproxy->user_ns);
-        if (IS_ERR(new_nsp->user_ns)) {
-                err = PTR_ERR(new_nsp->user_ns);
-                goto out_user;
-        }
-
         new_nsp->net_ns = copy_net_ns(flags, tsk->nsproxy->net_ns);
         if (IS_ERR(new_nsp->net_ns)) {
                 err = PTR_ERR(new_nsp->net_ns);
@@ -95,9 +89,6 @@ static struct nsproxy *create_new_namespaces(unsigned long flags,
         return new_nsp;
 
 out_net:
-        if (new_nsp->user_ns)
-                put_user_ns(new_nsp->user_ns);
-out_user:
         if (new_nsp->pid_ns)
                 put_pid_ns(new_nsp->pid_ns);
 out_pid:
@@ -130,7 +121,7 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk)
         get_nsproxy(old_ns);
 
         if (!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
-                                CLONE_NEWUSER | CLONE_NEWPID | CLONE_NEWNET)))
+                                CLONE_NEWPID | CLONE_NEWNET)))
                 return 0;
 
         if (!capable(CAP_SYS_ADMIN)) {
@@ -173,8 +164,6 @@ void free_nsproxy(struct nsproxy *ns)
                 put_ipc_ns(ns->ipc_ns);
         if (ns->pid_ns)
                 put_pid_ns(ns->pid_ns);
-        if (ns->user_ns)
-                put_user_ns(ns->user_ns);
         put_net(ns->net_ns);
         kmem_cache_free(nsproxy_cachep, ns);
 }
@@ -189,7 +178,7 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags,
         int err = 0;
 
         if (!(unshare_flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
-                               CLONE_NEWUSER | CLONE_NEWNET)))
+                               CLONE_NEWNET)))
                 return 0;
 
         if (!capable(CAP_SYS_ADMIN))
diff --git a/kernel/sys.c b/kernel/sys.c
index ab735040468a..ebe65c2c9873 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -565,13 +565,13 @@ static int set_user(struct cred *new)
 {
         struct user_struct *new_user;
 
-        new_user = alloc_uid(current->nsproxy->user_ns, new->uid);
+        new_user = alloc_uid(current_user_ns(), new->uid);
         if (!new_user)
                 return -EAGAIN;
 
         if (atomic_read(&new_user->processes) >=
                                 current->signal->rlim[RLIMIT_NPROC].rlim_cur &&
-                        new_user != current->nsproxy->user_ns->root_user) {
+                        new_user != INIT_USER) {
                 free_uid(new_user);
                 return -EAGAIN;
         }
diff --git a/kernel/user.c b/kernel/user.c
index d476307dd4b0..c0ef3a464438 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -20,9 +20,9 @@
 
 struct user_namespace init_user_ns = {
         .kref = {
-                .refcount       = ATOMIC_INIT(2),
+                .refcount       = ATOMIC_INIT(1),
         },
-        .root_user = &root_user,
+        .creator = &root_user,
 };
 EXPORT_SYMBOL_GPL(init_user_ns);
 
@@ -48,12 +48,14 @@ static struct kmem_cache *uid_cachep;
  */
 static DEFINE_SPINLOCK(uidhash_lock);
 
+/* root_user.__count is 2, 1 for init task cred, 1 for init_user_ns->creator */
 struct user_struct root_user = {
-        .__count        = ATOMIC_INIT(1),
+        .__count        = ATOMIC_INIT(2),
         .processes      = ATOMIC_INIT(1),
         .files          = ATOMIC_INIT(0),
         .sigpending     = ATOMIC_INIT(0),
         .locked_shm     = 0,
+        .user_ns        = &init_user_ns,
 #ifdef CONFIG_USER_SCHED
         .tg             = &init_task_group,
 #endif
@@ -314,12 +316,13 @@ done:
  * IRQ state (as stored in flags) is restored and uidhash_lock released
  * upon function exit.
  */
-static inline void free_user(struct user_struct *up, unsigned long flags)
+static void free_user(struct user_struct *up, unsigned long flags)
 {
         /* restore back the count */
         atomic_inc(&up->__count);
         spin_unlock_irqrestore(&uidhash_lock, flags);
 
+        put_user_ns(up->user_ns);
         INIT_WORK(&up->work, remove_user_sysfs_dir);
         schedule_work(&up->work);
 }
@@ -335,13 +338,14 @@ static inline void uids_mutex_unlock(void) { }
  * IRQ state (as stored in flags) is restored and uidhash_lock released
  * upon function exit.
  */
-static inline void free_user(struct user_struct *up, unsigned long flags)
+static void free_user(struct user_struct *up, unsigned long flags)
 {
         uid_hash_remove(up);
         spin_unlock_irqrestore(&uidhash_lock, flags);
         sched_destroy_user(up);
         key_put(up->uid_keyring);
         key_put(up->session_keyring);
+        put_user_ns(up->user_ns);
         kmem_cache_free(uid_cachep, up);
 }
 
@@ -357,7 +361,7 @@ struct user_struct *find_user(uid_t uid)
 {
         struct user_struct *ret;
         unsigned long flags;
-        struct user_namespace *ns = current->nsproxy->user_ns;
+        struct user_namespace *ns = current_user()->user_ns;
 
         spin_lock_irqsave(&uidhash_lock, flags);
         ret = uid_hash_find(uid, uidhashentry(ns, uid));
@@ -404,6 +408,8 @@ struct user_struct *alloc_uid(struct user_namespace *ns, uid_t uid)
                 if (sched_create_user(new) < 0)
                         goto out_free_user;
 
+                new->user_ns = get_user_ns(ns);
+
                 if (uids_user_create(new))
                         goto out_destoy_sched;
 
@@ -427,7 +433,6 @@ struct user_struct *alloc_uid(struct user_namespace *ns, uid_t uid)
                         up = new;
                 }
                 spin_unlock_irq(&uidhash_lock);
-
         }
 
         uids_mutex_unlock();
@@ -436,6 +441,7 @@ struct user_struct *alloc_uid(struct user_namespace *ns, uid_t uid)
 
 out_destoy_sched:
         sched_destroy_user(new);
+        put_user_ns(new->user_ns);
 out_free_user:
         kmem_cache_free(uid_cachep, new);
 out_unlock:
@@ -443,33 +449,6 @@ out_unlock:
         return NULL;
 }
 
-#ifdef CONFIG_USER_NS
-void release_uids(struct user_namespace *ns)
-{
-        int i;
-        unsigned long flags;
-        struct hlist_head *head;
-        struct hlist_node *nd;
-
-        spin_lock_irqsave(&uidhash_lock, flags);
-        /*
-         * collapse the chains so that the user_struct-s will
-         * be still alive, but not in hashes. subsequent free_uid()
-         * will free them.
-         */
-        for (i = 0; i < UIDHASH_SZ; i++) {
-                head = ns->uidhash_table + i;
-                while (!hlist_empty(head)) {
-                        nd = head->first;
-                        hlist_del_init(nd);
-                }
-        }
-        spin_unlock_irqrestore(&uidhash_lock, flags);
-
-        free_uid(ns->root_user);
-}
-#endif
-
 static int __init uid_cache_init(void)
 {
         int n;
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 0d9c51d67333..79084311ee57 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -9,70 +9,55 @@
 #include <linux/nsproxy.h>
 #include <linux/slab.h>
 #include <linux/user_namespace.h>
+#include <linux/cred.h>
 
 /*
- * Clone a new ns copying an original user ns, setting refcount to 1
- * @old_ns: namespace to clone
- * Return NULL on error (failure to kmalloc), new ns otherwise
+ * Create a new user namespace, deriving the creator from the user in the
+ * passed credentials, and replacing that user with the new root user for the
+ * new namespace.
+ *
+ * This is called by copy_creds(), which will finish setting the target task's
+ * credentials.
  */
-static struct user_namespace *clone_user_ns(struct user_namespace *old_ns)
+int create_user_ns(struct cred *new)
 {
         struct user_namespace *ns;
-        struct user_struct *new_user;
-        struct cred *new;
+        struct user_struct *root_user;
         int n;
 
         ns = kmalloc(sizeof(struct user_namespace), GFP_KERNEL);
         if (!ns)
-                return ERR_PTR(-ENOMEM);
+                return -ENOMEM;
 
         kref_init(&ns->kref);
 
         for (n = 0; n < UIDHASH_SZ; ++n)
                 INIT_HLIST_HEAD(ns->uidhash_table + n);
 
-        /* Insert new root user.  */
-        ns->root_user = alloc_uid(ns, 0);
-        if (!ns->root_user) {
+        /* Alloc new root user.  */
+        root_user = alloc_uid(ns, 0);
+        if (!root_user) {
                 kfree(ns);
-                return ERR_PTR(-ENOMEM);
+                return -ENOMEM;
         }
 
-        /* Reset current->user with a new one */
-        new_user = alloc_uid(ns, current_uid());
-        if (!new_user) {
-                free_uid(ns->root_user);
-                kfree(ns);
-                return ERR_PTR(-ENOMEM);
-        }
-
-        /* Install the new user */
-        new = prepare_creds();
-        if (!new) {
-                free_uid(new_user);
-                free_uid(ns->root_user);
-                kfree(ns);
-        }
-        free_uid(new->user);
-        new->user = new_user;
-        commit_creds(new);
-        return ns;
-}
-
-struct user_namespace * copy_user_ns(int flags, struct user_namespace *old_ns)
-{
-        struct user_namespace *new_ns;
-
-        BUG_ON(!old_ns);
-        get_user_ns(old_ns);
-
-        if (!(flags & CLONE_NEWUSER))
-                return old_ns;
+        /* set the new root user in the credentials under preparation */
+        ns->creator = new->user;
+        new->user = root_user;
+        new->uid = new->euid = new->suid = new->fsuid = 0;
+        new->gid = new->egid = new->sgid = new->fsgid = 0;
+        put_group_info(new->group_info);
+        new->group_info = get_group_info(&init_groups);
+#ifdef CONFIG_KEYS
+        key_put(new->request_key_auth);
+        new->request_key_auth = NULL;
+#endif
+        /* tgcred will be cleared in our caller bc CLONE_THREAD won't be set */
 
-        new_ns = clone_user_ns(old_ns);
+        /* alloc_uid() incremented the userns refcount.  Just set it to 1 */
+        kref_set(&ns->kref, 1);
 
-        put_user_ns(old_ns);
-        return new_ns;
+        return 0;
 }
 
 void free_user_ns(struct kref *kref)
@@ -80,7 +65,7 @@ void free_user_ns(struct kref *kref)
         struct user_namespace *ns;
 
         ns = container_of(kref, struct user_namespace, kref);
-        release_uids(ns);
+        free_uid(ns->creator);
         kfree(ns);
 }
 EXPORT_SYMBOL(free_user_ns);