* Re: [PATCH v2 2/2] nsfs: Add an ioctl() to return owner UID of a userns @ 2017-01-05 15:36 Michael Kerrisk (man-pages) 0 siblings, 0 replies; 3+ messages in thread From: Michael Kerrisk (man-pages) @ 2017-01-05 15:36 UTC (permalink / raw) To: Andrei Vagin Cc: Eric W. Biederman, Serge E. Hallyn, Linux API, lkml, linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Andrey Vagin, James Bottomley, W. Trevor King, Alexander Viro Hello Andrei, On 24 December 2016 at 14:16, Andrei Vagin <avagin-5HdwGun5lf+gSpxsJD1C4w@public.gmane.org> wrote: > On Fri, Dec 23, 2016 at 10:54:53AM +0100, Michael Kerrisk (man-pages) wrote: >> I'd like to write code that discovers the user namespace hierarchy on >> a running system, and also shows who owns the various user namespaces. >> Currently, there is no way of getting the owner UID of a user >> namespace. Therefore, this patch adds an NS_GET_CREATOR_UID ioctl() >> that fetches the (munged) UID of the creator of the user namespace >> referred to by the specified file descriptor. >> >> If the supplied file descriptor does not refer to a user namespace, >> the operation fails with the error EINVAL. > > Acked-by: Andrey Vagin <avagin-GEFAQzZX7r8dnm+yROfE0A@public.gmane.org> Thanks for looking the patches over. > Here is one minor comment bellow > >> Signed-off-by: Michael Kerrisk <mtk-manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> >> >> --- >> V2 changes: >> * Renamed ioctl() from NS_CREATOR_UID to NS_OWNER_UID, at the >> suggestion of Eric Biederman. >> * Make ioctl() return UID via buffer pointed to by argp. (Returning >> the UID via the result value could lead to problems since a large >> unsigned int UID might be misinterpreted as an error.) Thanks to >> Andrei Vagin for pointing this out. >> --- >> fs/nsfs.c | 11 +++++++++++ >> include/uapi/linux/nsfs.h | 8 +++++--- >> 2 files changed, 16 insertions(+), 3 deletions(-) >> >> diff --git a/fs/nsfs.c b/fs/nsfs.c >> index 9f24b47..9c9277c 100644 >> --- a/fs/nsfs.c >> +++ b/fs/nsfs.c >> @@ -7,6 +7,7 @@ >> #include <linux/seq_file.h> >> #include <linux/user_namespace.h> >> #include <linux/nsfs.h> >> +#include <linux/uaccess.h> >> >> static struct vfsmount *nsfs_mnt; >> >> @@ -163,7 +164,10 @@ static int open_related_ns(struct ns_common *ns, >> static long ns_ioctl(struct file *filp, unsigned int ioctl, >> unsigned long arg) >> { >> + struct user_namespace *user_ns; >> struct ns_common *ns = get_proc_ns(file_inode(filp)); >> + unsigned int __user *argp; >> + unsigned int uid; > > I think it is better to use uid_t here Fair enough. Should in fact the type for the ioctl() argument be changed? I mean, make the following change to the line before: - unsigned int __user *argp; + uid_t __user *argp; And further below, change: - argp = (unsigned int __user *) arg; + argp = (uid_t __user *) arg; ? Happy New Year! Cheers, Michael >> switch (ioctl) { >> case NS_GET_USERNS: >> @@ -174,6 +178,13 @@ static long ns_ioctl(struct file *filp, unsigned int ioctl, >> return open_related_ns(ns, ns->ops->get_parent); >> case NS_GET_NSTYPE: >> return ns->ops->type; >> + case NS_GET_OWNER_UID: >> + if (ns->ops->type != CLONE_NEWUSER) >> + return -EINVAL; >> + user_ns = container_of(ns, struct user_namespace, ns); >> + argp = (unsigned int __user *) arg; >> + uid = from_kuid_munged(current_user_ns(), user_ns->owner); >> + return put_user(uid, argp); >> default: >> return -ENOTTY; >> } >> diff --git a/include/uapi/linux/nsfs.h b/include/uapi/linux/nsfs.h >> index 2b48df1..c4a925e 100644 >> --- a/include/uapi/linux/nsfs.h >> +++ b/include/uapi/linux/nsfs.h >> @@ -6,11 +6,13 @@ >> #define NSIO 0xb7 >> >> /* Returns a file descriptor that refers to an owning user namespace */ >> -#define NS_GET_USERNS _IO(NSIO, 0x1) >> +#define NS_GET_USERNS _IO(NSIO, 0x1) >> /* Returns a file descriptor that refers to a parent namespace */ >> -#define NS_GET_PARENT _IO(NSIO, 0x2) >> +#define NS_GET_PARENT _IO(NSIO, 0x2) >> /* Returns the type of namespace (CLONE_NEW* value) referred to by >> file descriptor */ >> -#define NS_GET_NSTYPE _IO(NSIO, 0x3) >> +#define NS_GET_NSTYPE _IO(NSIO, 0x3) >> +/* Get owner UID for a user namespace */ >> +#define NS_GET_OWNER_UID _IO(NSIO, 0x4) >> >> #endif /* __LINUX_NSFS_H */ >> -- >> 2.5.5 >> -- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Linux/UNIX System Programming Training: http://man7.org/training/ ^ permalink raw reply [flat|nested] 3+ messages in thread
[parent not found: <11b302a2-aac3-5994-a12d-e93ce64f7819@gmail.com>]
[parent not found: <11b302a2-aac3-5994-a12d-e93ce64f7819-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>]
* [PATCH v2 2/2] nsfs: Add an ioctl() to return owner UID of a userns [not found] ` <11b302a2-aac3-5994-a12d-e93ce64f7819-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> @ 2016-12-23 9:54 ` Michael Kerrisk (man-pages) [not found] ` <44599777-c346-3b24-0181-6d86b20ab201-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> 0 siblings, 1 reply; 3+ messages in thread From: Michael Kerrisk (man-pages) @ 2016-12-23 9:54 UTC (permalink / raw) To: Eric W. Biederman Cc: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w, Serge E. Hallyn, linux-api-u79uwXL29TY76Z2rM5mHXA, linux-kernel-u79uwXL29TY76Z2rM5mHXA, linux-fsdevel-u79uwXL29TY76Z2rM5mHXA, Andrey Vagin, James Bottomley, W. Trevor King, Alexander Viro I'd like to write code that discovers the user namespace hierarchy on a running system, and also shows who owns the various user namespaces. Currently, there is no way of getting the owner UID of a user namespace. Therefore, this patch adds an NS_GET_CREATOR_UID ioctl() that fetches the (munged) UID of the creator of the user namespace referred to by the specified file descriptor. If the supplied file descriptor does not refer to a user namespace, the operation fails with the error EINVAL. Signed-off-by: Michael Kerrisk <mtk-manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> --- V2 changes: * Renamed ioctl() from NS_CREATOR_UID to NS_OWNER_UID, at the suggestion of Eric Biederman. * Make ioctl() return UID via buffer pointed to by argp. (Returning the UID via the result value could lead to problems since a large unsigned int UID might be misinterpreted as an error.) Thanks to Andrei Vagin for pointing this out. --- fs/nsfs.c | 11 +++++++++++ include/uapi/linux/nsfs.h | 8 +++++--- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/fs/nsfs.c b/fs/nsfs.c index 9f24b47..9c9277c 100644 --- a/fs/nsfs.c +++ b/fs/nsfs.c @@ -7,6 +7,7 @@ #include <linux/seq_file.h> #include <linux/user_namespace.h> #include <linux/nsfs.h> +#include <linux/uaccess.h> static struct vfsmount *nsfs_mnt; @@ -163,7 +164,10 @@ static int open_related_ns(struct ns_common *ns, static long ns_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg) { + struct user_namespace *user_ns; struct ns_common *ns = get_proc_ns(file_inode(filp)); + unsigned int __user *argp; + unsigned int uid; switch (ioctl) { case NS_GET_USERNS: @@ -174,6 +178,13 @@ static long ns_ioctl(struct file *filp, unsigned int ioctl, return open_related_ns(ns, ns->ops->get_parent); case NS_GET_NSTYPE: return ns->ops->type; + case NS_GET_OWNER_UID: + if (ns->ops->type != CLONE_NEWUSER) + return -EINVAL; + user_ns = container_of(ns, struct user_namespace, ns); + argp = (unsigned int __user *) arg; + uid = from_kuid_munged(current_user_ns(), user_ns->owner); + return put_user(uid, argp); default: return -ENOTTY; } diff --git a/include/uapi/linux/nsfs.h b/include/uapi/linux/nsfs.h index 2b48df1..c4a925e 100644 --- a/include/uapi/linux/nsfs.h +++ b/include/uapi/linux/nsfs.h @@ -6,11 +6,13 @@ #define NSIO 0xb7 /* Returns a file descriptor that refers to an owning user namespace */ -#define NS_GET_USERNS _IO(NSIO, 0x1) +#define NS_GET_USERNS _IO(NSIO, 0x1) /* Returns a file descriptor that refers to a parent namespace */ -#define NS_GET_PARENT _IO(NSIO, 0x2) +#define NS_GET_PARENT _IO(NSIO, 0x2) /* Returns the type of namespace (CLONE_NEW* value) referred to by file descriptor */ -#define NS_GET_NSTYPE _IO(NSIO, 0x3) +#define NS_GET_NSTYPE _IO(NSIO, 0x3) +/* Get owner UID for a user namespace */ +#define NS_GET_OWNER_UID _IO(NSIO, 0x4) #endif /* __LINUX_NSFS_H */ -- 2.5.5 ^ permalink raw reply related [flat|nested] 3+ messages in thread
[parent not found: <44599777-c346-3b24-0181-6d86b20ab201-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>]
* Re: [PATCH v2 2/2] nsfs: Add an ioctl() to return owner UID of a userns [not found] ` <44599777-c346-3b24-0181-6d86b20ab201-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> @ 2016-12-24 1:16 ` Andrei Vagin 0 siblings, 0 replies; 3+ messages in thread From: Andrei Vagin @ 2016-12-24 1:16 UTC (permalink / raw) To: Michael Kerrisk (man-pages) Cc: Eric W. Biederman, Serge E. Hallyn, linux-api-u79uwXL29TY76Z2rM5mHXA, linux-kernel-u79uwXL29TY76Z2rM5mHXA, linux-fsdevel-u79uwXL29TY76Z2rM5mHXA, Andrey Vagin, James Bottomley, W. Trevor King, Alexander Viro On Fri, Dec 23, 2016 at 10:54:53AM +0100, Michael Kerrisk (man-pages) wrote: > I'd like to write code that discovers the user namespace hierarchy on > a running system, and also shows who owns the various user namespaces. > Currently, there is no way of getting the owner UID of a user > namespace. Therefore, this patch adds an NS_GET_CREATOR_UID ioctl() > that fetches the (munged) UID of the creator of the user namespace > referred to by the specified file descriptor. > > If the supplied file descriptor does not refer to a user namespace, > the operation fails with the error EINVAL. > Acked-by: Andrey Vagin <avagin-GEFAQzZX7r8dnm+yROfE0A@public.gmane.org> Here is one minor comment bellow > Signed-off-by: Michael Kerrisk <mtk-manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> > > --- > V2 changes: > * Renamed ioctl() from NS_CREATOR_UID to NS_OWNER_UID, at the > suggestion of Eric Biederman. > * Make ioctl() return UID via buffer pointed to by argp. (Returning > the UID via the result value could lead to problems since a large > unsigned int UID might be misinterpreted as an error.) Thanks to > Andrei Vagin for pointing this out. > --- > fs/nsfs.c | 11 +++++++++++ > include/uapi/linux/nsfs.h | 8 +++++--- > 2 files changed, 16 insertions(+), 3 deletions(-) > > diff --git a/fs/nsfs.c b/fs/nsfs.c > index 9f24b47..9c9277c 100644 > --- a/fs/nsfs.c > +++ b/fs/nsfs.c > @@ -7,6 +7,7 @@ > #include <linux/seq_file.h> > #include <linux/user_namespace.h> > #include <linux/nsfs.h> > +#include <linux/uaccess.h> > > static struct vfsmount *nsfs_mnt; > > @@ -163,7 +164,10 @@ static int open_related_ns(struct ns_common *ns, > static long ns_ioctl(struct file *filp, unsigned int ioctl, > unsigned long arg) > { > + struct user_namespace *user_ns; > struct ns_common *ns = get_proc_ns(file_inode(filp)); > + unsigned int __user *argp; > + unsigned int uid; I think it is better to use uid_t here > > switch (ioctl) { > case NS_GET_USERNS: > @@ -174,6 +178,13 @@ static long ns_ioctl(struct file *filp, unsigned int ioctl, > return open_related_ns(ns, ns->ops->get_parent); > case NS_GET_NSTYPE: > return ns->ops->type; > + case NS_GET_OWNER_UID: > + if (ns->ops->type != CLONE_NEWUSER) > + return -EINVAL; > + user_ns = container_of(ns, struct user_namespace, ns); > + argp = (unsigned int __user *) arg; > + uid = from_kuid_munged(current_user_ns(), user_ns->owner); > + return put_user(uid, argp); > default: > return -ENOTTY; > } > diff --git a/include/uapi/linux/nsfs.h b/include/uapi/linux/nsfs.h > index 2b48df1..c4a925e 100644 > --- a/include/uapi/linux/nsfs.h > +++ b/include/uapi/linux/nsfs.h > @@ -6,11 +6,13 @@ > #define NSIO 0xb7 > > /* Returns a file descriptor that refers to an owning user namespace */ > -#define NS_GET_USERNS _IO(NSIO, 0x1) > +#define NS_GET_USERNS _IO(NSIO, 0x1) > /* Returns a file descriptor that refers to a parent namespace */ > -#define NS_GET_PARENT _IO(NSIO, 0x2) > +#define NS_GET_PARENT _IO(NSIO, 0x2) > /* Returns the type of namespace (CLONE_NEW* value) referred to by > file descriptor */ > -#define NS_GET_NSTYPE _IO(NSIO, 0x3) > +#define NS_GET_NSTYPE _IO(NSIO, 0x3) > +/* Get owner UID for a user namespace */ > +#define NS_GET_OWNER_UID _IO(NSIO, 0x4) > > #endif /* __LINUX_NSFS_H */ > -- > 2.5.5 > ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-01-05 15:36 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-01-05 15:36 [PATCH v2 2/2] nsfs: Add an ioctl() to return owner UID of a userns Michael Kerrisk (man-pages)
[not found] <11b302a2-aac3-5994-a12d-e93ce64f7819@gmail.com>
[not found] ` <11b302a2-aac3-5994-a12d-e93ce64f7819-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2016-12-23 9:54 ` Michael Kerrisk (man-pages)
[not found] ` <44599777-c346-3b24-0181-6d86b20ab201-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2016-12-24 1:16 ` Andrei Vagin
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).