netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "Serge E. Hallyn" <serge-A9i7LUbDfNHQT0dZR+AlfA@public.gmane.org>
To: "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
Cc: Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>,
	netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	Linux Containers
	<containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org>,
	linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	Andy Lutomirski <luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org>,
	Seth Forshee
	<seth.forshee-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>,
	Nikolay Borisov <kernel-6AxghH7DbtA@public.gmane.org>,
	linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	Jann Horn <jann-XZ1E9jl8jIdeoWH0uzbU5w@public.gmane.org>
Subject: Re: [PATCH v2 06/10] utsns: Add a limit on the number of uts namespaces
Date: Mon, 25 Jul 2016 18:09:28 -0500	[thread overview]
Message-ID: <20160725230927.GD26841@mail.hallyn.com> (raw)
In-Reply-To: <20160721164014.17534-6-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>

Quoting Eric W. Biederman (ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org):
> Signed-off-by: "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>

Acked-by: Serge Hallyn <serge-A9i7LUbDfNHQT0dZR+AlfA@public.gmane.org>

> ---
>  include/linux/user_namespace.h |  1 +
>  kernel/user_namespace.c        |  1 +
>  kernel/utsname.c               | 31 ++++++++++++++++++++++++++-----
>  3 files changed, 28 insertions(+), 5 deletions(-)
> 
> diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
> index 47733637741a..bed2506081fe 100644
> --- a/include/linux/user_namespace.h
> +++ b/include/linux/user_namespace.h
> @@ -25,6 +25,7 @@ struct uid_gid_map {	/* 64 bytes -- 1 cache line */
>  enum ucounts {
>  	UCOUNT_USER_NAMESPACES,
>  	UCOUNT_PID_NAMESPACES,
> +	UCOUNT_UTS_NAMESPACES,
>  	UCOUNT_COUNTS,
>  };
>  
> diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
> index 02a03ead7afc..6b205c24e888 100644
> --- a/kernel/user_namespace.c
> +++ b/kernel/user_namespace.c
> @@ -78,6 +78,7 @@ static int count_max = COUNT_MAX;
>  static struct ctl_table userns_table[] = {
>  	UCOUNT_ENTRY("max_user_namespaces"),
>  	UCOUNT_ENTRY("max_pid_namespaces"),
> +	UCOUNT_ENTRY("max_uts_namespaces"),
>  	{ }
>  };
>  #endif /* CONFIG_SYSCTL */
> diff --git a/kernel/utsname.c b/kernel/utsname.c
> index 831ea7108232..4f13c0419d64 100644
> --- a/kernel/utsname.c
> +++ b/kernel/utsname.c
> @@ -17,6 +17,16 @@
>  #include <linux/user_namespace.h>
>  #include <linux/proc_ns.h>
>  
> +static bool inc_uts_namespaces(struct user_namespace *ns)
> +{
> +	return inc_ucount(ns, UCOUNT_UTS_NAMESPACES);
> +}
> +
> +static void dec_uts_namespaces(struct user_namespace *ns)
> +{
> +	dec_ucount(ns, UCOUNT_UTS_NAMESPACES);
> +}
> +
>  static struct uts_namespace *create_uts_ns(void)
>  {
>  	struct uts_namespace *uts_ns;
> @@ -38,15 +48,18 @@ static struct uts_namespace *clone_uts_ns(struct user_namespace *user_ns,
>  	struct uts_namespace *ns;
>  	int err;
>  
> +	err = -ENFILE;
> +	if (!inc_uts_namespaces(user_ns))
> +		goto fail;
> +
> +	err = -ENOMEM;
>  	ns = create_uts_ns();
>  	if (!ns)
> -		return ERR_PTR(-ENOMEM);
> +		goto fail_dec;
>  
>  	err = ns_alloc_inum(&ns->ns);
> -	if (err) {
> -		kfree(ns);
> -		return ERR_PTR(err);
> -	}
> +	if (err)
> +		goto fail_free;
>  
>  	ns->ns.ops = &utsns_operations;
>  
> @@ -55,6 +68,13 @@ static struct uts_namespace *clone_uts_ns(struct user_namespace *user_ns,
>  	ns->user_ns = get_user_ns(user_ns);
>  	up_read(&uts_sem);
>  	return ns;
> +
> +fail_free:
> +	kfree(ns);
> +fail_dec:
> +	dec_uts_namespaces(user_ns);
> +fail:
> +	return ERR_PTR(err);
>  }
>  
>  /*
> @@ -85,6 +105,7 @@ void free_uts_ns(struct kref *kref)
>  	struct uts_namespace *ns;
>  
>  	ns = container_of(kref, struct uts_namespace, kref);
> +	dec_uts_namespaces(ns->user_ns);
>  	put_user_ns(ns->user_ns);
>  	ns_free_inum(&ns->ns);
>  	kfree(ns);
> -- 
> 2.8.3

  parent reply	other threads:[~2016-07-25 23:09 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <8737n5dscy.fsf@x220.int.ebiederm.org>
     [not found] ` <8737n5dscy.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org>
2016-07-21 16:39   ` [PATCH v2 00/10] userns: sysctl limits for namespaces Eric W. Biederman
2016-07-22 13:33     ` Colin Walters
     [not found]       ` <1469194399.3817016.673814953.7581706C-2RFepEojUI2N1INw9kWLP6GC3tUn3ZHUQQ4Iyu8u01E@public.gmane.org>
2016-07-22 18:45         ` Eric W. Biederman
2016-07-22 21:46           ` Kees Cook
     [not found]             ` <CAGXu5j+X7eWggkwpBpABsFe4hqK5LN1mYJ2TH91qj3iSe6rtcQ-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2016-07-23  2:11               ` Eric W. Biederman
     [not found]     ` <87d1m754jc.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org>
2016-07-21 16:40       ` [PATCH v2 01/10] sysctl: Stop implicitly passing current into sysctl_table_root.lookup Eric W. Biederman
     [not found]         ` <20160721164014.17534-1-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2016-07-21 16:40           ` [PATCH v2 02/10] userns: Add per user namespace sysctls Eric W. Biederman
     [not found]             ` <20160721164014.17534-2-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2016-07-26  0:02               ` Eric W. Biederman
     [not found]                 ` <878twp6zd2.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org>
2016-07-26  0:24                   ` David Miller
     [not found]                     ` <20160725.172406.352408511647766870.davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
2016-07-26  0:44                       ` Eric W. Biederman
     [not found]                         ` <87k2g95it9.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org>
2016-07-26  2:58                           ` David Miller
     [not found]                             ` <20160725.195836.1881375122073635224.davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
2016-07-26  4:00                               ` Eric W. Biederman
2016-07-21 16:40           ` [PATCH v2 03/10] userns: Add a limit on the number of user namespaces Eric W. Biederman
2016-07-25 23:05             ` Serge E. Hallyn
2016-07-21 16:40           ` [PATCH v2 05/10] pidns: Add a limit on the number of pid namespaces Eric W. Biederman
     [not found]             ` <20160721164014.17534-5-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2016-07-25 23:09               ` Serge E. Hallyn
2016-07-21 16:40           ` [PATCH v2 07/10] ipcns: Add a limit on the number of ipc namespaces Eric W. Biederman
2016-07-25 23:10             ` Serge E. Hallyn
2016-07-21 16:40           ` [PATCH v2 08/10] cgroupns: Add a limit on the number of cgroup namespaces Eric W. Biederman
     [not found]             ` <20160721164014.17534-8-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2016-07-25 23:12               ` Serge E. Hallyn
2016-07-21 16:40           ` [PATCH v2 09/10] netns: Add a limit on the number of net namespaces Eric W. Biederman
2016-07-25 23:13             ` Serge E. Hallyn
     [not found]             ` <20160721164014.17534-9-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2016-07-26  6:01               ` Andrei Vagin
     [not found]                 ` <CANaxB-zfkvu9XYkuYB47tYFGLeVnWBhpgEUaSrGD4+-O8ThcNw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2016-07-26 20:00                   ` Eric W. Biederman
2016-07-21 16:40         ` [PATCH v2 04/10] userns: Generalize the user namespace count into ucount Eric W. Biederman
     [not found]           ` <20160721164014.17534-4-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2016-07-25 23:09             ` Serge E. Hallyn
2016-07-21 16:40         ` [PATCH v2 06/10] utsns: Add a limit on the number of uts namespaces Eric W. Biederman
     [not found]           ` <20160721164014.17534-6-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2016-07-25 23:09             ` Serge E. Hallyn [this message]
2016-07-21 16:40         ` [PATCH v2 10/10] mntns: Add a limit on the number of mount namespaces Eric W. Biederman
     [not found]           ` <20160721164014.17534-10-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2016-07-25 23:15             ` Serge E. Hallyn
2016-07-26 10:27       ` [PATCH v2 00/10] userns: sysctl limits for namespaces Michael Kerrisk (man-pages)
     [not found]         ` <94b608ae-1d06-5c41-cbd5-94e663a2163a-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2016-07-26 15:14           ` Eric W. Biederman
2016-07-26 10:30       ` Michael Kerrisk (man-pages)
     [not found]         ` <6be70177-a81d-7ed8-d2c9-a596d4d6a165-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2016-07-26 15:06           ` Eric W. Biederman
     [not found]             ` <87shuwtp4c.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org>
2016-07-26 16:52               ` Kees Cook
     [not found]                 ` <CAGXu5j+ZtZAFpW0ajnnBTRZk17ez6XYF=meEJY_rF7wwgyZB5Q-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2016-07-26 17:29                   ` Michael Kerrisk (man-pages)
2016-07-26 20:44                     ` Kees Cook
2016-08-08 21:16       ` Eric W. Biederman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20160725230927.GD26841@mail.hallyn.com \
    --to=serge-a9i7lubdfnhqt0dzr+alfa@public.gmane.org \
    --cc=containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \
    --cc=ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org \
    --cc=jann-XZ1E9jl8jIdeoWH0uzbU5w@public.gmane.org \
    --cc=keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org \
    --cc=kernel-6AxghH7DbtA@public.gmane.org \
    --cc=linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org \
    --cc=netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=seth.forshee-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).