On Fri, Aug 26, 2016 at 04:08:08PM -0700, Andrei Vagin wrote:
> From: Andrey Vagin <avagin@xxxxxxxxxx>
>
> Return -EPERM if an owning user namespace is outside of a process
> current user namespace.
>
> v2: In a first version ns_get_owner returned ENOENT for init_user_ns.
> This special cases was removed from this version. There is nothing
> outside of init_user_ns, so we can return EPERM.
>
> Signed-off-by: Andrei Vagin <avagin@xxxxxxxxxx>
> ---
> fs/namespace.c | 6 ++++++
> include/linux/proc_ns.h | 1 +
> include/linux/user_namespace.h | 7 +++++++
> ipc/namespace.c | 6 ++++++
> kernel/cgroup.c | 6 ++++++
> kernel/pid_namespace.c | 6 ++++++
> kernel/user_namespace.c | 24 ++++++++++++++++++++++++
> kernel/utsname.c | 6 ++++++
> net/core/net_namespace.c | 6 ++++++
> 9 files changed, 68 insertions(+)
>
> diff --git a/fs/namespace.c b/fs/namespace.c
> index 491b8f3..f985817 100644
> --- a/fs/namespace.c
> +++ b/fs/namespace.c
> @@ -3368,10 +3368,16 @@ static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns)
> return 0;
> }
>
> +static struct user_namespace *mntns_get_owner(struct ns_common *ns)
> +{
> + return to_mnt_ns(ns)->user_ns;
Hi - sorry to be pedantic here, but *_get_owner makes me think
it will grab a reference too. A bit unfortunate, maybe it doesn't
matter, but would mntns_owner(), netns_owner(), etc be better?
--
To unsubscribe from this list: send the line "unsubscribe linux-api" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
