[RFC,07/27] containers: Make fsopen() able to create a superblock in a container

Message ID	155024689635.21651.15943029551519736259.stgit@warthog.procyon.org.uk (mailing list archive)
State	New, archived
Headers	show Return-Path: <linux-cifs-owner@kernel.org> Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 Subject: [RFC PATCH 07/27] containers: Make fsopen() able to create a superblock in a container From: David Howells <dhowells@redhat.com> To: keyrings@vger.kernel.org, trond.myklebust@hammerspace.com, sfrench@samba.org Cc: linux-security-module@vger.kernel.org, linux-nfs@vger.kernel.org, linux-cifs@vger.kernel.org, linux-fsdevel@vger.kernel.org, rgb@redhat.com, dhowells@redhat.com, linux-kernel@vger.kernel.org Date: Fri, 15 Feb 2019 16:08:16 +0000 Message-ID: <155024689635.21651.15943029551519736259.stgit@warthog.procyon.org.uk> In-Reply-To: <155024683432.21651.14153938339749694146.stgit@warthog.procyon.org.uk> References: <155024683432.21651.14153938339749694146.stgit@warthog.procyon.org.uk> User-Agent: StGit/unknown-version MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Sender: linux-cifs-owner@vger.kernel.org Precedence: bulk
Series	Containers and using authenticated filesystems \| expand [RFC,00/27] Containers and using authenticated filesystems [RFC,01/27] containers: Rename linux/container.h to linux/container_dev.h [RFC,02/27] containers: Implement containers as kernel objects [RFC,03/27] containers: Provide /proc/containers [RFC,04/27] containers: Allow a process to be forked into a container [RFC,05/27] containers: Open a socket inside a container [RFC,06/27] containers, vfs: Allow syscall dirfd arguments to take a container fd [RFC,07/27] containers: Make fsopen() able to create a superblock in a container [RFC,08/27] containers, vfs: Honour CONTAINER_NEW_EMPTY_FS_NS [RFC,09/27] vfs: Allow mounting to other namespaces [RFC,10/27] containers: Provide fs_context op for container setting [RFC,11/27] containers: Sample program for driving container objects [RFC,12/27] containers: Allow a daemon to intercept request_key upcalls in a container [RFC,13/27] keys: Provide a keyctl to query a request_key authentication key [RFC,14/27] keys: Break bits out of key_unlink() [RFC,15/27] keys: Make __key_link_begin() handle lockdep nesting [RFC,16/27] keys: Grant Link permission to possessers of request_key auth keys [RFC,17/27] keys: Add a keyctl to move a key between keyrings [RFC,18/27] keys: Find the least-recently used unseen key in a keyring. [RFC,19/27] containers: Sample: request_key upcall handling [RFC,20/27] container, keys: Add a container keyring [RFC,21/27] keys: Fix request_key() lack of Link perm check on found key [RFC,22/27] KEYS: Replace uid/gid/perm permissions checking with an ACL [RFC,23/27] KEYS: Provide KEYCTL_GRANT_PERMISSION [RFC,24/27] keys: Allow a container to be specified as a subject in a key's ACL [RFC,25/27] keys: Provide a way to ask for the container keyring [RFC,26/27] keys: Allow containers to be included in key ACLs by name [RFC,27/27] containers: Sample to grant access to a key in a container

diff --git a/fs/fs_context.c b/fs/fs_context.c index a47ccd5a4a78..fc76ac02d618 100644 --- a/fs/fs_context.c +++ b/fs/fs_context.c @@ -20,6 +20,7 @@ #include <linux/slab.h> #include <linux/magic.h> #include <linux/security.h> +#include <linux/container.h> #include <linux/mnt_namespace.h> #include <linux/pid_namespace.h> #include <linux/user_namespace.h> @@ -169,6 +170,21 @@ int vfs_parse_fs_param(struct fs_context *fc, struct fs_parameter *param) } EXPORT_SYMBOL(vfs_parse_fs_param); +/* + * Specify a container in which a superblock will exist. + */ +void vfs_set_container(struct fs_context *fc, struct container *container) +{ + if (container) { + put_user_ns(fc->user_ns); + put_net(fc->net_ns); + + fc->container = get_container(container); + fc->user_ns = get_user_ns(container->cred->user_ns); + fc->net_ns = get_net(container->ns->net_ns); + } +} + /** * vfs_parse_fs_string - Convenience function to just parse a string. */ @@ -364,6 +380,8 @@ struct fs_context *vfs_dup_fs_context(struct fs_context *src_fc) fc->source = NULL; fc->security = NULL; get_filesystem(fc->fs_type); + if (fc->container) + get_container(fc->container); get_net(fc->net_ns); get_user_ns(fc->user_ns); get_cred(fc->cred); @@ -510,6 +528,7 @@ void put_fs_context(struct fs_context *fc) put_net(fc->net_ns); put_user_ns(fc->user_ns); put_cred(fc->cred); + put_container(fc->container); kfree(fc->subtype); put_fc_log(fc); put_filesystem(fc->fs_type); diff --git a/fs/fsopen.c b/fs/fsopen.c index 3bb9c0c8cbcc..d0fe9e563ebb 100644 --- a/fs/fsopen.c +++ b/fs/fsopen.c @@ -17,11 +17,33 @@ #include <linux/security.h> #include <linux/anon_inodes.h> #include <linux/namei.h> +#include <linux/container.h> #include <linux/file.h> #include <uapi/linux/mount.h> #include "internal.h" #include "mount.h" +/* + * Configure the destination container on a filesystem context. This must be + * done before any other parameters are offered. Containers are presented as + * fds attached to such objects given by the auxiliary parameter. + * + * For example: + * + * fsconfig(fsfd, FSCONFIG_SET_CONTAINER, NULL, NULL, container_fd); + */ +static int fsconfig_set_container(struct fs_context *fc, struct fs_parameter *param) +{ + struct container *c; + + if (!is_container_file(param->file)) + return -EINVAL; + + c = param->file->private_data; + vfs_set_container(fc, c); + return 0; +} + /* * Allow the user to read back any error, warning or informational messages. */ @@ -111,10 +133,6 @@ static int fscontext_alloc_log(struct fs_context *fc) /* * Open a filesystem by name so that it can be configured for mounting. - * - * We are allowed to specify a container in which the filesystem will be - * opened, thereby indicating which namespaces will be used (notably, which - * network namespace will be used for network filesystems). */ SYSCALL_DEFINE2(fsopen, const char __user *, _fs_name, unsigned int, flags) { @@ -143,7 +161,7 @@ SYSCALL_DEFINE2(fsopen, const char __user *, _fs_name, unsigned int, flags) if (IS_ERR(fc)) return PTR_ERR(fc); - fc->phase = FS_CONTEXT_CREATE_PARAMS; + fc->phase = FS_CONTEXT_CREATE_NS; ret = fscontext_alloc_log(fc); if (ret < 0) @@ -228,7 +246,8 @@ static int vfs_fsconfig_locked(struct fs_context *fc, int cmd, return ret; switch (cmd) { case FSCONFIG_CMD_CREATE: - if (fc->phase != FS_CONTEXT_CREATE_PARAMS) + if (fc->phase != FS_CONTEXT_CREATE_NS && + fc->phase != FS_CONTEXT_CREATE_PARAMS) return -EBUSY; fc->phase = FS_CONTEXT_CREATING; ret = vfs_get_tree(fc); @@ -259,9 +278,17 @@ static int vfs_fsconfig_locked(struct fs_context *fc, int cmd, break; vfs_clean_context(fc); return 0; + + case FSCONFIG_SET_CONTAINER: + if (fc->phase != FS_CONTEXT_CREATE_NS) + return -EBUSY; + return fsconfig_set_container(fc, param); + default: - if (fc->phase != FS_CONTEXT_CREATE_PARAMS && - fc->phase != FS_CONTEXT_RECONF_PARAMS) + if (fc->phase == FS_CONTEXT_CREATE_NS) + fc->phase = FS_CONTEXT_CREATE_PARAMS; + else if (fc->phase != FS_CONTEXT_CREATE_PARAMS && + fc->phase != FS_CONTEXT_RECONF_PARAMS) return -EBUSY; return vfs_parse_fs_param(fc, param); @@ -353,6 +380,10 @@ SYSCALL_DEFINE5(fsconfig, if (!_key || _value || aux < 0) return -EINVAL; break; + case FSCONFIG_SET_CONTAINER: + if (_key || _value || aux < 0) + return -EINVAL; + break; case FSCONFIG_CMD_CREATE: case FSCONFIG_CMD_RECONFIGURE: if (_key || _value || aux) @@ -438,6 +469,12 @@ SYSCALL_DEFINE5(fsconfig, if (!param.file) goto out_key; break; + case FSCONFIG_SET_CONTAINER: + ret = -EBADF; + param.file = fget(aux); + if (!param.file) + goto out_key; + break; default: break; } @@ -463,6 +500,7 @@ SYSCALL_DEFINE5(fsconfig, putname(param.name); break; case FSCONFIG_SET_FD: + case FSCONFIG_SET_CONTAINER: if (param.file) fput(param.file); break; diff --git a/fs/namespace.c b/fs/namespace.c index ea005f55ec4c..cc5d56f7ae29 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -781,9 +781,16 @@ static void put_mountpoint(struct mountpoint *mp) } } +static inline int __check_mnt(struct mount *mnt, struct mnt_namespace *mnt_ns) +{ + if (!mnt_ns) + mnt_ns = current->nsproxy->mnt_ns; + return mnt->mnt_ns == mnt_ns; +} + static inline int check_mnt(struct mount *mnt) { - return mnt->mnt_ns == current->nsproxy->mnt_ns; + return __check_mnt(mnt, NULL); } /* @@ -2696,7 +2703,8 @@ static int do_move_mount_old(struct path *path, const char *old_name) /* * add a mount into a namespace's mount tree */ -static int do_add_mount(struct mount *newmnt, struct path *path, int mnt_flags) +static int do_add_mount(struct mount *newmnt, struct path *path, int mnt_flags, + struct mnt_namespace *mnt_ns) { struct mountpoint *mp; struct mount *parent; @@ -2710,7 +2718,7 @@ static int do_add_mount(struct mount *newmnt, struct path *path, int mnt_flags) parent = real_mount(path->mnt); err = -EINVAL; - if (unlikely(!check_mnt(parent))) { + if (unlikely(!__check_mnt(parent, mnt_ns))) { /* that's acceptable only for automounts done in private ns */ if (!(mnt_flags & MNT_SHRINKABLE)) goto unlock; @@ -2765,7 +2773,8 @@ static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint, if (IS_ERR(mnt)) return PTR_ERR(mnt); - error = do_add_mount(real_mount(mnt), mountpoint, mnt_flags); + error = do_add_mount(real_mount(mnt), mountpoint, mnt_flags, + fc->container ? fc->container->ns->mnt_ns : NULL); if (error < 0) mntput(mnt); return error; @@ -2839,7 +2848,7 @@ int finish_automount(struct vfsmount *m, struct path *path) goto fail; } - err = do_add_mount(mnt, path, path->mnt->mnt_flags | MNT_SHRINKABLE); + err = do_add_mount(mnt, path, path->mnt->mnt_flags | MNT_SHRINKABLE, NULL); if (!err) return 0; fail: diff --git a/fs/proc/root.c b/fs/proc/root.c index 6927b29ece76..aa802006d855 100644 --- a/fs/proc/root.c +++ b/fs/proc/root.c @@ -18,6 +18,7 @@ #include <linux/sched/stat.h> #include <linux/module.h> #include <linux/bitops.h> +#include <linux/container.h> #include <linux/user_namespace.h> #include <linux/fs_context.h> #include <linux/mount.h> @@ -186,8 +187,12 @@ static int proc_init_fs_context(struct fs_context *fc) ctx = kzalloc(sizeof(struct proc_fs_context), GFP_KERNEL); if (!ctx) return -ENOMEM; + + if (fc->container) + ctx->pid_ns = get_pid_ns(fc->container->pid_ns); + else + ctx->pid_ns = get_pid_ns(task_active_pid_ns(current)); - ctx->pid_ns = get_pid_ns(task_active_pid_ns(current)); fc->fs_private = ctx; fc->ops = &proc_fs_context_ops; return 0; @@ -300,7 +305,7 @@ struct proc_dir_entry proc_root = { .name = "/proc", }; -int pid_ns_prepare_proc(struct pid_namespace *ns) +int pid_ns_prepare_proc(struct pid_namespace *ns, struct container *container) { struct proc_fs_context *ctx; struct fs_context *fc; @@ -315,6 +320,8 @@ int pid_ns_prepare_proc(struct pid_namespace *ns) fc->user_ns = get_user_ns(ns->user_ns); } + vfs_set_container(fc, container); + ctx = fc->fs_private; if (ctx->pid_ns != ns) { put_pid_ns(ctx->pid_ns); diff --git a/include/linux/container.h b/include/linux/container.h index 0a8918435097..087aa1885ef7 100644 --- a/include/linux/container.h +++ b/include/linux/container.h @@ -37,6 +37,7 @@ struct container { struct path root; /* The root of the container's fs namespace */ struct task_struct *init; /* The 'init' task for this container */ struct container *parent; /* Parent of this container. */ + struct pid_namespace *pid_ns; /* The process ID namespace for this container */ void *security; /* LSM data */ struct list_head members; /* Member processes, guarded with ->lock */ struct list_head child_link; /* Link in parent->children */ diff --git a/include/linux/fs_context.h b/include/linux/fs_context.h index dc8c9fcba341..45486080eb84 100644 --- a/include/linux/fs_context.h +++ b/include/linux/fs_context.h @@ -40,6 +40,7 @@ enum fs_context_purpose { * Userspace usage phase for fsopen/fspick. */ enum fs_context_phase { + FS_CONTEXT_CREATE_NS, /* Set namespaces for sb creation */ FS_CONTEXT_CREATE_PARAMS, /* Loading params for sb creation */ FS_CONTEXT_CREATING, /* A superblock is being created */ FS_CONTEXT_AWAITING_MOUNT, /* Superblock created, awaiting fsmount() */ @@ -93,6 +94,7 @@ struct fs_context { struct file_system_type *fs_type; void *fs_private; /* The filesystem's context */ struct dentry *root; /* The root and superblock */ + struct container *container; /* The container in which the mount will exist */ struct user_namespace *user_ns; /* The user namespace for this mount */ struct net *net_ns; /* The network namespace for this mount */ const struct cred *cred; /* The mounter's credentials */ @@ -136,6 +138,7 @@ extern int vfs_parse_fs_param(struct fs_context *fc, struct fs_parameter *param) extern int vfs_parse_fs_string(struct fs_context *fc, const char *key, const char *value, size_t v_size); extern int generic_parse_monolithic(struct fs_context *fc, void *data); +extern void vfs_set_container(struct fs_context *fc, struct container *container); extern int vfs_get_tree(struct fs_context *fc); extern void put_fs_context(struct fs_context *fc); diff --git a/include/linux/pid.h b/include/linux/pid.h index 14a9a39da9c7..16dc152ceef1 100644 --- a/include/linux/pid.h +++ b/include/linux/pid.h @@ -73,6 +73,8 @@ static inline struct pid *get_pid(struct pid *pid) return pid; } +struct container; + extern void put_pid(struct pid *pid); extern struct task_struct *pid_task(struct pid *pid, enum pid_type); extern struct task_struct *get_pid_task(struct pid *pid, enum pid_type); @@ -111,7 +113,8 @@ extern struct pid *find_get_pid(int nr); extern struct pid *find_ge_pid(int nr, struct pid_namespace *); int next_pidmap(struct pid_namespace *pid_ns, unsigned int last); -extern struct pid *alloc_pid(struct pid_namespace *ns); +extern struct pid *alloc_pid(struct pid_namespace *ns, + struct container *container); extern void free_pid(struct pid *pid); extern void disable_pid_allocation(struct pid_namespace *ns); diff --git a/include/linux/proc_ns.h b/include/linux/proc_ns.h index d31cb6215905..dee0881eca5c 100644 --- a/include/linux/proc_ns.h +++ b/include/linux/proc_ns.h @@ -47,14 +47,16 @@ enum { #ifdef CONFIG_PROC_FS -extern int pid_ns_prepare_proc(struct pid_namespace *ns); +extern int pid_ns_prepare_proc(struct pid_namespace *ns, + struct container *container); extern void pid_ns_release_proc(struct pid_namespace *ns); extern int proc_alloc_inum(unsigned int *pino); extern void proc_free_inum(unsigned int inum); #else /* CONFIG_PROC_FS */ -static inline int pid_ns_prepare_proc(struct pid_namespace *ns) { return 0; } +static inline int pid_ns_prepare_proc(struct pid_namespace *ns, struct container *container) +{ return 0; } static inline void pid_ns_release_proc(struct pid_namespace *ns) {} static inline int proc_alloc_inum(unsigned int *inum) diff --git a/include/uapi/linux/mount.h b/include/uapi/linux/mount.h index 96a0240f23fe..f60bbe6f4099 100644 --- a/include/uapi/linux/mount.h +++ b/include/uapi/linux/mount.h @@ -97,6 +97,7 @@ enum fsconfig_command { FSCONFIG_SET_FD = 5, /* Set parameter, supplying an object by fd */ FSCONFIG_CMD_CREATE = 6, /* Invoke superblock creation */ FSCONFIG_CMD_RECONFIGURE = 7, /* Invoke superblock reconfiguration */ + FSCONFIG_SET_CONTAINER = 8, /* Set a container, supplied by fd */ }; /* diff --git a/kernel/container.c b/kernel/container.c index 1d2cb1c1e9b1..fd3b2a6849a1 100644 --- a/kernel/container.c +++ b/kernel/container.c @@ -30,6 +30,7 @@ struct container init_container = { .cred = &init_cred, .ns = &init_nsproxy, .init = &init_task, + .pid_ns = &init_pid_ns, .members.next = &init_task.container_link, .members.prev = &init_task.container_link, .children = LIST_HEAD_INIT(init_container.children), @@ -51,6 +52,8 @@ void put_container(struct container *c) while (c && refcount_dec_and_test(&c->usage)) { BUG_ON(!list_empty(&c->members)); + if (c->pid_ns) + put_pid_ns(c->pid_ns); if (c->ns) put_nsproxy(c->ns); path_put(&c->root); @@ -391,6 +394,7 @@ static struct container *create_container(const char __user *name, unsigned int } c->ns = ns; + c->pid_ns = get_pid_ns(c->ns->pid_ns_for_children); c->root = fs->root; c->seq = fs->seq; fs->root.mnt = NULL; diff --git a/kernel/fork.c b/kernel/fork.c index 71401deb4434..09de5f35d312 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1958,7 +1958,7 @@ static __latent_entropy struct task_struct *copy_process( stackleak_task_init(p); if (pid != &init_struct_pid) { - pid = alloc_pid(p->nsproxy->pid_ns_for_children); + pid = alloc_pid(p->nsproxy->pid_ns_for_children, dest_container); if (IS_ERR(pid)) { retval = PTR_ERR(pid); goto bad_fork_cleanup_thread; diff --git a/kernel/pid.c b/kernel/pid.c index 20881598bdfa..6528a75e6c0d 100644 --- a/kernel/pid.c +++ b/kernel/pid.c @@ -156,7 +156,7 @@ void free_pid(struct pid *pid) call_rcu(&pid->rcu, delayed_put_pid); } -struct pid *alloc_pid(struct pid_namespace *ns) +struct pid *alloc_pid(struct pid_namespace *ns, struct container *container) { struct pid *pid; enum pid_type type; @@ -205,7 +205,7 @@ struct pid *alloc_pid(struct pid_namespace *ns) } if (unlikely(is_child_reaper(pid))) { - if (pid_ns_prepare_proc(ns)) + if (pid_ns_prepare_proc(ns, container)) goto out_free; }

[RFC,07/27] containers: Make fsopen() able to create a superblock in a container

Commit Message

Patch