From patchwork Wed May 4 14:26:48 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Djalal Harouni X-Patchwork-Id: 9014751 Return-Path: X-Original-To: patchwork-linux-fsdevel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 023D3BF29F for ; Wed, 4 May 2016 14:32:40 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id E97A5203AA for ; Wed, 4 May 2016 14:32:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B18AE203A1 for ; Wed, 4 May 2016 14:32:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753343AbcEDOcS (ORCPT ); Wed, 4 May 2016 10:32:18 -0400 Received: from mail-wm0-f47.google.com ([74.125.82.47]:38010 "EHLO mail-wm0-f47.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752890AbcEDO3n (ORCPT ); Wed, 4 May 2016 10:29:43 -0400 Received: by mail-wm0-f47.google.com with SMTP id g17so97562517wme.1; Wed, 04 May 2016 07:29:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=wX0hLtcBcMjRKUz521fpwqTt4nq5kWYn/bSzVCsyXYQ=; b=HJPIJEts473pXluFMg/UQSa9PDSNCQUmdFC5c6PFrEAEU1JKi/Eqo/eR1xIFcNTQy6 XHwYuDJ6zt8ux1ZHWfu3XO1OP0BjoLIwhA5tbTY9iG0rr6ODUbYjtbBBa6fC2Yc3N+a4 LmmJKyUSy44Q6PrXylgVUFCNxQAskuTiPJOuEb+X7XhyrjLC8Xr3997NiEaazkikGMsX TnJHwrufxXWTIzJqD/y3fAdLJ8BX4uD2lEX6hQAET+ATo2ihjYgIM/GB7+8NvkoEV712 qLKC67XK/aDIOzMCRdF1ZqCgp4HWxX4q4sdeQIUmMjdB/L3RPDUfq4pMc2JUgHi/w9GF MvNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=wX0hLtcBcMjRKUz521fpwqTt4nq5kWYn/bSzVCsyXYQ=; b=RtLivMYxLQvnlfLL5wHjwGMVw18+CwpbgI5SvlGX0fCXbDrNace5xNKVkjaV5OXsuc /WlUYEIl77LXANuEKuqrGjZDNTM/H1n6SiBrnvZNdrwza8CGjk5gSw3VWmHi2R9vItIG wMgOiDAOYJN/8B9ClG6GCusQBFPc/f3cw6gTNjeZdXAidfSY7zdceWYr7aKsETGAMdEa 9NtZccIbrbo6eRleFQdmaJYgH3dgCoCFrHPh2NkX2qQdgtUZgII6Y6ZSL6XZwsFsHk+f ug1smHmZSKmrJULE/nc5mpN/G25wVq2nESaEdO3/7o8NeBCGCBqKBEb1WOkHL6+Po+a2 JrmQ== X-Gm-Message-State: AOPr4FXjv5QSRKJIjLQVqharhxh4QLv1g9Nba1l5Rd9RJQhYfeygEoUFG83nKzTIyQinAA== X-Received: by 10.194.122.199 with SMTP id lu7mr9550171wjb.40.1462372181332; Wed, 04 May 2016 07:29:41 -0700 (PDT) Received: from dztty2.localdomain (ip5b42f9c9.dynamic.kabel-deutschland.de. [91.66.249.201]) by smtp.gmail.com with ESMTPSA id a75sm4615505wme.18.2016.05.04.07.29.39 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 04 May 2016 07:29:40 -0700 (PDT) From: Djalal Harouni To: Alexander Viro , Chris Mason , , Serge Hallyn , Josh Triplett , "Eric W. Biederman" , Andy Lutomirski , Seth Forshee , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, Dongsu Park , David Herrmann , Miklos Szeredi , Alban Crequy Cc: Djalal Harouni , Djalal Harouni Subject: [RFC v2 PATCH 2/8] VFS:uidshift: add flags and helpers to shift UIDs and GIDs to virtual view Date: Wed, 4 May 2016 16:26:48 +0200 Message-Id: <1462372014-3786-3-git-send-email-tixxdz@gmail.com> X-Mailer: git-send-email 2.5.5 In-Reply-To: <1462372014-3786-1-git-send-email-tixxdz@gmail.com> References: <1462372014-3786-1-git-send-email-tixxdz@gmail.com> Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Spam-Status: No, score=-8.9 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Add helpers to allow the VFS to shift UIDs and GIDs according to the user namespace of the containing mount namespace. All decisions are taken by VFS. In this regard, to allow the shift of UID and GID filesystems when mounted must set "vfs_shift_uids" and "vfs_shift_gids" options, therefore add the appropriate flags to distinguish between mounts that support UID/GID shifts and others. The flags are "SB_I_VFS_SHIFT_UIDS" and "SB_I_VFS_SHIFT_GIDS" and should be set my filesystems in the super_block->s_iflags when they are mounted. If a mount supports VFS UID/GID shifts shows up in a mount namespace that allows UID/GID shifts, VFS helpers will handle the shift and translate it according to that mount namespace. The user namespace of that containing mount namespace will be used to perform the translation, this gives the advantage that only a process with the right privileges or an ancestor of the mount namespace is able to set user namespace mappings. As an example do the shift to the virtual view when we stat() inodes, the VFS handles that and inodes->{i_uid|i_gid} will always contain the on-disk view. Returned stat()->{uid|gid} example inside user_ns_X --------------------------------------------------- ------------------------------------------------------------------------- inode->uid on Disk | init_user_ns uid | userns_ns_X uid | stat->uid ------------------------------------------------------------------------- 0 | 1000000 | 0 | 65534 ------------------------------------------------------------------------- 999 | 1000999 | 999 | 65534 ------------------------------------------------------------------------- 1000 | 1001000 | 1000 | 65534 ------------------------------------------------------------------------- 1000000 | 1000000 | 0 | 0 ------------------------------------------------------------------------- 1000999 | 1000000 | 0 | 999 ------------------------------------------------------------------------- 1001000 | 1000999 | 999 | 1000 ------------------------------------------------------------------------- With this patch: ------------------------------------------------------------------------- inode->uid on Disk | init_user_ns uid | userns_ns_X uid | stat->uid ------------------------------------------------------------------------- 0 | 1000000 | 0 | 0 ------------------------------------------------------------------------- 999 | 1000999 | 999 | 999 ------------------------------------------------------------------------- 1000 | 1001000 | 1000 | 1000 ------------------------------------------------------------------------- 1000000 | 1000000 | 0 | 0 ------------------------------------------------------------------------- 1000999 | 1000000 | 0 | 999 ------------------------------------------------------------------------- 1001000 | 1000999 | 999 | 1000 ------------------------------------------------------------------------- Signed-off-by: Dongsu Park Signed-off-by: Djalal Harouni --- fs/namespace.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ fs/stat.c | 4 ++-- include/linux/fs.h | 11 ++++++++++ 3 files changed, 75 insertions(+), 2 deletions(-) diff --git a/fs/namespace.c b/fs/namespace.c index 940ecfc..de02b39 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -1652,6 +1652,22 @@ SYSCALL_DEFINE1(oldumount, char __user *, name) #endif +/* Returns true if the VFS should shift inode's UID */ +static bool vfs_mount_shift_i_uid(struct mnt_namespace *ns, + const struct inode *inode) +{ + return (ns->flags & CLONE_MNTNS_SHIFT_UIDGID) && + (inode->i_sb->s_iflags & SB_I_VFS_SHIFT_UIDS); +} + +/* Returns true if the VFS should shift inode's GID */ +static bool vfs_mount_shift_i_gid(struct mnt_namespace *ns, + const struct inode *inode) +{ + return (ns->flags & CLONE_MNTNS_SHIFT_UIDGID) && + (inode->i_sb->s_iflags & SB_I_VFS_SHIFT_GIDS); +} + static bool is_mnt_ns_file(struct dentry *dentry) { /* Is this a proxy for a mount namespace? */ @@ -1664,6 +1680,52 @@ struct mnt_namespace *to_mnt_ns(struct ns_common *ns) return container_of(ns, struct mnt_namespace, ns); } +/* + * Returns the virtual UID view of the inode's uid + * If UID shifts are enabled on the mount namespace and the filesystem, + * the VFS will return the shifted UID according to the rules of the + * user namespace of the containing mount namespace. If no shift is + * performed, inode->i_uid is returned. + */ +kuid_t vfs_shift_i_uid_to_virtual(const struct inode *inode) +{ + kuid_t i_uid = inode->i_uid; + struct mnt_namespace *ns = current->nsproxy->mnt_ns; + + /* Nothing to do */ + if (!vfs_mount_shift_i_uid(ns, inode)) + return i_uid; + + /* If there is no mapping construct one in the current mountns */ + if (!kuid_has_mapping(ns->user_ns, i_uid)) + return make_kuid(ns->user_ns, i_uid.val); + + return i_uid; +} + +/* + * Returns the virtual GID view of the inode's gid + * If GID shifts are enabled on the mount namespace and the filesystem, + * the VFS will return the shifted GID according to the rules of the + * user namespace of the containing mount namespace. If no shift is + * performed, inode->i_gid is returned. + */ +kgid_t vfs_shift_i_gid_to_virtual(const struct inode *inode) +{ + kgid_t i_gid = inode->i_gid; + struct mnt_namespace *ns = current->nsproxy->mnt_ns; + + /* Nothing to do */ + if (!vfs_mount_shift_i_gid(ns, inode)) + return i_gid; + + /* If there is no mapping construct one in the current mountns */ + if (!kgid_has_mapping(ns->user_ns, i_gid)) + return make_kgid(ns->user_ns, i_gid.val); + + return i_gid; +} + static bool mnt_ns_loop(struct dentry *dentry) { /* Could bind mounting the mount namespace inode cause a diff --git a/fs/stat.c b/fs/stat.c index bc045c7..d00622b 100644 --- a/fs/stat.c +++ b/fs/stat.c @@ -24,8 +24,8 @@ void generic_fillattr(struct inode *inode, struct kstat *stat) stat->ino = inode->i_ino; stat->mode = inode->i_mode; stat->nlink = inode->i_nlink; - stat->uid = inode->i_uid; - stat->gid = inode->i_gid; + stat->uid = vfs_shift_i_uid_to_virtual(inode); + stat->gid = vfs_shift_i_gid_to_virtual(inode); stat->rdev = inode->i_rdev; stat->size = i_size_read(inode); stat->atime = inode->i_atime; diff --git a/include/linux/fs.h b/include/linux/fs.h index 70e61b5..a9efc5a 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -1298,6 +1298,8 @@ struct mm_struct; /* sb->s_iflags */ #define SB_I_CGROUPWB 0x00000001 /* cgroup-aware writeback enabled */ #define SB_I_NOEXEC 0x00000002 /* Ignore executables on this fs */ +#define SB_I_VFS_SHIFT_UIDS 0X00000004 /* FS allows VFS to do UID shifts */ +#define SB_I_VFS_SHIFT_GIDS 0X00000008 /* FS allows VFS to do GID shifts */ /* Possible states of 'frozen' field */ enum { @@ -1563,6 +1565,15 @@ extern int vfs_whiteout(struct inode *, struct dentry *); */ extern void inode_init_owner(struct inode *inode, const struct inode *dir, umode_t mode); + +/* + * VFS helpers to shift inodes's uid/gid and passed values to either virtual + * or on-disk view. The shift is done according to rules of the user namespace + * of the containing mount namespace. + */ +extern kuid_t vfs_shift_i_uid_to_virtual(const struct inode *inode); +extern kgid_t vfs_shift_i_gid_to_virtual(const struct inode *inode); + /* * VFS FS_IOC_FIEMAP helper definitions. */