userns: Allow unprivileged use of setns.

- Push the permission check from the core setns syscall into
  the setns install methods where the user namespace of the
  target namespace can be determined, and used in a ns_capable
  call.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>

diff --git a/ipc/namespace.c b/ipc/namespace.c
index f362298c5ce465e3585dfd2cbfdd528e29e4790d..6ed33c05cb66731d11aba8936d570222869aa52c 100644 (file)
--- a/ipc/namespace.c
+++ b/ipc/namespace.c
@@ -161,8 +161,12 @@ static void ipcns_put(void *ns)
        return put_ipc_ns(ns);
 }
 
-static int ipcns_install(struct nsproxy *nsproxy, void *ns)
+static int ipcns_install(struct nsproxy *nsproxy, void *new)
 {
+       struct ipc_namespace *ns = new;
+       if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+               return -EPERM;
+
        /* Ditch state from the old ipc namespace */
        exit_sem(current);
        put_ipc_ns(nsproxy->ipc_ns);

diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index a214e0e9035fd0fb76c1d7cbcc518bff8fb1aab8..4357a0a7d17d29889adf04712e5e254ec50eaa02 100644 (file)
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -242,9 +242,6 @@ SYSCALL_DEFINE2(setns, int, fd, int, nstype)
        struct file *file;
        int err;
 
-       if (!capable(CAP_SYS_ADMIN))
-               return -EPERM;
-
        file = proc_ns_fget(fd);
        if (IS_ERR(file))
                return PTR_ERR(file);

diff --git a/kernel/utsname.c b/kernel/utsname.c
index 679d97a5d3fdf95c7f22958bc3f8276dd0657984..4a9362f9325d60e5809db9e48ffb73b6ce2f756a 100644 (file)
--- a/kernel/utsname.c
+++ b/kernel/utsname.c
@@ -102,8 +102,13 @@ static void utsns_put(void *ns)
        put_uts_ns(ns);
 }
 
-static int utsns_install(struct nsproxy *nsproxy, void *ns)
+static int utsns_install(struct nsproxy *nsproxy, void *new)
 {
+       struct uts_namespace *ns = new;
+
+       if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+               return -EPERM;
+
        get_uts_ns(ns);
        put_uts_ns(nsproxy->uts_ns);
        nsproxy->uts_ns = ns;

diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 6456439cbbd9e4160c05105554db665226892620..ec2870b44c1f920b734a4bccaf09824e99250742 100644 (file)
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -630,8 +630,13 @@ static void netns_put(void *ns)
 
 static int netns_install(struct nsproxy *nsproxy, void *ns)
 {
+       struct net *net = ns;
+
+       if (!ns_capable(net->user_ns, CAP_SYS_ADMIN))
+               return -EPERM;
+
        put_net(nsproxy->net_ns);
-       nsproxy->net_ns = get_net(ns);
+       nsproxy->net_ns = get_net(net);
        return 0;
 }