On Mon, Oct 16, 2017 at 01:33:12PM +0300, Konstantin Khorenko wrote: > Stas, please review the patch. > > Andrey, why do we need to support deeper user namespaces at all? > Someone app tries to create a new userns inside a vz7 CT and use ipt_owner > inside it?
The kernel grabs userns when we send START to the "state" file of a container ve cgroup. But vzctl does this after restoring a container, so we don't know a ve userns, when we are retoriung iptable rules. CRIU can't dump nested userns, so if any app will create a new userns, criu dump will return an error. > > -- > Best regards, > > Konstantin Khorenko, > Virtuozzo Linux Kernel Team > > On 10/14/2017 02:20 AM, Andrei Vagin wrote: > > From: "Eric W. Biederman" <ebied...@xmission.com> > > > > ML: 9847371a84b0be330f4bc4aaa98904101ee8573d > > https://jira.sw.ru/browse/PSBM-69409? > > > > Making this work is a little tricky as it really isn't kosher to > > change the xt_owner_match_info in a check function. > > > > Without changing xt_owner_match_info we need to know the user > > namespace the uids and gids are specified in. In the common case > > net->user_ns == current_user_ns(). Verify net->user_ns == > > current_user_ns() in owner_check so we can later assume it in > > owner_mt. > > > > In owner_check also verify that all of the uids and gids specified are > > in net->user_ns and that the expected min/max relationship exists > > between the uids and gids in xt_owner_match_info. > > > > In owner_mt get the network namespace from the outgoing socket, as this > > must be the same network namespace as the netfilter rules, and use that > > network namespace to find the user namespace the uids and gids in > > xt_match_owner_info are encoded in. Then convert from their encoded > > from into the kernel internal format for uids and gids and perform the > > owner match. > > > > Similar to ping_group_range, this code does not try to detect > > noncontiguous UID/GID ranges. > > > > Signed-off-by: "Eric W. Biederman" <ebied...@xmission.com> > > Signed-off-by: Kevin Cernekee <cerne...@chromium.org> > > Signed-off-by: Pablo Neira Ayuso <pa...@netfilter.org> > > Signed-off-by: Andrei Vagin <ava...@virtuozzo.com> > > --- > > net/netfilter/xt_owner.c | 41 +++++++++++++++++++++++++++++++++++------ > > 1 file changed, 35 insertions(+), 6 deletions(-) > > > > diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c > > index 31dec4a..1744f78 100644 > > --- a/net/netfilter/xt_owner.c > > +++ b/net/netfilter/xt_owner.c > > @@ -80,11 +80,39 @@ owner_mt6_v0(const struct sk_buff *skb, struct > > xt_action_param *par) > > static int owner_check(const struct xt_mtchk_param *par) > > { > > struct xt_owner_match_info *info = par->matchinfo; > > + struct net *net = par->net; > > > > - /* For now only allow adding matches from the initial user namespace */ > > + /* Only allow the common case where the userns of the writer > > + * matches the userns of the network namespace. > > + */ > > if ((info->match & (XT_OWNER_UID|XT_OWNER_GID)) && > > - !current_user_ns_initial()) > > + (current_user_ns() != net->user_ns)) > > return -EINVAL; > > + > > + /* Ensure the uids are valid */ > > + if (info->match & XT_OWNER_UID) { > > + kuid_t uid_min = make_kuid(net->user_ns, info->uid_min); > > + kuid_t uid_max = make_kuid(net->user_ns, info->uid_max); > > + > > + if (!uid_valid(uid_min) || !uid_valid(uid_max) || > > + (info->uid_max < info->uid_min) || > > + uid_lt(uid_max, uid_min)) { > > + return -EINVAL; > > + } > > + } > > + > > + /* Ensure the gids are valid */ > > + if (info->match & XT_OWNER_GID) { > > + kgid_t gid_min = make_kgid(net->user_ns, info->gid_min); > > + kgid_t gid_max = make_kgid(net->user_ns, info->gid_max); > > + > > + if (!gid_valid(gid_min) || !gid_valid(gid_max) || > > + (info->gid_max < info->gid_min) || > > + gid_lt(gid_max, gid_min)) { > > + return -EINVAL; > > + } > > + } > > + > > return 0; > > } > > > > @@ -93,6 +121,7 @@ owner_mt(const struct sk_buff *skb, struct > > xt_action_param *par) > > { > > const struct xt_owner_match_info *info = par->matchinfo; > > const struct file *filp; > > + struct net *net = dev_net(par->in ? par->in : par->out); > > > > if (skb->sk == NULL || skb->sk->sk_socket == NULL) > > return (info->match ^ info->invert) == 0; > > @@ -109,8 +138,8 @@ owner_mt(const struct sk_buff *skb, struct > > xt_action_param *par) > > (XT_OWNER_UID | XT_OWNER_GID)) == 0; > > > > if (info->match & XT_OWNER_UID) { > > - kuid_t uid_min = make_kuid(ve_init_user_ns(), info->uid_min); > > - kuid_t uid_max = make_kuid(ve_init_user_ns(), info->uid_max); > > + kuid_t uid_min = make_kuid(net->user_ns, info->uid_min); > > + kuid_t uid_max = make_kuid(net->user_ns, info->uid_max); > > if ((uid_gte(filp->f_cred->fsuid, uid_min) && > > uid_lte(filp->f_cred->fsuid, uid_max)) ^ > > !(info->invert & XT_OWNER_UID)) > > @@ -118,8 +147,8 @@ owner_mt(const struct sk_buff *skb, struct > > xt_action_param *par) > > } > > > > if (info->match & XT_OWNER_GID) { > > - kgid_t gid_min = make_kgid(ve_init_user_ns(), info->gid_min); > > - kgid_t gid_max = make_kgid(ve_init_user_ns(), info->gid_max); > > + kgid_t gid_min = make_kgid(net->user_ns, info->gid_min); > > + kgid_t gid_max = make_kgid(net->user_ns, info->gid_max); > > if ((gid_gte(filp->f_cred->fsgid, gid_min) && > > gid_lte(filp->f_cred->fsgid, gid_max)) ^ > > !(info->invert & XT_OWNER_GID)) > > _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel
