With this patch, an id is allocated for each netns. Id database is stored in the user namespace. It's allowed to get an id of a peer netns only if they share the same user ns.
Signed-off-by: Nicolas Dichtel <nicolas.dich...@6wind.com> --- include/linux/user_namespace.h | 4 ++++ include/net/net_namespace.h | 11 +++++++++++ kernel/user_namespace.c | 6 ++++++ net/core/net_namespace.c | 20 +++++++++++++++++++- 4 files changed, 40 insertions(+), 1 deletion(-) diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h index e95372654f09..9d122b540422 100644 --- a/include/linux/user_namespace.h +++ b/include/linux/user_namespace.h @@ -5,6 +5,7 @@ #include <linux/nsproxy.h> #include <linux/sched.h> #include <linux/err.h> +#include <linux/idr.h> #define UID_GID_MAP_MAX_EXTENTS 5 @@ -33,6 +34,9 @@ struct user_namespace { struct key *persistent_keyring_register; struct rw_semaphore persistent_keyring_register_sem; #endif +#ifdef CONFIG_NET_NS + struct idr netns_ids; +#endif }; extern struct user_namespace init_user_ns; diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h index 361d26077196..92b5f94e2842 100644 --- a/include/net/net_namespace.h +++ b/include/net/net_namespace.h @@ -59,6 +59,7 @@ struct net { struct list_head exit_list; /* Use only net_mutex */ struct user_namespace *user_ns; /* Owning user namespace */ + int netnsid; unsigned int proc_inum; @@ -289,6 +290,16 @@ static inline struct net *read_pnet(struct net * const *pnet) #define __net_initconst __initconst #endif +static inline int peernet2id(struct net *net, struct net *peer) +{ + if (net->user_ns != peer->user_ns) + return -EPERM; + + return peer->netnsid; +} + +struct net *get_net_from_netnsid(struct net *net, int id); + struct pernet_operations { struct list_head list; int (*init)(struct net *net); diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index aa312b0dc3ec..30316a2eed49 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -104,6 +104,9 @@ int create_user_ns(struct cred *new) #ifdef CONFIG_PERSISTENT_KEYRINGS init_rwsem(&ns->persistent_keyring_register_sem); #endif +#ifdef CONFIG_NET_NS + idr_init(&ns->netns_ids); +#endif return 0; } @@ -133,6 +136,9 @@ void free_user_ns(struct user_namespace *ns) do { parent = ns->parent; +#ifdef CONFIG_NET_NS + idr_destroy(&ns->netns_ids); +#endif #ifdef CONFIG_PERSISTENT_KEYRINGS key_put(ns->persistent_keyring_register); #endif diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c index 7f155175bba8..f44378de7831 100644 --- a/net/core/net_namespace.c +++ b/net/core/net_namespace.c @@ -144,6 +144,19 @@ static void ops_free_list(const struct pernet_operations *ops, } } +struct net *get_net_from_netnsid(struct net *net, int id) +{ + struct net *peer; + + rcu_read_lock(); + peer = idr_find(&net->user_ns->netns_ids, id); + if (peer) + get_net(peer); + rcu_read_unlock(); + + return peer; +} + /* * setup_net runs the initializers for the network namespace object. */ @@ -151,13 +164,16 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns) { /* Must be called with net_mutex held */ const struct pernet_operations *ops, *saved_ops; - int error = 0; + int error = 0, id; LIST_HEAD(net_exit_list); atomic_set(&net->count, 1); atomic_set(&net->passive, 1); net->dev_base_seq = 1; net->user_ns = user_ns; + id = idr_alloc_cyclic(&user_ns->netns_ids, net, 1, 0, GFP_KERNEL); + if (id > 0) + net->netnsid = id; #ifdef NETNS_REFCNT_DEBUG atomic_set(&net->use_count, 0); @@ -288,6 +304,8 @@ static void cleanup_net(struct work_struct *work) list_for_each_entry(net, &net_kill_list, cleanup_list) { list_del_rcu(&net->list); list_add_tail(&net->exit_list, &net_exit_list); + if (net->netnsid) + idr_remove(&net->user_ns->netns_ids, net->netnsid); } rtnl_unlock(); -- 2.1.0 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/