user_namespace.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2
   3#include <linux/export.h>
   4#include <linux/nsproxy.h>
   5#include <linux/slab.h>
   6#include <linux/sched/signal.h>
   7#include <linux/user_namespace.h>
   8#include <linux/proc_ns.h>
   9#include <linux/highuid.h>
  10#include <linux/cred.h>
  11#include <linux/securebits.h>
  12#include <linux/security.h>
  13#include <linux/keyctl.h>
  14#include <linux/key-type.h>
  15#include <keys/user-type.h>
  16#include <linux/seq_file.h>
  17#include <linux/fs.h>
  18#include <linux/uaccess.h>
  19#include <linux/ctype.h>
  20#include <linux/projid.h>
  21#include <linux/fs_struct.h>
  22#include <linux/bsearch.h>
  23#include <linux/sort.h>
  24#include <linux/nstree.h>
  25
  26static struct kmem_cache *user_ns_cachep __ro_after_init;
  27static DEFINE_MUTEX(userns_state_mutex);
  28
  29static bool new_idmap_permitted(const struct file *file,
  30				struct user_namespace *ns, int cap_setid,
  31				struct uid_gid_map *map);
  32static void free_user_ns(struct work_struct *work);
  33
  34static struct ucounts *inc_user_namespaces(struct user_namespace *ns, kuid_t uid)
  35{
  36	return inc_ucount(ns, uid, UCOUNT_USER_NAMESPACES);
  37}
  38
  39static void dec_user_namespaces(struct ucounts *ucounts)
  40{
  41	return dec_ucount(ucounts, UCOUNT_USER_NAMESPACES);
  42}
  43
  44static void set_cred_user_ns(struct cred *cred, struct user_namespace *user_ns)
  45{
  46	/* Start with the same capabilities as init but useless for doing
  47	 * anything as the capabilities are bound to the new user namespace.
  48	 */
  49	cred->securebits = SECUREBITS_DEFAULT;
  50	cred->cap_inheritable = CAP_EMPTY_SET;
  51	cred->cap_permitted = CAP_FULL_SET;
  52	cred->cap_effective = CAP_FULL_SET;
  53	cred->cap_ambient = CAP_EMPTY_SET;
  54	cred->cap_bset = CAP_FULL_SET;
  55#ifdef CONFIG_KEYS
  56	key_put(cred->request_key_auth);
  57	cred->request_key_auth = NULL;
  58#endif
  59	/* tgcred will be cleared in our caller bc CLONE_THREAD won't be set */
  60	cred->user_ns = user_ns;
  61}
  62
  63static unsigned long enforced_nproc_rlimit(void)
  64{
  65	unsigned long limit = RLIM_INFINITY;
  66
  67	/* Is RLIMIT_NPROC currently enforced? */
  68	if (!uid_eq(current_uid(), GLOBAL_ROOT_UID) ||
  69	    (current_user_ns() != &init_user_ns))
  70		limit = rlimit(RLIMIT_NPROC);
  71
  72	return limit;
  73}
  74
  75/*
  76 * Create a new user namespace, deriving the creator from the user in the
  77 * passed credentials, and replacing that user with the new root user for the
  78 * new namespace.
  79 *
  80 * This is called by copy_creds(), which will finish setting the target task's
  81 * credentials.
  82 */
  83int create_user_ns(struct cred *new)
  84{
  85	struct user_namespace *ns, *parent_ns = new->user_ns;
  86	kuid_t owner = new->euid;
  87	kgid_t group = new->egid;
  88	struct ucounts *ucounts;
  89	int ret, i;
  90
  91	ret = -ENOSPC;
  92	if (parent_ns->level > 32)
  93		goto fail;
  94
  95	ucounts = inc_user_namespaces(parent_ns, owner);
  96	if (!ucounts)
  97		goto fail;
  98
  99	/*
 100	 * Verify that we can not violate the policy of which files
 101	 * may be accessed that is specified by the root directory,
 102	 * by verifying that the root directory is at the root of the
 103	 * mount namespace which allows all files to be accessed.
 104	 */
 105	ret = -EPERM;
 106	if (current_chrooted())
 107		goto fail_dec;
 108
 109	/* The creator needs a mapping in the parent user namespace
 110	 * or else we won't be able to reasonably tell userspace who
 111	 * created a user_namespace.
 112	 */
 113	ret = -EPERM;
 114	if (!kuid_has_mapping(parent_ns, owner) ||
 115	    !kgid_has_mapping(parent_ns, group))
 116		goto fail_dec;
 117
 118	ret = security_create_user_ns(new);
 119	if (ret < 0)
 120		goto fail_dec;
 121
 122	ret = -ENOMEM;
 123	ns = kmem_cache_zalloc(user_ns_cachep, GFP_KERNEL);
 124	if (!ns)
 125		goto fail_dec;
 126
 127	ns->parent_could_setfcap = cap_raised(new->cap_effective, CAP_SETFCAP);
 128
 129	ret = ns_common_init(ns);
 130	if (ret)
 131		goto fail_free;
 132
 133	/* Leave the new->user_ns reference with the new user namespace. */
 134	ns->parent = parent_ns;
 135	ns->level = parent_ns->level + 1;
 136	ns->owner = owner;
 137	ns->group = group;
 138	INIT_WORK(&ns->work, free_user_ns);
 139	for (i = 0; i < UCOUNT_COUNTS; i++) {
 140		ns->ucount_max[i] = INT_MAX;
 141	}
 142	set_userns_rlimit_max(ns, UCOUNT_RLIMIT_NPROC, enforced_nproc_rlimit());
 143	set_userns_rlimit_max(ns, UCOUNT_RLIMIT_MSGQUEUE, rlimit(RLIMIT_MSGQUEUE));
 144	set_userns_rlimit_max(ns, UCOUNT_RLIMIT_SIGPENDING, rlimit(RLIMIT_SIGPENDING));
 145	set_userns_rlimit_max(ns, UCOUNT_RLIMIT_MEMLOCK, rlimit(RLIMIT_MEMLOCK));
 146	ns->ucounts = ucounts;
 147
 148	/* Inherit USERNS_SETGROUPS_ALLOWED from our parent */
 149	mutex_lock(&userns_state_mutex);
 150	ns->flags = parent_ns->flags;
 151	mutex_unlock(&userns_state_mutex);
 152
 153#ifdef CONFIG_KEYS
 154	INIT_LIST_HEAD(&ns->keyring_name_list);
 155	init_rwsem(&ns->keyring_sem);
 156#endif
 157	ret = -ENOMEM;
 158	if (!setup_userns_sysctls(ns))
 159		goto fail_keyring;
 160
 161	set_cred_user_ns(new, ns);
 162	ns_tree_add(ns);
 163	return 0;
 164fail_keyring:
 165#ifdef CONFIG_PERSISTENT_KEYRINGS
 166	key_put(ns->persistent_keyring_register);
 167#endif
 168	ns_common_free(ns);
 169fail_free:
 170	kmem_cache_free(user_ns_cachep, ns);
 171fail_dec:
 172	dec_user_namespaces(ucounts);
 173fail:
 174	return ret;
 175}
 176
 177int unshare_userns(unsigned long unshare_flags, struct cred **new_cred)
 178{
 179	struct cred *cred;
 180	int err = -ENOMEM;
 181
 182	if (!(unshare_flags & CLONE_NEWUSER))
 183		return 0;
 184
 185	cred = prepare_creds();
 186	if (cred) {
 187		err = create_user_ns(cred);
 188		if (err)
 189			put_cred(cred);
 190		else
 191			*new_cred = cred;
 192	}
 193
 194	return err;
 195}
 196
 197static void free_user_ns(struct work_struct *work)
 198{
 199	struct user_namespace *parent, *ns =
 200		container_of(work, struct user_namespace, work);
 201
 202	do {
 203		struct ucounts *ucounts = ns->ucounts;
 204		parent = ns->parent;
 205		ns_tree_remove(ns);
 206		if (ns->gid_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) {
 207			kfree(ns->gid_map.forward);
 208			kfree(ns->gid_map.reverse);
 209		}
 210		if (ns->uid_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) {
 211			kfree(ns->uid_map.forward);
 212			kfree(ns->uid_map.reverse);
 213		}
 214		if (ns->projid_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) {
 215			kfree(ns->projid_map.forward);
 216			kfree(ns->projid_map.reverse);
 217		}
 218#if IS_ENABLED(CONFIG_BINFMT_MISC)
 219		kfree(ns->binfmt_misc);
 220#endif
 221		retire_userns_sysctls(ns);
 222		key_free_user_ns(ns);
 223		ns_common_free(ns);
 224		/* Concurrent nstree traversal depends on a grace period. */
 225		kfree_rcu(ns, ns.ns_rcu);
 226		dec_user_namespaces(ucounts);
 227		ns = parent;
 228	} while (ns_ref_put(parent));
 229}
 230
 231void __put_user_ns(struct user_namespace *ns)
 232{
 233	schedule_work(&ns->work);
 234}
 235EXPORT_SYMBOL(__put_user_ns);
 236
 237/*
 238 * struct idmap_key - holds the information necessary to find an idmapping in a
 239 * sorted idmap array. It is passed to cmp_map_id() as first argument.
 240 */
 241struct idmap_key {
 242	bool map_up; /* true  -> id from kid; false -> kid from id */
 243	u32 id; /* id to find */
 244	u32 count;
 245};
 246
 247/*
 248 * cmp_map_id - Function to be passed to bsearch() to find the requested
 249 * idmapping. Expects struct idmap_key to be passed via @k.
 250 */
 251static int cmp_map_id(const void *k, const void *e)
 252{
 253	u32 first, last, id2;
 254	const struct idmap_key *key = k;
 255	const struct uid_gid_extent *el = e;
 256
 257	id2 = key->id + key->count - 1;
 258
 259	/* handle map_id_{down,up}() */
 260	if (key->map_up)
 261		first = el->lower_first;
 262	else
 263		first = el->first;
 264
 265	last = first + el->count - 1;
 266
 267	if (key->id >= first && key->id <= last &&
 268	    (id2 >= first && id2 <= last))
 269		return 0;
 270
 271	if (key->id < first || id2 < first)
 272		return -1;
 273
 274	return 1;
 275}
 276
 277/*
 278 * map_id_range_down_max - Find idmap via binary search in ordered idmap array.
 279 * Can only be called if number of mappings exceeds UID_GID_MAP_MAX_BASE_EXTENTS.
 280 */
 281static struct uid_gid_extent *
 282map_id_range_down_max(unsigned extents, struct uid_gid_map *map, u32 id, u32 count)
 283{
 284	struct idmap_key key;
 285
 286	key.map_up = false;
 287	key.count = count;
 288	key.id = id;
 289
 290	return bsearch(&key, map->forward, extents,
 291		       sizeof(struct uid_gid_extent), cmp_map_id);
 292}
 293
 294/*
 295 * map_id_range_down_base - Find idmap via binary search in static extent array.
 296 * Can only be called if number of mappings is equal or less than
 297 * UID_GID_MAP_MAX_BASE_EXTENTS.
 298 */
 299static struct uid_gid_extent *
 300map_id_range_down_base(unsigned extents, struct uid_gid_map *map, u32 id, u32 count)
 301{
 302	unsigned idx;
 303	u32 first, last, id2;
 304
 305	id2 = id + count - 1;
 306
 307	/* Find the matching extent */
 308	for (idx = 0; idx < extents; idx++) {
 309		first = map->extent[idx].first;
 310		last = first + map->extent[idx].count - 1;
 311		if (id >= first && id <= last &&
 312		    (id2 >= first && id2 <= last))
 313			return &map->extent[idx];
 314	}
 315	return NULL;
 316}
 317
 318static u32 map_id_range_down(struct uid_gid_map *map, u32 id, u32 count)
 319{
 320	struct uid_gid_extent *extent;
 321	unsigned extents = map->nr_extents;
 322	smp_rmb();
 323
 324	if (extents <= UID_GID_MAP_MAX_BASE_EXTENTS)
 325		extent = map_id_range_down_base(extents, map, id, count);
 326	else
 327		extent = map_id_range_down_max(extents, map, id, count);
 328
 329	/* Map the id or note failure */
 330	if (extent)
 331		id = (id - extent->first) + extent->lower_first;
 332	else
 333		id = (u32) -1;
 334
 335	return id;
 336}
 337
 338u32 map_id_down(struct uid_gid_map *map, u32 id)
 339{
 340	return map_id_range_down(map, id, 1);
 341}
 342
 343/*
 344 * map_id_up_base - Find idmap via binary search in static extent array.
 345 * Can only be called if number of mappings is equal or less than
 346 * UID_GID_MAP_MAX_BASE_EXTENTS.
 347 */
 348static struct uid_gid_extent *
 349map_id_range_up_base(unsigned extents, struct uid_gid_map *map, u32 id, u32 count)
 350{
 351	unsigned idx;
 352	u32 first, last, id2;
 353
 354	id2 = id + count - 1;
 355
 356	/* Find the matching extent */
 357	for (idx = 0; idx < extents; idx++) {
 358		first = map->extent[idx].lower_first;
 359		last = first + map->extent[idx].count - 1;
 360		if (id >= first && id <= last &&
 361		    (id2 >= first && id2 <= last))
 362			return &map->extent[idx];
 363	}
 364	return NULL;
 365}
 366
 367/*
 368 * map_id_up_max - Find idmap via binary search in ordered idmap array.
 369 * Can only be called if number of mappings exceeds UID_GID_MAP_MAX_BASE_EXTENTS.
 370 */
 371static struct uid_gid_extent *
 372map_id_range_up_max(unsigned extents, struct uid_gid_map *map, u32 id, u32 count)
 373{
 374	struct idmap_key key;
 375
 376	key.map_up = true;
 377	key.count = count;
 378	key.id = id;
 379
 380	return bsearch(&key, map->reverse, extents,
 381		       sizeof(struct uid_gid_extent), cmp_map_id);
 382}
 383
 384u32 map_id_range_up(struct uid_gid_map *map, u32 id, u32 count)
 385{
 386	struct uid_gid_extent *extent;
 387	unsigned extents = map->nr_extents;
 388	smp_rmb();
 389
 390	if (extents <= UID_GID_MAP_MAX_BASE_EXTENTS)
 391		extent = map_id_range_up_base(extents, map, id, count);
 392	else
 393		extent = map_id_range_up_max(extents, map, id, count);
 394
 395	/* Map the id or note failure */
 396	if (extent)
 397		id = (id - extent->lower_first) + extent->first;
 398	else
 399		id = (u32) -1;
 400
 401	return id;
 402}
 403
 404u32 map_id_up(struct uid_gid_map *map, u32 id)
 405{
 406	return map_id_range_up(map, id, 1);
 407}
 408
 409/**
 410 *	make_kuid - Map a user-namespace uid pair into a kuid.
 411 *	@ns:  User namespace that the uid is in
 412 *	@uid: User identifier
 413 *
 414 *	Maps a user-namespace uid pair into a kernel internal kuid,
 415 *	and returns that kuid.
 416 *
 417 *	When there is no mapping defined for the user-namespace uid
 418 *	pair INVALID_UID is returned.  Callers are expected to test
 419 *	for and handle INVALID_UID being returned.  INVALID_UID
 420 *	may be tested for using uid_valid().
 421 */
 422kuid_t make_kuid(struct user_namespace *ns, uid_t uid)
 423{
 424	/* Map the uid to a global kernel uid */
 425	return KUIDT_INIT(map_id_down(&ns->uid_map, uid));
 426}
 427EXPORT_SYMBOL(make_kuid);
 428
 429/**
 430 *	from_kuid - Create a uid from a kuid user-namespace pair.
 431 *	@targ: The user namespace we want a uid in.
 432 *	@kuid: The kernel internal uid to start with.
 433 *
 434 *	Map @kuid into the user-namespace specified by @targ and
 435 *	return the resulting uid.
 436 *
 437 *	There is always a mapping into the initial user_namespace.
 438 *
 439 *	If @kuid has no mapping in @targ (uid_t)-1 is returned.
 440 */
 441uid_t from_kuid(struct user_namespace *targ, kuid_t kuid)
 442{
 443	/* Map the uid from a global kernel uid */
 444	return map_id_up(&targ->uid_map, __kuid_val(kuid));
 445}
 446EXPORT_SYMBOL(from_kuid);
 447
 448/**
 449 *	from_kuid_munged - Create a uid from a kuid user-namespace pair.
 450 *	@targ: The user namespace we want a uid in.
 451 *	@kuid: The kernel internal uid to start with.
 452 *
 453 *	Map @kuid into the user-namespace specified by @targ and
 454 *	return the resulting uid.
 455 *
 456 *	There is always a mapping into the initial user_namespace.
 457 *
 458 *	Unlike from_kuid from_kuid_munged never fails and always
 459 *	returns a valid uid.  This makes from_kuid_munged appropriate
 460 *	for use in syscalls like stat and getuid where failing the
 461 *	system call and failing to provide a valid uid are not an
 462 *	options.
 463 *
 464 *	If @kuid has no mapping in @targ overflowuid is returned.
 465 */
 466uid_t from_kuid_munged(struct user_namespace *targ, kuid_t kuid)
 467{
 468	uid_t uid;
 469	uid = from_kuid(targ, kuid);
 470
 471	if (uid == (uid_t) -1)
 472		uid = overflowuid;
 473	return uid;
 474}
 475EXPORT_SYMBOL(from_kuid_munged);
 476
 477/**
 478 *	make_kgid - Map a user-namespace gid pair into a kgid.
 479 *	@ns:  User namespace that the gid is in
 480 *	@gid: group identifier
 481 *
 482 *	Maps a user-namespace gid pair into a kernel internal kgid,
 483 *	and returns that kgid.
 484 *
 485 *	When there is no mapping defined for the user-namespace gid
 486 *	pair INVALID_GID is returned.  Callers are expected to test
 487 *	for and handle INVALID_GID being returned.  INVALID_GID may be
 488 *	tested for using gid_valid().
 489 */
 490kgid_t make_kgid(struct user_namespace *ns, gid_t gid)
 491{
 492	/* Map the gid to a global kernel gid */
 493	return KGIDT_INIT(map_id_down(&ns->gid_map, gid));
 494}
 495EXPORT_SYMBOL(make_kgid);
 496
 497/**
 498 *	from_kgid - Create a gid from a kgid user-namespace pair.
 499 *	@targ: The user namespace we want a gid in.
 500 *	@kgid: The kernel internal gid to start with.
 501 *
 502 *	Map @kgid into the user-namespace specified by @targ and
 503 *	return the resulting gid.
 504 *
 505 *	There is always a mapping into the initial user_namespace.
 506 *
 507 *	If @kgid has no mapping in @targ (gid_t)-1 is returned.
 508 */
 509gid_t from_kgid(struct user_namespace *targ, kgid_t kgid)
 510{
 511	/* Map the gid from a global kernel gid */
 512	return map_id_up(&targ->gid_map, __kgid_val(kgid));
 513}
 514EXPORT_SYMBOL(from_kgid);
 515
 516/**
 517 *	from_kgid_munged - Create a gid from a kgid user-namespace pair.
 518 *	@targ: The user namespace we want a gid in.
 519 *	@kgid: The kernel internal gid to start with.
 520 *
 521 *	Map @kgid into the user-namespace specified by @targ and
 522 *	return the resulting gid.
 523 *
 524 *	There is always a mapping into the initial user_namespace.
 525 *
 526 *	Unlike from_kgid from_kgid_munged never fails and always
 527 *	returns a valid gid.  This makes from_kgid_munged appropriate
 528 *	for use in syscalls like stat and getgid where failing the
 529 *	system call and failing to provide a valid gid are not options.
 530 *
 531 *	If @kgid has no mapping in @targ overflowgid is returned.
 532 */
 533gid_t from_kgid_munged(struct user_namespace *targ, kgid_t kgid)
 534{
 535	gid_t gid;
 536	gid = from_kgid(targ, kgid);
 537
 538	if (gid == (gid_t) -1)
 539		gid = overflowgid;
 540	return gid;
 541}
 542EXPORT_SYMBOL(from_kgid_munged);
 543
 544/**
 545 *	make_kprojid - Map a user-namespace projid pair into a kprojid.
 546 *	@ns:  User namespace that the projid is in
 547 *	@projid: Project identifier
 548 *
 549 *	Maps a user-namespace uid pair into a kernel internal kuid,
 550 *	and returns that kuid.
 551 *
 552 *	When there is no mapping defined for the user-namespace projid
 553 *	pair INVALID_PROJID is returned.  Callers are expected to test
 554 *	for and handle INVALID_PROJID being returned.  INVALID_PROJID
 555 *	may be tested for using projid_valid().
 556 */
 557kprojid_t make_kprojid(struct user_namespace *ns, projid_t projid)
 558{
 559	/* Map the uid to a global kernel uid */
 560	return KPROJIDT_INIT(map_id_down(&ns->projid_map, projid));
 561}
 562EXPORT_SYMBOL(make_kprojid);
 563
 564/**
 565 *	from_kprojid - Create a projid from a kprojid user-namespace pair.
 566 *	@targ: The user namespace we want a projid in.
 567 *	@kprojid: The kernel internal project identifier to start with.
 568 *
 569 *	Map @kprojid into the user-namespace specified by @targ and
 570 *	return the resulting projid.
 571 *
 572 *	There is always a mapping into the initial user_namespace.
 573 *
 574 *	If @kprojid has no mapping in @targ (projid_t)-1 is returned.
 575 */
 576projid_t from_kprojid(struct user_namespace *targ, kprojid_t kprojid)
 577{
 578	/* Map the uid from a global kernel uid */
 579	return map_id_up(&targ->projid_map, __kprojid_val(kprojid));
 580}
 581EXPORT_SYMBOL(from_kprojid);
 582
 583/**
 584 *	from_kprojid_munged - Create a projiid from a kprojid user-namespace pair.
 585 *	@targ: The user namespace we want a projid in.
 586 *	@kprojid: The kernel internal projid to start with.
 587 *
 588 *	Map @kprojid into the user-namespace specified by @targ and
 589 *	return the resulting projid.
 590 *
 591 *	There is always a mapping into the initial user_namespace.
 592 *
 593 *	Unlike from_kprojid from_kprojid_munged never fails and always
 594 *	returns a valid projid.  This makes from_kprojid_munged
 595 *	appropriate for use in syscalls like stat and where
 596 *	failing the system call and failing to provide a valid projid are
 597 *	not an options.
 598 *
 599 *	If @kprojid has no mapping in @targ OVERFLOW_PROJID is returned.
 600 */
 601projid_t from_kprojid_munged(struct user_namespace *targ, kprojid_t kprojid)
 602{
 603	projid_t projid;
 604	projid = from_kprojid(targ, kprojid);
 605
 606	if (projid == (projid_t) -1)
 607		projid = OVERFLOW_PROJID;
 608	return projid;
 609}
 610EXPORT_SYMBOL(from_kprojid_munged);
 611
 612
 613static int uid_m_show(struct seq_file *seq, void *v)
 614{
 615	struct user_namespace *ns = seq->private;
 616	struct uid_gid_extent *extent = v;
 617	struct user_namespace *lower_ns;
 618	uid_t lower;
 619
 620	lower_ns = seq_user_ns(seq);
 621	if ((lower_ns == ns) && lower_ns->parent)
 622		lower_ns = lower_ns->parent;
 623
 624	lower = from_kuid(lower_ns, KUIDT_INIT(extent->lower_first));
 625
 626	seq_printf(seq, "%10u %10u %10u\n",
 627		extent->first,
 628		lower,
 629		extent->count);
 630
 631	return 0;
 632}
 633
 634static int gid_m_show(struct seq_file *seq, void *v)
 635{
 636	struct user_namespace *ns = seq->private;
 637	struct uid_gid_extent *extent = v;
 638	struct user_namespace *lower_ns;
 639	gid_t lower;
 640
 641	lower_ns = seq_user_ns(seq);
 642	if ((lower_ns == ns) && lower_ns->parent)
 643		lower_ns = lower_ns->parent;
 644
 645	lower = from_kgid(lower_ns, KGIDT_INIT(extent->lower_first));
 646
 647	seq_printf(seq, "%10u %10u %10u\n",
 648		extent->first,
 649		lower,
 650		extent->count);
 651
 652	return 0;
 653}
 654
 655static int projid_m_show(struct seq_file *seq, void *v)
 656{
 657	struct user_namespace *ns = seq->private;
 658	struct uid_gid_extent *extent = v;
 659	struct user_namespace *lower_ns;
 660	projid_t lower;
 661
 662	lower_ns = seq_user_ns(seq);
 663	if ((lower_ns == ns) && lower_ns->parent)
 664		lower_ns = lower_ns->parent;
 665
 666	lower = from_kprojid(lower_ns, KPROJIDT_INIT(extent->lower_first));
 667
 668	seq_printf(seq, "%10u %10u %10u\n",
 669		extent->first,
 670		lower,
 671		extent->count);
 672
 673	return 0;
 674}
 675
 676static void *m_start(struct seq_file *seq, loff_t *ppos,
 677		     struct uid_gid_map *map)
 678{
 679	loff_t pos = *ppos;
 680	unsigned extents = map->nr_extents;
 681	smp_rmb();
 682
 683	if (pos >= extents)
 684		return NULL;
 685
 686	if (extents <= UID_GID_MAP_MAX_BASE_EXTENTS)
 687		return &map->extent[pos];
 688
 689	return &map->forward[pos];
 690}
 691
 692static void *uid_m_start(struct seq_file *seq, loff_t *ppos)
 693{
 694	struct user_namespace *ns = seq->private;
 695
 696	return m_start(seq, ppos, &ns->uid_map);
 697}
 698
 699static void *gid_m_start(struct seq_file *seq, loff_t *ppos)
 700{
 701	struct user_namespace *ns = seq->private;
 702
 703	return m_start(seq, ppos, &ns->gid_map);
 704}
 705
 706static void *projid_m_start(struct seq_file *seq, loff_t *ppos)
 707{
 708	struct user_namespace *ns = seq->private;
 709
 710	return m_start(seq, ppos, &ns->projid_map);
 711}
 712
 713static void *m_next(struct seq_file *seq, void *v, loff_t *pos)
 714{
 715	(*pos)++;
 716	return seq->op->start(seq, pos);
 717}
 718
 719static void m_stop(struct seq_file *seq, void *v)
 720{
 721	return;
 722}
 723
 724const struct seq_operations proc_uid_seq_operations = {
 725	.start = uid_m_start,
 726	.stop = m_stop,
 727	.next = m_next,
 728	.show = uid_m_show,
 729};
 730
 731const struct seq_operations proc_gid_seq_operations = {
 732	.start = gid_m_start,
 733	.stop = m_stop,
 734	.next = m_next,
 735	.show = gid_m_show,
 736};
 737
 738const struct seq_operations proc_projid_seq_operations = {
 739	.start = projid_m_start,
 740	.stop = m_stop,
 741	.next = m_next,
 742	.show = projid_m_show,
 743};
 744
 745static bool mappings_overlap(struct uid_gid_map *new_map,
 746			     struct uid_gid_extent *extent)
 747{
 748	u32 upper_first, lower_first, upper_last, lower_last;
 749	unsigned idx;
 750
 751	upper_first = extent->first;
 752	lower_first = extent->lower_first;
 753	upper_last = upper_first + extent->count - 1;
 754	lower_last = lower_first + extent->count - 1;
 755
 756	for (idx = 0; idx < new_map->nr_extents; idx++) {
 757		u32 prev_upper_first, prev_lower_first;
 758		u32 prev_upper_last, prev_lower_last;
 759		struct uid_gid_extent *prev;
 760
 761		if (new_map->nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS)
 762			prev = &new_map->extent[idx];
 763		else
 764			prev = &new_map->forward[idx];
 765
 766		prev_upper_first = prev->first;
 767		prev_lower_first = prev->lower_first;
 768		prev_upper_last = prev_upper_first + prev->count - 1;
 769		prev_lower_last = prev_lower_first + prev->count - 1;
 770
 771		/* Does the upper range intersect a previous extent? */
 772		if ((prev_upper_first <= upper_last) &&
 773		    (prev_upper_last >= upper_first))
 774			return true;
 775
 776		/* Does the lower range intersect a previous extent? */
 777		if ((prev_lower_first <= lower_last) &&
 778		    (prev_lower_last >= lower_first))
 779			return true;
 780	}
 781	return false;
 782}
 783
 784/*
 785 * insert_extent - Safely insert a new idmap extent into struct uid_gid_map.
 786 * Takes care to allocate a 4K block of memory if the number of mappings exceeds
 787 * UID_GID_MAP_MAX_BASE_EXTENTS.
 788 */
 789static int insert_extent(struct uid_gid_map *map, struct uid_gid_extent *extent)
 790{
 791	struct uid_gid_extent *dest;
 792
 793	if (map->nr_extents == UID_GID_MAP_MAX_BASE_EXTENTS) {
 794		struct uid_gid_extent *forward;
 795
 796		/* Allocate memory for 340 mappings. */
 797		forward = kmalloc_array(UID_GID_MAP_MAX_EXTENTS,
 798					sizeof(struct uid_gid_extent),
 799					GFP_KERNEL);
 800		if (!forward)
 801			return -ENOMEM;
 802
 803		/* Copy over memory. Only set up memory for the forward pointer.
 804		 * Defer the memory setup for the reverse pointer.
 805		 */
 806		memcpy(forward, map->extent,
 807		       map->nr_extents * sizeof(map->extent[0]));
 808
 809		map->forward = forward;
 810		map->reverse = NULL;
 811	}
 812
 813	if (map->nr_extents < UID_GID_MAP_MAX_BASE_EXTENTS)
 814		dest = &map->extent[map->nr_extents];
 815	else
 816		dest = &map->forward[map->nr_extents];
 817
 818	*dest = *extent;
 819	map->nr_extents++;
 820	return 0;
 821}
 822
 823/* cmp function to sort() forward mappings */
 824static int cmp_extents_forward(const void *a, const void *b)
 825{
 826	const struct uid_gid_extent *e1 = a;
 827	const struct uid_gid_extent *e2 = b;
 828
 829	if (e1->first < e2->first)
 830		return -1;
 831
 832	if (e1->first > e2->first)
 833		return 1;
 834
 835	return 0;
 836}
 837
 838/* cmp function to sort() reverse mappings */
 839static int cmp_extents_reverse(const void *a, const void *b)
 840{
 841	const struct uid_gid_extent *e1 = a;
 842	const struct uid_gid_extent *e2 = b;
 843
 844	if (e1->lower_first < e2->lower_first)
 845		return -1;
 846
 847	if (e1->lower_first > e2->lower_first)
 848		return 1;
 849
 850	return 0;
 851}
 852
 853/*
 854 * sort_idmaps - Sorts an array of idmap entries.
 855 * Can only be called if number of mappings exceeds UID_GID_MAP_MAX_BASE_EXTENTS.
 856 */
 857static int sort_idmaps(struct uid_gid_map *map)
 858{
 859	if (map->nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS)
 860		return 0;
 861
 862	/* Sort forward array. */
 863	sort(map->forward, map->nr_extents, sizeof(struct uid_gid_extent),
 864	     cmp_extents_forward, NULL);
 865
 866	/* Only copy the memory from forward we actually need. */
 867	map->reverse = kmemdup_array(map->forward, map->nr_extents,
 868				     sizeof(struct uid_gid_extent), GFP_KERNEL);
 869	if (!map->reverse)
 870		return -ENOMEM;
 871
 872	/* Sort reverse array. */
 873	sort(map->reverse, map->nr_extents, sizeof(struct uid_gid_extent),
 874	     cmp_extents_reverse, NULL);
 875
 876	return 0;
 877}
 878
 879/**
 880 * verify_root_map() - check the uid 0 mapping
 881 * @file: idmapping file
 882 * @map_ns: user namespace of the target process
 883 * @new_map: requested idmap
 884 *
 885 * If a process requests mapping parent uid 0 into the new ns, verify that the
 886 * process writing the map had the CAP_SETFCAP capability as the target process
 887 * will be able to write fscaps that are valid in ancestor user namespaces.
 888 *
 889 * Return: true if the mapping is allowed, false if not.
 890 */
 891static bool verify_root_map(const struct file *file,
 892			    struct user_namespace *map_ns,
 893			    struct uid_gid_map *new_map)
 894{
 895	int idx;
 896	const struct user_namespace *file_ns = file->f_cred->user_ns;
 897	struct uid_gid_extent *extent0 = NULL;
 898
 899	for (idx = 0; idx < new_map->nr_extents; idx++) {
 900		if (new_map->nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS)
 901			extent0 = &new_map->extent[idx];
 902		else
 903			extent0 = &new_map->forward[idx];
 904		if (extent0->lower_first == 0)
 905			break;
 906
 907		extent0 = NULL;
 908	}
 909
 910	if (!extent0)
 911		return true;
 912
 913	if (map_ns == file_ns) {
 914		/* The process unshared its ns and is writing to its own
 915		 * /proc/self/uid_map.  User already has full capabilites in
 916		 * the new namespace.  Verify that the parent had CAP_SETFCAP
 917		 * when it unshared.
 918		 * */
 919		if (!file_ns->parent_could_setfcap)
 920			return false;
 921	} else {
 922		/* Process p1 is writing to uid_map of p2, who is in a child
 923		 * user namespace to p1's.  Verify that the opener of the map
 924		 * file has CAP_SETFCAP against the parent of the new map
 925		 * namespace */
 926		if (!file_ns_capable(file, map_ns->parent, CAP_SETFCAP))
 927			return false;
 928	}
 929
 930	return true;
 931}
 932
 933static ssize_t map_write(struct file *file, const char __user *buf,
 934			 size_t count, loff_t *ppos,
 935			 int cap_setid,
 936			 struct uid_gid_map *map,
 937			 struct uid_gid_map *parent_map)
 938{
 939	struct seq_file *seq = file->private_data;
 940	struct user_namespace *map_ns = seq->private;
 941	struct uid_gid_map new_map;
 942	unsigned idx;
 943	struct uid_gid_extent extent;
 944	char *kbuf, *pos, *next_line;
 945	ssize_t ret;
 946
 947	/* Only allow < page size writes at the beginning of the file */
 948	if ((*ppos != 0) || (count >= PAGE_SIZE))
 949		return -EINVAL;
 950
 951	/* Slurp in the user data */
 952	kbuf = memdup_user_nul(buf, count);
 953	if (IS_ERR(kbuf))
 954		return PTR_ERR(kbuf);
 955
 956	/*
 957	 * The userns_state_mutex serializes all writes to any given map.
 958	 *
 959	 * Any map is only ever written once.
 960	 *
 961	 * An id map fits within 1 cache line on most architectures.
 962	 *
 963	 * On read nothing needs to be done unless you are on an
 964	 * architecture with a crazy cache coherency model like alpha.
 965	 *
 966	 * There is a one time data dependency between reading the
 967	 * count of the extents and the values of the extents.  The
 968	 * desired behavior is to see the values of the extents that
 969	 * were written before the count of the extents.
 970	 *
 971	 * To achieve this smp_wmb() is used on guarantee the write
 972	 * order and smp_rmb() is guaranteed that we don't have crazy
 973	 * architectures returning stale data.
 974	 */
 975	mutex_lock(&userns_state_mutex);
 976
 977	memset(&new_map, 0, sizeof(struct uid_gid_map));
 978
 979	ret = -EPERM;
 980	/* Only allow one successful write to the map */
 981	if (map->nr_extents != 0)
 982		goto out;
 983
 984	/*
 985	 * Adjusting namespace settings requires capabilities on the target.
 986	 */
 987	if (cap_valid(cap_setid) && !file_ns_capable(file, map_ns, CAP_SYS_ADMIN))
 988		goto out;
 989
 990	/* Parse the user data */
 991	ret = -EINVAL;
 992	pos = kbuf;
 993	for (; pos; pos = next_line) {
 994
 995		/* Find the end of line and ensure I don't look past it */
 996		next_line = strchr(pos, '\n');
 997		if (next_line) {
 998			*next_line = '\0';
 999			next_line++;
1000			if (*next_line == '\0')
1001				next_line = NULL;
1002		}
1003
1004		pos = skip_spaces(pos);
1005		extent.first = simple_strtoul(pos, &pos, 10);
1006		if (!isspace(*pos))
1007			goto out;
1008
1009		pos = skip_spaces(pos);
1010		extent.lower_first = simple_strtoul(pos, &pos, 10);
1011		if (!isspace(*pos))
1012			goto out;
1013
1014		pos = skip_spaces(pos);
1015		extent.count = simple_strtoul(pos, &pos, 10);
1016		if (*pos && !isspace(*pos))
1017			goto out;
1018
1019		/* Verify there is not trailing junk on the line */
1020		pos = skip_spaces(pos);
1021		if (*pos != '\0')
1022			goto out;
1023
1024		/* Verify we have been given valid starting values */
1025		if ((extent.first == (u32) -1) ||
1026		    (extent.lower_first == (u32) -1))
1027			goto out;
1028
1029		/* Verify count is not zero and does not cause the
1030		 * extent to wrap
1031		 */
1032		if ((extent.first + extent.count) <= extent.first)
1033			goto out;
1034		if ((extent.lower_first + extent.count) <=
1035		     extent.lower_first)
1036			goto out;
1037
1038		/* Do the ranges in extent overlap any previous extents? */
1039		if (mappings_overlap(&new_map, &extent))
1040			goto out;
1041
1042		if ((new_map.nr_extents + 1) == UID_GID_MAP_MAX_EXTENTS &&
1043		    (next_line != NULL))
1044			goto out;
1045
1046		ret = insert_extent(&new_map, &extent);
1047		if (ret < 0)
1048			goto out;
1049		ret = -EINVAL;
1050	}
1051	/* Be very certain the new map actually exists */
1052	if (new_map.nr_extents == 0)
1053		goto out;
1054
1055	ret = -EPERM;
1056	/* Validate the user is allowed to use user id's mapped to. */
1057	if (!new_idmap_permitted(file, map_ns, cap_setid, &new_map))
1058		goto out;
1059
1060	ret = -EPERM;
1061	/* Map the lower ids from the parent user namespace to the
1062	 * kernel global id space.
1063	 */
1064	for (idx = 0; idx < new_map.nr_extents; idx++) {
1065		struct uid_gid_extent *e;
1066		u32 lower_first;
1067
1068		if (new_map.nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS)
1069			e = &new_map.extent[idx];
1070		else
1071			e = &new_map.forward[idx];
1072
1073		lower_first = map_id_range_down(parent_map,
1074						e->lower_first,
1075						e->count);
1076
1077		/* Fail if we can not map the specified extent to
1078		 * the kernel global id space.
1079		 */
1080		if (lower_first == (u32) -1)
1081			goto out;
1082
1083		e->lower_first = lower_first;
1084	}
1085
1086	/*
1087	 * If we want to use binary search for lookup, this clones the extent
1088	 * array and sorts both copies.
1089	 */
1090	ret = sort_idmaps(&new_map);
1091	if (ret < 0)
1092		goto out;
1093
1094	/* Install the map */
1095	if (new_map.nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS) {
1096		memcpy(map->extent, new_map.extent,
1097		       new_map.nr_extents * sizeof(new_map.extent[0]));
1098	} else {
1099		map->forward = new_map.forward;
1100		map->reverse = new_map.reverse;
1101	}
1102	smp_wmb();
1103	map->nr_extents = new_map.nr_extents;
1104
1105	*ppos = count;
1106	ret = count;
1107out:
1108	if (ret < 0 && new_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) {
1109		kfree(new_map.forward);
1110		kfree(new_map.reverse);
1111		map->forward = NULL;
1112		map->reverse = NULL;
1113		map->nr_extents = 0;
1114	}
1115
1116	mutex_unlock(&userns_state_mutex);
1117	kfree(kbuf);
1118	return ret;
1119}
1120
1121ssize_t proc_uid_map_write(struct file *file, const char __user *buf,
1122			   size_t size, loff_t *ppos)
1123{
1124	struct seq_file *seq = file->private_data;
1125	struct user_namespace *ns = seq->private;
1126	struct user_namespace *seq_ns = seq_user_ns(seq);
1127
1128	if (!ns->parent)
1129		return -EPERM;
1130
1131	if ((seq_ns != ns) && (seq_ns != ns->parent))
1132		return -EPERM;
1133
1134	return map_write(file, buf, size, ppos, CAP_SETUID,
1135			 &ns->uid_map, &ns->parent->uid_map);
1136}
1137
1138ssize_t proc_gid_map_write(struct file *file, const char __user *buf,
1139			   size_t size, loff_t *ppos)
1140{
1141	struct seq_file *seq = file->private_data;
1142	struct user_namespace *ns = seq->private;
1143	struct user_namespace *seq_ns = seq_user_ns(seq);
1144
1145	if (!ns->parent)
1146		return -EPERM;
1147
1148	if ((seq_ns != ns) && (seq_ns != ns->parent))
1149		return -EPERM;
1150
1151	return map_write(file, buf, size, ppos, CAP_SETGID,
1152			 &ns->gid_map, &ns->parent->gid_map);
1153}
1154
1155ssize_t proc_projid_map_write(struct file *file, const char __user *buf,
1156			      size_t size, loff_t *ppos)
1157{
1158	struct seq_file *seq = file->private_data;
1159	struct user_namespace *ns = seq->private;
1160	struct user_namespace *seq_ns = seq_user_ns(seq);
1161
1162	if (!ns->parent)
1163		return -EPERM;
1164
1165	if ((seq_ns != ns) && (seq_ns != ns->parent))
1166		return -EPERM;
1167
1168	/* Anyone can set any valid project id no capability needed */
1169	return map_write(file, buf, size, ppos, -1,
1170			 &ns->projid_map, &ns->parent->projid_map);
1171}
1172
1173static bool new_idmap_permitted(const struct file *file,
1174				struct user_namespace *ns, int cap_setid,
1175				struct uid_gid_map *new_map)
1176{
1177	const struct cred *cred = file->f_cred;
1178
1179	if (cap_setid == CAP_SETUID && !verify_root_map(file, ns, new_map))
1180		return false;
1181
1182	/* Don't allow mappings that would allow anything that wouldn't
1183	 * be allowed without the establishment of unprivileged mappings.
1184	 */
1185	if ((new_map->nr_extents == 1) && (new_map->extent[0].count == 1) &&
1186	    uid_eq(ns->owner, cred->euid)) {
1187		u32 id = new_map->extent[0].lower_first;
1188		if (cap_setid == CAP_SETUID) {
1189			kuid_t uid = make_kuid(ns->parent, id);
1190			if (uid_eq(uid, cred->euid))
1191				return true;
1192		} else if (cap_setid == CAP_SETGID) {
1193			kgid_t gid = make_kgid(ns->parent, id);
1194			if (!(ns->flags & USERNS_SETGROUPS_ALLOWED) &&
1195			    gid_eq(gid, cred->egid))
1196				return true;
1197		}
1198	}
1199
1200	/* Allow anyone to set a mapping that doesn't require privilege */
1201	if (!cap_valid(cap_setid))
1202		return true;
1203
1204	/* Allow the specified ids if we have the appropriate capability
1205	 * (CAP_SETUID or CAP_SETGID) over the parent user namespace.
1206	 * And the opener of the id file also has the appropriate capability.
1207	 */
1208	if (ns_capable(ns->parent, cap_setid) &&
1209	    file_ns_capable(file, ns->parent, cap_setid))
1210		return true;
1211
1212	return false;
1213}
1214
1215int proc_setgroups_show(struct seq_file *seq, void *v)
1216{
1217	struct user_namespace *ns = seq->private;
1218	unsigned long userns_flags = READ_ONCE(ns->flags);
1219
1220	seq_printf(seq, "%s\n",
1221		   (userns_flags & USERNS_SETGROUPS_ALLOWED) ?
1222		   "allow" : "deny");
1223	return 0;
1224}
1225
1226ssize_t proc_setgroups_write(struct file *file, const char __user *buf,
1227			     size_t count, loff_t *ppos)
1228{
1229	struct seq_file *seq = file->private_data;
1230	struct user_namespace *ns = seq->private;
1231	char kbuf[8], *pos;
1232	bool setgroups_allowed;
1233	ssize_t ret;
1234
1235	/* Only allow a very narrow range of strings to be written */
1236	ret = -EINVAL;
1237	if ((*ppos != 0) || (count >= sizeof(kbuf)))
1238		goto out;
1239
1240	/* What was written? */
1241	ret = -EFAULT;
1242	if (copy_from_user(kbuf, buf, count))
1243		goto out;
1244	kbuf[count] = '\0';
1245	pos = kbuf;
1246
1247	/* What is being requested? */
1248	ret = -EINVAL;
1249	if (strncmp(pos, "allow", 5) == 0) {
1250		pos += 5;
1251		setgroups_allowed = true;
1252	}
1253	else if (strncmp(pos, "deny", 4) == 0) {
1254		pos += 4;
1255		setgroups_allowed = false;
1256	}
1257	else
1258		goto out;
1259
1260	/* Verify there is not trailing junk on the line */
1261	pos = skip_spaces(pos);
1262	if (*pos != '\0')
1263		goto out;
1264
1265	ret = -EPERM;
1266	mutex_lock(&userns_state_mutex);
1267	if (setgroups_allowed) {
1268		/* Enabling setgroups after setgroups has been disabled
1269		 * is not allowed.
1270		 */
1271		if (!(ns->flags & USERNS_SETGROUPS_ALLOWED))
1272			goto out_unlock;
1273	} else {
1274		/* Permanently disabling setgroups after setgroups has
1275		 * been enabled by writing the gid_map is not allowed.
1276		 */
1277		if (ns->gid_map.nr_extents != 0)
1278			goto out_unlock;
1279		ns->flags &= ~USERNS_SETGROUPS_ALLOWED;
1280	}
1281	mutex_unlock(&userns_state_mutex);
1282
1283	/* Report a successful write */
1284	*ppos = count;
1285	ret = count;
1286out:
1287	return ret;
1288out_unlock:
1289	mutex_unlock(&userns_state_mutex);
1290	goto out;
1291}
1292
1293bool userns_may_setgroups(const struct user_namespace *ns)
1294{
1295	bool allowed;
1296
1297	mutex_lock(&userns_state_mutex);
1298	/* It is not safe to use setgroups until a gid mapping in
1299	 * the user namespace has been established.
1300	 */
1301	allowed = ns->gid_map.nr_extents != 0;
1302	/* Is setgroups allowed? */
1303	allowed = allowed && (ns->flags & USERNS_SETGROUPS_ALLOWED);
1304	mutex_unlock(&userns_state_mutex);
1305
1306	return allowed;
1307}
1308
1309/*
1310 * Returns true if @child is the same namespace or a descendant of
1311 * @ancestor.
1312 */
1313bool in_userns(const struct user_namespace *ancestor,
1314	       const struct user_namespace *child)
1315{
1316	const struct user_namespace *ns;
1317	for (ns = child; ns->level > ancestor->level; ns = ns->parent)
1318		;
1319	return (ns == ancestor);
1320}
1321
1322bool current_in_userns(const struct user_namespace *target_ns)
1323{
1324	return in_userns(target_ns, current_user_ns());
1325}
1326EXPORT_SYMBOL(current_in_userns);
1327
1328static struct ns_common *userns_get(struct task_struct *task)
1329{
1330	struct user_namespace *user_ns;
1331
1332	rcu_read_lock();
1333	user_ns = get_user_ns(__task_cred(task)->user_ns);
1334	rcu_read_unlock();
1335
1336	return user_ns ? &user_ns->ns : NULL;
1337}
1338
1339static void userns_put(struct ns_common *ns)
1340{
1341	put_user_ns(to_user_ns(ns));
1342}
1343
1344static int userns_install(struct nsset *nsset, struct ns_common *ns)
1345{
1346	struct user_namespace *user_ns = to_user_ns(ns);
1347	struct cred *cred;
1348
1349	/* Don't allow gaining capabilities by reentering
1350	 * the same user namespace.
1351	 */
1352	if (user_ns == current_user_ns())
1353		return -EINVAL;
1354
1355	/* Tasks that share a thread group must share a user namespace */
1356	if (!thread_group_empty(current))
1357		return -EINVAL;
1358
1359	if (current->fs->users != 1)
1360		return -EINVAL;
1361
1362	if (!ns_capable(user_ns, CAP_SYS_ADMIN))
1363		return -EPERM;
1364
1365	cred = nsset_cred(nsset);
1366	if (!cred)
1367		return -EINVAL;
1368
1369	put_user_ns(cred->user_ns);
1370	set_cred_user_ns(cred, get_user_ns(user_ns));
1371
1372	if (set_cred_ucounts(cred) < 0)
1373		return -EINVAL;
1374
1375	return 0;
1376}
1377
1378struct ns_common *ns_get_owner(struct ns_common *ns)
1379{
1380	struct user_namespace *my_user_ns = current_user_ns();
1381	struct user_namespace *owner, *p;
1382
1383	/* See if the owner is in the current user namespace */
1384	owner = p = ns->ops->owner(ns);
1385	for (;;) {
1386		if (!p)
1387			return ERR_PTR(-EPERM);
1388		if (p == my_user_ns)
1389			break;
1390		p = p->parent;
1391	}
1392
1393	return &get_user_ns(owner)->ns;
1394}
1395
1396static struct user_namespace *userns_owner(struct ns_common *ns)
1397{
1398	return to_user_ns(ns)->parent;
1399}
1400
1401const struct proc_ns_operations userns_operations = {
1402	.name		= "user",
1403	.get		= userns_get,
1404	.put		= userns_put,
1405	.install	= userns_install,
1406	.owner		= userns_owner,
1407	.get_parent	= ns_get_owner,
1408};
1409
1410static __init int user_namespaces_init(void)
1411{
1412	user_ns_cachep = KMEM_CACHE(user_namespace, SLAB_PANIC | SLAB_ACCOUNT);
1413	ns_tree_add(&init_user_ns);
1414	return 0;
1415}
1416subsys_initcall(user_namespaces_init);