Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965114AbcLWJzB (ORCPT ); Fri, 23 Dec 2016 04:55:01 -0500 Received: from mail-wm0-f68.google.com ([74.125.82.68]:36553 "EHLO mail-wm0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S941300AbcLWJy5 (ORCPT ); Fri, 23 Dec 2016 04:54:57 -0500 Subject: [PATCH v2 2/2] nsfs: Add an ioctl() to return owner UID of a userns To: "Eric W. Biederman" References: <11b302a2-aac3-5994-a12d-e93ce64f7819@gmail.com> Cc: mtk.manpages@gmail.com, "Serge E. Hallyn" , linux-api@vger.kernel.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, Andrey Vagin , James Bottomley , "W. Trevor King" , Alexander Viro From: "Michael Kerrisk (man-pages)" Message-ID: <44599777-c346-3b24-0181-6d86b20ab201@gmail.com> Date: Fri, 23 Dec 2016 10:54:53 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: <11b302a2-aac3-5994-a12d-e93ce64f7819@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2928 Lines: 85 I'd like to write code that discovers the user namespace hierarchy on a running system, and also shows who owns the various user namespaces. Currently, there is no way of getting the owner UID of a user namespace. Therefore, this patch adds an NS_GET_CREATOR_UID ioctl() that fetches the (munged) UID of the creator of the user namespace referred to by the specified file descriptor. If the supplied file descriptor does not refer to a user namespace, the operation fails with the error EINVAL. Signed-off-by: Michael Kerrisk --- V2 changes: * Renamed ioctl() from NS_CREATOR_UID to NS_OWNER_UID, at the suggestion of Eric Biederman. * Make ioctl() return UID via buffer pointed to by argp. (Returning the UID via the result value could lead to problems since a large unsigned int UID might be misinterpreted as an error.) Thanks to Andrei Vagin for pointing this out. --- fs/nsfs.c | 11 +++++++++++ include/uapi/linux/nsfs.h | 8 +++++--- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/fs/nsfs.c b/fs/nsfs.c index 9f24b47..9c9277c 100644 --- a/fs/nsfs.c +++ b/fs/nsfs.c @@ -7,6 +7,7 @@ #include #include #include +#include static struct vfsmount *nsfs_mnt; @@ -163,7 +164,10 @@ static int open_related_ns(struct ns_common *ns, static long ns_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg) { + struct user_namespace *user_ns; struct ns_common *ns = get_proc_ns(file_inode(filp)); + unsigned int __user *argp; + unsigned int uid; switch (ioctl) { case NS_GET_USERNS: @@ -174,6 +178,13 @@ static long ns_ioctl(struct file *filp, unsigned int ioctl, return open_related_ns(ns, ns->ops->get_parent); case NS_GET_NSTYPE: return ns->ops->type; + case NS_GET_OWNER_UID: + if (ns->ops->type != CLONE_NEWUSER) + return -EINVAL; + user_ns = container_of(ns, struct user_namespace, ns); + argp = (unsigned int __user *) arg; + uid = from_kuid_munged(current_user_ns(), user_ns->owner); + return put_user(uid, argp); default: return -ENOTTY; } diff --git a/include/uapi/linux/nsfs.h b/include/uapi/linux/nsfs.h index 2b48df1..c4a925e 100644 --- a/include/uapi/linux/nsfs.h +++ b/include/uapi/linux/nsfs.h @@ -6,11 +6,13 @@ #define NSIO 0xb7 /* Returns a file descriptor that refers to an owning user namespace */ -#define NS_GET_USERNS _IO(NSIO, 0x1) +#define NS_GET_USERNS _IO(NSIO, 0x1) /* Returns a file descriptor that refers to a parent namespace */ -#define NS_GET_PARENT _IO(NSIO, 0x2) +#define NS_GET_PARENT _IO(NSIO, 0x2) /* Returns the type of namespace (CLONE_NEW* value) referred to by file descriptor */ -#define NS_GET_NSTYPE _IO(NSIO, 0x3) +#define NS_GET_NSTYPE _IO(NSIO, 0x3) +/* Get owner UID for a user namespace */ +#define NS_GET_OWNER_UID _IO(NSIO, 0x4) #endif /* __LINUX_NSFS_H */ -- 2.5.5