linux-toradex.git/kernel/nsproxy.c, branch v2.6.23.12

mm: Remove slab destructors from kmem_cache_create().

2007-07-20T01:11:58+00:00

Slab destructors were no longer supported after Christoph's
c59def9f222d44bb7e2f0a559f2906191a0862d7 change. They've been
BUGs for both slab and slub, and slob never supported them
either.

This rips out support for the dtor pointer from kmem_cache_create()
completely and fixes up every single callsite in the kernel (there were
about 224, not including the slab allocator definitions themselves,
or the documentation references).

Signed-off-by: Paul Mundt

namespace: ensure clone_flags are always stored in an unsigned long

2007-07-16T16:05:48+00:00

While working on unshare support for the network namespace I noticed we
were putting clone flags in an int.  Which is weird because the syscall
uses unsigned long and we at least need an unsigned to properly hold all of
the unshare flags.

So to make the code consistent, this patch updates the code to use
unsigned long instead of int for the clone flags in those places
where we get it wrong today.

Signed-off-by: Eric W. Biederman 
Acked-by: Cedric Le Goater 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

add a kmem_cache for nsproxy objects

2007-07-16T16:05:47+00:00

It should improve performance in some scenarii where a lot of
these nsproxy objects are created by unsharing namespaces. This is
a typical use of virtual servers that are being created or entered.

This is also a good tool to find leaks and gather statistics on
namespace usage.

Signed-off-by: Cedric Le Goater 
Cc: Herbert Poetzl 
Cc: Pavel Emelianov 
Cc: "Eric W. Biederman" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fix create_new_namespaces() return value

2007-07-16T16:05:47+00:00

dup_mnt_ns() and clone_uts_ns() return NULL on failure.  This is wrong,
create_new_namespaces() uses ERR_PTR() to catch an error.  This means that the
subsequent create_new_namespaces() will hit BUG_ON() in copy_mnt_ns() or
copy_utsname().

Modify create_new_namespaces() to also use the errors returned by the
copy_*_ns routines and not to systematically return ENOMEM.

[oleg@tv-sign.ru: better changelog]
Signed-off-by: Cedric Le Goater 
Cc: Serge E. Hallyn 
Cc: Badari Pulavarty 
Cc: Pavel Emelianov 
Cc: Herbert Poetzl 
Cc: Eric W. Biederman 
Cc: Oleg Nesterov 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

user namespace: add unshare

2007-07-16T16:05:47+00:00

This patch enables the unshare of user namespaces.

It adds a new clone flag CLONE_NEWUSER and implements copy_user_ns() which
resets the current user_struct and adds a new root user (uid == 0)

For now, unsharing the user namespace allows a process to reset its
user_struct accounting and uid 0 in the new user namespace should be contained
using appropriate means, for instance selinux

The plan, when the full support is complete (all uid checks covered), is to
keep the original user's rights in the original namespace, and let a process
become uid 0 in the new namespace, with full capabilities to the new
namespace.

Signed-off-by: Serge E. Hallyn 
Signed-off-by: Cedric Le Goater 
Acked-by: Pavel Emelianov 
Cc: Herbert Poetzl 
Cc: Kirill Korotaev 
Cc: Eric W. Biederman 
Cc: Chris Wright 
Cc: Stephen Smalley 
Cc: James Morris 
Cc: Andrew Morgan 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

user namespace: add the framework

2007-07-16T16:05:47+00:00

Basically, it will allow a process to unshare its user_struct table,
resetting at the same time its own user_struct and all the associated
accounting.

A new root user (uid == 0) is added to the user namespace upon creation.
Such root users have full privileges and it seems that theses privileges
should be controlled through some means (process capabilities ?)

The unshare is not included in this patch.

Changes since [try #4]:
	- Updated get_user_ns and put_user_ns to accept NULL, and
	  get_user_ns to return the namespace.

Changes since [try #3]:
	- moved struct user_namespace to files user_namespace.{c,h}

Changes since [try #2]:
	- removed struct user_namespace* argument from find_user()

Changes since [try #1]:
	- removed struct user_namespace* argument from find_user()
	- added a root_user per user namespace

Signed-off-by: Cedric Le Goater 
Signed-off-by: Serge E. Hallyn 
Acked-by: Pavel Emelianov 
Cc: Herbert Poetzl 
Cc: Kirill Korotaev 
Cc: Eric W. Biederman 
Cc: Chris Wright 
Cc: Stephen Smalley 
Cc: James Morris 
Cc: Andrew Morgan 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

remove CONFIG_UTS_NS and CONFIG_IPC_NS

2007-07-16T16:05:47+00:00

CONFIG_UTS_NS and CONFIG_IPC_NS have very little value as they only
deactivate the unshare of the uts and ipc namespaces and do not improve
performance.

Signed-off-by: Cedric Le Goater 
Acked-by: "Serge E. Hallyn" 
Cc: Eric W. Biederman 
Cc: Herbert Poetzl 
Cc: Pavel Emelianov 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fix refcounting of nsproxy object when unshared

2007-06-24T15:59:10+00:00

When a namespace is unshared, a refcount on the previous nsproxy is
abusively taken, leading to a memory leak of nsproxy objects.

Signed-off-by: Cedric Le Goater 
Cc: Badari Pulavarty 
Cc: Herbert Poetzl 
Cc: Oleg Nesterov 
Cc: "Eric W. Biederman" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Merge sys_clone()/sys_unshare() nsproxy and namespace handling

2007-05-08T18:15:00+00:00

sys_clone() and sys_unshare() both makes copies of nsproxy and its associated
namespaces.  But they have different code paths.

This patch merges all the nsproxy and its associated namespace copy/clone
handling (as much as possible).  Posted on container list earlier for
feedback.

- Create a new nsproxy and its associated namespaces and pass it back to
  caller to attach it to right process.

- Changed all copy_*_ns() routines to return a new copy of namespace
  instead of attaching it to task->nsproxy.

- Moved the CAP_SYS_ADMIN checks out of copy_*_ns() routines.

- Removed unnessary !ns checks from copy_*_ns() and added BUG_ON()
  just incase.

- Get rid of all individual unshare_*_ns() routines and make use of
  copy_*_ns() instead.

[akpm@osdl.org: cleanups, warning fix]
[clg@fr.ibm.com: remove dup_namespaces() declaration]
[serue@us.ibm.com: fix CONFIG_IPC_NS=n, clone(CLONE_NEWIPC) retval]
[akpm@linux-foundation.org: fix build with CONFIG_SYSVIPC=n]
Signed-off-by: Badari Pulavarty 
Signed-off-by: Serge Hallyn 
Cc: Cedric Le Goater 
Cc: "Eric W. Biederman" 
Cc: 
Signed-off-by: Cedric Le Goater 
Cc: Oleg Nesterov 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Revert "[PATCH] namespaces: fix exit race by splitting exit"

2007-01-30T21:35:18+00:00

This reverts commit 7a238fcba0629b6f2edbcd37458bae56fcf36be5 in
preparation for a better and simpler fix proposed by Eric Biederman
(and fixed up by Serge Hallyn)

Acked-by: Serge E. Hallyn 
Signed-off-by: Linus Torvalds