LXR linux/include/linux/user

   1/* SPDX-License-Identifier: GPL-2.0 */
   2#ifndef _LINUX_USER_NAMESPACE_H
   3#define _LINUX_USER_NAMESPACE_H
   4
   5#include <linux/kref.h>
   6#include <linux/nsproxy.h>
   7#include <linux/ns_common.h>
   8#include <linux/sched.h>
   9#include <linux/workqueue.h>
  10#include <linux/rwsem.h>
  11#include <linux/sysctl.h>
  12#include <linux/err.h>
  13
  14#define UID_GID_MAP_MAX_BASE_EXTENTS 5
  15#define UID_GID_MAP_MAX_EXTENTS 340
  16
  17struct uid_gid_extent {
  18        u32 first;
  19        u32 lower_first;
  20        u32 count;
  21};
  22
  23struct uid_gid_map { /* 64 bytes -- 1 cache line */
  24        u32 nr_extents;
  25        union {
  26                struct uid_gid_extent extent[UID_GID_MAP_MAX_BASE_EXTENTS];
  27                struct {
  28                        struct uid_gid_extent *forward;
  29                        struct uid_gid_extent *reverse;
  30                };
  31        };
  32};
  33
  34#define USERNS_SETGROUPS_ALLOWED 1UL
  35
  36#define USERNS_INIT_FLAGS USERNS_SETGROUPS_ALLOWED
  37
  38struct ucounts;
  39
  40enum ucount_type {
  41        UCOUNT_USER_NAMESPACES,
  42        UCOUNT_PID_NAMESPACES,
  43        UCOUNT_UTS_NAMESPACES,
  44        UCOUNT_IPC_NAMESPACES,
  45        UCOUNT_NET_NAMESPACES,
  46        UCOUNT_MNT_NAMESPACES,
  47        UCOUNT_CGROUP_NAMESPACES,
  48#ifdef CONFIG_INOTIFY_USER
  49        UCOUNT_INOTIFY_INSTANCES,
  50        UCOUNT_INOTIFY_WATCHES,
  51#endif
  52        UCOUNT_COUNTS,
  53};
  54
  55struct user_namespace {
  56        struct uid_gid_map      uid_map;
  57        struct uid_gid_map      gid_map;
  58        struct uid_gid_map      projid_map;
  59        atomic_t                count;
  60        struct user_namespace   *parent;
  61        int                     level;
  62        kuid_t                  owner;
  63        kgid_t                  group;
  64        struct ns_common        ns;
  65        unsigned long           flags;
  66
  67        /* Register of per-UID persistent keyrings for this namespace */
  68#ifdef CONFIG_PERSISTENT_KEYRINGS
  69        struct key              *persistent_keyring_register;
  70        struct rw_semaphore     persistent_keyring_register_sem;
  71#endif
  72        struct work_struct      work;
  73#ifdef CONFIG_SYSCTL
  74        struct ctl_table_set    set;
  75        struct ctl_table_header *sysctls;
  76#endif
  77        struct ucounts          *ucounts;
  78        int ucount_max[UCOUNT_COUNTS];
  79} __randomize_layout;
  80
  81struct ucounts {
  82        struct hlist_node node;
  83        struct user_namespace *ns;
  84        kuid_t uid;
  85        int count;
  86        atomic_t ucount[UCOUNT_COUNTS];
  87};
  88
  89extern struct user_namespace init_user_ns;
  90
  91bool setup_userns_sysctls(struct user_namespace *ns);
  92void retire_userns_sysctls(struct user_namespace *ns);
  93struct ucounts *inc_ucount(struct user_namespace *ns, kuid_t uid, enum ucount_type type);
  94void dec_ucount(struct ucounts *ucounts, enum ucount_type type);
  95
  96#ifdef CONFIG_USER_NS
  97
  98static inline struct user_namespace *get_user_ns(struct user_namespace *ns)
  99{
 100        if (ns)
 101                atomic_inc(&ns->count);
 102        return ns;
 103}
 104
 105extern int create_user_ns(struct cred *new);
 106extern int unshare_userns(unsigned long unshare_flags, struct cred **new_cred);
 107extern void __put_user_ns(struct user_namespace *ns);
 108
 109static inline void put_user_ns(struct user_namespace *ns)
 110{
 111        if (ns && atomic_dec_and_test(&ns->count))
 112                __put_user_ns(ns);
 113}
 114
 115struct seq_operations;
 116extern const struct seq_operations proc_uid_seq_operations;
 117extern const struct seq_operations proc_gid_seq_operations;
 118extern const struct seq_operations proc_projid_seq_operations;
 119extern ssize_t proc_uid_map_write(struct file *, const char __user *, size_t, loff_t *);
 120extern ssize_t proc_gid_map_write(struct file *, const char __user *, size_t, loff_t *);
 121extern ssize_t proc_projid_map_write(struct file *, const char __user *, size_t, loff_t *);
 122extern ssize_t proc_setgroups_write(struct file *, const char __user *, size_t, loff_t *);
 123extern int proc_setgroups_show(struct seq_file *m, void *v);
 124extern bool userns_may_setgroups(const struct user_namespace *ns);
 125extern bool in_userns(const struct user_namespace *ancestor,
 126                       const struct user_namespace *child);
 127extern bool current_in_userns(const struct user_namespace *target_ns);
 128struct ns_common *ns_get_owner(struct ns_common *ns);
 129#else
 130
 131static inline struct user_namespace *get_user_ns(struct user_namespace *ns)
 132{
 133        return &init_user_ns;
 134}
 135
 136static inline int create_user_ns(struct cred *new)
 137{
 138        return -EINVAL;
 139}
 140
 141static inline int unshare_userns(unsigned long unshare_flags,
 142                                 struct cred **new_cred)
 143{
 144        if (unshare_flags & CLONE_NEWUSER)
 145                return -EINVAL;
 146        return 0;
 147}
 148
 149static inline void put_user_ns(struct user_namespace *ns)
 150{
 151}
 152
 153static inline bool userns_may_setgroups(const struct user_namespace *ns)
 154{
 155        return true;
 156}
 157
 158static inline bool in_userns(const struct user_namespace *ancestor,
 159                             const struct user_namespace *child)
 160{
 161        return true;
 162}
 163
 164static inline bool current_in_userns(const struct user_namespace *target_ns)
 165{
 166        return true;
 167}
 168
 169static inline struct ns_common *ns_get_owner(struct ns_common *ns)
 170{
 171        return ERR_PTR(-EPERM);
 172}
 173#endif
 174
 175#endif /* _LINUX_USER_H */
 176