LXR linux/include/linux/user

   1/* SPDX-License-Identifier: GPL-2.0 */
   2#ifndef _LINUX_USER_NAMESPACE_H
   3#define _LINUX_USER_NAMESPACE_H
   4
   5#include <linux/kref.h>
   6#include <linux/nsproxy.h>
   7#include <linux/ns_common.h>
   8#include <linux/sched.h>
   9#include <linux/workqueue.h>
  10#include <linux/rwsem.h>
  11#include <linux/sysctl.h>
  12#include <linux/err.h>
  13
  14#define UID_GID_MAP_MAX_BASE_EXTENTS 5
  15#define UID_GID_MAP_MAX_EXTENTS 340
  16
  17struct uid_gid_extent {
  18        u32 first;
  19        u32 lower_first;
  20        u32 count;
  21};
  22
  23struct uid_gid_map { /* 64 bytes -- 1 cache line */
  24        u32 nr_extents;
  25        union {
  26                struct uid_gid_extent extent[UID_GID_MAP_MAX_BASE_EXTENTS];
  27                struct {
  28                        struct uid_gid_extent *forward;
  29                        struct uid_gid_extent *reverse;
  30                };
  31        };
  32};
  33
  34#define USERNS_SETGROUPS_ALLOWED 1UL
  35
  36#define USERNS_INIT_FLAGS USERNS_SETGROUPS_ALLOWED
  37
  38struct ucounts;
  39
  40enum ucount_type {
  41        UCOUNT_USER_NAMESPACES,
  42        UCOUNT_PID_NAMESPACES,
  43        UCOUNT_UTS_NAMESPACES,
  44        UCOUNT_IPC_NAMESPACES,
  45        UCOUNT_NET_NAMESPACES,
  46        UCOUNT_MNT_NAMESPACES,
  47        UCOUNT_CGROUP_NAMESPACES,
  48        UCOUNT_TIME_NAMESPACES,
  49#ifdef CONFIG_INOTIFY_USER
  50        UCOUNT_INOTIFY_INSTANCES,
  51        UCOUNT_INOTIFY_WATCHES,
  52#endif
  53#ifdef CONFIG_FANOTIFY
  54        UCOUNT_FANOTIFY_GROUPS,
  55        UCOUNT_FANOTIFY_MARKS,
  56#endif
  57        UCOUNT_COUNTS,
  58};
  59
  60struct user_namespace {
  61        struct uid_gid_map      uid_map;
  62        struct uid_gid_map      gid_map;
  63        struct uid_gid_map      projid_map;
  64        struct user_namespace   *parent;
  65        int                     level;
  66        kuid_t                  owner;
  67        kgid_t                  group;
  68        struct ns_common        ns;
  69        unsigned long           flags;
  70        /* parent_could_setfcap: true if the creator if this ns had CAP_SETFCAP
  71         * in its effective capability set at the child ns creation time. */
  72        bool                    parent_could_setfcap;
  73
  74#ifdef CONFIG_KEYS
  75        /* List of joinable keyrings in this namespace.  Modification access of
  76         * these pointers is controlled by keyring_sem.  Once
  77         * user_keyring_register is set, it won't be changed, so it can be
  78         * accessed directly with READ_ONCE().
  79         */
  80        struct list_head        keyring_name_list;
  81        struct key              *user_keyring_register;
  82        struct rw_semaphore     keyring_sem;
  83#endif
  84
  85        /* Register of per-UID persistent keyrings for this namespace */
  86#ifdef CONFIG_PERSISTENT_KEYRINGS
  87        struct key              *persistent_keyring_register;
  88#endif
  89        struct work_struct      work;
  90#ifdef CONFIG_SYSCTL
  91        struct ctl_table_set    set;
  92        struct ctl_table_header *sysctls;
  93#endif
  94        struct ucounts          *ucounts;
  95        int ucount_max[UCOUNT_COUNTS];
  96} __randomize_layout;
  97
  98struct ucounts {
  99        struct hlist_node node;
 100        struct user_namespace *ns;
 101        kuid_t uid;
 102        int count;
 103        atomic_t ucount[UCOUNT_COUNTS];
 104};
 105
 106extern struct user_namespace init_user_ns;
 107
 108bool setup_userns_sysctls(struct user_namespace *ns);
 109void retire_userns_sysctls(struct user_namespace *ns);
 110struct ucounts *inc_ucount(struct user_namespace *ns, kuid_t uid, enum ucount_type type);
 111void dec_ucount(struct ucounts *ucounts, enum ucount_type type);
 112
 113#ifdef CONFIG_USER_NS
 114
 115static inline struct user_namespace *get_user_ns(struct user_namespace *ns)
 116{
 117        if (ns)
 118                refcount_inc(&ns->ns.count);
 119        return ns;
 120}
 121
 122extern int create_user_ns(struct cred *new);
 123extern int unshare_userns(unsigned long unshare_flags, struct cred **new_cred);
 124extern void __put_user_ns(struct user_namespace *ns);
 125
 126static inline void put_user_ns(struct user_namespace *ns)
 127{
 128        if (ns && refcount_dec_and_test(&ns->ns.count))
 129                __put_user_ns(ns);
 130}
 131
 132struct seq_operations;
 133extern const struct seq_operations proc_uid_seq_operations;
 134extern const struct seq_operations proc_gid_seq_operations;
 135extern const struct seq_operations proc_projid_seq_operations;
 136extern ssize_t proc_uid_map_write(struct file *, const char __user *, size_t, loff_t *);
 137extern ssize_t proc_gid_map_write(struct file *, const char __user *, size_t, loff_t *);
 138extern ssize_t proc_projid_map_write(struct file *, const char __user *, size_t, loff_t *);
 139extern ssize_t proc_setgroups_write(struct file *, const char __user *, size_t, loff_t *);
 140extern int proc_setgroups_show(struct seq_file *m, void *v);
 141extern bool userns_may_setgroups(const struct user_namespace *ns);
 142extern bool in_userns(const struct user_namespace *ancestor,
 143                       const struct user_namespace *child);
 144extern bool current_in_userns(const struct user_namespace *target_ns);
 145struct ns_common *ns_get_owner(struct ns_common *ns);
 146#else
 147
 148static inline struct user_namespace *get_user_ns(struct user_namespace *ns)
 149{
 150        return &init_user_ns;
 151}
 152
 153static inline int create_user_ns(struct cred *new)
 154{
 155        return -EINVAL;
 156}
 157
 158static inline int unshare_userns(unsigned long unshare_flags,
 159                                 struct cred **new_cred)
 160{
 161        if (unshare_flags & CLONE_NEWUSER)
 162                return -EINVAL;
 163        return 0;
 164}
 165
 166static inline void put_user_ns(struct user_namespace *ns)
 167{
 168}
 169
 170static inline bool userns_may_setgroups(const struct user_namespace *ns)
 171{
 172        return true;
 173}
 174
 175static inline bool in_userns(const struct user_namespace *ancestor,
 176                             const struct user_namespace *child)
 177{
 178        return true;
 179}
 180
 181static inline bool current_in_userns(const struct user_namespace *target_ns)
 182{
 183        return true;
 184}
 185
 186static inline struct ns_common *ns_get_owner(struct ns_common *ns)
 187{
 188        return ERR_PTR(-EPERM);
 189}
 190#endif
 191
 192#endif /* _LINUX_USER_H */
 193