2 * This program is free software; you can redistribute it and/or
3 * modify it under the terms of the GNU General Public License as
4 * published by the Free Software Foundation, version 2 of the
8 #include <linux/export.h>
9 #include <linux/nsproxy.h>
10 #include <linux/slab.h>
11 #include <linux/user_namespace.h>
12 #include <linux/proc_fs.h>
13 #include <linux/highuid.h>
14 #include <linux/cred.h>
15 #include <linux/securebits.h>
16 #include <linux/keyctl.h>
17 #include <linux/key-type.h>
18 #include <keys/user-type.h>
19 #include <linux/seq_file.h>
21 #include <linux/uaccess.h>
22 #include <linux/ctype.h>
23 #include <linux/projid.h>
24 #include <linux/fs_struct.h>
26 static struct kmem_cache *user_ns_cachep __read_mostly;
28 static bool new_idmap_permitted(struct user_namespace *ns, int cap_setid,
29 struct uid_gid_map *map);
31 static void set_cred_user_ns(struct cred *cred, struct user_namespace *user_ns)
33 /* Start with the same capabilities as init but useless for doing
34 * anything as the capabilities are bound to the new user namespace.
36 cred->securebits = SECUREBITS_DEFAULT;
37 cred->cap_inheritable = CAP_EMPTY_SET;
38 cred->cap_permitted = CAP_FULL_SET;
39 cred->cap_effective = CAP_FULL_SET;
40 cred->cap_bset = CAP_FULL_SET;
42 key_put(cred->request_key_auth);
43 cred->request_key_auth = NULL;
45 /* tgcred will be cleared in our caller bc CLONE_THREAD won't be set */
46 cred->user_ns = user_ns;
50 * Create a new user namespace, deriving the creator from the user in the
51 * passed credentials, and replacing that user with the new root user for the
54 * This is called by copy_creds(), which will finish setting the target task's
57 int create_user_ns(struct cred *new)
59 struct user_namespace *ns, *parent_ns = new->user_ns;
60 kuid_t owner = new->euid;
61 kgid_t group = new->egid;
65 * Verify that we can not violate the policy of which files
66 * may be accessed that is specified by the root directory,
67 * by verifing that the root directory is at the root of the
68 * mount namespace which allows all files to be accessed.
70 if (current_chrooted())
73 /* The creator needs a mapping in the parent user namespace
74 * or else we won't be able to reasonably tell userspace who
75 * created a user_namespace.
77 if (!kuid_has_mapping(parent_ns, owner) ||
78 !kgid_has_mapping(parent_ns, group))
81 ns = kmem_cache_zalloc(user_ns_cachep, GFP_KERNEL);
85 ret = proc_alloc_inum(&ns->proc_inum);
87 kmem_cache_free(user_ns_cachep, ns);
91 atomic_set(&ns->count, 1);
92 /* Leave the new->user_ns reference with the new user namespace. */
93 ns->parent = parent_ns;
97 set_cred_user_ns(new, ns);
102 int unshare_userns(unsigned long unshare_flags, struct cred **new_cred)
106 if (!(unshare_flags & CLONE_NEWUSER))
109 cred = prepare_creds();
114 return create_user_ns(cred);
117 void free_user_ns(struct user_namespace *ns)
119 struct user_namespace *parent;
123 proc_free_inum(ns->proc_inum);
124 kmem_cache_free(user_ns_cachep, ns);
126 } while (atomic_dec_and_test(&parent->count));
128 EXPORT_SYMBOL(free_user_ns);
130 static u32 map_id_range_down(struct uid_gid_map *map, u32 id, u32 count)
132 unsigned idx, extents;
133 u32 first, last, id2;
135 id2 = id + count - 1;
137 /* Find the matching extent */
138 extents = map->nr_extents;
139 smp_read_barrier_depends();
140 for (idx = 0; idx < extents; idx++) {
141 first = map->extent[idx].first;
142 last = first + map->extent[idx].count - 1;
143 if (id >= first && id <= last &&
144 (id2 >= first && id2 <= last))
147 /* Map the id or note failure */
149 id = (id - first) + map->extent[idx].lower_first;
156 static u32 map_id_down(struct uid_gid_map *map, u32 id)
158 unsigned idx, extents;
161 /* Find the matching extent */
162 extents = map->nr_extents;
163 smp_read_barrier_depends();
164 for (idx = 0; idx < extents; idx++) {
165 first = map->extent[idx].first;
166 last = first + map->extent[idx].count - 1;
167 if (id >= first && id <= last)
170 /* Map the id or note failure */
172 id = (id - first) + map->extent[idx].lower_first;
179 static u32 map_id_up(struct uid_gid_map *map, u32 id)
181 unsigned idx, extents;
184 /* Find the matching extent */
185 extents = map->nr_extents;
186 smp_read_barrier_depends();
187 for (idx = 0; idx < extents; idx++) {
188 first = map->extent[idx].lower_first;
189 last = first + map->extent[idx].count - 1;
190 if (id >= first && id <= last)
193 /* Map the id or note failure */
195 id = (id - first) + map->extent[idx].first;
203 * make_kuid - Map a user-namespace uid pair into a kuid.
204 * @ns: User namespace that the uid is in
205 * @uid: User identifier
207 * Maps a user-namespace uid pair into a kernel internal kuid,
208 * and returns that kuid.
210 * When there is no mapping defined for the user-namespace uid
211 * pair INVALID_UID is returned. Callers are expected to test
212 * for and handle handle INVALID_UID being returned. INVALID_UID
213 * may be tested for using uid_valid().
215 kuid_t make_kuid(struct user_namespace *ns, uid_t uid)
217 /* Map the uid to a global kernel uid */
218 return KUIDT_INIT(map_id_down(&ns->uid_map, uid));
220 EXPORT_SYMBOL(make_kuid);
223 * from_kuid - Create a uid from a kuid user-namespace pair.
224 * @targ: The user namespace we want a uid in.
225 * @kuid: The kernel internal uid to start with.
227 * Map @kuid into the user-namespace specified by @targ and
228 * return the resulting uid.
230 * There is always a mapping into the initial user_namespace.
232 * If @kuid has no mapping in @targ (uid_t)-1 is returned.
234 uid_t from_kuid(struct user_namespace *targ, kuid_t kuid)
236 /* Map the uid from a global kernel uid */
237 return map_id_up(&targ->uid_map, __kuid_val(kuid));
239 EXPORT_SYMBOL(from_kuid);
242 * from_kuid_munged - Create a uid from a kuid user-namespace pair.
243 * @targ: The user namespace we want a uid in.
244 * @kuid: The kernel internal uid to start with.
246 * Map @kuid into the user-namespace specified by @targ and
247 * return the resulting uid.
249 * There is always a mapping into the initial user_namespace.
251 * Unlike from_kuid from_kuid_munged never fails and always
252 * returns a valid uid. This makes from_kuid_munged appropriate
253 * for use in syscalls like stat and getuid where failing the
254 * system call and failing to provide a valid uid are not an
257 * If @kuid has no mapping in @targ overflowuid is returned.
259 uid_t from_kuid_munged(struct user_namespace *targ, kuid_t kuid)
262 uid = from_kuid(targ, kuid);
264 if (uid == (uid_t) -1)
268 EXPORT_SYMBOL(from_kuid_munged);
271 * make_kgid - Map a user-namespace gid pair into a kgid.
272 * @ns: User namespace that the gid is in
273 * @uid: group identifier
275 * Maps a user-namespace gid pair into a kernel internal kgid,
276 * and returns that kgid.
278 * When there is no mapping defined for the user-namespace gid
279 * pair INVALID_GID is returned. Callers are expected to test
280 * for and handle INVALID_GID being returned. INVALID_GID may be
281 * tested for using gid_valid().
283 kgid_t make_kgid(struct user_namespace *ns, gid_t gid)
285 /* Map the gid to a global kernel gid */
286 return KGIDT_INIT(map_id_down(&ns->gid_map, gid));
288 EXPORT_SYMBOL(make_kgid);
291 * from_kgid - Create a gid from a kgid user-namespace pair.
292 * @targ: The user namespace we want a gid in.
293 * @kgid: The kernel internal gid to start with.
295 * Map @kgid into the user-namespace specified by @targ and
296 * return the resulting gid.
298 * There is always a mapping into the initial user_namespace.
300 * If @kgid has no mapping in @targ (gid_t)-1 is returned.
302 gid_t from_kgid(struct user_namespace *targ, kgid_t kgid)
304 /* Map the gid from a global kernel gid */
305 return map_id_up(&targ->gid_map, __kgid_val(kgid));
307 EXPORT_SYMBOL(from_kgid);
310 * from_kgid_munged - Create a gid from a kgid user-namespace pair.
311 * @targ: The user namespace we want a gid in.
312 * @kgid: The kernel internal gid to start with.
314 * Map @kgid into the user-namespace specified by @targ and
315 * return the resulting gid.
317 * There is always a mapping into the initial user_namespace.
319 * Unlike from_kgid from_kgid_munged never fails and always
320 * returns a valid gid. This makes from_kgid_munged appropriate
321 * for use in syscalls like stat and getgid where failing the
322 * system call and failing to provide a valid gid are not options.
324 * If @kgid has no mapping in @targ overflowgid is returned.
326 gid_t from_kgid_munged(struct user_namespace *targ, kgid_t kgid)
329 gid = from_kgid(targ, kgid);
331 if (gid == (gid_t) -1)
335 EXPORT_SYMBOL(from_kgid_munged);
338 * make_kprojid - Map a user-namespace projid pair into a kprojid.
339 * @ns: User namespace that the projid is in
340 * @projid: Project identifier
342 * Maps a user-namespace uid pair into a kernel internal kuid,
343 * and returns that kuid.
345 * When there is no mapping defined for the user-namespace projid
346 * pair INVALID_PROJID is returned. Callers are expected to test
347 * for and handle handle INVALID_PROJID being returned. INVALID_PROJID
348 * may be tested for using projid_valid().
350 kprojid_t make_kprojid(struct user_namespace *ns, projid_t projid)
352 /* Map the uid to a global kernel uid */
353 return KPROJIDT_INIT(map_id_down(&ns->projid_map, projid));
355 EXPORT_SYMBOL(make_kprojid);
358 * from_kprojid - Create a projid from a kprojid user-namespace pair.
359 * @targ: The user namespace we want a projid in.
360 * @kprojid: The kernel internal project identifier to start with.
362 * Map @kprojid into the user-namespace specified by @targ and
363 * return the resulting projid.
365 * There is always a mapping into the initial user_namespace.
367 * If @kprojid has no mapping in @targ (projid_t)-1 is returned.
369 projid_t from_kprojid(struct user_namespace *targ, kprojid_t kprojid)
371 /* Map the uid from a global kernel uid */
372 return map_id_up(&targ->projid_map, __kprojid_val(kprojid));
374 EXPORT_SYMBOL(from_kprojid);
377 * from_kprojid_munged - Create a projiid from a kprojid user-namespace pair.
378 * @targ: The user namespace we want a projid in.
379 * @kprojid: The kernel internal projid to start with.
381 * Map @kprojid into the user-namespace specified by @targ and
382 * return the resulting projid.
384 * There is always a mapping into the initial user_namespace.
386 * Unlike from_kprojid from_kprojid_munged never fails and always
387 * returns a valid projid. This makes from_kprojid_munged
388 * appropriate for use in syscalls like stat and where
389 * failing the system call and failing to provide a valid projid are
392 * If @kprojid has no mapping in @targ OVERFLOW_PROJID is returned.
394 projid_t from_kprojid_munged(struct user_namespace *targ, kprojid_t kprojid)
397 projid = from_kprojid(targ, kprojid);
399 if (projid == (projid_t) -1)
400 projid = OVERFLOW_PROJID;
403 EXPORT_SYMBOL(from_kprojid_munged);
406 static int uid_m_show(struct seq_file *seq, void *v)
408 struct user_namespace *ns = seq->private;
409 struct uid_gid_extent *extent = v;
410 struct user_namespace *lower_ns;
413 lower_ns = seq_user_ns(seq);
414 if ((lower_ns == ns) && lower_ns->parent)
415 lower_ns = lower_ns->parent;
417 lower = from_kuid(lower_ns, KUIDT_INIT(extent->lower_first));
419 seq_printf(seq, "%10u %10u %10u\n",
427 static int gid_m_show(struct seq_file *seq, void *v)
429 struct user_namespace *ns = seq->private;
430 struct uid_gid_extent *extent = v;
431 struct user_namespace *lower_ns;
434 lower_ns = seq_user_ns(seq);
435 if ((lower_ns == ns) && lower_ns->parent)
436 lower_ns = lower_ns->parent;
438 lower = from_kgid(lower_ns, KGIDT_INIT(extent->lower_first));
440 seq_printf(seq, "%10u %10u %10u\n",
448 static int projid_m_show(struct seq_file *seq, void *v)
450 struct user_namespace *ns = seq->private;
451 struct uid_gid_extent *extent = v;
452 struct user_namespace *lower_ns;
455 lower_ns = seq_user_ns(seq);
456 if ((lower_ns == ns) && lower_ns->parent)
457 lower_ns = lower_ns->parent;
459 lower = from_kprojid(lower_ns, KPROJIDT_INIT(extent->lower_first));
461 seq_printf(seq, "%10u %10u %10u\n",
469 static void *m_start(struct seq_file *seq, loff_t *ppos, struct uid_gid_map *map)
471 struct uid_gid_extent *extent = NULL;
474 if (pos < map->nr_extents)
475 extent = &map->extent[pos];
480 static void *uid_m_start(struct seq_file *seq, loff_t *ppos)
482 struct user_namespace *ns = seq->private;
484 return m_start(seq, ppos, &ns->uid_map);
487 static void *gid_m_start(struct seq_file *seq, loff_t *ppos)
489 struct user_namespace *ns = seq->private;
491 return m_start(seq, ppos, &ns->gid_map);
494 static void *projid_m_start(struct seq_file *seq, loff_t *ppos)
496 struct user_namespace *ns = seq->private;
498 return m_start(seq, ppos, &ns->projid_map);
501 static void *m_next(struct seq_file *seq, void *v, loff_t *pos)
504 return seq->op->start(seq, pos);
507 static void m_stop(struct seq_file *seq, void *v)
512 struct seq_operations proc_uid_seq_operations = {
513 .start = uid_m_start,
519 struct seq_operations proc_gid_seq_operations = {
520 .start = gid_m_start,
526 struct seq_operations proc_projid_seq_operations = {
527 .start = projid_m_start,
530 .show = projid_m_show,
533 static bool mappings_overlap(struct uid_gid_map *new_map, struct uid_gid_extent *extent)
535 u32 upper_first, lower_first, upper_last, lower_last;
538 upper_first = extent->first;
539 lower_first = extent->lower_first;
540 upper_last = upper_first + extent->count - 1;
541 lower_last = lower_first + extent->count - 1;
543 for (idx = 0; idx < new_map->nr_extents; idx++) {
544 u32 prev_upper_first, prev_lower_first;
545 u32 prev_upper_last, prev_lower_last;
546 struct uid_gid_extent *prev;
548 prev = &new_map->extent[idx];
550 prev_upper_first = prev->first;
551 prev_lower_first = prev->lower_first;
552 prev_upper_last = prev_upper_first + prev->count - 1;
553 prev_lower_last = prev_lower_first + prev->count - 1;
555 /* Does the upper range intersect a previous extent? */
556 if ((prev_upper_first <= upper_last) &&
557 (prev_upper_last >= upper_first))
560 /* Does the lower range intersect a previous extent? */
561 if ((prev_lower_first <= lower_last) &&
562 (prev_lower_last >= lower_first))
569 static DEFINE_MUTEX(id_map_mutex);
571 static ssize_t map_write(struct file *file, const char __user *buf,
572 size_t count, loff_t *ppos,
574 struct uid_gid_map *map,
575 struct uid_gid_map *parent_map)
577 struct seq_file *seq = file->private_data;
578 struct user_namespace *ns = seq->private;
579 struct uid_gid_map new_map;
581 struct uid_gid_extent *extent = NULL;
582 unsigned long page = 0;
583 char *kbuf, *pos, *next_line;
584 ssize_t ret = -EINVAL;
587 * The id_map_mutex serializes all writes to any given map.
589 * Any map is only ever written once.
591 * An id map fits within 1 cache line on most architectures.
593 * On read nothing needs to be done unless you are on an
594 * architecture with a crazy cache coherency model like alpha.
596 * There is a one time data dependency between reading the
597 * count of the extents and the values of the extents. The
598 * desired behavior is to see the values of the extents that
599 * were written before the count of the extents.
601 * To achieve this smp_wmb() is used on guarantee the write
602 * order and smp_read_barrier_depends() is guaranteed that we
603 * don't have crazy architectures returning stale data.
606 mutex_lock(&id_map_mutex);
609 /* Only allow one successful write to the map */
610 if (map->nr_extents != 0)
613 /* Require the appropriate privilege CAP_SETUID or CAP_SETGID
614 * over the user namespace in order to set the id mapping.
616 if (cap_valid(cap_setid) && !ns_capable(ns, cap_setid))
621 page = __get_free_page(GFP_TEMPORARY);
622 kbuf = (char *) page;
626 /* Only allow <= page size writes at the beginning of the file */
628 if ((*ppos != 0) || (count >= PAGE_SIZE))
631 /* Slurp in the user data */
633 if (copy_from_user(kbuf, buf, count))
637 /* Parse the user data */
640 new_map.nr_extents = 0;
641 for (;pos; pos = next_line) {
642 extent = &new_map.extent[new_map.nr_extents];
644 /* Find the end of line and ensure I don't look past it */
645 next_line = strchr(pos, '\n');
649 if (*next_line == '\0')
653 pos = skip_spaces(pos);
654 extent->first = simple_strtoul(pos, &pos, 10);
658 pos = skip_spaces(pos);
659 extent->lower_first = simple_strtoul(pos, &pos, 10);
663 pos = skip_spaces(pos);
664 extent->count = simple_strtoul(pos, &pos, 10);
665 if (*pos && !isspace(*pos))
668 /* Verify there is not trailing junk on the line */
669 pos = skip_spaces(pos);
673 /* Verify we have been given valid starting values */
674 if ((extent->first == (u32) -1) ||
675 (extent->lower_first == (u32) -1 ))
678 /* Verify count is not zero and does not cause the extent to wrap */
679 if ((extent->first + extent->count) <= extent->first)
681 if ((extent->lower_first + extent->count) <= extent->lower_first)
684 /* Do the ranges in extent overlap any previous extents? */
685 if (mappings_overlap(&new_map, extent))
688 new_map.nr_extents++;
690 /* Fail if the file contains too many extents */
691 if ((new_map.nr_extents == UID_GID_MAP_MAX_EXTENTS) &&
695 /* Be very certaint the new map actually exists */
696 if (new_map.nr_extents == 0)
700 /* Validate the user is allowed to use user id's mapped to. */
701 if (!new_idmap_permitted(ns, cap_setid, &new_map))
704 /* Map the lower ids from the parent user namespace to the
705 * kernel global id space.
707 for (idx = 0; idx < new_map.nr_extents; idx++) {
709 extent = &new_map.extent[idx];
711 lower_first = map_id_range_down(parent_map,
715 /* Fail if we can not map the specified extent to
716 * the kernel global id space.
718 if (lower_first == (u32) -1)
721 extent->lower_first = lower_first;
724 /* Install the map */
725 memcpy(map->extent, new_map.extent,
726 new_map.nr_extents*sizeof(new_map.extent[0]));
728 map->nr_extents = new_map.nr_extents;
733 mutex_unlock(&id_map_mutex);
739 ssize_t proc_uid_map_write(struct file *file, const char __user *buf, size_t size, loff_t *ppos)
741 struct seq_file *seq = file->private_data;
742 struct user_namespace *ns = seq->private;
743 struct user_namespace *seq_ns = seq_user_ns(seq);
748 if ((seq_ns != ns) && (seq_ns != ns->parent))
751 return map_write(file, buf, size, ppos, CAP_SETUID,
752 &ns->uid_map, &ns->parent->uid_map);
755 ssize_t proc_gid_map_write(struct file *file, const char __user *buf, size_t size, loff_t *ppos)
757 struct seq_file *seq = file->private_data;
758 struct user_namespace *ns = seq->private;
759 struct user_namespace *seq_ns = seq_user_ns(seq);
764 if ((seq_ns != ns) && (seq_ns != ns->parent))
767 return map_write(file, buf, size, ppos, CAP_SETGID,
768 &ns->gid_map, &ns->parent->gid_map);
771 ssize_t proc_projid_map_write(struct file *file, const char __user *buf, size_t size, loff_t *ppos)
773 struct seq_file *seq = file->private_data;
774 struct user_namespace *ns = seq->private;
775 struct user_namespace *seq_ns = seq_user_ns(seq);
780 if ((seq_ns != ns) && (seq_ns != ns->parent))
783 /* Anyone can set any valid project id no capability needed */
784 return map_write(file, buf, size, ppos, -1,
785 &ns->projid_map, &ns->parent->projid_map);
788 static bool new_idmap_permitted(struct user_namespace *ns, int cap_setid,
789 struct uid_gid_map *new_map)
791 /* Allow mapping to your own filesystem ids */
792 if ((new_map->nr_extents == 1) && (new_map->extent[0].count == 1)) {
793 u32 id = new_map->extent[0].lower_first;
794 if (cap_setid == CAP_SETUID) {
795 kuid_t uid = make_kuid(ns->parent, id);
796 if (uid_eq(uid, current_fsuid()))
799 else if (cap_setid == CAP_SETGID) {
800 kgid_t gid = make_kgid(ns->parent, id);
801 if (gid_eq(gid, current_fsgid()))
806 /* Allow anyone to set a mapping that doesn't require privilege */
807 if (!cap_valid(cap_setid))
810 /* Allow the specified ids if we have the appropriate capability
811 * (CAP_SETUID or CAP_SETGID) over the parent user namespace.
813 if (ns_capable(ns->parent, cap_setid))
819 static void *userns_get(struct task_struct *task)
821 struct user_namespace *user_ns;
824 user_ns = get_user_ns(__task_cred(task)->user_ns);
830 static void userns_put(void *ns)
835 static int userns_install(struct nsproxy *nsproxy, void *ns)
837 struct user_namespace *user_ns = ns;
840 /* Don't allow gaining capabilities by reentering
841 * the same user namespace.
843 if (user_ns == current_user_ns())
846 /* Threaded processes may not enter a different user namespace */
847 if (atomic_read(¤t->mm->mm_users) > 1)
850 if (current->fs->users != 1)
853 if (!ns_capable(user_ns, CAP_SYS_ADMIN))
856 cred = prepare_creds();
860 put_user_ns(cred->user_ns);
861 set_cred_user_ns(cred, get_user_ns(user_ns));
863 return commit_creds(cred);
866 static unsigned int userns_inum(void *ns)
868 struct user_namespace *user_ns = ns;
869 return user_ns->proc_inum;
872 const struct proc_ns_operations userns_operations = {
874 .type = CLONE_NEWUSER,
877 .install = userns_install,
881 static __init int user_namespaces_init(void)
883 user_ns_cachep = KMEM_CACHE(user_namespace, SLAB_PANIC);
886 module_init(user_namespaces_init);