first commit

1 files changed, 102 insertions, 0 deletions

diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
new file mode 100644
index 000000000..a37081cf5
--- /dev/null
+++ b/include/linux/user_namespace.h
@@ -0,0 +1,102 @@
+#ifndef _LINUX_USER_NAMESPACE_H
+#define _LINUX_USER_NAMESPACE_H
+
+#include <linux/kref.h>
+#include <linux/nsproxy.h>
+#include <linux/sched.h>
+#include <linux/err.h>
+
+#define UID_GID_MAP_MAX_EXTENTS 5
+
+struct uid_gid_map {	/* 64 bytes -- 1 cache line */
+	u32 nr_extents;
+	struct uid_gid_extent {
+		u32 first;
+		u32 lower_first;
+		u32 count;
+	} extent[UID_GID_MAP_MAX_EXTENTS];
+};
+
+#define USERNS_SETGROUPS_ALLOWED 1UL
+
+#define USERNS_INIT_FLAGS USERNS_SETGROUPS_ALLOWED
+
+struct user_namespace {
+	struct uid_gid_map	uid_map;
+	struct uid_gid_map	gid_map;
+	struct uid_gid_map	projid_map;
+	atomic_t		count;
+	struct user_namespace	*parent;
+	int			level;
+	kuid_t			owner;
+	kgid_t			group;
+	unsigned int		proc_inum;
+	unsigned long		flags;
+	bool			may_mount_sysfs;
+	bool			may_mount_proc;
+};
+
+extern struct user_namespace init_user_ns;
+
+#ifdef CONFIG_USER_NS
+
+static inline struct user_namespace *get_user_ns(struct user_namespace *ns)
+{
+	if (ns)
+		atomic_inc(&ns->count);
+	return ns;
+}
+
+extern int create_user_ns(struct cred *new);
+extern int unshare_userns(unsigned long unshare_flags, struct cred **new_cred);
+extern void free_user_ns(struct user_namespace *ns);
+
+static inline void put_user_ns(struct user_namespace *ns)
+{
+	if (ns && atomic_dec_and_test(&ns->count))
+		free_user_ns(ns);
+}
+
+struct seq_operations;
+extern struct seq_operations proc_uid_seq_operations;
+extern struct seq_operations proc_gid_seq_operations;
+extern struct seq_operations proc_projid_seq_operations;
+extern ssize_t proc_uid_map_write(struct file *, const char __user *, size_t, loff_t *);
+extern ssize_t proc_gid_map_write(struct file *, const char __user *, size_t, loff_t *);
+extern ssize_t proc_projid_map_write(struct file *, const char __user *, size_t, loff_t *);
+extern ssize_t proc_setgroups_write(struct file *, const char __user *, size_t, loff_t *);
+extern int proc_setgroups_show(struct seq_file *m, void *v);
+extern bool userns_may_setgroups(const struct user_namespace *ns);
+#else
+
+static inline struct user_namespace *get_user_ns(struct user_namespace *ns)
+{
+	return &init_user_ns;
+}
+
+static inline int create_user_ns(struct cred *new)
+{
+	return -EINVAL;
+}
+
+static inline int unshare_userns(unsigned long unshare_flags,
+				 struct cred **new_cred)
+{
+	if (unshare_flags & CLONE_NEWUSER)
+		return -EINVAL;
+	return 0;
+}
+
+static inline void put_user_ns(struct user_namespace *ns)
+{
+}
+
+static inline bool userns_may_setgroups(const struct user_namespace *ns)
+{
+	return true;
+}
+#endif
+
+void update_mnt_policy(struct user_namespace *userns);
+
+#endif /* _LINUX_USER_H */