1// SPDX-License-Identifier: GPL-2.0-only
2
3#include <linux/export.h>
4#include <linux/nsproxy.h>
5#include <linux/slab.h>
6#include <linux/sched/signal.h>
7#include <linux/user_namespace.h>
8#include <linux/proc_ns.h>
9#include <linux/highuid.h>
10#include <linux/cred.h>
11#include <linux/securebits.h>
12#include <linux/security.h>
13#include <linux/keyctl.h>
14#include <linux/key-type.h>
15#include <keys/user-type.h>
16#include <linux/seq_file.h>
17#include <linux/fs.h>
18#include <linux/uaccess.h>
19#include <linux/ctype.h>
20#include <linux/projid.h>
21#include <linux/fs_struct.h>
22#include <linux/bsearch.h>
23#include <linux/sort.h>
24#include <linux/nstree.h>
25
26static struct kmem_cache *user_ns_cachep __ro_after_init;
27static DEFINE_MUTEX(userns_state_mutex);
28
29static bool new_idmap_permitted(const struct file *file,
30 struct user_namespace *ns, int cap_setid,
31 struct uid_gid_map *map);
32static void free_user_ns(struct work_struct *work);
33
34static struct ucounts *inc_user_namespaces(struct user_namespace *ns, kuid_t uid)
35{
36 return inc_ucount(ns, uid, type: UCOUNT_USER_NAMESPACES);
37}
38
39static void dec_user_namespaces(struct ucounts *ucounts)
40{
41 return dec_ucount(ucounts, type: UCOUNT_USER_NAMESPACES);
42}
43
44static void set_cred_user_ns(struct cred *cred, struct user_namespace *user_ns)
45{
46 /* Start with the same capabilities as init but useless for doing
47 * anything as the capabilities are bound to the new user namespace.
48 */
49 cred->securebits = SECUREBITS_DEFAULT;
50 cred->cap_inheritable = CAP_EMPTY_SET;
51 cred->cap_permitted = CAP_FULL_SET;
52 cred->cap_effective = CAP_FULL_SET;
53 cred->cap_ambient = CAP_EMPTY_SET;
54 cred->cap_bset = CAP_FULL_SET;
55#ifdef CONFIG_KEYS
56 key_put(cred->request_key_auth);
57 cred->request_key_auth = NULL;
58#endif
59 /* tgcred will be cleared in our caller bc CLONE_THREAD won't be set */
60 cred->user_ns = user_ns;
61}
62
63static unsigned long enforced_nproc_rlimit(void)
64{
65 unsigned long limit = RLIM_INFINITY;
66
67 /* Is RLIMIT_NPROC currently enforced? */
68 if (!uid_eq(current_uid(), GLOBAL_ROOT_UID) ||
69 (current_user_ns() != &init_user_ns))
70 limit = rlimit(RLIMIT_NPROC);
71
72 return limit;
73}
74
75/*
76 * Create a new user namespace, deriving the creator from the user in the
77 * passed credentials, and replacing that user with the new root user for the
78 * new namespace.
79 *
80 * This is called by copy_creds(), which will finish setting the target task's
81 * credentials.
82 */
83int create_user_ns(struct cred *new)
84{
85 struct user_namespace *ns, *parent_ns = new->user_ns;
86 kuid_t owner = new->euid;
87 kgid_t group = new->egid;
88 struct ucounts *ucounts;
89 int ret, i;
90
91 ret = -ENOSPC;
92 if (parent_ns->level > 32)
93 goto fail;
94
95 ucounts = inc_user_namespaces(ns: parent_ns, uid: owner);
96 if (!ucounts)
97 goto fail;
98
99 /*
100 * Verify that we can not violate the policy of which files
101 * may be accessed that is specified by the root directory,
102 * by verifying that the root directory is at the root of the
103 * mount namespace which allows all files to be accessed.
104 */
105 ret = -EPERM;
106 if (current_chrooted())
107 goto fail_dec;
108
109 /* The creator needs a mapping in the parent user namespace
110 * or else we won't be able to reasonably tell userspace who
111 * created a user_namespace.
112 */
113 ret = -EPERM;
114 if (!kuid_has_mapping(ns: parent_ns, uid: owner) ||
115 !kgid_has_mapping(ns: parent_ns, gid: group))
116 goto fail_dec;
117
118 ret = security_create_user_ns(cred: new);
119 if (ret < 0)
120 goto fail_dec;
121
122 ret = -ENOMEM;
123 ns = kmem_cache_zalloc(user_ns_cachep, GFP_KERNEL);
124 if (!ns)
125 goto fail_dec;
126
127 ns->parent_could_setfcap = cap_raised(new->cap_effective, CAP_SETFCAP);
128
129 ret = ns_common_init(ns);
130 if (ret)
131 goto fail_free;
132
133 /* Leave the new->user_ns reference with the new user namespace. */
134 ns->parent = parent_ns;
135 ns->level = parent_ns->level + 1;
136 ns->owner = owner;
137 ns->group = group;
138 INIT_WORK(&ns->work, free_user_ns);
139 for (i = 0; i < UCOUNT_COUNTS; i++) {
140 ns->ucount_max[i] = INT_MAX;
141 }
142 set_userns_rlimit_max(ns, type: UCOUNT_RLIMIT_NPROC, max: enforced_nproc_rlimit());
143 set_userns_rlimit_max(ns, type: UCOUNT_RLIMIT_MSGQUEUE, max: rlimit(RLIMIT_MSGQUEUE));
144 set_userns_rlimit_max(ns, type: UCOUNT_RLIMIT_SIGPENDING, max: rlimit(RLIMIT_SIGPENDING));
145 set_userns_rlimit_max(ns, type: UCOUNT_RLIMIT_MEMLOCK, max: rlimit(RLIMIT_MEMLOCK));
146 ns->ucounts = ucounts;
147
148 /* Inherit USERNS_SETGROUPS_ALLOWED from our parent */
149 mutex_lock(&userns_state_mutex);
150 ns->flags = parent_ns->flags;
151 mutex_unlock(lock: &userns_state_mutex);
152
153#ifdef CONFIG_KEYS
154 INIT_LIST_HEAD(list: &ns->keyring_name_list);
155 init_rwsem(&ns->keyring_sem);
156#endif
157 ret = -ENOMEM;
158 if (!setup_userns_sysctls(ns))
159 goto fail_keyring;
160
161 set_cred_user_ns(cred: new, user_ns: ns);
162 ns_tree_add(ns);
163 return 0;
164fail_keyring:
165#ifdef CONFIG_PERSISTENT_KEYRINGS
166 key_put(key: ns->persistent_keyring_register);
167#endif
168 ns_common_free(ns);
169fail_free:
170 kmem_cache_free(s: user_ns_cachep, objp: ns);
171fail_dec:
172 dec_user_namespaces(ucounts);
173fail:
174 return ret;
175}
176
177int unshare_userns(unsigned long unshare_flags, struct cred **new_cred)
178{
179 struct cred *cred;
180 int err = -ENOMEM;
181
182 if (!(unshare_flags & CLONE_NEWUSER))
183 return 0;
184
185 cred = prepare_creds();
186 if (cred) {
187 err = create_user_ns(new: cred);
188 if (err)
189 put_cred(cred);
190 else
191 *new_cred = cred;
192 }
193
194 return err;
195}
196
197static void free_user_ns(struct work_struct *work)
198{
199 struct user_namespace *parent, *ns =
200 container_of(work, struct user_namespace, work);
201
202 do {
203 struct ucounts *ucounts = ns->ucounts;
204 parent = ns->parent;
205 ns_tree_remove(ns);
206 if (ns->gid_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) {
207 kfree(objp: ns->gid_map.forward);
208 kfree(objp: ns->gid_map.reverse);
209 }
210 if (ns->uid_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) {
211 kfree(objp: ns->uid_map.forward);
212 kfree(objp: ns->uid_map.reverse);
213 }
214 if (ns->projid_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) {
215 kfree(objp: ns->projid_map.forward);
216 kfree(objp: ns->projid_map.reverse);
217 }
218#if IS_ENABLED(CONFIG_BINFMT_MISC)
219 kfree(objp: ns->binfmt_misc);
220#endif
221 retire_userns_sysctls(ns);
222 key_free_user_ns(ns);
223 ns_common_free(ns);
224 /* Concurrent nstree traversal depends on a grace period. */
225 kfree_rcu(ns, ns.ns_rcu);
226 dec_user_namespaces(ucounts);
227 ns = parent;
228 } while (ns_ref_put(parent));
229}
230
231void __put_user_ns(struct user_namespace *ns)
232{
233 schedule_work(work: &ns->work);
234}
235EXPORT_SYMBOL(__put_user_ns);
236
237/*
238 * struct idmap_key - holds the information necessary to find an idmapping in a
239 * sorted idmap array. It is passed to cmp_map_id() as first argument.
240 */
241struct idmap_key {
242 bool map_up; /* true -> id from kid; false -> kid from id */
243 u32 id; /* id to find */
244 u32 count;
245};
246
247/*
248 * cmp_map_id - Function to be passed to bsearch() to find the requested
249 * idmapping. Expects struct idmap_key to be passed via @k.
250 */
251static int cmp_map_id(const void *k, const void *e)
252{
253 u32 first, last, id2;
254 const struct idmap_key *key = k;
255 const struct uid_gid_extent *el = e;
256
257 id2 = key->id + key->count - 1;
258
259 /* handle map_id_{down,up}() */
260 if (key->map_up)
261 first = el->lower_first;
262 else
263 first = el->first;
264
265 last = first + el->count - 1;
266
267 if (key->id >= first && key->id <= last &&
268 (id2 >= first && id2 <= last))
269 return 0;
270
271 if (key->id < first || id2 < first)
272 return -1;
273
274 return 1;
275}
276
277/*
278 * map_id_range_down_max - Find idmap via binary search in ordered idmap array.
279 * Can only be called if number of mappings exceeds UID_GID_MAP_MAX_BASE_EXTENTS.
280 */
281static struct uid_gid_extent *
282map_id_range_down_max(unsigned extents, struct uid_gid_map *map, u32 id, u32 count)
283{
284 struct idmap_key key;
285
286 key.map_up = false;
287 key.count = count;
288 key.id = id;
289
290 return bsearch(key: &key, base: map->forward, num: extents,
291 size: sizeof(struct uid_gid_extent), cmp: cmp_map_id);
292}
293
294/*
295 * map_id_range_down_base - Find idmap via binary search in static extent array.
296 * Can only be called if number of mappings is equal or less than
297 * UID_GID_MAP_MAX_BASE_EXTENTS.
298 */
299static struct uid_gid_extent *
300map_id_range_down_base(unsigned extents, struct uid_gid_map *map, u32 id, u32 count)
301{
302 unsigned idx;
303 u32 first, last, id2;
304
305 id2 = id + count - 1;
306
307 /* Find the matching extent */
308 for (idx = 0; idx < extents; idx++) {
309 first = map->extent[idx].first;
310 last = first + map->extent[idx].count - 1;
311 if (id >= first && id <= last &&
312 (id2 >= first && id2 <= last))
313 return &map->extent[idx];
314 }
315 return NULL;
316}
317
318static u32 map_id_range_down(struct uid_gid_map *map, u32 id, u32 count)
319{
320 struct uid_gid_extent *extent;
321 unsigned extents = map->nr_extents;
322 smp_rmb();
323
324 if (extents <= UID_GID_MAP_MAX_BASE_EXTENTS)
325 extent = map_id_range_down_base(extents, map, id, count);
326 else
327 extent = map_id_range_down_max(extents, map, id, count);
328
329 /* Map the id or note failure */
330 if (extent)
331 id = (id - extent->first) + extent->lower_first;
332 else
333 id = (u32) -1;
334
335 return id;
336}
337
338u32 map_id_down(struct uid_gid_map *map, u32 id)
339{
340 return map_id_range_down(map, id, count: 1);
341}
342
343/*
344 * map_id_up_base - Find idmap via binary search in static extent array.
345 * Can only be called if number of mappings is equal or less than
346 * UID_GID_MAP_MAX_BASE_EXTENTS.
347 */
348static struct uid_gid_extent *
349map_id_range_up_base(unsigned extents, struct uid_gid_map *map, u32 id, u32 count)
350{
351 unsigned idx;
352 u32 first, last, id2;
353
354 id2 = id + count - 1;
355
356 /* Find the matching extent */
357 for (idx = 0; idx < extents; idx++) {
358 first = map->extent[idx].lower_first;
359 last = first + map->extent[idx].count - 1;
360 if (id >= first && id <= last &&
361 (id2 >= first && id2 <= last))
362 return &map->extent[idx];
363 }
364 return NULL;
365}
366
367/*
368 * map_id_up_max - Find idmap via binary search in ordered idmap array.
369 * Can only be called if number of mappings exceeds UID_GID_MAP_MAX_BASE_EXTENTS.
370 */
371static struct uid_gid_extent *
372map_id_range_up_max(unsigned extents, struct uid_gid_map *map, u32 id, u32 count)
373{
374 struct idmap_key key;
375
376 key.map_up = true;
377 key.count = count;
378 key.id = id;
379
380 return bsearch(key: &key, base: map->reverse, num: extents,
381 size: sizeof(struct uid_gid_extent), cmp: cmp_map_id);
382}
383
384u32 map_id_range_up(struct uid_gid_map *map, u32 id, u32 count)
385{
386 struct uid_gid_extent *extent;
387 unsigned extents = map->nr_extents;
388 smp_rmb();
389
390 if (extents <= UID_GID_MAP_MAX_BASE_EXTENTS)
391 extent = map_id_range_up_base(extents, map, id, count);
392 else
393 extent = map_id_range_up_max(extents, map, id, count);
394
395 /* Map the id or note failure */
396 if (extent)
397 id = (id - extent->lower_first) + extent->first;
398 else
399 id = (u32) -1;
400
401 return id;
402}
403
404u32 map_id_up(struct uid_gid_map *map, u32 id)
405{
406 return map_id_range_up(map, id, count: 1);
407}
408
409/**
410 * make_kuid - Map a user-namespace uid pair into a kuid.
411 * @ns: User namespace that the uid is in
412 * @uid: User identifier
413 *
414 * Maps a user-namespace uid pair into a kernel internal kuid,
415 * and returns that kuid.
416 *
417 * When there is no mapping defined for the user-namespace uid
418 * pair INVALID_UID is returned. Callers are expected to test
419 * for and handle INVALID_UID being returned. INVALID_UID
420 * may be tested for using uid_valid().
421 */
422kuid_t make_kuid(struct user_namespace *ns, uid_t uid)
423{
424 /* Map the uid to a global kernel uid */
425 return KUIDT_INIT(map_id_down(&ns->uid_map, uid));
426}
427EXPORT_SYMBOL(make_kuid);
428
429/**
430 * from_kuid - Create a uid from a kuid user-namespace pair.
431 * @targ: The user namespace we want a uid in.
432 * @kuid: The kernel internal uid to start with.
433 *
434 * Map @kuid into the user-namespace specified by @targ and
435 * return the resulting uid.
436 *
437 * There is always a mapping into the initial user_namespace.
438 *
439 * If @kuid has no mapping in @targ (uid_t)-1 is returned.
440 */
441uid_t from_kuid(struct user_namespace *targ, kuid_t kuid)
442{
443 /* Map the uid from a global kernel uid */
444 return map_id_up(map: &targ->uid_map, id: __kuid_val(uid: kuid));
445}
446EXPORT_SYMBOL(from_kuid);
447
448/**
449 * from_kuid_munged - Create a uid from a kuid user-namespace pair.
450 * @targ: The user namespace we want a uid in.
451 * @kuid: The kernel internal uid to start with.
452 *
453 * Map @kuid into the user-namespace specified by @targ and
454 * return the resulting uid.
455 *
456 * There is always a mapping into the initial user_namespace.
457 *
458 * Unlike from_kuid from_kuid_munged never fails and always
459 * returns a valid uid. This makes from_kuid_munged appropriate
460 * for use in syscalls like stat and getuid where failing the
461 * system call and failing to provide a valid uid are not an
462 * options.
463 *
464 * If @kuid has no mapping in @targ overflowuid is returned.
465 */
466uid_t from_kuid_munged(struct user_namespace *targ, kuid_t kuid)
467{
468 uid_t uid;
469 uid = from_kuid(targ, kuid);
470
471 if (uid == (uid_t) -1)
472 uid = overflowuid;
473 return uid;
474}
475EXPORT_SYMBOL(from_kuid_munged);
476
477/**
478 * make_kgid - Map a user-namespace gid pair into a kgid.
479 * @ns: User namespace that the gid is in
480 * @gid: group identifier
481 *
482 * Maps a user-namespace gid pair into a kernel internal kgid,
483 * and returns that kgid.
484 *
485 * When there is no mapping defined for the user-namespace gid
486 * pair INVALID_GID is returned. Callers are expected to test
487 * for and handle INVALID_GID being returned. INVALID_GID may be
488 * tested for using gid_valid().
489 */
490kgid_t make_kgid(struct user_namespace *ns, gid_t gid)
491{
492 /* Map the gid to a global kernel gid */
493 return KGIDT_INIT(map_id_down(&ns->gid_map, gid));
494}
495EXPORT_SYMBOL(make_kgid);
496
497/**
498 * from_kgid - Create a gid from a kgid user-namespace pair.
499 * @targ: The user namespace we want a gid in.
500 * @kgid: The kernel internal gid to start with.
501 *
502 * Map @kgid into the user-namespace specified by @targ and
503 * return the resulting gid.
504 *
505 * There is always a mapping into the initial user_namespace.
506 *
507 * If @kgid has no mapping in @targ (gid_t)-1 is returned.
508 */
509gid_t from_kgid(struct user_namespace *targ, kgid_t kgid)
510{
511 /* Map the gid from a global kernel gid */
512 return map_id_up(map: &targ->gid_map, id: __kgid_val(gid: kgid));
513}
514EXPORT_SYMBOL(from_kgid);
515
516/**
517 * from_kgid_munged - Create a gid from a kgid user-namespace pair.
518 * @targ: The user namespace we want a gid in.
519 * @kgid: The kernel internal gid to start with.
520 *
521 * Map @kgid into the user-namespace specified by @targ and
522 * return the resulting gid.
523 *
524 * There is always a mapping into the initial user_namespace.
525 *
526 * Unlike from_kgid from_kgid_munged never fails and always
527 * returns a valid gid. This makes from_kgid_munged appropriate
528 * for use in syscalls like stat and getgid where failing the
529 * system call and failing to provide a valid gid are not options.
530 *
531 * If @kgid has no mapping in @targ overflowgid is returned.
532 */
533gid_t from_kgid_munged(struct user_namespace *targ, kgid_t kgid)
534{
535 gid_t gid;
536 gid = from_kgid(targ, kgid);
537
538 if (gid == (gid_t) -1)
539 gid = overflowgid;
540 return gid;
541}
542EXPORT_SYMBOL(from_kgid_munged);
543
544/**
545 * make_kprojid - Map a user-namespace projid pair into a kprojid.
546 * @ns: User namespace that the projid is in
547 * @projid: Project identifier
548 *
549 * Maps a user-namespace uid pair into a kernel internal kuid,
550 * and returns that kuid.
551 *
552 * When there is no mapping defined for the user-namespace projid
553 * pair INVALID_PROJID is returned. Callers are expected to test
554 * for and handle INVALID_PROJID being returned. INVALID_PROJID
555 * may be tested for using projid_valid().
556 */
557kprojid_t make_kprojid(struct user_namespace *ns, projid_t projid)
558{
559 /* Map the uid to a global kernel uid */
560 return KPROJIDT_INIT(map_id_down(&ns->projid_map, projid));
561}
562EXPORT_SYMBOL(make_kprojid);
563
564/**
565 * from_kprojid - Create a projid from a kprojid user-namespace pair.
566 * @targ: The user namespace we want a projid in.
567 * @kprojid: The kernel internal project identifier to start with.
568 *
569 * Map @kprojid into the user-namespace specified by @targ and
570 * return the resulting projid.
571 *
572 * There is always a mapping into the initial user_namespace.
573 *
574 * If @kprojid has no mapping in @targ (projid_t)-1 is returned.
575 */
576projid_t from_kprojid(struct user_namespace *targ, kprojid_t kprojid)
577{
578 /* Map the uid from a global kernel uid */
579 return map_id_up(map: &targ->projid_map, id: __kprojid_val(projid: kprojid));
580}
581EXPORT_SYMBOL(from_kprojid);
582
583/**
584 * from_kprojid_munged - Create a projiid from a kprojid user-namespace pair.
585 * @targ: The user namespace we want a projid in.
586 * @kprojid: The kernel internal projid to start with.
587 *
588 * Map @kprojid into the user-namespace specified by @targ and
589 * return the resulting projid.
590 *
591 * There is always a mapping into the initial user_namespace.
592 *
593 * Unlike from_kprojid from_kprojid_munged never fails and always
594 * returns a valid projid. This makes from_kprojid_munged
595 * appropriate for use in syscalls like stat and where
596 * failing the system call and failing to provide a valid projid are
597 * not an options.
598 *
599 * If @kprojid has no mapping in @targ OVERFLOW_PROJID is returned.
600 */
601projid_t from_kprojid_munged(struct user_namespace *targ, kprojid_t kprojid)
602{
603 projid_t projid;
604 projid = from_kprojid(targ, kprojid);
605
606 if (projid == (projid_t) -1)
607 projid = OVERFLOW_PROJID;
608 return projid;
609}
610EXPORT_SYMBOL(from_kprojid_munged);
611
612
613static int uid_m_show(struct seq_file *seq, void *v)
614{
615 struct user_namespace *ns = seq->private;
616 struct uid_gid_extent *extent = v;
617 struct user_namespace *lower_ns;
618 uid_t lower;
619
620 lower_ns = seq_user_ns(seq);
621 if ((lower_ns == ns) && lower_ns->parent)
622 lower_ns = lower_ns->parent;
623
624 lower = from_kuid(lower_ns, KUIDT_INIT(extent->lower_first));
625
626 seq_printf(m: seq, fmt: "%10u %10u %10u\n",
627 extent->first,
628 lower,
629 extent->count);
630
631 return 0;
632}
633
634static int gid_m_show(struct seq_file *seq, void *v)
635{
636 struct user_namespace *ns = seq->private;
637 struct uid_gid_extent *extent = v;
638 struct user_namespace *lower_ns;
639 gid_t lower;
640
641 lower_ns = seq_user_ns(seq);
642 if ((lower_ns == ns) && lower_ns->parent)
643 lower_ns = lower_ns->parent;
644
645 lower = from_kgid(lower_ns, KGIDT_INIT(extent->lower_first));
646
647 seq_printf(m: seq, fmt: "%10u %10u %10u\n",
648 extent->first,
649 lower,
650 extent->count);
651
652 return 0;
653}
654
655static int projid_m_show(struct seq_file *seq, void *v)
656{
657 struct user_namespace *ns = seq->private;
658 struct uid_gid_extent *extent = v;
659 struct user_namespace *lower_ns;
660 projid_t lower;
661
662 lower_ns = seq_user_ns(seq);
663 if ((lower_ns == ns) && lower_ns->parent)
664 lower_ns = lower_ns->parent;
665
666 lower = from_kprojid(lower_ns, KPROJIDT_INIT(extent->lower_first));
667
668 seq_printf(m: seq, fmt: "%10u %10u %10u\n",
669 extent->first,
670 lower,
671 extent->count);
672
673 return 0;
674}
675
676static void *m_start(struct seq_file *seq, loff_t *ppos,
677 struct uid_gid_map *map)
678{
679 loff_t pos = *ppos;
680 unsigned extents = map->nr_extents;
681 smp_rmb();
682
683 if (pos >= extents)
684 return NULL;
685
686 if (extents <= UID_GID_MAP_MAX_BASE_EXTENTS)
687 return &map->extent[pos];
688
689 return &map->forward[pos];
690}
691
692static void *uid_m_start(struct seq_file *seq, loff_t *ppos)
693{
694 struct user_namespace *ns = seq->private;
695
696 return m_start(seq, ppos, map: &ns->uid_map);
697}
698
699static void *gid_m_start(struct seq_file *seq, loff_t *ppos)
700{
701 struct user_namespace *ns = seq->private;
702
703 return m_start(seq, ppos, map: &ns->gid_map);
704}
705
706static void *projid_m_start(struct seq_file *seq, loff_t *ppos)
707{
708 struct user_namespace *ns = seq->private;
709
710 return m_start(seq, ppos, map: &ns->projid_map);
711}
712
713static void *m_next(struct seq_file *seq, void *v, loff_t *pos)
714{
715 (*pos)++;
716 return seq->op->start(seq, pos);
717}
718
719static void m_stop(struct seq_file *seq, void *v)
720{
721 return;
722}
723
724const struct seq_operations proc_uid_seq_operations = {
725 .start = uid_m_start,
726 .stop = m_stop,
727 .next = m_next,
728 .show = uid_m_show,
729};
730
731const struct seq_operations proc_gid_seq_operations = {
732 .start = gid_m_start,
733 .stop = m_stop,
734 .next = m_next,
735 .show = gid_m_show,
736};
737
738const struct seq_operations proc_projid_seq_operations = {
739 .start = projid_m_start,
740 .stop = m_stop,
741 .next = m_next,
742 .show = projid_m_show,
743};
744
745static bool mappings_overlap(struct uid_gid_map *new_map,
746 struct uid_gid_extent *extent)
747{
748 u32 upper_first, lower_first, upper_last, lower_last;
749 unsigned idx;
750
751 upper_first = extent->first;
752 lower_first = extent->lower_first;
753 upper_last = upper_first + extent->count - 1;
754 lower_last = lower_first + extent->count - 1;
755
756 for (idx = 0; idx < new_map->nr_extents; idx++) {
757 u32 prev_upper_first, prev_lower_first;
758 u32 prev_upper_last, prev_lower_last;
759 struct uid_gid_extent *prev;
760
761 if (new_map->nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS)
762 prev = &new_map->extent[idx];
763 else
764 prev = &new_map->forward[idx];
765
766 prev_upper_first = prev->first;
767 prev_lower_first = prev->lower_first;
768 prev_upper_last = prev_upper_first + prev->count - 1;
769 prev_lower_last = prev_lower_first + prev->count - 1;
770
771 /* Does the upper range intersect a previous extent? */
772 if ((prev_upper_first <= upper_last) &&
773 (prev_upper_last >= upper_first))
774 return true;
775
776 /* Does the lower range intersect a previous extent? */
777 if ((prev_lower_first <= lower_last) &&
778 (prev_lower_last >= lower_first))
779 return true;
780 }
781 return false;
782}
783
784/*
785 * insert_extent - Safely insert a new idmap extent into struct uid_gid_map.
786 * Takes care to allocate a 4K block of memory if the number of mappings exceeds
787 * UID_GID_MAP_MAX_BASE_EXTENTS.
788 */
789static int insert_extent(struct uid_gid_map *map, struct uid_gid_extent *extent)
790{
791 struct uid_gid_extent *dest;
792
793 if (map->nr_extents == UID_GID_MAP_MAX_BASE_EXTENTS) {
794 struct uid_gid_extent *forward;
795
796 /* Allocate memory for 340 mappings. */
797 forward = kmalloc_array(UID_GID_MAP_MAX_EXTENTS,
798 sizeof(struct uid_gid_extent),
799 GFP_KERNEL);
800 if (!forward)
801 return -ENOMEM;
802
803 /* Copy over memory. Only set up memory for the forward pointer.
804 * Defer the memory setup for the reverse pointer.
805 */
806 memcpy(forward, map->extent,
807 map->nr_extents * sizeof(map->extent[0]));
808
809 map->forward = forward;
810 map->reverse = NULL;
811 }
812
813 if (map->nr_extents < UID_GID_MAP_MAX_BASE_EXTENTS)
814 dest = &map->extent[map->nr_extents];
815 else
816 dest = &map->forward[map->nr_extents];
817
818 *dest = *extent;
819 map->nr_extents++;
820 return 0;
821}
822
823/* cmp function to sort() forward mappings */
824static int cmp_extents_forward(const void *a, const void *b)
825{
826 const struct uid_gid_extent *e1 = a;
827 const struct uid_gid_extent *e2 = b;
828
829 if (e1->first < e2->first)
830 return -1;
831
832 if (e1->first > e2->first)
833 return 1;
834
835 return 0;
836}
837
838/* cmp function to sort() reverse mappings */
839static int cmp_extents_reverse(const void *a, const void *b)
840{
841 const struct uid_gid_extent *e1 = a;
842 const struct uid_gid_extent *e2 = b;
843
844 if (e1->lower_first < e2->lower_first)
845 return -1;
846
847 if (e1->lower_first > e2->lower_first)
848 return 1;
849
850 return 0;
851}
852
853/*
854 * sort_idmaps - Sorts an array of idmap entries.
855 * Can only be called if number of mappings exceeds UID_GID_MAP_MAX_BASE_EXTENTS.
856 */
857static int sort_idmaps(struct uid_gid_map *map)
858{
859 if (map->nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS)
860 return 0;
861
862 /* Sort forward array. */
863 sort(base: map->forward, num: map->nr_extents, size: sizeof(struct uid_gid_extent),
864 cmp_func: cmp_extents_forward, NULL);
865
866 /* Only copy the memory from forward we actually need. */
867 map->reverse = kmemdup_array(src: map->forward, count: map->nr_extents,
868 element_size: sizeof(struct uid_gid_extent), GFP_KERNEL);
869 if (!map->reverse)
870 return -ENOMEM;
871
872 /* Sort reverse array. */
873 sort(base: map->reverse, num: map->nr_extents, size: sizeof(struct uid_gid_extent),
874 cmp_func: cmp_extents_reverse, NULL);
875
876 return 0;
877}
878
879/**
880 * verify_root_map() - check the uid 0 mapping
881 * @file: idmapping file
882 * @map_ns: user namespace of the target process
883 * @new_map: requested idmap
884 *
885 * If a process requests mapping parent uid 0 into the new ns, verify that the
886 * process writing the map had the CAP_SETFCAP capability as the target process
887 * will be able to write fscaps that are valid in ancestor user namespaces.
888 *
889 * Return: true if the mapping is allowed, false if not.
890 */
891static bool verify_root_map(const struct file *file,
892 struct user_namespace *map_ns,
893 struct uid_gid_map *new_map)
894{
895 int idx;
896 const struct user_namespace *file_ns = file->f_cred->user_ns;
897 struct uid_gid_extent *extent0 = NULL;
898
899 for (idx = 0; idx < new_map->nr_extents; idx++) {
900 if (new_map->nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS)
901 extent0 = &new_map->extent[idx];
902 else
903 extent0 = &new_map->forward[idx];
904 if (extent0->lower_first == 0)
905 break;
906
907 extent0 = NULL;
908 }
909
910 if (!extent0)
911 return true;
912
913 if (map_ns == file_ns) {
914 /* The process unshared its ns and is writing to its own
915 * /proc/self/uid_map. User already has full capabilites in
916 * the new namespace. Verify that the parent had CAP_SETFCAP
917 * when it unshared.
918 * */
919 if (!file_ns->parent_could_setfcap)
920 return false;
921 } else {
922 /* Process p1 is writing to uid_map of p2, who is in a child
923 * user namespace to p1's. Verify that the opener of the map
924 * file has CAP_SETFCAP against the parent of the new map
925 * namespace */
926 if (!file_ns_capable(file, ns: map_ns->parent, CAP_SETFCAP))
927 return false;
928 }
929
930 return true;
931}
932
933static ssize_t map_write(struct file *file, const char __user *buf,
934 size_t count, loff_t *ppos,
935 int cap_setid,
936 struct uid_gid_map *map,
937 struct uid_gid_map *parent_map)
938{
939 struct seq_file *seq = file->private_data;
940 struct user_namespace *map_ns = seq->private;
941 struct uid_gid_map new_map;
942 unsigned idx;
943 struct uid_gid_extent extent;
944 char *kbuf, *pos, *next_line;
945 ssize_t ret;
946
947 /* Only allow < page size writes at the beginning of the file */
948 if ((*ppos != 0) || (count >= PAGE_SIZE))
949 return -EINVAL;
950
951 /* Slurp in the user data */
952 kbuf = memdup_user_nul(buf, count);
953 if (IS_ERR(ptr: kbuf))
954 return PTR_ERR(ptr: kbuf);
955
956 /*
957 * The userns_state_mutex serializes all writes to any given map.
958 *
959 * Any map is only ever written once.
960 *
961 * An id map fits within 1 cache line on most architectures.
962 *
963 * On read nothing needs to be done unless you are on an
964 * architecture with a crazy cache coherency model like alpha.
965 *
966 * There is a one time data dependency between reading the
967 * count of the extents and the values of the extents. The
968 * desired behavior is to see the values of the extents that
969 * were written before the count of the extents.
970 *
971 * To achieve this smp_wmb() is used on guarantee the write
972 * order and smp_rmb() is guaranteed that we don't have crazy
973 * architectures returning stale data.
974 */
975 mutex_lock(&userns_state_mutex);
976
977 memset(&new_map, 0, sizeof(struct uid_gid_map));
978
979 ret = -EPERM;
980 /* Only allow one successful write to the map */
981 if (map->nr_extents != 0)
982 goto out;
983
984 /*
985 * Adjusting namespace settings requires capabilities on the target.
986 */
987 if (cap_valid(cap_setid) && !file_ns_capable(file, ns: map_ns, CAP_SYS_ADMIN))
988 goto out;
989
990 /* Parse the user data */
991 ret = -EINVAL;
992 pos = kbuf;
993 for (; pos; pos = next_line) {
994
995 /* Find the end of line and ensure I don't look past it */
996 next_line = strchr(pos, '\n');
997 if (next_line) {
998 *next_line = '\0';
999 next_line++;
1000 if (*next_line == '\0')
1001 next_line = NULL;
1002 }
1003
1004 pos = skip_spaces(pos);
1005 extent.first = simple_strtoul(pos, &pos, 10);
1006 if (!isspace(*pos))
1007 goto out;
1008
1009 pos = skip_spaces(pos);
1010 extent.lower_first = simple_strtoul(pos, &pos, 10);
1011 if (!isspace(*pos))
1012 goto out;
1013
1014 pos = skip_spaces(pos);
1015 extent.count = simple_strtoul(pos, &pos, 10);
1016 if (*pos && !isspace(*pos))
1017 goto out;
1018
1019 /* Verify there is not trailing junk on the line */
1020 pos = skip_spaces(pos);
1021 if (*pos != '\0')
1022 goto out;
1023
1024 /* Verify we have been given valid starting values */
1025 if ((extent.first == (u32) -1) ||
1026 (extent.lower_first == (u32) -1))
1027 goto out;
1028
1029 /* Verify count is not zero and does not cause the
1030 * extent to wrap
1031 */
1032 if ((extent.first + extent.count) <= extent.first)
1033 goto out;
1034 if ((extent.lower_first + extent.count) <=
1035 extent.lower_first)
1036 goto out;
1037
1038 /* Do the ranges in extent overlap any previous extents? */
1039 if (mappings_overlap(new_map: &new_map, extent: &extent))
1040 goto out;
1041
1042 if ((new_map.nr_extents + 1) == UID_GID_MAP_MAX_EXTENTS &&
1043 (next_line != NULL))
1044 goto out;
1045
1046 ret = insert_extent(map: &new_map, extent: &extent);
1047 if (ret < 0)
1048 goto out;
1049 ret = -EINVAL;
1050 }
1051 /* Be very certain the new map actually exists */
1052 if (new_map.nr_extents == 0)
1053 goto out;
1054
1055 ret = -EPERM;
1056 /* Validate the user is allowed to use user id's mapped to. */
1057 if (!new_idmap_permitted(file, ns: map_ns, cap_setid, map: &new_map))
1058 goto out;
1059
1060 ret = -EPERM;
1061 /* Map the lower ids from the parent user namespace to the
1062 * kernel global id space.
1063 */
1064 for (idx = 0; idx < new_map.nr_extents; idx++) {
1065 struct uid_gid_extent *e;
1066 u32 lower_first;
1067
1068 if (new_map.nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS)
1069 e = &new_map.extent[idx];
1070 else
1071 e = &new_map.forward[idx];
1072
1073 lower_first = map_id_range_down(map: parent_map,
1074 id: e->lower_first,
1075 count: e->count);
1076
1077 /* Fail if we can not map the specified extent to
1078 * the kernel global id space.
1079 */
1080 if (lower_first == (u32) -1)
1081 goto out;
1082
1083 e->lower_first = lower_first;
1084 }
1085
1086 /*
1087 * If we want to use binary search for lookup, this clones the extent
1088 * array and sorts both copies.
1089 */
1090 ret = sort_idmaps(map: &new_map);
1091 if (ret < 0)
1092 goto out;
1093
1094 /* Install the map */
1095 if (new_map.nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS) {
1096 memcpy(map->extent, new_map.extent,
1097 new_map.nr_extents * sizeof(new_map.extent[0]));
1098 } else {
1099 map->forward = new_map.forward;
1100 map->reverse = new_map.reverse;
1101 }
1102 smp_wmb();
1103 map->nr_extents = new_map.nr_extents;
1104
1105 *ppos = count;
1106 ret = count;
1107out:
1108 if (ret < 0 && new_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) {
1109 kfree(objp: new_map.forward);
1110 kfree(objp: new_map.reverse);
1111 map->forward = NULL;
1112 map->reverse = NULL;
1113 map->nr_extents = 0;
1114 }
1115
1116 mutex_unlock(lock: &userns_state_mutex);
1117 kfree(objp: kbuf);
1118 return ret;
1119}
1120
1121ssize_t proc_uid_map_write(struct file *file, const char __user *buf,
1122 size_t size, loff_t *ppos)
1123{
1124 struct seq_file *seq = file->private_data;
1125 struct user_namespace *ns = seq->private;
1126 struct user_namespace *seq_ns = seq_user_ns(seq);
1127
1128 if (!ns->parent)
1129 return -EPERM;
1130
1131 if ((seq_ns != ns) && (seq_ns != ns->parent))
1132 return -EPERM;
1133
1134 return map_write(file, buf, count: size, ppos, CAP_SETUID,
1135 map: &ns->uid_map, parent_map: &ns->parent->uid_map);
1136}
1137
1138ssize_t proc_gid_map_write(struct file *file, const char __user *buf,
1139 size_t size, loff_t *ppos)
1140{
1141 struct seq_file *seq = file->private_data;
1142 struct user_namespace *ns = seq->private;
1143 struct user_namespace *seq_ns = seq_user_ns(seq);
1144
1145 if (!ns->parent)
1146 return -EPERM;
1147
1148 if ((seq_ns != ns) && (seq_ns != ns->parent))
1149 return -EPERM;
1150
1151 return map_write(file, buf, count: size, ppos, CAP_SETGID,
1152 map: &ns->gid_map, parent_map: &ns->parent->gid_map);
1153}
1154
1155ssize_t proc_projid_map_write(struct file *file, const char __user *buf,
1156 size_t size, loff_t *ppos)
1157{
1158 struct seq_file *seq = file->private_data;
1159 struct user_namespace *ns = seq->private;
1160 struct user_namespace *seq_ns = seq_user_ns(seq);
1161
1162 if (!ns->parent)
1163 return -EPERM;
1164
1165 if ((seq_ns != ns) && (seq_ns != ns->parent))
1166 return -EPERM;
1167
1168 /* Anyone can set any valid project id no capability needed */
1169 return map_write(file, buf, count: size, ppos, cap_setid: -1,
1170 map: &ns->projid_map, parent_map: &ns->parent->projid_map);
1171}
1172
1173static bool new_idmap_permitted(const struct file *file,
1174 struct user_namespace *ns, int cap_setid,
1175 struct uid_gid_map *new_map)
1176{
1177 const struct cred *cred = file->f_cred;
1178
1179 if (cap_setid == CAP_SETUID && !verify_root_map(file, map_ns: ns, new_map))
1180 return false;
1181
1182 /* Don't allow mappings that would allow anything that wouldn't
1183 * be allowed without the establishment of unprivileged mappings.
1184 */
1185 if ((new_map->nr_extents == 1) && (new_map->extent[0].count == 1) &&
1186 uid_eq(left: ns->owner, right: cred->euid)) {
1187 u32 id = new_map->extent[0].lower_first;
1188 if (cap_setid == CAP_SETUID) {
1189 kuid_t uid = make_kuid(ns->parent, id);
1190 if (uid_eq(left: uid, right: cred->euid))
1191 return true;
1192 } else if (cap_setid == CAP_SETGID) {
1193 kgid_t gid = make_kgid(ns->parent, id);
1194 if (!(ns->flags & USERNS_SETGROUPS_ALLOWED) &&
1195 gid_eq(left: gid, right: cred->egid))
1196 return true;
1197 }
1198 }
1199
1200 /* Allow anyone to set a mapping that doesn't require privilege */
1201 if (!cap_valid(cap_setid))
1202 return true;
1203
1204 /* Allow the specified ids if we have the appropriate capability
1205 * (CAP_SETUID or CAP_SETGID) over the parent user namespace.
1206 * And the opener of the id file also has the appropriate capability.
1207 */
1208 if (ns_capable(ns: ns->parent, cap: cap_setid) &&
1209 file_ns_capable(file, ns: ns->parent, cap: cap_setid))
1210 return true;
1211
1212 return false;
1213}
1214
1215int proc_setgroups_show(struct seq_file *seq, void *v)
1216{
1217 struct user_namespace *ns = seq->private;
1218 unsigned long userns_flags = READ_ONCE(ns->flags);
1219
1220 seq_printf(m: seq, fmt: "%s\n",
1221 (userns_flags & USERNS_SETGROUPS_ALLOWED) ?
1222 "allow" : "deny");
1223 return 0;
1224}
1225
1226ssize_t proc_setgroups_write(struct file *file, const char __user *buf,
1227 size_t count, loff_t *ppos)
1228{
1229 struct seq_file *seq = file->private_data;
1230 struct user_namespace *ns = seq->private;
1231 char kbuf[8], *pos;
1232 bool setgroups_allowed;
1233 ssize_t ret;
1234
1235 /* Only allow a very narrow range of strings to be written */
1236 ret = -EINVAL;
1237 if ((*ppos != 0) || (count >= sizeof(kbuf)))
1238 goto out;
1239
1240 /* What was written? */
1241 ret = -EFAULT;
1242 if (copy_from_user(to: kbuf, from: buf, n: count))
1243 goto out;
1244 kbuf[count] = '\0';
1245 pos = kbuf;
1246
1247 /* What is being requested? */
1248 ret = -EINVAL;
1249 if (strncmp(pos, "allow", 5) == 0) {
1250 pos += 5;
1251 setgroups_allowed = true;
1252 }
1253 else if (strncmp(pos, "deny", 4) == 0) {
1254 pos += 4;
1255 setgroups_allowed = false;
1256 }
1257 else
1258 goto out;
1259
1260 /* Verify there is not trailing junk on the line */
1261 pos = skip_spaces(pos);
1262 if (*pos != '\0')
1263 goto out;
1264
1265 ret = -EPERM;
1266 mutex_lock(&userns_state_mutex);
1267 if (setgroups_allowed) {
1268 /* Enabling setgroups after setgroups has been disabled
1269 * is not allowed.
1270 */
1271 if (!(ns->flags & USERNS_SETGROUPS_ALLOWED))
1272 goto out_unlock;
1273 } else {
1274 /* Permanently disabling setgroups after setgroups has
1275 * been enabled by writing the gid_map is not allowed.
1276 */
1277 if (ns->gid_map.nr_extents != 0)
1278 goto out_unlock;
1279 ns->flags &= ~USERNS_SETGROUPS_ALLOWED;
1280 }
1281 mutex_unlock(lock: &userns_state_mutex);
1282
1283 /* Report a successful write */
1284 *ppos = count;
1285 ret = count;
1286out:
1287 return ret;
1288out_unlock:
1289 mutex_unlock(lock: &userns_state_mutex);
1290 goto out;
1291}
1292
1293bool userns_may_setgroups(const struct user_namespace *ns)
1294{
1295 bool allowed;
1296
1297 mutex_lock(&userns_state_mutex);
1298 /* It is not safe to use setgroups until a gid mapping in
1299 * the user namespace has been established.
1300 */
1301 allowed = ns->gid_map.nr_extents != 0;
1302 /* Is setgroups allowed? */
1303 allowed = allowed && (ns->flags & USERNS_SETGROUPS_ALLOWED);
1304 mutex_unlock(lock: &userns_state_mutex);
1305
1306 return allowed;
1307}
1308
1309/*
1310 * Returns true if @child is the same namespace or a descendant of
1311 * @ancestor.
1312 */
1313bool in_userns(const struct user_namespace *ancestor,
1314 const struct user_namespace *child)
1315{
1316 const struct user_namespace *ns;
1317 for (ns = child; ns->level > ancestor->level; ns = ns->parent)
1318 ;
1319 return (ns == ancestor);
1320}
1321
1322bool current_in_userns(const struct user_namespace *target_ns)
1323{
1324 return in_userns(ancestor: target_ns, current_user_ns());
1325}
1326EXPORT_SYMBOL(current_in_userns);
1327
1328static struct ns_common *userns_get(struct task_struct *task)
1329{
1330 struct user_namespace *user_ns;
1331
1332 rcu_read_lock();
1333 user_ns = get_user_ns(__task_cred(task)->user_ns);
1334 rcu_read_unlock();
1335
1336 return user_ns ? &user_ns->ns : NULL;
1337}
1338
1339static void userns_put(struct ns_common *ns)
1340{
1341 put_user_ns(ns: to_user_ns(ns));
1342}
1343
1344static int userns_install(struct nsset *nsset, struct ns_common *ns)
1345{
1346 struct user_namespace *user_ns = to_user_ns(ns);
1347 struct cred *cred;
1348
1349 /* Don't allow gaining capabilities by reentering
1350 * the same user namespace.
1351 */
1352 if (user_ns == current_user_ns())
1353 return -EINVAL;
1354
1355 /* Tasks that share a thread group must share a user namespace */
1356 if (!thread_group_empty(current))
1357 return -EINVAL;
1358
1359 if (current->fs->users != 1)
1360 return -EINVAL;
1361
1362 if (!ns_capable(ns: user_ns, CAP_SYS_ADMIN))
1363 return -EPERM;
1364
1365 cred = nsset_cred(set: nsset);
1366 if (!cred)
1367 return -EINVAL;
1368
1369 put_user_ns(ns: cred->user_ns);
1370 set_cred_user_ns(cred, user_ns: get_user_ns(ns: user_ns));
1371
1372 if (set_cred_ucounts(cred) < 0)
1373 return -EINVAL;
1374
1375 return 0;
1376}
1377
1378struct ns_common *ns_get_owner(struct ns_common *ns)
1379{
1380 struct user_namespace *my_user_ns = current_user_ns();
1381 struct user_namespace *owner, *p;
1382
1383 /* See if the owner is in the current user namespace */
1384 owner = p = ns->ops->owner(ns);
1385 for (;;) {
1386 if (!p)
1387 return ERR_PTR(error: -EPERM);
1388 if (p == my_user_ns)
1389 break;
1390 p = p->parent;
1391 }
1392
1393 return &get_user_ns(ns: owner)->ns;
1394}
1395
1396static struct user_namespace *userns_owner(struct ns_common *ns)
1397{
1398 return to_user_ns(ns)->parent;
1399}
1400
1401const struct proc_ns_operations userns_operations = {
1402 .name = "user",
1403 .get = userns_get,
1404 .put = userns_put,
1405 .install = userns_install,
1406 .owner = userns_owner,
1407 .get_parent = ns_get_owner,
1408};
1409
1410static __init int user_namespaces_init(void)
1411{
1412 user_ns_cachep = KMEM_CACHE(user_namespace, SLAB_PANIC | SLAB_ACCOUNT);
1413 ns_tree_add(&init_user_ns);
1414 return 0;
1415}
1416subsys_initcall(user_namespaces_init);
1417

source code of linux/kernel/user_namespace.c