linux-imx

/*

 *  This program is free software; you can redistribute it and/or

 *  modify it under the terms of the GNU General Public License as

 *  published by the Free Software Foundation, version 2 of the

 *  License.

 */

​

#include <linux/stat.h>

#include <linux/sysctl.h>

#include <linux/slab.h>

#include <linux/cred.h>

#include <linux/hash.h>

#include <linux/kmemleak.h>

#include <linux/user_namespace.h>

​

#define UCOUNTS_HASHTABLE_BITS 10

static struct hlist_head ucounts_hashtable[(1 << UCOUNTS_HASHTABLE_BITS)];

static DEFINE_SPINLOCK(ucounts_lock);

​

#define ucounts_hashfn(ns, uid)                     \

    hash_long((unsigned long)__kuid_val(uid) + (unsigned long)(ns), \

          UCOUNTS_HASHTABLE_BITS)

#define ucounts_hashentry(ns, uid)  \

    (ucounts_hashtable + ucounts_hashfn(ns, uid))

​

​

#ifdef CONFIG_SYSCTL

static struct ctl_table_set *

set_lookup(struct ctl_table_root *root)

{

    return &current_user_ns()->set;

}

​

static int set_is_seen(struct ctl_table_set *set)

{

    return &current_user_ns()->set == set;

}

​

static int set_permissions(struct ctl_table_header *head,

                  struct ctl_table *table)

{

    struct user_namespace *user_ns =

        container_of(head->set, struct user_namespace, set);

    int mode;

​

    /* Allow users with CAP_SYS_RESOURCE unrestrained access */

    if (ns_capable(user_ns, CAP_SYS_RESOURCE))

        mode = (table->mode & S_IRWXU) >> 6;

    else

    /* Allow all others at most read-only access */

        mode = table->mode & S_IROTH;

    return (mode << 6) | (mode << 3) | mode;

}

​

static struct ctl_table_root set_root = {

    .lookup = set_lookup,

    .permissions = set_permissions,

};

​

static int zero = 0;

static int int_max = INT_MAX;

#define UCOUNT_ENTRY(name)              \

    {                       \

        .procname   = name,         \

        .maxlen     = sizeof(int),      \

        .mode       = 0644,         \

        .proc_handler   = proc_dointvec_minmax, \

        .extra1     = &zero,        \

        .extra2     = &int_max,     \

    }

static struct ctl_table user_table[] = {

    UCOUNT_ENTRY("max_user_namespaces"),

    UCOUNT_ENTRY("max_pid_namespaces"),

    UCOUNT_ENTRY("max_uts_namespaces"),

    UCOUNT_ENTRY("max_ipc_namespaces"),

    UCOUNT_ENTRY("max_net_namespaces"),

    UCOUNT_ENTRY("max_mnt_namespaces"),

    UCOUNT_ENTRY("max_cgroup_namespaces"),

#ifdef CONFIG_INOTIFY_USER

    UCOUNT_ENTRY("max_inotify_instances"),

    UCOUNT_ENTRY("max_inotify_watches"),

#endif

    { }

};

#endif /* CONFIG_SYSCTL */

​

bool setup_userns_sysctls(struct user_namespace *ns)

{

#ifdef CONFIG_SYSCTL

    struct ctl_table *tbl;

    setup_sysctl_set(&ns->set, &set_root, set_is_seen);

    tbl = kmemdup(user_table, sizeof(user_table), GFP_KERNEL);