Pull namespace updates from Eric Biederman:
"This set of changes is a number of smaller things that have been
overlooked in other development cycles focused on more fundamental
change. The devpts changes are small things that were a distraction
until we managed to kill off DEVPTS_MULTPLE_INSTANCES. There is an
trivial regression fix to autofs for the unprivileged mount changes
that went in last cycle. A pair of ioctls has been added by Andrey
Vagin making it is possible to discover the relationships between
namespaces when referring to them through file descriptors.
The big user visible change is starting to add simple resource limits
to catch programs that misbehave. With namespaces in general and user
namespaces in particular allowing users to use more kinds of
resources, it has become important to have something to limit errant
programs. Because the purpose of these limits is to catch errant
programs the code needs to be inexpensive to use as it always on, and
the default limits need to be high enough that well behaved programs
on well behaved systems don't encounter them.
To this end, after some review I have implemented per user per user
namespace limits, and use them to limit the number of namespaces. The
limits being per user mean that one user can not exhause the limits of
another user. The limits being per user namespace allow contexts where
the limit is 0 and security conscious folks can remove from their
threat anlysis the code used to manage namespaces (as they have
historically done as it root only). At the same time the limits being
per user namespace allow other parts of the system to use namespaces.
Namespaces are increasingly being used in application sand boxing
scenarios so an all or nothing disable for the entire system for the
security conscious folks makes increasing use of these sandboxes
impossible.
There is also added a limit on the maximum number of mounts present in
a single mount namespace. It is nontrivial to guess what a reasonable
system wide limit on the number of mount structure in the kernel would
be, especially as it various based on how a system is using
containers. A limit on the number of mounts in a mount namespace
however is much easier to understand and set. In most cases in
practice only about 1000 mounts are used. Given that some autofs
scenarious have the potential to be 30,000 to 50,000 mounts I have set
the default limit for the number of mounts at 100,000 which is well
above every known set of users but low enough that the mount hash
tables don't degrade unreaonsably.
These limits are a start. I expect this estabilishes a pattern that
other limits for resources that namespaces use will follow. There has
been interest in making inotify event limits per user per user
namespace as well as interest expressed in making details about what
is going on in the kernel more visible"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: (28 commits)
autofs: Fix automounts by using current_real_cred()->uid
mnt: Add a per mount namespace limit on the number of mounts
netns: move {inc,dec}_net_namespaces into #ifdef
nsfs: Simplify __ns_get_path
tools/testing: add a test to check nsfs ioctl-s
nsfs: add ioctl to get a parent namespace
nsfs: add ioctl to get an owning user namespace for ns file descriptor
kernel: add a helper to get an owning user namespace for a namespace
devpts: Change the owner of /dev/pts/ptmx to the mounter of /dev/pts
devpts: Remove sync_filesystems
devpts: Make devpts_kill_sb safe if fsi is NULL
devpts: Simplify devpts_mount by using mount_nodev
devpts: Move the creation of /dev/pts/ptmx into fill_super
devpts: Move parse_mount_options into fill_super
userns: When the per user per user namespace limit is reached return ENOSPC
userns; Document per user per user namespace limits.
mntns: Add a limit on the number of mount namespaces.
netns: Add a limit on the number of net namespaces
cgroupns: Add a limit on the number of cgroup namespaces
ipcns: Add a limit on the number of ipc namespaces
...
master
Linus Torvalds
7 years ago
commit
14986a34e1
@ -0,0 +1,66 @@
|
||||
Documentation for /proc/sys/user/* kernel version 4.9.0
|
||||
(c) 2016 Eric Biederman <ebiederm@xmission.com>
|
||||
|
||||
==============================================================
|
||||
|
||||
This file contains the documetation for the sysctl files in
|
||||
/proc/sys/user.
|
||||
|
||||
The files in this directory can be used to override the default
|
||||
limits on the number of namespaces and other objects that have
|
||||
per user per user namespace limits.
|
||||
|
||||
The primary purpose of these limits is to stop programs that
|
||||
malfunction and attempt to create a ridiculous number of objects,
|
||||
before the malfunction becomes a system wide problem. It is the
|
||||
intention that the defaults of these limits are set high enough that
|
||||
no program in normal operation should run into these limits.
|
||||
|
||||
The creation of per user per user namespace objects are charged to
|
||||
the user in the user namespace who created the object and
|
||||
verified to be below the per user limit in that user namespace.
|
||||
|
||||
The creation of objects is also charged to all of the users
|
||||
who created user namespaces the creation of the object happens
|
||||
in (user namespaces can be nested) and verified to be below the per user
|
||||
limits in the user namespaces of those users.
|
||||
|
||||
This recursive counting of created objects ensures that creating a
|
||||
user namespace does not allow a user to escape their current limits.
|
||||
|
||||
Currently, these files are in /proc/sys/user:
|
||||
|
||||
- max_cgroup_namespaces
|
||||
|
||||
The maximum number of cgroup namespaces that any user in the current
|
||||
user namespace may create.
|
||||
|
||||
- max_ipc_namespaces
|
||||
|
||||
The maximum number of ipc namespaces that any user in the current
|
||||
user namespace may create.
|
||||
|
||||
- max_mnt_namespaces
|
||||
|
||||
The maximum number of mount namespaces that any user in the current
|
||||
user namespace may create.
|
||||
|
||||
- max_net_namespaces
|
||||
|
||||
The maximum number of network namespaces that any user in the
|
||||
current user namespace may create.
|
||||
|
||||
- max_pid_namespaces
|
||||
|
||||
The maximum number of pid namespaces that any user in the current
|
||||
user namespace may create.
|
||||
|
||||
- max_user_namespaces
|
||||
|
||||
The maximum number of user namespaces that any user in the current
|
||||
user namespace may create.
|
||||
|
||||
- max_uts_namespaces
|
||||
|
||||
The maximum number of user namespaces that any user in the current
|
||||
user namespace may create.
|
||||
@ -0,0 +1,13 @@
|
||||
#ifndef __LINUX_NSFS_H
|
||||
#define __LINUX_NSFS_H
|
||||
|
||||
#include <linux/ioctl.h>
|
||||
|
||||
#define NSIO 0xb7
|
||||
|
||||
/* Returns a file descriptor that refers to an owning user namespace */
|
||||
#define NS_GET_USERNS _IO(NSIO, 0x1)
|
||||
/* Returns a file descriptor that refers to a parent namespace */
|
||||
#define NS_GET_PARENT _IO(NSIO, 0x2)
|
||||
|
||||
#endif /* __LINUX_NSFS_H */
|
||||
@ -0,0 +1,235 @@
|
||||
/*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License as
|
||||
* published by the Free Software Foundation, version 2 of the
|
||||
* License.
|
||||
*/
|
||||
|
||||
#include <linux/stat.h>
|
||||
#include <linux/sysctl.h>
|
||||
#include <linux/slab.h>
|
||||
#include <linux/hash.h>
|
||||
#include <linux/user_namespace.h>
|
||||
|
||||
#define UCOUNTS_HASHTABLE_BITS 10
|
||||
static struct hlist_head ucounts_hashtable[(1 << UCOUNTS_HASHTABLE_BITS)];
|
||||
static DEFINE_SPINLOCK(ucounts_lock);
|
||||
|
||||
#define ucounts_hashfn(ns, uid) \
|
||||
hash_long((unsigned long)__kuid_val(uid) + (unsigned long)(ns), \
|
||||
UCOUNTS_HASHTABLE_BITS)
|
||||
#define ucounts_hashentry(ns, uid) \
|
||||
(ucounts_hashtable + ucounts_hashfn(ns, uid))
|
||||
|
||||
|
||||
#ifdef CONFIG_SYSCTL
|
||||
static struct ctl_table_set *
|
||||
set_lookup(struct ctl_table_root *root)
|
||||
{
|
||||
return ¤t_user_ns()->set;
|
||||
}
|
||||
|
||||
static int set_is_seen(struct ctl_table_set *set)
|
||||
{
|
||||
return ¤t_user_ns()->set == set;
|
||||
}
|
||||
|
||||
static int set_permissions(struct ctl_table_header *head,
|
||||
struct ctl_table *table)
|
||||
{
|
||||
struct user_namespace *user_ns =
|
||||
container_of(head->set, struct user_namespace, set);
|
||||
int mode;
|
||||
|
||||
/* Allow users with CAP_SYS_RESOURCE unrestrained access */
|
||||
if (ns_capable(user_ns, CAP_SYS_RESOURCE))
|
||||
mode = (table->mode & S_IRWXU) >> 6;
|
||||
else
|
||||
/* Allow all others at most read-only access */
|
||||
mode = table->mode & S_IROTH;
|
||||
return (mode << 6) | (mode << 3) | mode;
|
||||
}
|
||||
|
||||
static struct ctl_table_root set_root = {
|
||||
.lookup = set_lookup,
|
||||
.permissions = set_permissions,
|
||||
};
|
||||
|
||||
static int zero = 0;
|
||||
static int int_max = INT_MAX;
|
||||
#define UCOUNT_ENTRY(name) \
|
||||
{ \
|
||||
.procname = name, \
|
||||
.maxlen = sizeof(int), \
|
||||
.mode = 0644, \
|
||||
.proc_handler = proc_dointvec_minmax, \
|
||||
.extra1 = &zero, \
|
||||
.extra2 = &int_max, \
|
||||
}
|
||||
static struct ctl_table user_table[] = {
|
||||
UCOUNT_ENTRY("max_user_namespaces"),
|
||||
UCOUNT_ENTRY("max_pid_namespaces"),
|
||||
UCOUNT_ENTRY("max_uts_namespaces"),
|
||||
UCOUNT_ENTRY("max_ipc_namespaces"),
|
||||
UCOUNT_ENTRY("max_net_namespaces"),
|
||||
UCOUNT_ENTRY("max_mnt_namespaces"),
|
||||
UCOUNT_ENTRY("max_cgroup_namespaces"),
|
||||
{ }
|
||||
};
|
||||
#endif /* CONFIG_SYSCTL */
|
||||
|
||||
bool setup_userns_sysctls(struct user_namespace *ns)
|
||||
{
|
||||
#ifdef CONFIG_SYSCTL
|
||||
struct ctl_table *tbl;
|
||||
setup_sysctl_set(&ns->set, &set_root, set_is_seen);
|
||||
tbl = kmemdup(user_table, sizeof(user_table), GFP_KERNEL);
|
||||
if (tbl) {
|
||||
int i;
|
||||
for (i = 0; i < UCOUNT_COUNTS; i++) {
|
||||
tbl[i].data = &ns->ucount_max[i];
|
||||
}
|
||||
ns->sysctls = __register_sysctl_table(&ns->set, "user", tbl);
|
||||
}
|
||||
if (!ns->sysctls) {
|
||||
kfree(tbl);
|
||||
retire_sysctl_set(&ns->set);
|
||||
return false;
|
||||
}
|
||||
#endif
|
||||
return true;
|
||||
}
|
||||
|
||||
void retire_userns_sysctls(struct user_namespace *ns)
|
||||
{
|
||||
#ifdef CONFIG_SYSCTL
|
||||
struct ctl_table *tbl;
|
||||
|
||||
tbl = ns->sysctls->ctl_table_arg;
|
||||
unregister_sysctl_table(ns->sysctls);
|
||||
retire_sysctl_set(&ns->set);
|
||||
kfree(tbl);
|
||||
#endif
|
||||
}
|
||||
|
||||
static struct ucounts *find_ucounts(struct user_namespace *ns, kuid_t uid, struct hlist_head *hashent)
|
||||
{
|
||||
struct ucounts *ucounts;
|
||||
|
||||
hlist_for_each_entry(ucounts, hashent, node) {
|
||||
if (uid_eq(ucounts->uid, uid) && (ucounts->ns == ns))
|
||||
return ucounts;
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
|
||||
static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
|
||||
{
|
||||
struct hlist_head *hashent = ucounts_hashentry(ns, uid);
|
||||
struct ucounts *ucounts, *new;
|
||||
|
||||
spin_lock(&ucounts_lock);
|
||||
ucounts = find_ucounts(ns, uid, hashent);
|
||||
if (!ucounts) {
|
||||
spin_unlock(&ucounts_lock);
|
||||
|
||||
new = kzalloc(sizeof(*new), GFP_KERNEL);
|
||||
if (!new)
|
||||
return NULL;
|
||||
|
||||
new->ns = ns;
|
||||
new->uid = uid;
|
||||
atomic_set(&new->count, 0);
|
||||
|
||||
spin_lock(&ucounts_lock);
|
||||
ucounts = find_ucounts(ns, uid, hashent);
|
||||
if (ucounts) {
|
||||
kfree(new);
|
||||
} else {
|
||||
hlist_add_head(&new->node, hashent);
|
||||
ucounts = new;
|
||||
}
|
||||
}
|
||||
if (!atomic_add_unless(&ucounts->count, 1, INT_MAX))
|
||||
ucounts = NULL;
|
||||
spin_unlock(&ucounts_lock);
|
||||
return ucounts;
|
||||
}
|
||||
|
||||
static void put_ucounts(struct ucounts *ucounts)
|
||||
{
|
||||
if (atomic_dec_and_test(&ucounts->count)) {
|
||||
spin_lock(&ucounts_lock);
|
||||
hlist_del_init(&ucounts->node);
|
||||
spin_unlock(&ucounts_lock);
|
||||
|
||||
kfree(ucounts);
|
||||
}
|
||||
}
|
||||
|
||||
static inline bool atomic_inc_below(atomic_t *v, int u)
|
||||
{
|
||||
int c, old;
|
||||
c = atomic_read(v);
|
||||
for (;;) {
|
||||
if (unlikely(c >= u))
|
||||
return false;
|
||||
old = atomic_cmpxchg(v, c, c+1);
|
||||
if (likely(old == c))
|
||||
return true;
|
||||
c = old;
|
||||
}
|
||||
}
|
||||
|
||||
struct ucounts *inc_ucount(struct user_namespace *ns, kuid_t uid,
|
||||
enum ucount_type type)
|
||||
{
|
||||
struct ucounts *ucounts, *iter, *bad;
|
||||
struct user_namespace *tns;
|
||||
ucounts = get_ucounts(ns, uid);
|
||||
for (iter = ucounts; iter; iter = tns->ucounts) {
|
||||
int max;
|
||||
tns = iter->ns;
|
||||
max = READ_ONCE(tns->ucount_max[type]);
|
||||
if (!atomic_inc_below(&iter->ucount[type], max))
|
||||
goto fail;
|
||||
}
|
||||
return ucounts;
|
||||
fail:
|
||||
bad = iter;
|
||||
for (iter = ucounts; iter != bad; iter = iter->ns->ucounts)
|
||||
atomic_dec(&iter->ucount[type]);
|
||||
|
||||
put_ucounts(ucounts);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
void dec_ucount(struct ucounts *ucounts, enum ucount_type type)
|
||||
{
|
||||
struct ucounts *iter;
|
||||
for (iter = ucounts; iter; iter = iter->ns->ucounts) {
|
||||
int dec = atomic_dec_if_positive(&iter->ucount[type]);
|
||||
WARN_ON_ONCE(dec < 0);
|
||||
}
|
||||
put_ucounts(ucounts);
|
||||
}
|
||||
|
||||
static __init int user_namespace_sysctl_init(void)
|
||||
{
|
||||
#ifdef CONFIG_SYSCTL
|
||||
static struct ctl_table_header *user_header;
|
||||
static struct ctl_table empty[1];
|
||||
/*
|
||||
* It is necessary to register the user directory in the
|
||||
* default set so that registrations in the child sets work
|
||||
* properly.
|
||||
*/
|
||||
user_header = register_sysctl("user", empty);
|
||||
BUG_ON(!user_header);
|
||||
BUG_ON(!setup_userns_sysctls(&init_user_ns));
|
||||
#endif
|
||||
return 0;
|
||||
}
|
||||
subsys_initcall(user_namespace_sysctl_init);
|
||||
|
||||
|
||||