29 				struct user_namespace *ns, int cap_setid,
33 static struct ucounts *inc_user_namespaces(struct user_namespace *ns, kuid_t uid)  in inc_user_namespaces()  argument
35 	return inc_ucount(ns, uid, UCOUNT_USER_NAMESPACES);  in inc_user_namespaces()
84 	struct user_namespace *ns, *parent_ns = new->user_ns;  in create_user_ns()  local
122 	ns = kmem_cache_zalloc(user_ns_cachep, GFP_KERNEL);  in create_user_ns()
123 	if (!ns)  in create_user_ns()
126 	ns->parent_could_setfcap = cap_raised(new->cap_effective, CAP_SETFCAP);  in create_user_ns()
127 	ret = ns_alloc_inum(&ns->ns);  in create_user_ns()
130 	ns->ns.ops = &userns_operations;  in create_user_ns()
132 	refcount_set(&ns->ns.count, 1);  in create_user_ns()
134 	ns->parent = parent_ns;  in create_user_ns()
135 	ns->level = parent_ns->level + 1;  in create_user_ns()
136 	ns->owner = owner;  in create_user_ns()
137 	ns->group = group;  in create_user_ns()
138 	INIT_WORK(&ns->work, free_user_ns);  in create_user_ns()
140 		ns->ucount_max[i] = INT_MAX;  in create_user_ns()
142 	set_userns_rlimit_max(ns, UCOUNT_RLIMIT_NPROC, enforced_nproc_rlimit());  in create_user_ns()
143 	set_userns_rlimit_max(ns, UCOUNT_RLIMIT_MSGQUEUE, rlimit(RLIMIT_MSGQUEUE));  in create_user_ns()
144 	set_userns_rlimit_max(ns, UCOUNT_RLIMIT_SIGPENDING, rlimit(RLIMIT_SIGPENDING));  in create_user_ns()
145 	set_userns_rlimit_max(ns, UCOUNT_RLIMIT_MEMLOCK, rlimit(RLIMIT_MEMLOCK));  in create_user_ns()
146 	ns->ucounts = ucounts;  in create_user_ns()
150 	ns->flags = parent_ns->flags;  in create_user_ns()
154 	INIT_LIST_HEAD(&ns->keyring_name_list);  in create_user_ns()
155 	init_rwsem(&ns->keyring_sem);  in create_user_ns()
158 	if (!setup_userns_sysctls(ns))  in create_user_ns()
161 	set_cred_user_ns(new, ns);  in create_user_ns()
165 	key_put(ns->persistent_keyring_register);  in create_user_ns()
167 	ns_free_inum(&ns->ns);  in create_user_ns()
169 	kmem_cache_free(user_ns_cachep, ns);  in create_user_ns()
198 	struct user_namespace *parent, *ns =  in free_user_ns()  local
202 		struct ucounts *ucounts = ns->ucounts;  in free_user_ns()
203 		parent = ns->parent;  in free_user_ns()
204 		if (ns->gid_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) {  in free_user_ns()
205 			kfree(ns->gid_map.forward);  in free_user_ns()
206 			kfree(ns->gid_map.reverse);  in free_user_ns()
208 		if (ns->uid_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) {  in free_user_ns()
209 			kfree(ns->uid_map.forward);  in free_user_ns()
210 			kfree(ns->uid_map.reverse);  in free_user_ns()
212 		if (ns->projid_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) {  in free_user_ns()
213 			kfree(ns->projid_map.forward);  in free_user_ns()
214 			kfree(ns->projid_map.reverse);  in free_user_ns()
216 		retire_userns_sysctls(ns);  in free_user_ns()
217 		key_free_user_ns(ns);  in free_user_ns()
218 		ns_free_inum(&ns->ns);  in free_user_ns()
219 		kmem_cache_free(user_ns_cachep, ns);  in free_user_ns()
221 		ns = parent;  in free_user_ns()
222 	} while (refcount_dec_and_test(&parent->ns.count));  in free_user_ns()
225 void __put_user_ns(struct user_namespace *ns)  in __put_user_ns()  argument
227 	schedule_work(&ns->work);  in __put_user_ns()
408 kuid_t make_kuid(struct user_namespace *ns, uid_t uid)  in make_kuid()  argument
411 	return KUIDT_INIT(map_id_down(&ns->uid_map, uid));  in make_kuid()
476 kgid_t make_kgid(struct user_namespace *ns, gid_t gid)  in make_kgid()  argument
479 	return KGIDT_INIT(map_id_down(&ns->gid_map, gid));  in make_kgid()
543 kprojid_t make_kprojid(struct user_namespace *ns, projid_t projid)  in make_kprojid()  argument
546 	return KPROJIDT_INIT(map_id_down(&ns->projid_map, projid));  in make_kprojid()
601 	struct user_namespace *ns = seq->private;  in uid_m_show()  local
607 	if ((lower_ns == ns) && lower_ns->parent)  in uid_m_show()
622 	struct user_namespace *ns = seq->private;  in gid_m_show()  local
628 	if ((lower_ns == ns) && lower_ns->parent)  in gid_m_show()
643 	struct user_namespace *ns = seq->private;  in projid_m_show()  local
649 	if ((lower_ns == ns) && lower_ns->parent)  in projid_m_show()
680 	struct user_namespace *ns = seq->private;  in uid_m_start()  local
682 	return m_start(seq, ppos, &ns->uid_map);  in uid_m_start()
687 	struct user_namespace *ns = seq->private;  in gid_m_start()  local
689 	return m_start(seq, ppos, &ns->gid_map);  in gid_m_start()
694 	struct user_namespace *ns = seq->private;  in projid_m_start()  local
696 	return m_start(seq, ppos, &ns->projid_map);  in projid_m_start()
1112 	struct user_namespace *ns = seq->private;  in proc_uid_map_write()  local
1115 	if (!ns->parent)  in proc_uid_map_write()
1118 	if ((seq_ns != ns) && (seq_ns != ns->parent))  in proc_uid_map_write()
1122 			 &ns->uid_map, &ns->parent->uid_map);  in proc_uid_map_write()
1129 	struct user_namespace *ns = seq->private;  in proc_gid_map_write()  local
1132 	if (!ns->parent)  in proc_gid_map_write()
1135 	if ((seq_ns != ns) && (seq_ns != ns->parent))  in proc_gid_map_write()
1139 			 &ns->gid_map, &ns->parent->gid_map);  in proc_gid_map_write()
1146 	struct user_namespace *ns = seq->private;  in proc_projid_map_write()  local
1149 	if (!ns->parent)  in proc_projid_map_write()
1152 	if ((seq_ns != ns) && (seq_ns != ns->parent))  in proc_projid_map_write()
1157 			 &ns->projid_map, &ns->parent->projid_map);  in proc_projid_map_write()
1161 				struct user_namespace *ns, int cap_setid,  in new_idmap_permitted()  argument
1166 	if (cap_setid == CAP_SETUID && !verify_root_map(file, ns, new_map))  in new_idmap_permitted()
1173 	    uid_eq(ns->owner, cred->euid)) {  in new_idmap_permitted()
1176 			kuid_t uid = make_kuid(ns->parent, id);  in new_idmap_permitted()
1180 			kgid_t gid = make_kgid(ns->parent, id);  in new_idmap_permitted()
1181 			if (!(ns->flags & USERNS_SETGROUPS_ALLOWED) &&  in new_idmap_permitted()
1195 	if (ns_capable(ns->parent, cap_setid) &&  in new_idmap_permitted()
1196 	    file_ns_capable(file, ns->parent, cap_setid))  in new_idmap_permitted()
1204 	struct user_namespace *ns = seq->private;  in proc_setgroups_show()  local
1205 	unsigned long userns_flags = READ_ONCE(ns->flags);  in proc_setgroups_show()
1217 	struct user_namespace *ns = seq->private;  in proc_setgroups_write()  local
1258 		if (!(ns->flags & USERNS_SETGROUPS_ALLOWED))  in proc_setgroups_write()
1264 		if (ns->gid_map.nr_extents != 0)  in proc_setgroups_write()
1266 		ns->flags &= ~USERNS_SETGROUPS_ALLOWED;  in proc_setgroups_write()
1280 bool userns_may_setgroups(const struct user_namespace *ns)  in userns_may_setgroups()  argument
1288 	allowed = ns->gid_map.nr_extents != 0;  in userns_may_setgroups()
1290 	allowed = allowed && (ns->flags & USERNS_SETGROUPS_ALLOWED);  in userns_may_setgroups()
1303 	const struct user_namespace *ns;  in in_userns()  local
1304 	for (ns = child; ns->level > ancestor->level; ns = ns->parent)  in in_userns()
1306 	return (ns == ancestor);  in in_userns()
1315 static inline struct user_namespace *to_user_ns(struct ns_common *ns)  in to_user_ns()  argument
1317 	return container_of(ns, struct user_namespace, ns);  in to_user_ns()
1328 	return user_ns ? &user_ns->ns : NULL;  in userns_get()
1331 static void userns_put(struct ns_common *ns)  in userns_put()  argument
1333 	put_user_ns(to_user_ns(ns));  in userns_put()
1336 static int userns_install(struct nsset *nsset, struct ns_common *ns)  in userns_install()  argument
1338 	struct user_namespace *user_ns = to_user_ns(ns);  in userns_install()
1370 struct ns_common *ns_get_owner(struct ns_common *ns)  in ns_get_owner()  argument
1376 	owner = p = ns->ops->owner(ns);  in ns_get_owner()
1385 	return &get_user_ns(owner)->ns;  in ns_get_owner()
1388 static struct user_namespace *userns_owner(struct ns_common *ns)  in userns_owner()  argument
1390 	return to_user_ns(ns)->parent;  in userns_owner()