--- /dev/null
+dnl #
+dnl # 2.6.38 API change
+dnl # ns_capable() was introduced
+dnl #
+AC_DEFUN([ZFS_AC_KERNEL_NS_CAPABLE], [
+ AC_MSG_CHECKING([whether ns_capable exists])
+ ZFS_LINUX_TRY_COMPILE([
+ #include <linux/capability.h>
+ ],[
+ ns_capable((struct user_namespace *)NULL, CAP_SYS_ADMIN);
+ ],[
+ AC_MSG_RESULT(yes)
+ AC_DEFINE(HAVE_NS_CAPABLE, 1,
+ [ns_capable exists])
+ ],[
+ AC_MSG_RESULT(no)
+ ])
+])
+
+dnl #
+dnl # 2.6.39 API change
+dnl # struct user_namespace was added to struct cred_t as
+dnl # cred->user_ns member
+dnl # Note that current_user_ns() was added in 2.6.28.
+dnl #
+AC_DEFUN([ZFS_AC_KERNEL_CRED_USER_NS], [
+ AC_MSG_CHECKING([whether cred_t->user_ns exists])
+ ZFS_LINUX_TRY_COMPILE([
+ #include <linux/cred.h>
+ ],[
+ struct cred cr;
+ cr.user_ns = (struct user_namespace *)NULL;
+ ],[
+ AC_MSG_RESULT(yes)
+ AC_DEFINE(HAVE_CRED_USER_NS, 1,
+ [cred_t->user_ns exists])
+ ],[
+ AC_MSG_RESULT(no)
+ ])
+])
+
+dnl #
+dnl # 3.4 API change
+dnl # kuid_has_mapping() and kgid_has_mapping() were added to distinguish
+dnl # between internal kernel uids/gids and user namespace uids/gids.
+dnl #
+AC_DEFUN([ZFS_AC_KERNEL_KUID_HAS_MAPPING], [
+ AC_MSG_CHECKING([whether kuid_has_mapping/kgid_has_mapping exist])
+ ZFS_LINUX_TRY_COMPILE([
+ #include <linux/uidgid.h>
+ ],[
+ kuid_has_mapping((struct user_namespace *)NULL, KUIDT_INIT(0));
+ kgid_has_mapping((struct user_namespace *)NULL, KGIDT_INIT(0));
+ ],[
+ AC_MSG_RESULT(yes)
+ AC_DEFINE(HAVE_KUID_HAS_MAPPING, 1,
+ [kuid_has_mapping/kgid_has_mapping exist])
+ ],[
+ AC_MSG_RESULT(no)
+ ])
+])
+
+AC_DEFUN([ZFS_AC_KERNEL_USERNS_CAPABILITIES], [
+ ZFS_AC_KERNEL_NS_CAPABLE
+ ZFS_AC_KERNEL_CRED_USER_NS
+ ZFS_AC_KERNEL_KUID_HAS_MAPPING
+])
ZFS_AC_KERNEL_CURRENT_TIME
ZFS_AC_KERNEL_GLOBAL_PAGE_STATE
ZFS_AC_KERNEL_ACL_HAS_REFCOUNT
+ ZFS_AC_KERNEL_USERNS_CAPABILITIES
AS_IF([test "$LINUX_OBJ" != "$LINUX"], [
KERNEL_MAKE="$KERNEL_MAKE O=$LINUX_OBJ"
tests/zfs-tests/callbacks/Makefile
tests/zfs-tests/cmd/Makefile
tests/zfs-tests/cmd/chg_usr_exec/Makefile
+ tests/zfs-tests/cmd/user_ns_exec/Makefile
tests/zfs-tests/cmd/devname2devid/Makefile
tests/zfs-tests/cmd/dir_rd_update/Makefile
tests/zfs-tests/cmd/file_check/Makefile
tests/zfs-tests/tests/functional/threadsappend/Makefile
tests/zfs-tests/tests/functional/tmpfile/Makefile
tests/zfs-tests/tests/functional/truncate/Makefile
+ tests/zfs-tests/tests/functional/user_namespace/Makefile
tests/zfs-tests/tests/functional/userquota/Makefile
tests/zfs-tests/tests/functional/upgrade/Makefile
tests/zfs-tests/tests/functional/vdev_zaps/Makefile
* all other cases this function must fail and return the passed err.
*/
static int
-priv_policy(const cred_t *cr, int capability, boolean_t all, int err)
+priv_policy_ns(const cred_t *cr, int capability, boolean_t all, int err,
+ struct user_namespace *ns)
{
ASSERT3S(all, ==, B_FALSE);
if (cr != CRED() && (cr != kcred))
return (err);
+#if defined(CONFIG_USER_NS) && defined(HAVE_NS_CAPABLE)
+ if (!(ns ? ns_capable(ns, capability) : capable(capability)))
+#else
if (!capable(capability))
+#endif
return (err);
return (0);
}
+static int
+priv_policy(const cred_t *cr, int capability, boolean_t all, int err)
+{
+ return (priv_policy_ns(cr, capability, all, err, NULL));
+}
+
+static int
+priv_policy_user(const cred_t *cr, int capability, boolean_t all, int err)
+{
+ /*
+ * All priv_policy_user checks are preceeded by kuid/kgid_has_mapping()
+ * checks. If we cannot do them, we shouldn't be using ns_capable()
+ * since we don't know whether the affected files are valid in our
+ * namespace. Note that kuid_has_mapping() came after cred->user_ns, so
+ * we shouldn't need to re-check for HAVE_CRED_USER_NS
+ */
+#if defined(CONFIG_USER_NS) && defined(HAVE_KUID_HAS_MAPPING)
+ return (priv_policy_ns(cr, capability, all, err, cr->user_ns));
+#else
+ return (priv_policy_ns(cr, capability, all, err, NULL));
+#endif
+}
+
/*
* Checks for operations that are either client-only or are used by
* both clients and servers.
if (zpl_inode_owner_or_capable(ip))
return (0);
- if (priv_policy(cr, CAP_DAC_OVERRIDE, B_FALSE, EPERM) == 0)
+#if defined(CONFIG_USER_NS) && defined(HAVE_KUID_HAS_MAPPING)
+ if (!kuid_has_mapping(cr->user_ns, SUID_TO_KUID(owner)))
+ return (EPERM);
+#endif
+
+ if (priv_policy_user(cr, CAP_DAC_OVERRIDE, B_FALSE, EPERM) == 0)
return (0);
- if (priv_policy(cr, CAP_DAC_READ_SEARCH, B_FALSE, EPERM) == 0)
+ if (priv_policy_user(cr, CAP_DAC_READ_SEARCH, B_FALSE, EPERM) == 0)
return (0);
return (EPERM);
if (crgetfsuid(cr) == owner)
return (0);
- return (priv_policy(cr, CAP_FOWNER, B_FALSE, EPERM));
+#if defined(CONFIG_USER_NS) && defined(HAVE_KUID_HAS_MAPPING)
+ if (!kuid_has_mapping(cr->user_ns, SUID_TO_KUID(owner)))
+ return (EPERM);
+#endif
+
+ return (priv_policy_user(cr, CAP_FOWNER, B_FALSE, EPERM));
}
/*
if (crgetfsuid(cr) == owner)
return (0);
- return (priv_policy(cr, CAP_FOWNER, B_FALSE, EPERM));
+#if defined(CONFIG_USER_NS) && defined(HAVE_KUID_HAS_MAPPING)
+ if (!kuid_has_mapping(cr->user_ns, SUID_TO_KUID(owner)))
+ return (EPERM);
+#endif
+
+ return (priv_policy_user(cr, CAP_FOWNER, B_FALSE, EPERM));
}
/*
int
secpolicy_vnode_setids_setgids(const cred_t *cr, gid_t gid)
{
+#if defined(CONFIG_USER_NS) && defined(HAVE_KUID_HAS_MAPPING)
+ if (!kgid_has_mapping(cr->user_ns, SGID_TO_KGID(gid)))
+ return (EPERM);
+#endif
if (crgetfsgid(cr) != gid && !groupmember(gid, cr))
- return (priv_policy(cr, CAP_FSETID, B_FALSE, EPERM));
+ return (priv_policy_user(cr, CAP_FSETID, B_FALSE, EPERM));
return (0);
}
if (crgetfsuid(cr) == owner)
return (0);
- return (priv_policy(cr, CAP_FSETID, B_FALSE, EPERM));
+#if defined(CONFIG_USER_NS) && defined(HAVE_KUID_HAS_MAPPING)
+ if (!kuid_has_mapping(cr->user_ns, SUID_TO_KUID(owner)))
+ return (EPERM);
+#endif
+
+ return (priv_policy_user(cr, CAP_FSETID, B_FALSE, EPERM));
}
/*
tests = ['upgrade_userobj_001_pos', 'upgrade_projectquota_001_pos']
tags = ['functional', 'upgrade']
+[tests/functional/user_namespace]
+tests = ['user_namespace_001']
+tags = ['functional', 'user_namespace']
+
[tests/functional/userquota]
tests = [
'userquota_001_pos', 'userquota_002_pos', 'userquota_003_pos',
SUBDIRS = \
chg_usr_exec \
+ user_ns_exec \
devname2devid \
dir_rd_update \
file_check \
--- /dev/null
+/user_ns_exec
--- /dev/null
+include $(top_srcdir)/config/Rules.am
+
+pkgexecdir = $(datadir)/@PACKAGE@/zfs-tests/bin
+
+pkgexec_PROGRAMS = user_ns_exec
+user_ns_exec_SOURCES = user_ns_exec.c
--- /dev/null
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <limits.h>
+#include <sys/types.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/wait.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <signal.h>
+#include <sched.h>
+
+#define EXECSHELL "/bin/sh"
+#define UIDMAP "0 100000 65536"
+
+static int
+child_main(int argc, char *argv[], int sync_pipe)
+{
+ char sync_buf;
+ char cmds[BUFSIZ] = { 0 };
+ char sep[] = " ";
+ int i, len;
+
+ if (unshare(CLONE_NEWUSER | CLONE_NEWNS) != 0) {
+ perror("unshare");
+ return (1);
+ }
+
+ /* tell parent we entered the new namespace */
+ if (write(sync_pipe, "1", 1) != 1) {
+ perror("write");
+ return (1);
+ }
+
+ /* wait for parent to setup the uid mapping */
+ if (read(sync_pipe, &sync_buf, 1) != 1) {
+ (void) fprintf(stderr, "user namespace setup failed\n");
+ return (1);
+ }
+
+ close(sync_pipe);
+
+ if (setuid(0) != 0) {
+ perror("setuid");
+ return (1);
+ }
+ if (setgid(0) != 0) {
+ perror("setgid");
+ return (1);
+ }
+
+ len = 0;
+ for (i = 1; i < argc; i++) {
+ (void) snprintf(cmds+len, sizeof (cmds)-len,
+ "%s%s", argv[i], sep);
+ len += strlen(argv[i]) + strlen(sep);
+ }
+
+ if (execl(EXECSHELL, "sh", "-c", cmds, (char *)NULL) != 0) {
+ perror("execl: " EXECSHELL);
+ return (1);
+ }
+
+ return (0);
+}
+
+static int
+set_idmap(pid_t pid, const char *file)
+{
+ int result = 0;
+ int mapfd;
+ char path[PATH_MAX];
+
+ (void) snprintf(path, sizeof (path), "/proc/%d/%s", (int)pid, file);
+
+ mapfd = open(path, O_WRONLY);
+ if (mapfd < 0) {
+ result = errno;
+ perror("open");
+ return (errno);
+ }
+
+ if (write(mapfd, UIDMAP, sizeof (UIDMAP)-1) != sizeof (UIDMAP)-1) {
+ perror("write");
+ result = (errno);
+ }
+
+ close(mapfd);
+
+ return (result);
+}
+
+int
+main(int argc, char *argv[])
+{
+ char sync_buf;
+ int result, wstatus;
+ int syncfd[2];
+ pid_t child;
+
+ if (argc < 2 || strlen(argv[1]) == 0) {
+ (void) printf("\tUsage: %s <commands> ...\n", argv[0]);
+ return (1);
+ }
+
+ if (socketpair(AF_UNIX, SOCK_STREAM, 0, syncfd) != 0) {
+ perror("socketpair");
+ return (1);
+ }
+
+ child = fork();
+ if (child == (pid_t)-1) {
+ perror("fork");
+ return (1);
+ }
+
+ if (child == 0) {
+ close(syncfd[0]);
+ return (child_main(argc, argv, syncfd[1]));
+ }
+
+ close(syncfd[1]);
+
+ result = 0;
+ /* wait for the child to have unshared its namespaces */
+ if (read(syncfd[0], &sync_buf, 1) != 1) {
+ perror("read");
+ kill(child, SIGKILL);
+ result = 1;
+ goto reap;
+ }
+
+ /* write uid mapping */
+ if (set_idmap(child, "uid_map") != 0 ||
+ set_idmap(child, "gid_map") != 0) {
+ result = 1;
+ kill(child, SIGKILL);
+ goto reap;
+ }
+
+ /* tell the child to proceed */
+ if (write(syncfd[0], "1", 1) != 1) {
+ perror("write");
+ kill(child, SIGKILL);
+ result = 1;
+ goto reap;
+ }
+ close(syncfd[0]);
+
+reap:
+ while (waitpid(child, &wstatus, 0) != child)
+ kill(child, SIGKILL);
+ if (result == 0)
+ result = WEXITSTATUS(wstatus);
+
+ return (result);
+}
rename_dir
rm_lnkcnt_zero_file
threadsappend
+ user_ns_exec
xattrtest'
tmpfile \
truncate \
upgrade \
+ user_namespace \
userquota \
vdev_zaps \
write_dirs \
--- /dev/null
+pkgdatadir = $(datadir)/@PACKAGE@/zfs-tests/tests/functional/user_namespace
+dist_pkgdata_SCRIPTS = \
+ setup.ksh \
+ cleanup.ksh \
+ user_namespace_common.kshlib \
+ user_namespace.cfg \
+ user_namespace_001.ksh
--- /dev/null
+#!/bin/ksh -p
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+. $STF_SUITE/include/libtest.shlib
+
+default_cleanup
--- /dev/null
+#!/bin/ksh -p
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+. $STF_SUITE/include/libtest.shlib
+
+if ! [ -f /proc/self/uid_map ]; then
+ log_unsupported "The kernel doesn't support user namespaces."
+fi
+
+verify_runnable "both"
+
+DISK=${DISKS%% *}
+default_setup $DISK
--- /dev/null
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+export ROOT_UID=100000
+export OTHER_UID=101000
--- /dev/null
+#!/bin/ksh -p
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+. $STF_SUITE/tests/functional/user_namespace/user_namespace_common.kshlib
+
+#
+#
+# DESCRIPTION:
+# Regression test for secpolicy_vnode_setids_setgids
+#
+#
+# STRATEGY:
+# 1. Create files with various owners.
+# 2. Try to set setgid bit.
+#
+
+verify_runnable "both"
+
+# rroot: real root,
+# uroot: root within user namespace
+# uother: other user within user namespace
+set -A files rroot_rroot uroot_uroot uroot_other uother_uroot uother_uother
+
+function cleanup
+{
+ for i in ${files[*]}; do
+ log_must rm -f $TESTDIR/$i
+ done
+}
+
+log_onexit cleanup
+
+log_assert "Check root in user namespaces"
+
+TOUCH=$(readlink -e $(which touch))
+CHMOD=$(readlink -e $(which chmod))
+
+for i in ${files[*]}; do
+ log_must $TOUCH $TESTDIR/$i
+ log_must $CHMOD 0644 $TESTDIR/$i
+done
+
+log_must chown 0:0 $TESTDIR/rroot_rroot
+log_must chown $ROOT_UID:$ROOT_UID $TESTDIR/uroot_uroot
+log_must chown $ROOT_UID:$OTHER_UID $TESTDIR/uroot_other
+log_must chown $OTHER_UID:$ROOT_UID $TESTDIR/uother_uroot
+log_must chown $OTHER_UID:$OTHER_UID $TESTDIR/uother_uother
+
+log_mustnot user_ns_exec $CHMOD 02755 $TESTDIR/rroot_rroot
+log_mustnot test -g $TESTDIR/rroot_rroot
+
+log_must user_ns_exec $CHMOD 02755 $TESTDIR/uroot_uroot
+log_must test -g $TESTDIR/uroot_uroot
+
+log_must user_ns_exec $CHMOD 02755 $TESTDIR/uroot_other
+log_must test -g $TESTDIR/uroot_other
+
+log_must user_ns_exec $CHMOD 02755 $TESTDIR/uother_uroot
+log_must test -g $TESTDIR/uother_uroot
+
+log_must user_ns_exec $CHMOD 02755 $TESTDIR/uother_uother
+log_must test -g $TESTDIR/uother_uother
+
+log_mustnot user_ns_exec $TOUCH $TESTDIR/rroot_rroot
+log_must $CHMOD 0666 $TESTDIR/rroot_rroot
+for i in ${files[*]}; do
+ log_must user_ns_exec $TOUCH $TESTDIR/$i
+done
+
+log_pass "Check root in user namespaces"
--- /dev/null
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+. $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/user_namespace/user_namespace.cfg
projects / zfs / commitdiff