userns: Make the count of user namespaces per user
Add a structure that is per user and per user ns and use it to hold
the count of user namespaces. This makes prevents one user from
creating denying service to another user by creating the maximum
number of user namespaces.
Rename the sysctl export of the maximum count from
/proc/sys/userns/max_user_namespaces to /proc/sys/user/max_user_namespaces
to reflect that the count is now per user.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
index 6421cca..826de7a1 100644
--- a/include/linux/user_namespace.h
+++ b/include/linux/user_namespace.h
@@ -22,6 +22,7 @@
#define USERNS_INIT_FLAGS USERNS_SETGROUPS_ALLOWED
+struct ucounts;
struct user_namespace {
struct uid_gid_map uid_map;
struct uid_gid_map gid_map;
@@ -44,15 +45,24 @@
struct ctl_table_set set;
struct ctl_table_header *sysctls;
#endif
+ struct ucounts *ucounts;
int max_user_namespaces;
+};
+
+struct ucounts {
+ struct hlist_node node;
+ struct user_namespace *ns;
+ kuid_t uid;
+ atomic_t count;
atomic_t user_namespaces;
};
extern struct user_namespace init_user_ns;
-extern bool setup_userns_sysctls(struct user_namespace *ns);
-extern void retire_userns_sysctls(struct user_namespace *ns);
-extern bool inc_user_namespaces(struct user_namespace *ns);
-extern void dec_user_namespaces(struct user_namespace *ns);
+
+bool setup_userns_sysctls(struct user_namespace *ns);
+void retire_userns_sysctls(struct user_namespace *ns);
+struct ucounts *inc_user_namespaces(struct user_namespace *ns, kuid_t uid);
+void dec_user_namespaces(struct ucounts *ucounts);
#ifdef CONFIG_USER_NS