diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2012-10-02 11:11:09 -0700 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2012-10-02 11:11:09 -0700 |
commit | 437589a74b6a590d175f86cf9f7b2efcee7765e7 (patch) | |
tree | 37bf8635b1356d80ef002b00e84f3faf3d555a63 /init/Kconfig | |
parent | 68d47a137c3bef754923bccf73fb639c9b0bbd5e (diff) | |
parent | 72235465864d84cedb2d9f26f8e1de824ee20339 (diff) | |
download | lwn-437589a74b6a590d175f86cf9f7b2efcee7765e7.tar.gz lwn-437589a74b6a590d175f86cf9f7b2efcee7765e7.zip |
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
Pull user namespace changes from Eric Biederman:
"This is a mostly modest set of changes to enable basic user namespace
support. This allows the code to code to compile with user namespaces
enabled and removes the assumption there is only the initial user
namespace. Everything is converted except for the most complex of the
filesystems: autofs4, 9p, afs, ceph, cifs, coda, fuse, gfs2, ncpfs,
nfs, ocfs2 and xfs as those patches need a bit more review.
The strategy is to push kuid_t and kgid_t values are far down into
subsystems and filesystems as reasonable. Leaving the make_kuid and
from_kuid operations to happen at the edge of userspace, as the values
come off the disk, and as the values come in from the network.
Letting compile type incompatible compile errors (present when user
namespaces are enabled) guide me to find the issues.
The most tricky areas have been the places where we had an implicit
union of uid and gid values and were storing them in an unsigned int.
Those places were converted into explicit unions. I made certain to
handle those places with simple trivial patches.
Out of that work I discovered we have generic interfaces for storing
quota by projid. I had never heard of the project identifiers before.
Adding full user namespace support for project identifiers accounts
for most of the code size growth in my git tree.
Ultimately there will be work to relax privlige checks from
"capable(FOO)" to "ns_capable(user_ns, FOO)" where it is safe allowing
root in a user names to do those things that today we only forbid to
non-root users because it will confuse suid root applications.
While I was pushing kuid_t and kgid_t changes deep into the audit code
I made a few other cleanups. I capitalized on the fact we process
netlink messages in the context of the message sender. I removed
usage of NETLINK_CRED, and started directly using current->tty.
Some of these patches have also made it into maintainer trees, with no
problems from identical code from different trees showing up in
linux-next.
After reading through all of this code I feel like I might be able to
win a game of kernel trivial pursuit."
Fix up some fairly trivial conflicts in netfilter uid/git logging code.
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: (107 commits)
userns: Convert the ufs filesystem to use kuid/kgid where appropriate
userns: Convert the udf filesystem to use kuid/kgid where appropriate
userns: Convert ubifs to use kuid/kgid
userns: Convert squashfs to use kuid/kgid where appropriate
userns: Convert reiserfs to use kuid and kgid where appropriate
userns: Convert jfs to use kuid/kgid where appropriate
userns: Convert jffs2 to use kuid and kgid where appropriate
userns: Convert hpfs to use kuid and kgid where appropriate
userns: Convert btrfs to use kuid/kgid where appropriate
userns: Convert bfs to use kuid/kgid where appropriate
userns: Convert affs to use kuid/kgid wherwe appropriate
userns: On alpha modify linux_to_osf_stat to use convert from kuids and kgids
userns: On ia64 deal with current_uid and current_gid being kuid and kgid
userns: On ppc convert current_uid from a kuid before printing.
userns: Convert s390 getting uid and gid system calls to use kuid and kgid
userns: Convert s390 hypfs to use kuid and kgid where appropriate
userns: Convert binder ipc to use kuids
userns: Teach security_path_chown to take kuids and kgids
userns: Add user namespace support to IMA
userns: Convert EVM to deal with kuids and kgids in it's hmac computation
...
Diffstat (limited to 'init/Kconfig')
-rw-r--r-- | init/Kconfig | 89 |
1 files changed, 0 insertions, 89 deletions
diff --git a/init/Kconfig b/init/Kconfig index 73e4adfa91dc..cb003a3c9122 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -986,113 +986,24 @@ config UIDGID_CONVERTED bool default y - # List of kernel pieces that need user namespace work - # Features - depends on SYSVIPC = n - depends on IMA = n - depends on EVM = n - depends on KEYS = n - depends on AUDIT = n - depends on AUDITSYSCALL = n - depends on TASKSTATS = n - depends on TRACING = n - depends on FS_POSIX_ACL = n - depends on QUOTA = n - depends on QUOTACTL = n - depends on DEBUG_CREDENTIALS = n - depends on BSD_PROCESS_ACCT = n - depends on DRM = n - depends on PROC_EVENTS = n - # Networking - depends on NET = n depends on NET_9P = n - depends on IPX = n - depends on PHONET = n - depends on NET_CLS_FLOW = n - depends on NETFILTER_XT_MATCH_OWNER = n - depends on NETFILTER_XT_MATCH_RECENT = n - depends on NETFILTER_XT_TARGET_LOG = n - depends on NETFILTER_NETLINK_LOG = n - depends on INET = n - depends on IPV6 = n - depends on IP_SCTP = n - depends on AF_RXRPC = n - depends on LLC2 = n - depends on NET_KEY = n - depends on INET_DIAG = n - depends on DNS_RESOLVER = n - depends on AX25 = n - depends on ATALK = n # Filesystems - depends on USB_DEVICEFS = n - depends on USB_GADGETFS = n - depends on USB_FUNCTIONFS = n - depends on DEVTMPFS = n - depends on XENFS = n - depends on 9P_FS = n - depends on ADFS_FS = n - depends on AFFS_FS = n depends on AFS_FS = n depends on AUTOFS4_FS = n - depends on BEFS_FS = n - depends on BFS_FS = n - depends on BTRFS_FS = n depends on CEPH_FS = n depends on CIFS = n depends on CODA_FS = n - depends on CONFIGFS_FS = n - depends on CRAMFS = n - depends on DEBUG_FS = n - depends on ECRYPT_FS = n - depends on EFS_FS = n - depends on EXOFS_FS = n - depends on FAT_FS = n depends on FUSE_FS = n depends on GFS2_FS = n - depends on HFS_FS = n - depends on HFSPLUS_FS = n - depends on HPFS_FS = n - depends on HUGETLBFS = n - depends on ISO9660_FS = n - depends on JFFS2_FS = n - depends on JFS_FS = n - depends on LOGFS = n - depends on MINIX_FS = n depends on NCP_FS = n depends on NFSD = n depends on NFS_FS = n - depends on NILFS2_FS = n - depends on NTFS_FS = n depends on OCFS2_FS = n - depends on OMFS_FS = n - depends on QNX4FS_FS = n - depends on QNX6FS_FS = n - depends on REISERFS_FS = n - depends on SQUASHFS = n - depends on SYSV_FS = n - depends on UBIFS_FS = n - depends on UDF_FS = n - depends on UFS_FS = n - depends on VXFS_FS = n depends on XFS_FS = n - depends on !UML || HOSTFS = n - - # The rare drivers that won't build - depends on AIRO = n - depends on AIRO_CS = n - depends on TUN = n - depends on INFINIBAND_QIB = n - depends on BLK_DEV_LOOP = n - depends on ANDROID_BINDER_IPC = n - - # Security modules - depends on SECURITY_TOMOYO = n - depends on SECURITY_APPARMOR = n - config UIDGID_STRICT_TYPE_CHECKS bool "Require conversions between uid/gids and their internal representation" depends on UIDGID_CONVERTED |