From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753440AbcGYXMK (ORCPT ); Mon, 25 Jul 2016 19:12:10 -0400 Received: from h2.hallyn.com ([78.46.35.8]:54470 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751953AbcGYXMI (ORCPT ); Mon, 25 Jul 2016 19:12:08 -0400 Date: Mon, 25 Jul 2016 18:12:05 -0500 From: "Serge E. Hallyn" To: "Eric W. Biederman" Cc: Linux Containers , Andy Lutomirski , Jann Horn , Kees Cook , Nikolay Borisov , "Serge E. Hallyn" , Seth Forshee , linux-fsdevel@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-api@vger.kernel.org Subject: Re: [PATCH v2 08/10] cgroupns: Add a limit on the number of cgroup namespaces Message-ID: <20160725231205.GF26841@mail.hallyn.com> References: <87d1m754jc.fsf@x220.int.ebiederm.org> <20160721164014.17534-1-ebiederm@xmission.com> <20160721164014.17534-8-ebiederm@xmission.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20160721164014.17534-8-ebiederm@xmission.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Quoting Eric W. Biederman (ebiederm@xmission.com): > Signed-off-by: "Eric W. Biederman" Acked-by: Serge Hallyn > --- > include/linux/user_namespace.h | 1 + > kernel/cgroup.c | 15 +++++++++++++++ > kernel/user_namespace.c | 1 + > 3 files changed, 17 insertions(+) > > diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h > index 367cf08ff63d..1a3a9cb93277 100644 > --- a/include/linux/user_namespace.h > +++ b/include/linux/user_namespace.h > @@ -27,6 +27,7 @@ enum ucounts { > UCOUNT_PID_NAMESPACES, > UCOUNT_UTS_NAMESPACES, > UCOUNT_IPC_NAMESPACES, > + UCOUNT_CGROUP_NAMESPACES, > UCOUNT_COUNTS, > }; > > diff --git a/kernel/cgroup.c b/kernel/cgroup.c > index 86cb5c6e8932..240eec43390b 100644 > --- a/kernel/cgroup.c > +++ b/kernel/cgroup.c > @@ -6260,6 +6260,16 @@ void cgroup_sk_free(struct sock_cgroup_data *skcd) > > /* cgroup namespaces */ > > +static bool inc_cgroup_namespaces(struct user_namespace *ns) > +{ > + return inc_ucount(ns, UCOUNT_CGROUP_NAMESPACES); > +} > + > +static void dec_cgroup_namespaces(struct user_namespace *ns) > +{ > + dec_ucount(ns, UCOUNT_CGROUP_NAMESPACES); > +} > + > static struct cgroup_namespace *alloc_cgroup_ns(void) > { > struct cgroup_namespace *new_ns; > @@ -6281,6 +6291,7 @@ static struct cgroup_namespace *alloc_cgroup_ns(void) > void free_cgroup_ns(struct cgroup_namespace *ns) > { > put_css_set(ns->root_cset); > + dec_cgroup_namespaces(ns->user_ns); > put_user_ns(ns->user_ns); > ns_free_inum(&ns->ns); > kfree(ns); > @@ -6305,6 +6316,9 @@ struct cgroup_namespace *copy_cgroup_ns(unsigned long flags, > if (!ns_capable(user_ns, CAP_SYS_ADMIN)) > return ERR_PTR(-EPERM); > > + if (!inc_cgroup_namespaces(user_ns)) > + return ERR_PTR(-ENFILE); > + > mutex_lock(&cgroup_mutex); > spin_lock_bh(&css_set_lock); > > @@ -6317,6 +6331,7 @@ struct cgroup_namespace *copy_cgroup_ns(unsigned long flags, > new_ns = alloc_cgroup_ns(); > if (IS_ERR(new_ns)) { > put_css_set(cset); > + dec_cgroup_namespaces(user_ns); > return new_ns; > } > > diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c > index 060d3e099f87..1cf074cb47e2 100644 > --- a/kernel/user_namespace.c > +++ b/kernel/user_namespace.c > @@ -80,6 +80,7 @@ static struct ctl_table userns_table[] = { > UCOUNT_ENTRY("max_pid_namespaces"), > UCOUNT_ENTRY("max_uts_namespaces"), > UCOUNT_ENTRY("max_ipc_namespaces"), > + UCOUNT_ENTRY("max_cgroup_namespaces"), > { } > }; > #endif /* CONFIG_SYSCTL */ > -- > 2.8.3