[PATCH RFC v3 47/90] cells: refuse a task of a cell a change of namespaces

[Josef Bacik <josef@toxicpanda.com>]

The point of a cell is that inside and outside are fixed once and for all.
setns() and unshare() turn that into a property of each task at each
moment. Tasks that are half way between two sets of namespaces have been
the source of many bugs.

For a task of a cell, refuse setns(), unshare(), and clone() with any
CLONE_NEW* flag.

Signed-off-by: Josef Bacik <josef@toxicpanda.com>
---
 kernel/fork.c    | 8 ++++++++
 kernel/nsproxy.c | 4 ++++
 2 files changed, 12 insertions(+)

diff --git a/kernel/fork.c b/kernel/fork.c
index 119b59f30f4d..134409910215 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -2080,6 +2080,10 @@ __latent_entropy struct task_struct *copy_process(
 	if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
 		return ERR_PTR(-EINVAL);
 
+	/* The namespaces of a cell are the cell's. A task has no say in them. */
+	if ((clone_flags & CLONE_NS_ALL) && current_cell())
+		return ERR_PTR(-EPERM);
+
 	/*
 	 * Thread groups must share signals as well, and detached threads
 	 * can only be started up within the thread group.
@@ -3300,6 +3304,10 @@ int ksys_unshare(unsigned long unshare_flags)
 	int do_sysvsem = 0;
 	int err;
 
+	/* The namespaces of a cell are the cell's. A task has no say in them. */
+	if ((unshare_flags & (CLONE_NS_ALL | UNSHARE_EMPTY_MNTNS)) && current_cell())
+		return -EPERM;
+
 	/*
 	 * If unsharing a user namespace must also unshare the thread group
 	 * and unshare the filesystem root and working directories.
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index dfe47a235cb5..5d6cec2dc4ce 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -664,6 +664,10 @@ SYSCALL_DEFINE2(setns, int, fd, int, flags)
 	if (fd_empty(f))
 		return -EBADF;
 
+	/* The namespaces of a cell are the cell's. A task has no say in them. */
+	if (current_cell())
+		return -EPERM;
+
 	if (proc_ns_file(fd_file(f))) {
 		ns = get_proc_ns(file_inode(fd_file(f)));
 		if (flags && (ns->ns_type != flags))

-- 
2.55.0