SELinux: open perm for sock files

[~andy/linux] / kernel / user.c

diff --git a/kernel/user.c b/kernel/user.c
index c0ef3a464438badd79da9bb4195e43dba8ce6437..d8b332c3ae3a15ba68a2ada320254d414810ec84 100644 (file)
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -20,7 +20,7 @@
 
 struct user_namespace init_user_ns = {
        .kref = {
-               .refcount       = ATOMIC_INIT(1),
+               .refcount       = ATOMIC_INIT(2),
        },
        .creator = &root_user,
 };
@@ -104,6 +104,8 @@ static int sched_create_user(struct user_struct *up)
        if (IS_ERR(up->tg))
                rc = -ENOMEM;
 
+       set_tg_uid(up);
+
        return rc;
 }
 
@@ -239,13 +241,21 @@ static struct kobj_type uids_ktype = {
        .release = uids_release,
 };
 
-/* create /sys/kernel/uids/<uid>/cpu_share file for this user */
+/*
+ * Create /sys/kernel/uids/<uid>/cpu_share file for this user
+ * We do not create this file for users in a user namespace (until
+ * sysfs tagging is implemented).
+ *
+ * See Documentation/scheduler/sched-design-CFS.txt for ramifications.
+ */
 static int uids_user_create(struct user_struct *up)
 {
        struct kobject *kobj = &up->kobj;
        int error;
 
        memset(kobj, 0, sizeof(struct kobject));
+       if (up->user_ns != &init_user_ns)
+               return 0;
        kobj->kset = uids_kset;
        error = kobject_init_and_add(kobj, &uids_ktype, NULL, "%d", up->uid);
        if (error) {
@@ -281,6 +291,8 @@ static void remove_user_sysfs_dir(struct work_struct *w)
        unsigned long flags;
        int remove_user = 0;
 
+       if (up->user_ns != &init_user_ns)
+               return;
        /* Make uid_hash_remove() + sysfs_remove_file() + kobject_del()
         * atomic.
         */
@@ -361,7 +373,7 @@ struct user_struct *find_user(uid_t uid)
 {
        struct user_struct *ret;
        unsigned long flags;
-       struct user_namespace *ns = current_user()->user_ns;
+       struct user_namespace *ns = current_user_ns();
 
        spin_lock_irqsave(&uidhash_lock, flags);
        ret = uid_hash_find(uid, uidhashentry(ns, uid));