• Lorenzo Colitti's avatar
    net: core: Add a UID field to struct sock. · 86741ec2
    Lorenzo Colitti authored
    
    
    Protocol sockets (struct sock) don't have UIDs, but most of the
    time, they map 1:1 to userspace sockets (struct socket) which do.
    
    Various operations such as the iptables xt_owner match need
    access to the "UID of a socket", and do so by following the
    backpointer to the struct socket. This involves taking
    sk_callback_lock and doesn't work when there is no socket
    because userspace has already called close().
    
    Simplify this by adding a sk_uid field to struct sock whose value
    matches the UID of the corresponding struct socket. The semantics
    are as follows:
    
    1. Whenever sk_socket is non-null: sk_uid is the same as the UID
       in sk_socket, i.e., matches the return value of sock_i_uid.
       Specifically, the UID is set when userspace calls socket(),
       fchown(), or accept().
    2. When sk_socket is NULL, sk_uid is defined as follows:
       - For a socket that no longer has a sk_socket because
         userspace has called close(): the previous UID.
       - For a cloned socket (e.g., an incoming connection that is
         established but on which userspace has not yet called
         accept): the UID of the socket it was cloned from.
       - For a socket that has never had an sk_socket: UID 0 inside
         the user namespace corresponding to the network namespace
         the socket belongs to.
    
    Kernel sockets created by sock_create_kern are a special case
    of #1 and sk_uid is the user that created them. For kernel
    sockets created at network namespace creation time, such as the
    per-processor ICMP and TCP sockets, this is the user that created
    the network namespace.
    Signed-off-by: default avatarLorenzo Colitti <lorenzo@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    86741ec2
socket.c 80.2 KB