userns: Convert cls_flow to work with user namespaces enabled

The flow classifier can use uids and gids of the sockets that
are transmitting packets and do insert those uids and gids
into the packet classification calcuation.  I don't fully
understand the details but it appears that we can depend
on specific uids and gids when making traffic classification
decisions.

To work with user namespaces enabled map from kuids and kgids
into uids and gids in the initial user namespace giving raw
integer values the code can play with and depend on.

To avoid issues of userspace depending on uids and gids in
packet classifiers installed from other user namespaces
and getting confused deny all packet classifiers that
use uids or gids that are not comming from a netlink socket
in the initial user namespace.

Cc: Patrick McHardy <kaber@trash.net>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Changli Gao <xiaosuo@gmail.com>
Acked-by: David S. Miller <davem@davemloft.net>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>

diff --git a/init/Kconfig b/init/Kconfig
index 2660b312ae9d61d0effc93683db89faeabad437a..b44c3a390699469882dfa757ca5ab0dda4d9c2ed 100644 (file)
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -943,7 +943,6 @@ config UIDGID_CONVERTED
 
        # Networking
        depends on NET_9P = n
-       depends on NET_CLS_FLOW = n
        depends on NETFILTER_XT_MATCH_OWNER = n
        depends on NETFILTER_XT_MATCH_RECENT = n
        depends on NETFILTER_XT_TARGET_LOG = n

diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index ae854f3434b0bf5e2f14d0da31fc56506a7005d2..ce82d0cb1b4762e8ffcc58d8e46beacd86e31db0 100644 (file)
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -193,15 +193,19 @@ static u32 flow_get_rtclassid(const struct sk_buff *skb)
 
 static u32 flow_get_skuid(const struct sk_buff *skb)
 {
-       if (skb->sk && skb->sk->sk_socket && skb->sk->sk_socket->file)
-               return skb->sk->sk_socket->file->f_cred->fsuid;
+       if (skb->sk && skb->sk->sk_socket && skb->sk->sk_socket->file) {
+               kuid_t skuid = skb->sk->sk_socket->file->f_cred->fsuid;
+               return from_kuid(&init_user_ns, skuid);
+       }
        return 0;
 }
 
 static u32 flow_get_skgid(const struct sk_buff *skb)
 {
-       if (skb->sk && skb->sk->sk_socket && skb->sk->sk_socket->file)
-               return skb->sk->sk_socket->file->f_cred->fsgid;
+       if (skb->sk && skb->sk->sk_socket && skb->sk->sk_socket->file) {
+               kgid_t skgid = skb->sk->sk_socket->file->f_cred->fsgid;
+               return from_kgid(&init_user_ns, skgid);
+       }
        return 0;
 }
 
@@ -387,6 +391,10 @@ static int flow_change(struct sk_buff *in_skb,
 
                if (fls(keymask) - 1 > FLOW_KEY_MAX)
                        return -EOPNOTSUPP;
+
+               if ((keymask & (FLOW_KEY_SKUID|FLOW_KEY_SKGID)) &&
+                   sk_user_ns(NETLINK_CB(in_skb).ssk) != &init_user_ns)
+                       return -EOPNOTSUPP;
        }
 
        err = tcf_exts_validate(tp, tb, tca[TCA_RATE], &e, &flow_ext_map);