Skip to content

Commit c4a4d60

Browse files
ebiedermebiederm
committed
userns: Use cred->user_ns instead of cred->user->user_ns
Optimize performance and prepare for the removal of the user_ns reference from user_struct. Remove the slow long walk through cred->user->user_ns and instead go straight to cred->user_ns. Acked-by: Serge Hallyn <[email protected]> Signed-off-by: Eric W. Biederman <[email protected]>
1 parent 7e6bd8f commit c4a4d60

File tree

12 files changed

+24
-24
lines changed

12 files changed

+24
-24
lines changed

‎fs/ecryptfs/messaging.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -303,7 +303,7 @@ int ecryptfs_process_response(struct ecryptfs_message *msg, uid_t euid,
303303
mutex_unlock(&ecryptfs_daemon_hash_mux);
304304
goto wake_up;
305305
}
306-
tsk_user_ns = __task_cred(msg_ctx->task)->user->user_ns;
306+
tsk_user_ns = __task_cred(msg_ctx->task)->user_ns;
307307
ctx_euid = task_euid(msg_ctx->task);
308308
rc = ecryptfs_find_daemon_by_euid(&daemon, ctx_euid, tsk_user_ns);
309309
rcu_read_unlock();

‎ipc/namespace.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ static struct ipc_namespace *create_ipc_ns(struct task_struct *tsk,
4646
ipcns_notify(IPCNS_CREATED);
4747
register_ipcns_notifier(ns);
4848

49-
ns->user_ns = get_user_ns(task_cred_xxx(tsk, user)->user_ns);
49+
ns->user_ns = get_user_ns(task_cred_xxx(tsk, user_ns));
5050

5151
return ns;
5252
}

‎kernel/ptrace.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -198,15 +198,15 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
198198
return 0;
199199
rcu_read_lock();
200200
tcred = __task_cred(task);
201-
if (cred->user->user_ns == tcred->user->user_ns &&
201+
if (cred->user_ns == tcred->user_ns &&
202202
(cred->uid == tcred->euid &&
203203
cred->uid == tcred->suid &&
204204
cred->uid == tcred->uid &&
205205
cred->gid == tcred->egid &&
206206
cred->gid == tcred->sgid &&
207207
cred->gid == tcred->gid))
208208
goto ok;
209-
if (ptrace_has_cap(tcred->user->user_ns, mode))
209+
if (ptrace_has_cap(tcred->user_ns, mode))
210210
goto ok;
211211
rcu_read_unlock();
212212
return -EPERM;

‎kernel/sched/core.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4042,7 +4042,7 @@ static bool check_same_owner(struct task_struct *p)
40424042

40434043
rcu_read_lock();
40444044
pcred = __task_cred(p);
4045-
if (cred->user->user_ns == pcred->user->user_ns)
4045+
if (cred->user_ns == pcred->user_ns)
40464046
match = (cred->euid == pcred->euid ||
40474047
cred->euid == pcred->uid);
40484048
else

‎kernel/signal.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -767,14 +767,14 @@ static int kill_ok_by_cred(struct task_struct *t)
767767
const struct cred *cred = current_cred();
768768
const struct cred *tcred = __task_cred(t);
769769

770-
if (cred->user->user_ns == tcred->user->user_ns &&
770+
if (cred->user_ns == tcred->user_ns &&
771771
(cred->euid == tcred->suid ||
772772
cred->euid == tcred->uid ||
773773
cred->uid == tcred->suid ||
774774
cred->uid == tcred->uid))
775775
return 1;
776776

777-
if (ns_capable(tcred->user->user_ns, CAP_KILL))
777+
if (ns_capable(tcred->user_ns, CAP_KILL))
778778
return 1;
779779

780780
return 0;

‎kernel/sys.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -133,11 +133,11 @@ static bool set_one_prio_perm(struct task_struct *p)
133133
{
134134
const struct cred *cred = current_cred(), *pcred = __task_cred(p);
135135

136-
if (pcred->user->user_ns == cred->user->user_ns &&
136+
if (pcred->user_ns == cred->user_ns &&
137137
(pcred->uid == cred->euid ||
138138
pcred->euid == cred->euid))
139139
return true;
140-
if (ns_capable(pcred->user->user_ns, CAP_SYS_NICE))
140+
if (ns_capable(pcred->user_ns, CAP_SYS_NICE))
141141
return true;
142142
return false;
143143
}
@@ -1498,15 +1498,15 @@ static int check_prlimit_permission(struct task_struct *task)
14981498
return 0;
14991499

15001500
tcred = __task_cred(task);
1501-
if (cred->user->user_ns == tcred->user->user_ns &&
1501+
if (cred->user_ns == tcred->user_ns &&
15021502
(cred->uid == tcred->euid &&
15031503
cred->uid == tcred->suid &&
15041504
cred->uid == tcred->uid &&
15051505
cred->gid == tcred->egid &&
15061506
cred->gid == tcred->sgid &&
15071507
cred->gid == tcred->gid))
15081508
return 0;
1509-
if (ns_capable(tcred->user->user_ns, CAP_SYS_RESOURCE))
1509+
if (ns_capable(tcred->user_ns, CAP_SYS_RESOURCE))
15101510
return 0;
15111511

15121512
return -EPERM;

‎kernel/user_namespace.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ uid_t user_ns_map_uid(struct user_namespace *to, const struct cred *cred, uid_t
9090
{
9191
struct user_namespace *tmp;
9292

93-
if (likely(to == cred->user->user_ns))
93+
if (likely(to == cred->user_ns))
9494
return uid;
9595

9696

@@ -112,7 +112,7 @@ gid_t user_ns_map_gid(struct user_namespace *to, const struct cred *cred, gid_t
112112
{
113113
struct user_namespace *tmp;
114114

115-
if (likely(to == cred->user->user_ns))
115+
if (likely(to == cred->user_ns))
116116
return gid;
117117

118118
/* Is cred->user the creator of the target user_ns

‎kernel/utsname.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ static struct uts_namespace *clone_uts_ns(struct task_struct *tsk,
4343

4444
down_read(&uts_sem);
4545
memcpy(&ns->name, &old_ns->name, sizeof(ns->name));
46-
ns->user_ns = get_user_ns(task_cred_xxx(tsk, user)->user_ns);
46+
ns->user_ns = get_user_ns(task_cred_xxx(tsk, user_ns));
4747
up_read(&uts_sem);
4848
return ns;
4949
}

‎security/commoncap.c

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ int cap_capable(const struct cred *cred, struct user_namespace *targ_ns,
8181
return 0;
8282

8383
/* Do we have the necessary capabilities? */
84-
if (targ_ns == cred->user->user_ns)
84+
if (targ_ns == cred->user_ns)
8585
return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;
8686

8787
/* Have we tried all of the parent namespaces? */
@@ -136,10 +136,10 @@ int cap_ptrace_access_check(struct task_struct *child, unsigned int mode)
136136
rcu_read_lock();
137137
cred = current_cred();
138138
child_cred = __task_cred(child);
139-
if (cred->user->user_ns == child_cred->user->user_ns &&
139+
if (cred->user_ns == child_cred->user_ns &&
140140
cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
141141
goto out;
142-
if (ns_capable(child_cred->user->user_ns, CAP_SYS_PTRACE))
142+
if (ns_capable(child_cred->user_ns, CAP_SYS_PTRACE))
143143
goto out;
144144
ret = -EPERM;
145145
out:
@@ -168,10 +168,10 @@ int cap_ptrace_traceme(struct task_struct *parent)
168168
rcu_read_lock();
169169
cred = __task_cred(parent);
170170
child_cred = current_cred();
171-
if (cred->user->user_ns == child_cred->user->user_ns &&
171+
if (cred->user_ns == child_cred->user_ns &&
172172
cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
173173
goto out;
174-
if (has_ns_capability(parent, child_cred->user->user_ns, CAP_SYS_PTRACE))
174+
if (has_ns_capability(parent, child_cred->user_ns, CAP_SYS_PTRACE))
175175
goto out;
176176
ret = -EPERM;
177177
out:
@@ -214,7 +214,7 @@ static inline int cap_inh_is_capped(void)
214214
/* they are so limited unless the current task has the CAP_SETPCAP
215215
* capability
216216
*/
217-
if (cap_capable(current_cred(), current_cred()->user->user_ns,
217+
if (cap_capable(current_cred(), current_cred()->user_ns,
218218
CAP_SETPCAP, SECURITY_CAP_AUDIT) == 0)
219219
return 0;
220220
return 1;
@@ -866,7 +866,7 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
866866
|| ((new->securebits & SECURE_ALL_LOCKS & ~arg2)) /*[2]*/
867867
|| (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS)) /*[3]*/
868868
|| (cap_capable(current_cred(),
869-
current_cred()->user->user_ns, CAP_SETPCAP,
869+
current_cred()->user_ns, CAP_SETPCAP,
870870
SECURITY_CAP_AUDIT) != 0) /*[4]*/
871871
/*
872872
* [1] no changing of bits that are locked

‎security/keys/key.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -253,7 +253,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
253253
quotalen = desclen + type->def_datalen;
254254

255255
/* get hold of the key tracking for this user */
256-
user = key_user_lookup(uid, cred->user->user_ns);
256+
user = key_user_lookup(uid, cred->user_ns);
257257
if (!user)
258258
goto no_memory_1;
259259

‎security/keys/permission.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ int key_task_permission(const key_ref_t key_ref, const struct cred *cred,
3636

3737
key = key_ref_to_ptr(key_ref);
3838

39-
if (key->user->user_ns != cred->user->user_ns)
39+
if (key->user->user_ns != cred->user_ns)
4040
goto use_other_perms;
4141

4242
/* use the second 8-bits of permissions for keys the caller owns */

‎security/keys/process_keys.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -858,7 +858,7 @@ void key_replace_session_keyring(void)
858858
new-> sgid = old-> sgid;
859859
new->fsgid = old->fsgid;
860860
new->user = get_uid(old->user);
861-
new->user_ns = new->user->user_ns;
861+
new->user_ns = new->user_ns;
862862
new->group_info = get_group_info(old->group_info);
863863

864864
new->securebits = old->securebits;

0 commit comments

Comments
 (0)