kernel-vserver-fixes.patch

   1 Missing header for routes patch, caused vs2.3 route.h mixing
   2 --- a/net/ipv4/netfilter/nf_nat_core.c~ 2008-01-24 23:58:37.000000000 +0100
   3 +++ a/net/ipv4/netfilter/nf_nat_core.c  2008-03-30 21:00:19.349593833 +0200
   4 @@ -15,6 +15,7 @@
   5  #include <net/checksum.h>
   6  #include <net/icmp.h>
   7  #include <net/ip.h>
   8 +#include <net/route.h>
   9  #include <net/tcp.h>  /* For tcp_prot in getorigdst */
  10  #include <linux/icmp.h>
  11  #include <linux/udp.h>
  12 --- linux-2.6.33/arch/x86/kernel/process.c~     2010-02-24 19:52:17.000000000 +0100
  13 +++ linux-2.6.33/arch/x86/kernel/process.c      2010-02-25 23:44:56.487156216 +0100
  14 @@ -104,8 +104,8 @@
  15                 product = "";
  16
  17         printk(KERN_CONT "\n");
  18 -       printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s %s/%s\n",
  19 -               current->pid, current->comm, print_tainted(),
  20 +       printk(KERN_DEFAULT "Pid: %d, xid: #%u, comm: %.20s %s %s %.*s %s/%s\n",
  21 +               task_pid_nr(current), current->xid, current->comm, print_tainted(),
  22                 init_utsname()->release,
  23                 (int)strcspn(init_utsname()->version, " "),
  24                 init_utsname()->version, board, product);
  25 --- linux-2.6.31/arch/x86/kernel/dumpstack.c~   2009-09-16 08:32:02.000000000 +0200
  26 +++ linux-2.6.31/arch/x86/kernel/dumpstack.c    2009-09-17 21:58:13.778791960 +0200
  27 @@ -180,8 +180,8 @@
  28                 get_bp(bp);
  29  #endif
  30
  31 -       printk("Pid: %d, comm: %.20s %s %s %.*s\n",
  32 -               current->pid, current->comm, print_tainted(),
  33 +       printk("Pid: %d, comm: %.20s xid: #%u %s %s %.*s\n",
  34 +               current->pid, current->comm, current->xid, print_tainted(),
  35                 init_utsname()->release,
  36                 (int)strcspn(init_utsname()->version, " "),
  37                 init_utsname()->version);
  38
  39
  40 --- linux-2.6.35.4/security/commoncap.c 2010-08-02 16:53:03.000000000 +0200
  41 +++ linux-2.6.35.4-vs2.3.0.36.32/security/commoncap.c   2010-08-02 17:05:06.000000000 +0200
  42 @@ -951,4 +969,3 @@ int cap_file_mmap(struct file *file, uns
  43         }
  44         return ret;
  45  }
  46 -
  47 diff -NurpP linux-2.6.36-vs2.3.0.36.38/include/linux/cred.h linux-2.6.36-vs2.3.0.36.38.2/include/linux/cred.h
  48 --- linux-2.6.36-vs2.3.0.36.38/include/linux/cred.h     2010-08-02 16:52:53.000000000 +0200
  49 +++ linux-2.6.36-vs2.3.0.36.38.2/include/linux/cred.h   2010-12-01 17:26:52.000000000 +0100
  50 @@ -208,6 +208,31 @@ static inline void validate_process_cred
  51  }
  52  #endif
  53
  54 +static inline void set_cred_subscribers(struct cred *cred, int n)
  55 +{
  56 +#ifdef CONFIG_DEBUG_CREDENTIALS
  57 +       atomic_set(&cred->subscribers, n);
  58 +#endif
  59 +}
  60 +
  61 +static inline int read_cred_subscribers(const struct cred *cred)
  62 +{
  63 +#ifdef CONFIG_DEBUG_CREDENTIALS
  64 +       return atomic_read(&cred->subscribers);
  65 +#else
  66 +       return 0;
  67 +#endif
  68 +}
  69 +
  70 +static inline void alter_cred_subscribers(const struct cred *_cred, int n)
  71 +{
  72 +#ifdef CONFIG_DEBUG_CREDENTIALS
  73 +       struct cred *cred = (struct cred *) _cred;
  74 +
  75 +       atomic_add(n, &cred->subscribers);
  76 +#endif
  77 +}
  78 +
  79  /**
  80   * get_new_cred - Get a reference on a new set of credentials
  81   * @cred: The new credentials to reference
  82 diff -NurpP linux-2.6.36-vs2.3.0.36.38/include/linux/vserver/context.h linux-2.6.36-vs2.3.0.36.38.2/include/linux/vserver/context.h
  83 --- linux-2.6.36-vs2.3.0.36.38/include/linux/vserver/context.h  2010-10-21 13:09:36.000000000 +0200
  84 +++ linux-2.6.36-vs2.3.0.36.38.2/include/linux/vserver/context.h        2010-12-01 17:36:51.000000000 +0100
  85 @@ -110,6 +110,8 @@ struct vx_info {
  86         unsigned long vx_nsmask[VX_SPACES];     /* assignment mask */
  87         struct nsproxy *vx_nsproxy[VX_SPACES];  /* private namespaces */
  88         struct fs_struct *vx_fs[VX_SPACES];     /* private namespace fs */
  89 +       const struct cred *vx_real_cred;        /* real task credentials */
  90 +       const struct cred *vx_cred;             /* task credentials */
  91
  92         uint64_t vx_flags;                      /* context flags */
  93         uint64_t vx_ccaps;                      /* context caps (vserver) */
  94 diff -NurpP linux-2.6.36-vs2.3.0.36.38/kernel/cred.c linux-2.6.36-vs2.3.0.36.38.2/kernel/cred.c
  95 --- linux-2.6.36-vs2.3.0.36.38/kernel/cred.c    2010-10-21 13:07:56.000000000 +0200
  96 +++ linux-2.6.36-vs2.3.0.36.38.2/kernel/cred.c  2010-12-01 17:25:55.000000000 +0100
  97 @@ -60,31 +60,6 @@ struct cred init_cred = {
  98  #endif
  99  };
 100
 101 -static inline void set_cred_subscribers(struct cred *cred, int n)
 102 -{
 103 -#ifdef CONFIG_DEBUG_CREDENTIALS
 104 -       atomic_set(&cred->subscribers, n);
 105 -#endif
 106 -}
 107 -
 108 -static inline int read_cred_subscribers(const struct cred *cred)
 109 -{
 110 -#ifdef CONFIG_DEBUG_CREDENTIALS
 111 -       return atomic_read(&cred->subscribers);
 112 -#else
 113 -       return 0;
 114 -#endif
 115 -}
 116 -
 117 -static inline void alter_cred_subscribers(const struct cred *_cred, int n)
 118 -{
 119 -#ifdef CONFIG_DEBUG_CREDENTIALS
 120 -       struct cred *cred = (struct cred *) _cred;
 121 -
 122 -       atomic_add(n, &cred->subscribers);
 123 -#endif
 124 -}
 125 -
 126  /*
 127   * Dispose of the shared task group credentials
 128   */
 129 diff -NurpP linux-2.6.36-vs2.3.0.36.38/kernel/vserver/context.c linux-2.6.36-vs2.3.0.36.38.2/kernel/vserver/context.c
 130 --- linux-2.6.36-vs2.3.0.36.38/kernel/vserver/context.c 2010-10-21 14:39:59.000000000 +0200
 131 +++ linux-2.6.36-vs2.3.0.36.38.2/kernel/vserver/context.c       2010-12-01 20:34:45.000000000 +0100
 132 @@ -3,7 +3,7 @@
 133   *
 134   *  Virtual Server: Context Support
 135   *
 136 - *  Copyright (C) 2003-2007  Herbert Pötzl
 137 + *  Copyright (C) 2003-2010  Herbert Pötzl
 138   *
 139   *  V0.01  context helper
 140   *  V0.02  vx_ctx_kill syscall command
 141 @@ -22,6 +22,7 @@
 142   *  V0.15  added context stat
 143   *  V0.16  have __create claim() the vxi
 144   *  V0.17  removed older and legacy stuff
 145 + *  V0.18  added user credentials
 146   *
 147   */
 148
 149 @@ -38,6 +39,7 @@
 150  #include <linux/vserver/space.h>
 151  #include <linux/init_task.h>
 152  #include <linux/fs_struct.h>
 153 +#include <linux/cred.h>
 154
 155  #include <linux/vs_context.h>
 156  #include <linux/vs_limit.h>
 157 @@ -127,6 +129,10 @@ static struct vx_info *__alloc_vx_info(x
 158                 new->vx_fs[index] = &init_fs;
 159         }
 160
 161 +       /* FIXME: we want defaults */
 162 +       new->vx_real_cred = 0;
 163 +       new->vx_cred = 0;
 164 +
 165         vxdprintk(VXD_CBIT(xid, 0),
 166                 "alloc_vx_info(%d) = %p", xid, new);
 167         vxh_alloc_vx_info(new);
 168 @@ -183,6 +189,7 @@ static void __shutdown_vx_info(struct vx
 169  {
 170         struct nsproxy *nsproxy;
 171         struct fs_struct *fs;
 172 +       const struct cred *cred;
 173         int index, kill;
 174
 175         might_sleep();
 176 @@ -202,6 +209,18 @@ static void __shutdown_vx_info(struct vx
 177                 if (kill)
 178                         free_fs_struct(fs);
 179         }
 180 +
 181 +       cred = xchg(&vxi->vx_real_cred, NULL);
 182 +       if (cred) {
 183 +               alter_cred_subscribers(cred, -1);
 184 +               put_cred(cred);
 185 +       }
 186 +
 187 +       cred = xchg(&vxi->vx_cred, NULL);
 188 +       if (cred) {
 189 +               alter_cred_subscribers(cred, -1);
 190 +               put_cred(cred);
 191 +       }
 192  }
 193
 194  /* exported stuff */
 195 diff -NurpP linux-2.6.36-vs2.3.0.36.38/kernel/vserver/space.c linux-2.6.36-vs2.3.0.36.38.2/kernel/vserver/space.c
 196 --- linux-2.6.36-vs2.3.0.36.38/kernel/vserver/space.c   2010-10-21 14:41:06.000000000 +0200
 197 +++ linux-2.6.36-vs2.3.0.36.38.2/kernel/vserver/space.c 2010-12-01 20:39:35.000000000 +0100
 198 @@ -3,12 +3,13 @@
 199   *
 200   *  Virtual Server: Context Space Support
 201   *
 202 - *  Copyright (C) 2003-2007  Herbert Pötzl
 203 + *  Copyright (C) 2003-2010  Herbert Pötzl
 204   *
 205   *  V0.01  broken out from context.c 0.07
 206   *  V0.02  added task locking for namespace
 207   *  V0.03  broken out vx_enter_namespace
 208   *  V0.04  added *space support and commands
 209 + *  V0.05  added credential support
 210   *
 211   */
 212
 213 @@ -16,6 +17,7 @@
 214  #include <linux/nsproxy.h>
 215  #include <linux/err.h>
 216  #include <linux/fs_struct.h>
 217 +#include <linux/cred.h>
 218  #include <asm/uaccess.h>
 219
 220  #include <linux/vs_context.h>
 221 @@ -238,6 +240,19 @@ int vx_enter_space(struct vx_info *vxi,
 222         }
 223
 224         proxy_new = xchg(&current->nsproxy, proxy_new);
 225 +
 226 +       if (mask & CLONE_NEWUSER) {
 227 +               vxdprintk(VXD_CBIT(space, 10),
 228 +                       "vx_enter_space(%p[#%u],%p,%p) cred (%p,%p)",
 229 +                       vxi, vxi->vx_id, vxi->vx_real_cred, vxi->vx_cred,
 230 +                       current->real_cred, current->cred);
 231 +               exit_creds(current);
 232 +               current->real_cred = get_cred(vxi->vx_real_cred);
 233 +               alter_cred_subscribers(current->real_cred, 1);
 234 +               current->cred = get_cred(vxi->vx_cred);
 235 +               alter_cred_subscribers(current->cred, 1);
 236 +       }
 237 +
 238         ret = 0;
 239
 240         if (proxy_new)
 241 @@ -297,6 +312,38 @@ int vx_set_space(struct vx_info *vxi, un
 242
 243         proxy_new = xchg(&vxi->vx_nsproxy[index], proxy_new);
 244         vxi->vx_nsmask[index] |= mask;
 245 +
 246 +       if (mask & CLONE_NEWUSER) {
 247 +               const struct cred *cred;
 248 +
 249 +               vxdprintk(VXD_CBIT(space, 10),
 250 +                       "vx_set_space(%p[#%u],%p,%p) cred (%p,%p)",
 251 +                       vxi, vxi->vx_id, vxi->vx_real_cred, vxi->vx_cred,
 252 +                       current->real_cred, current->cred);
 253 +
 254 +               if (current->real_cred) {
 255 +                       cred = get_cred(current->real_cred);
 256 +                       alter_cred_subscribers(cred, 1);
 257 +               } else
 258 +                       cred = NULL;
 259 +               cred = xchg(&vxi->vx_real_cred, cred);
 260 +               if (cred) {
 261 +                       alter_cred_subscribers(cred, -1);
 262 +                       put_cred(cred);
 263 +               }
 264 +
 265 +               if (current->cred) {
 266 +                       cred = get_cred(current->cred);
 267 +                       alter_cred_subscribers(cred, 1);
 268 +               } else
 269 +                       cred = NULL;
 270 +               cred = xchg(&vxi->vx_cred, cred);
 271 +               if (cred) {
 272 +                       alter_cred_subscribers(cred, -1);
 273 +                       put_cred(cred);
 274 +               }
 275 +       }
 276 +
 277         ret = 0;
 278
 279         if (proxy_new)