userns: Convert autofs4 to use kuid/kgid where appropriate

Cc: Ian Kent <raven@themaw.net>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
userns: Convert fuse to use kuid/kgid where appropriate

Cc: Miklos Szeredi <miklos@szeredi.hu>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
userns: Convert 9p's uid/gid handling

Cc: Eric Van Hensbergen <ericvh@gmail.com>
Cc: Ron Minnich <rminnich@gmail.com>
Cc: Latchesar Ionkov <lucho@ionkov.net>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
userns: Convert afs to use kuid/kgid where appropriate

Cc: David Howells <dhowells@redhat.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
userns: Convert ceph to use kuid/kgid where appropriate

Cc: Sage Weil <sage@inktank.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
userns: Convert cifs to use kuid/kgid where appropriate

Cc: Steve French <sfrench@samba.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
userns: Convert coda's to use kuid/kgid where appropriate

Cc: Jan Harkes <jaharkes@cs.cmu.edu>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
userns: Convert gfs2 to use kuid/kgid where appropriate

- Use struct kqid to hold the identifier of in core quota objects
- Use qid.type uniformly for all in core quota type computation.
- kill QDF_USER
- kill QUOTA_USER and QUOTA_GROUP

Cc: Steven Whitehouse <swhiteho@redhat.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
userns: Convert ncpfs to use kuid and kgid where appropriate

Cc: Petr Vandrovec <petr@vandrovec.name>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
userns: Convert nfs and nfsd to use kuid/kgid where appropriate

Changed as many fields as practical to be kuid_t and kgid_t.  With
the result that we create kuids and kgids in the network decodes
and we change out of kuids and kgids in the network encoders.

The one slight exception to this is the name to id mapping
where we use a plane unsigned integer as the key, instead of
a kuid_t or a kgid_t.  Using a plain integer is necessary to
prevent duplication of all of the mapping state.

This one was a little tricky as nfs has some special cases where
INVALID_UID aka -1 is used to indicate that the uid does not have a
mapping and where 2^16 -2 is used to talk about nobody or the
overflowuid, and similary for gids.

I believe I have converted everything correctly, but if I have not in
the worst case there will be a place or two where a uid_valid or a
gid_valid check will need to be removed.

Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
userns: Convert ocfs2 to use kuid and kgid where appropriate

Cc: Mark Fasheh <mfasheh@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
userns: Convert xfs to use kuid/kgid/kprojid where appropriate

- Modify the incore inode to use kuid_t, kgid_t and kprojid_t.
- Remove xfs_get_projid and xfs_set_projid with projid being stored
  in a single field they are unnecessary.
- Add dq_id (a struct kqid) to struct xfs_dquot to retain the incore
  version of the quota identifiers.
- Pass struct kquid all of the way into xfs_qm_dqgetn and xfs_qm_dqread,
  and move xfs_quota_type into xfs_dquot.c from xfs_quotaops.c to support
  this change.

Cc: Ben Myers <bpm@sgi.com>
Cc: Alex Elder <elder@kernel.org>
Cc: Dave Chinner <david@fromorbit.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
userns: Now that everything has been converted remove the unnecessary infrastructure

In particular kill UIDGID_CONVERTED and UIDGID_STRICT_TYPE_CHECKS
and have the code treat them as always true.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
userns: Remove the EXPERMINTAL kconfig tag

While there is more work to be done in the form of allowing
more to happen when you have root inside of a user namespace
there is nothing experimental about them.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
netns: Deduplicate and fix copy_net_ns when !CONFIG_NET_NS

The copy of copy_net_ns used when the network stack is not
built is broken as it does not return -EINVAL when attempting
to create a new network namespace.  We don't even have
a previous network namespace.

Since we need a copy of copy_net_ns in net/net_namespace.h that is
available when the networking stack is not built at all move the
correct version of copy_net_ns from net_namespace.c into net_namespace.h
Leaving us with just 2 versions of copy_net_ns.  One version for when
we compile in network namespace suport and another stub for all other
occasions.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
userns: make each net (net_ns) belong to a user_ns

The user namespace which creates a new network namespace owns that
namespace and all resources created in it.  This way we can target
capability checks for privileged operations against network resources to
the user_ns which created the network namespace in which the resource
lives.  Privilege to the user namespace which owns the network
namespace, or any parent user namespace thereof, provides the same
privilege to the network resource.

This patch is reworked from a version originally by
Serge E. Hallyn <serge.hallyn@canonical.com>

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
userns: Ignore suid and sgid on binaries if the uid or gid can not be mapped

When performing an exec where the binary lives in one user namespace and
the execing process lives in another usre namespace there is the possibility
that the target uids can not be represented.

Instead of failing the exec simply ignore the suid/sgid bits and run
the binary with lower privileges.   We already do this in the case
of MNT_NOSUID so this should be a well tested code path.

As the user and group are not changed this should not introduce any
security issues.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
userns: Allow unprivileged users to create user namespaces.

Now that we have been through every permission check in the kernel
having uid == 0 and gid == 0 in your local user namespace no
longer adds any special privileges.  Even having a full set
of caps in your local user namespace is safe because capabilies
are relative to your local user namespace, and do not confer
unexpected privileges.

Over the long term this should allow much more of the kernels
functionality to be safely used by non-root users.  Functionality
like unsharing the mount namespace that is only unsafe because
it can fool applications whose privileges are raised when they
are executed.  Since those applications have no privileges in
a user namespaces it becomes safe to spoof and confuse those
applications all you want.

Those capabilities will still need to be enabled carefully because
we may still need things like rlimits on the number of unprivileged
mounts but that is to avoid DOS attacks not to avoid fooling root
owned processes.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
userns: Allow chown and setgid preservation

- Allow chown if CAP_CHOWN is present in the current user namespace
  and the uid of the inode maps into the current user namespace, and
  the destination uid or gid maps into the current user namespace.

- Allow perserving setgid when changing an inode if CAP_FSETID is
  present in the current user namespace and the owner of the file has
  a mapping into the current user namespace.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
userns: Allow setting a userns mapping to your current uid.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>