1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
|
Index: linux-2.6.17/include/linux/vserver/network.h
===================================================================
--- linux-2.6.17.orig/include/linux/vserver/network.h
+++ linux-2.6.17/include/linux/vserver/network.h
@@ -13,6 +13,8 @@
/* network flags */
+#define NXF_INFO_LOCK 0x00000001
+
#define NXF_STATE_SETUP (1ULL<<32)
#define NXF_SC_HELPER (1ULL<<36)
Index: linux-2.6.17/kernel/vserver/context.c
===================================================================
--- linux-2.6.17.orig/kernel/vserver/context.c
+++ linux-2.6.17/kernel/vserver/context.c
@@ -578,6 +578,10 @@ int vx_migrate_user(struct task_struct *
if (!p || !vxi)
BUG();
+
+ if (vx_info_flags(vxi, VXF_INFO_LOCK, 0))
+ return -EACCES;
+
new_user = alloc_uid(vxi->vx_id, p->uid);
if (!new_user)
return -ENOMEM;
@@ -636,14 +640,17 @@ int vx_migrate_task(struct task_struct *
if (!p || !vxi)
BUG();
- old_vxi = task_get_vx_info(p);
- if (old_vxi == vxi)
- goto out;
-
vxdprintk(VXD_CBIT(xid, 5),
"vx_migrate_task(%p,%p[#%d.%d])", p, vxi,
vxi->vx_id, atomic_read(&vxi->vx_usecnt));
+ if (vx_info_flags(vxi, VXF_INFO_LOCK, 0))
+ return -EACCES;
+
+ old_vxi = task_get_vx_info(p);
+ if (old_vxi == vxi)
+ goto out;
+
if (!(ret = vx_migrate_user(p, vxi))) {
int openfd;
@@ -836,9 +843,10 @@ int vc_ctx_create(uint32_t xid, void __u
vx_set_persistent(new_vxi);
vs_state_change(new_vxi, VSC_STARTUP);
- ret = new_vxi->vx_id;
- vx_migrate_task(current, new_vxi);
+ ret = vx_migrate_task(current, new_vxi);
/* if this fails, we might end up with a hashed vx_info */
+ if (ret == 0)
+ ret = new_vxi->vx_id;
put_vx_info(new_vxi);
return ret;
}
Index: linux-2.6.17/kernel/vserver/namespace.c
===================================================================
--- linux-2.6.17.orig/kernel/vserver/namespace.c
+++ linux-2.6.17/kernel/vserver/namespace.c
@@ -51,6 +51,8 @@ int vc_enter_namespace(struct vx_info *v
struct fs_struct *old_fs, *fs;
struct namespace *old_ns;
+ if (vx_info_flags(vxi, VXF_INFO_LOCK, 0))
+ return -EACCES;
if (!vxi->vx_namespace)
return -EINVAL;
Index: linux-2.6.17/kernel/vserver/network.c
===================================================================
--- linux-2.6.17.orig/kernel/vserver/network.c
+++ linux-2.6.17/kernel/vserver/network.c
@@ -387,6 +387,9 @@ int nx_migrate_task(struct task_struct *
atomic_read(&nxi->nx_usecnt),
atomic_read(&nxi->nx_tasks));
+ if (nx_info_flags(nxi, NXF_INFO_LOCK, 0))
+ return -EACCES;
+
/* maybe disallow this completely? */
old_nxi = task_get_nx_info(p);
if (old_nxi == nxi)
@@ -595,8 +598,7 @@ int vc_net_create(uint32_t nid, void __u
int vc_net_migrate(struct nx_info *nxi, void __user *data)
{
- nx_migrate_task(current, nxi);
- return 0;
+ return nx_migrate_task(current, nxi);
}
int vc_net_add(struct nx_info *nxi, void __user *data)
|
GitWeb