[Devel] [PATCH RHEL7 COMMIT] ms/userns, pidns: Force thread group sharing, not signal handler sharing.

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-327.3.1-vz7.10.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-327.3.1.vz7.10.13
------>
commit b078a46c3ee31313d43a5dc5ce2a92759598e51d
Author: Eric W. Biederman <ebiederm at xmission.com>
Date:   Fri Feb 26 16:05:45 2016 +0400

    ms/userns, pidns: Force thread group sharing, not signal handler sharing.
    
    ML: faf00da544045fdc1454f3b9e6d7f65c841de302
    
    The code that places signals in signal queues computes the uids, gids,
    and pids at the time the signals are enqueued.  Which means that tasks
    that share signal queues must be in the same pid and user namespaces.
    
    Sharing signal handlers is fine, but bizarre.
    
    So make the code in fork and userns_install clearer by only testing
    for what is functionally necessary.
    
    Also update the comment in unshare about unsharing a user namespace to
    be a little more explicit and make a little more sense.
    
    https://jira.sw.ru/browse/PSBM-44152
    
    Acked-by: Oleg Nesterov <oleg at redhat.com>
    Signed-off-by: "Eric W. Biederman" <ebiederm at xmission.com>
    Signed-off-by: Andrew Vagin <avagin at openvz.org>
---
 kernel/fork.c           | 8 ++++----
 kernel/user_namespace.c | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/kernel/fork.c b/kernel/fork.c
index 27d5efc..760cf55 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1236,10 +1236,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 
 	/*
 	 * If the new process will be in a different pid or user namespace
-	 * do not allow it to share a thread group or signal handlers or
-	 * parent with the forking task.
+	 * do not allow it to share a thread group with the forking task.
 	 */
-	if (clone_flags & CLONE_SIGHAND) {
+	if (clone_flags & CLONE_THREAD) {
 		if ((clone_flags & (CLONE_NEWUSER | CLONE_NEWPID)) ||
 		    (task_active_pid_ns(current) !=
 				current->nsproxy->pid_ns))
@@ -1887,7 +1886,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
 	int err;
 
 	/*
-	 * If unsharing a user namespace must also unshare the thread.
+	 * If unsharing a user namespace must also unshare the thread group
+	 * and unshare the filesystem root and working directories.
 	 */
 	if (unshare_flags & CLONE_NEWUSER)
 		unshare_flags |= CLONE_THREAD | CLONE_FS;
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index fe53b77..e5f3658 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -976,8 +976,8 @@ static int userns_install(struct nsproxy *nsproxy, void *ns)
 	if (user_ns == current_user_ns())
 		return -EINVAL;
 
-	/* Threaded processes may not enter a different user namespace */
-	if (atomic_read(&current->mm->mm_users) > 1)
+	/* Tasks that share a thread group must share a user namespace */
+	if (!thread_group_empty(current))
 		return -EINVAL;
 
 	if (current->fs->users != 1)