^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * linux/ipc/namespace.c
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) * Copyright (C) 2006 Pavel Emelyanov <xemul@openvz.org> OpenVZ, SWsoft Inc.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) #include <linux/ipc.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) #include <linux/msg.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) #include <linux/ipc_namespace.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) #include <linux/rcupdate.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #include <linux/nsproxy.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <linux/cred.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <linux/fs.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/mount.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include <linux/user_namespace.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include <linux/proc_ns.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include <linux/sched/task.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) #include "util.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) static struct ucounts *inc_ipc_namespaces(struct user_namespace *ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) return inc_ucount(ns, current_euid(), UCOUNT_IPC_NAMESPACES);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) static void dec_ipc_namespaces(struct ucounts *ucounts)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) dec_ucount(ucounts, UCOUNT_IPC_NAMESPACES);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) static struct ipc_namespace *create_ipc_ns(struct user_namespace *user_ns,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) struct ipc_namespace *old_ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) struct ipc_namespace *ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) struct ucounts *ucounts;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) err = -ENOSPC;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) ucounts = inc_ipc_namespaces(user_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) if (!ucounts)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) goto fail;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) err = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) ns = kzalloc(sizeof(struct ipc_namespace), GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) if (ns == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) goto fail_dec;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) err = ns_alloc_inum(&ns->ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) goto fail_free;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) ns->ns.ops = &ipcns_operations;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) refcount_set(&ns->count, 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) ns->user_ns = get_user_ns(user_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) ns->ucounts = ucounts;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) err = mq_init_ns(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) goto fail_put;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) sem_init_ns(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) msg_init_ns(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) shm_init_ns(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) return ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) fail_put:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) put_user_ns(ns->user_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) ns_free_inum(&ns->ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) fail_free:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) kfree(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) fail_dec:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) dec_ipc_namespaces(ucounts);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) fail:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) return ERR_PTR(err);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) struct ipc_namespace *copy_ipcs(unsigned long flags,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) struct user_namespace *user_ns, struct ipc_namespace *ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) if (!(flags & CLONE_NEWIPC))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) return get_ipc_ns(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) return create_ipc_ns(user_ns, ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) * free_ipcs - free all ipcs of one type
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) * @ns: the namespace to remove the ipcs from
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) * @ids: the table of ipcs to free
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) * @free: the function called to free each individual ipc
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) * Called for each kind of ipc when an ipc_namespace exits.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) void free_ipcs(struct ipc_namespace *ns, struct ipc_ids *ids,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) void (*free)(struct ipc_namespace *, struct kern_ipc_perm *))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) struct kern_ipc_perm *perm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) int next_id;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) int total, in_use;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) down_write(&ids->rwsem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) in_use = ids->in_use;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) for (total = 0, next_id = 0; total < in_use; next_id++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) perm = idr_find(&ids->ipcs_idr, next_id);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) if (perm == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) ipc_lock_object(perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) free(ns, perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) total++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) up_write(&ids->rwsem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) static void free_ipc_ns(struct ipc_namespace *ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) /* mq_put_mnt() waits for a grace period as kern_unmount()
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) * uses synchronize_rcu().
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) mq_put_mnt(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) sem_exit_ns(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) msg_exit_ns(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) shm_exit_ns(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) dec_ipc_namespaces(ns->ucounts);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) put_user_ns(ns->user_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) ns_free_inum(&ns->ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) kfree(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) static LLIST_HEAD(free_ipc_list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) static void free_ipc(struct work_struct *unused)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) struct llist_node *node = llist_del_all(&free_ipc_list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) struct ipc_namespace *n, *t;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) llist_for_each_entry_safe(n, t, node, mnt_llist)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) free_ipc_ns(n);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) * The work queue is used to avoid the cost of synchronize_rcu in kern_unmount.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) static DECLARE_WORK(free_ipc_work, free_ipc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) * put_ipc_ns - drop a reference to an ipc namespace.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) * @ns: the namespace to put
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) * If this is the last task in the namespace exiting, and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) * it is dropping the refcount to 0, then it can race with
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) * a task in another ipc namespace but in a mounts namespace
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) * which has this ipcns's mqueuefs mounted, doing some action
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) * with one of the mqueuefs files. That can raise the refcount.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) * So dropping the refcount, and raising the refcount when
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) * accessing it through the VFS, are protected with mq_lock.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) * (Clearly, a task raising the refcount on its own ipc_ns
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) * needn't take mq_lock since it can't race with the last task
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) * in the ipcns exiting).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) void put_ipc_ns(struct ipc_namespace *ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) if (refcount_dec_and_lock(&ns->count, &mq_lock)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) mq_clear_sbinfo(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) spin_unlock(&mq_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) if (llist_add(&ns->mnt_llist, &free_ipc_list))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) schedule_work(&free_ipc_work);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) static inline struct ipc_namespace *to_ipc_ns(struct ns_common *ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) return container_of(ns, struct ipc_namespace, ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) static struct ns_common *ipcns_get(struct task_struct *task)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) struct ipc_namespace *ns = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) struct nsproxy *nsproxy;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) task_lock(task);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) nsproxy = task->nsproxy;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) if (nsproxy)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) ns = get_ipc_ns(nsproxy->ipc_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) task_unlock(task);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) return ns ? &ns->ns : NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) static void ipcns_put(struct ns_common *ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) return put_ipc_ns(to_ipc_ns(ns));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) static int ipcns_install(struct nsset *nsset, struct ns_common *new)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) struct nsproxy *nsproxy = nsset->nsproxy;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) struct ipc_namespace *ns = to_ipc_ns(new);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) put_ipc_ns(nsproxy->ipc_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) nsproxy->ipc_ns = get_ipc_ns(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) static struct user_namespace *ipcns_owner(struct ns_common *ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) return to_ipc_ns(ns)->user_ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) const struct proc_ns_operations ipcns_operations = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) .name = "ipc",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) .type = CLONE_NEWIPC,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) .get = ipcns_get,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) .put = ipcns_put,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) .install = ipcns_install,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) .owner = ipcns_owner,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) };