^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) #include "cgroup-internal.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) #include <linux/sched/task.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) #include <linux/nsproxy.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) #include <linux/proc_ns.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) /* cgroup namespaces */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) static struct ucounts *inc_cgroup_namespaces(struct user_namespace *ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) return inc_ucount(ns, current_euid(), UCOUNT_CGROUP_NAMESPACES);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) static void dec_cgroup_namespaces(struct ucounts *ucounts)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) dec_ucount(ucounts, UCOUNT_CGROUP_NAMESPACES);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) static struct cgroup_namespace *alloc_cgroup_ns(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) struct cgroup_namespace *new_ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) new_ns = kzalloc(sizeof(struct cgroup_namespace), GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) if (!new_ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) return ERR_PTR(-ENOMEM);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) ret = ns_alloc_inum(&new_ns->ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) if (ret) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) kfree(new_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) return ERR_PTR(ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) refcount_set(&new_ns->count, 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) new_ns->ns.ops = &cgroupns_operations;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) return new_ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) void free_cgroup_ns(struct cgroup_namespace *ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) put_css_set(ns->root_cset);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) dec_cgroup_namespaces(ns->ucounts);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) put_user_ns(ns->user_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) ns_free_inum(&ns->ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) kfree(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) EXPORT_SYMBOL(free_cgroup_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) struct cgroup_namespace *copy_cgroup_ns(unsigned long flags,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) struct user_namespace *user_ns,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) struct cgroup_namespace *old_ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) struct cgroup_namespace *new_ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) struct ucounts *ucounts;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) struct css_set *cset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) BUG_ON(!old_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) if (!(flags & CLONE_NEWCGROUP)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) get_cgroup_ns(old_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) return old_ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) /* Allow only sysadmin to create cgroup namespace. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) if (!ns_capable(user_ns, CAP_SYS_ADMIN))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) return ERR_PTR(-EPERM);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) ucounts = inc_cgroup_namespaces(user_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) if (!ucounts)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) return ERR_PTR(-ENOSPC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) /* It is not safe to take cgroup_mutex here */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) spin_lock_irq(&css_set_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) cset = task_css_set(current);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) get_css_set(cset);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) spin_unlock_irq(&css_set_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) new_ns = alloc_cgroup_ns();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) if (IS_ERR(new_ns)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) put_css_set(cset);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) dec_cgroup_namespaces(ucounts);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) return new_ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) new_ns->user_ns = get_user_ns(user_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) new_ns->ucounts = ucounts;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) new_ns->root_cset = cset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) return new_ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) static inline struct cgroup_namespace *to_cg_ns(struct ns_common *ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) return container_of(ns, struct cgroup_namespace, ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) static int cgroupns_install(struct nsset *nsset, struct ns_common *ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) struct nsproxy *nsproxy = nsset->nsproxy;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) struct cgroup_namespace *cgroup_ns = to_cg_ns(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) if (!ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) !ns_capable(cgroup_ns->user_ns, CAP_SYS_ADMIN))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) /* Don't need to do anything if we are attaching to our own cgroupns. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) if (cgroup_ns == nsproxy->cgroup_ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) get_cgroup_ns(cgroup_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) put_cgroup_ns(nsproxy->cgroup_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) nsproxy->cgroup_ns = cgroup_ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) static struct ns_common *cgroupns_get(struct task_struct *task)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) struct cgroup_namespace *ns = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) struct nsproxy *nsproxy;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) task_lock(task);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) nsproxy = task->nsproxy;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) if (nsproxy) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) ns = nsproxy->cgroup_ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) get_cgroup_ns(ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) task_unlock(task);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) return ns ? &ns->ns : NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) static void cgroupns_put(struct ns_common *ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) put_cgroup_ns(to_cg_ns(ns));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) static struct user_namespace *cgroupns_owner(struct ns_common *ns)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) return to_cg_ns(ns)->user_ns;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) const struct proc_ns_operations cgroupns_operations = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) .name = "cgroup",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) .type = CLONE_NEWCGROUP,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) .get = cgroupns_get,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) .put = cgroupns_put,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) .install = cgroupns_install,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) .owner = cgroupns_owner,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) static __init int cgroup_namespaces_init(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) subsys_initcall(cgroup_namespaces_init);
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags