FILE
base.c
File preview with syntax highlighting.
linux-6.19.14/fs/proc/base.c
1// SPDX-License-Identifier: GPL-2.0 2/* 3 * linux/fs/proc/base.c 4 * 5 * Copyright (C) 1991, 1992 Linus Torvalds 6 * 7 * proc base directory handling functions 8 * 9 * 1999, Al Viro. Rewritten. Now it covers the whole per-process part. 10 * Instead of using magical inumbers to determine the kind of object 11 * we allocate and fill in-core inodes upon lookup. They don't even 12 * go into icache. We cache the reference to task_struct upon lookup too. 13 * Eventually it should become a filesystem in its own. We don't use the 14 * rest of procfs anymore. 15 * 16 * 17 * Changelog: 18 * 17-Jan-2005 19 * Allan Bezerra 20 * Bruna Moreira <bruna.moreira@indt.org.br> 21 * Edjard Mota <edjard.mota@indt.org.br> 22 * Ilias Biris <ilias.biris@indt.org.br> 23 * Mauricio Lin <mauricio.lin@indt.org.br> 24 * 25 * Embedded Linux Lab - 10LE Instituto Nokia de Tecnologia - INdT 26 * 27 * A new process specific entry (smaps) included in /proc. It shows the 28 * size of rss for each memory area. The maps entry lacks information 29 * about physical memory size (rss) for each mapped file, i.e., 30 * rss information for executables and library files. 31 * This additional information is useful for any tools that need to know 32 * about physical memory consumption for a process specific library. 33 * 34 * Changelog: 35 * 21-Feb-2005 36 * Embedded Linux Lab - 10LE Instituto Nokia de Tecnologia - INdT 37 * Pud inclusion in the page table walking. 38 * 39 * ChangeLog: 40 * 10-Mar-2005 41 * 10LE Instituto Nokia de Tecnologia - INdT: 42 * A better way to walks through the page table as suggested by Hugh Dickins. 43 * 44 * Simo Piiroinen <simo.piiroinen@nokia.com>: 45 * Smaps information related to shared, private, clean and dirty pages. 46 * 47 * Paul Mundt <paul.mundt@nokia.com>: 48 * Overall revision about smaps. 49 */ 50 51#include <linux/uaccess.h> 52 53#include <linux/errno.h> 54#include <linux/time.h> 55#include <linux/proc_fs.h> 56#include <linux/stat.h> 57#include <linux/task_io_accounting_ops.h> 58#include <linux/init.h> 59#include <linux/capability.h> 60#include <linux/file.h> 61#include <linux/generic-radix-tree.h> 62#include <linux/string.h> 63#include <linux/seq_file.h> 64#include <linux/namei.h> 65#include <linux/mnt_namespace.h> 66#include <linux/mm.h> 67#include <linux/swap.h> 68#include <linux/rcupdate.h> 69#include <linux/kallsyms.h> 70#include <linux/stacktrace.h> 71#include <linux/resource.h> 72#include <linux/module.h> 73#include <linux/mount.h> 74#include <linux/security.h> 75#include <linux/ptrace.h> 76#include <linux/printk.h> 77#include <linux/cache.h> 78#include <linux/cgroup.h> 79#include <linux/cpuset.h> 80#include <linux/audit.h> 81#include <linux/poll.h> 82#include <linux/nsproxy.h> 83#include <linux/oom.h> 84#include <linux/elf.h> 85#include <linux/pid_namespace.h> 86#include <linux/user_namespace.h> 87#include <linux/fs_parser.h> 88#include <linux/fs_struct.h> 89#include <linux/slab.h> 90#include <linux/sched/autogroup.h> 91#include <linux/sched/mm.h> 92#include <linux/sched/coredump.h> 93#include <linux/sched/debug.h> 94#include <linux/sched/stat.h> 95#include <linux/posix-timers.h> 96#include <linux/time_namespace.h> 97#include <linux/resctrl.h> 98#include <linux/cn_proc.h> 99#include <linux/ksm.h> 100#include <uapi/linux/lsm.h> 101#include <trace/events/oom.h> 102#include "internal.h" 103#include "fd.h" 104 105#include "../../lib/kstrtox.h" 106 107/* NOTE: 108 * Implementing inode permission operations in /proc is almost 109 * certainly an error. Permission checks need to happen during 110 * each system call not at open time. The reason is that most of 111 * what we wish to check for permissions in /proc varies at runtime. 112 * 113 * The classic example of a problem is opening file descriptors 114 * in /proc for a task before it execs a suid executable. 115 */ 116 117static u8 nlink_tid __ro_after_init; 118static u8 nlink_tgid __ro_after_init; 119 120enum proc_mem_force { 121 PROC_MEM_FORCE_ALWAYS, 122 PROC_MEM_FORCE_PTRACE, 123 PROC_MEM_FORCE_NEVER 124}; 125 126static enum proc_mem_force proc_mem_force_override __ro_after_init = 127 IS_ENABLED(CONFIG_PROC_MEM_NO_FORCE) ? PROC_MEM_FORCE_NEVER : 128 IS_ENABLED(CONFIG_PROC_MEM_FORCE_PTRACE) ? PROC_MEM_FORCE_PTRACE : 129 PROC_MEM_FORCE_ALWAYS; 130 131static const struct constant_table proc_mem_force_table[] __initconst = { 132 { "always", PROC_MEM_FORCE_ALWAYS }, 133 { "ptrace", PROC_MEM_FORCE_PTRACE }, 134 { "never", PROC_MEM_FORCE_NEVER }, 135 { } 136}; 137 138static int __init early_proc_mem_force_override(char *buf) 139{ 140 if (!buf) 141 return -EINVAL; 142 143 /* 144 * lookup_constant() defaults to proc_mem_force_override to preseve 145 * the initial Kconfig choice in case an invalid param gets passed. 146 */ 147 proc_mem_force_override = lookup_constant(proc_mem_force_table, 148 buf, proc_mem_force_override); 149 150 return 0; 151} 152early_param("proc_mem.force_override", early_proc_mem_force_override); 153 154struct pid_entry { 155 const char *name; 156 unsigned int len; 157 umode_t mode; 158 const struct inode_operations *iop; 159 const struct file_operations *fop; 160 union proc_op op; 161}; 162 163#define NOD(NAME, MODE, IOP, FOP, OP) { \ 164 .name = (NAME), \ 165 .len = sizeof(NAME) - 1, \ 166 .mode = MODE, \ 167 .iop = IOP, \ 168 .fop = FOP, \ 169 .op = OP, \ 170} 171 172#define DIR(NAME, MODE, iops, fops) \ 173 NOD(NAME, (S_IFDIR|(MODE)), &iops, &fops, {} ) 174#define LNK(NAME, get_link) \ 175 NOD(NAME, (S_IFLNK|S_IRWXUGO), \ 176 &proc_pid_link_inode_operations, NULL, \ 177 { .proc_get_link = get_link } ) 178#define REG(NAME, MODE, fops) \ 179 NOD(NAME, (S_IFREG|(MODE)), NULL, &fops, {}) 180#define ONE(NAME, MODE, show) \ 181 NOD(NAME, (S_IFREG|(MODE)), \ 182 NULL, &proc_single_file_operations, \ 183 { .proc_show = show } ) 184#define ATTR(LSMID, NAME, MODE) \ 185 NOD(NAME, (S_IFREG|(MODE)), \ 186 NULL, &proc_pid_attr_operations, \ 187 { .lsmid = LSMID }) 188 189/* 190 * Count the number of hardlinks for the pid_entry table, excluding the . 191 * and .. links. 192 */ 193static unsigned int __init pid_entry_nlink(const struct pid_entry *entries, 194 unsigned int n) 195{ 196 unsigned int i; 197 unsigned int count; 198 199 count = 2; 200 for (i = 0; i < n; ++i) { 201 if (S_ISDIR(entries[i].mode)) 202 ++count; 203 } 204 205 return count; 206} 207 208static int get_task_root(struct task_struct *task, struct path *root) 209{ 210 int result = -ENOENT; 211 212 task_lock(task); 213 if (task->fs) { 214 get_fs_root(task->fs, root); 215 result = 0; 216 } 217 task_unlock(task); 218 return result; 219} 220 221static int proc_cwd_link(struct dentry *dentry, struct path *path) 222{ 223 struct task_struct *task = get_proc_task(d_inode(dentry)); 224 int result = -ENOENT; 225 226 if (task) { 227 task_lock(task); 228 if (task->fs) { 229 get_fs_pwd(task->fs, path); 230 result = 0; 231 } 232 task_unlock(task); 233 put_task_struct(task); 234 } 235 return result; 236} 237 238static int proc_root_link(struct dentry *dentry, struct path *path) 239{ 240 struct task_struct *task = get_proc_task(d_inode(dentry)); 241 int result = -ENOENT; 242 243 if (task) { 244 result = get_task_root(task, path); 245 put_task_struct(task); 246 } 247 return result; 248} 249 250/* 251 * If the user used setproctitle(), we just get the string from 252 * user space at arg_start, and limit it to a maximum of one page. 253 */ 254static ssize_t get_mm_proctitle(struct mm_struct *mm, char __user *buf, 255 size_t count, unsigned long pos, 256 unsigned long arg_start) 257{ 258 char *page; 259 int ret, got; 260 261 if (pos >= PAGE_SIZE) 262 return 0; 263 264 page = (char *)__get_free_page(GFP_KERNEL); 265 if (!page) 266 return -ENOMEM; 267 268 ret = 0; 269 got = access_remote_vm(mm, arg_start, page, PAGE_SIZE, FOLL_ANON); 270 if (got > 0) { 271 int len = strnlen(page, got); 272 273 /* Include the NUL character if it was found */ 274 if (len < got) 275 len++; 276 277 if (len > pos) { 278 len -= pos; 279 if (len > count) 280 len = count; 281 len -= copy_to_user(buf, page+pos, len); 282 if (!len) 283 len = -EFAULT; 284 ret = len; 285 } 286 } 287 free_page((unsigned long)page); 288 return ret; 289} 290 291static ssize_t get_mm_cmdline(struct mm_struct *mm, char __user *buf, 292 size_t count, loff_t *ppos) 293{ 294 unsigned long arg_start, arg_end, env_start, env_end; 295 unsigned long pos, len; 296 char *page, c; 297 298 /* Check if process spawned far enough to have cmdline. */ 299 if (!mm->env_end) 300 return 0; 301 302 spin_lock(&mm->arg_lock); 303 arg_start = mm->arg_start; 304 arg_end = mm->arg_end; 305 env_start = mm->env_start; 306 env_end = mm->env_end; 307 spin_unlock(&mm->arg_lock); 308 309 if (arg_start >= arg_end) 310 return 0; 311 312 /* 313 * We allow setproctitle() to overwrite the argument 314 * strings, and overflow past the original end. But 315 * only when it overflows into the environment area. 316 */ 317 if (env_start != arg_end || env_end < env_start) 318 env_start = env_end = arg_end; 319 len = env_end - arg_start; 320 321 /* We're not going to care if "*ppos" has high bits set */ 322 pos = *ppos; 323 if (pos >= len) 324 return 0; 325 if (count > len - pos) 326 count = len - pos; 327 if (!count) 328 return 0; 329 330 /* 331 * Magical special case: if the argv[] end byte is not 332 * zero, the user has overwritten it with setproctitle(3). 333 * 334 * Possible future enhancement: do this only once when 335 * pos is 0, and set a flag in the 'struct file'. 336 */ 337 if (access_remote_vm(mm, arg_end-1, &c, 1, FOLL_ANON) == 1 && c) 338 return get_mm_proctitle(mm, buf, count, pos, arg_start); 339 340 /* 341 * For the non-setproctitle() case we limit things strictly 342 * to the [arg_start, arg_end[ range. 343 */ 344 pos += arg_start; 345 if (pos < arg_start || pos >= arg_end) 346 return 0; 347 if (count > arg_end - pos) 348 count = arg_end - pos; 349 350 page = (char *)__get_free_page(GFP_KERNEL); 351 if (!page) 352 return -ENOMEM; 353 354 len = 0; 355 while (count) { 356 int got; 357 size_t size = min_t(size_t, PAGE_SIZE, count); 358 359 got = access_remote_vm(mm, pos, page, size, FOLL_ANON); 360 if (got <= 0) 361 break; 362 got -= copy_to_user(buf, page, got); 363 if (unlikely(!got)) { 364 if (!len) 365 len = -EFAULT; 366 break; 367 } 368 pos += got; 369 buf += got; 370 len += got; 371 count -= got; 372 } 373 374 free_page((unsigned long)page); 375 return len; 376} 377 378static ssize_t get_task_cmdline(struct task_struct *tsk, char __user *buf, 379 size_t count, loff_t *pos) 380{ 381 struct mm_struct *mm; 382 ssize_t ret; 383 384 mm = get_task_mm(tsk); 385 if (!mm) 386 return 0; 387 388 ret = get_mm_cmdline(mm, buf, count, pos); 389 mmput(mm); 390 return ret; 391} 392 393static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf, 394 size_t count, loff_t *pos) 395{ 396 struct task_struct *tsk; 397 ssize_t ret; 398 399 BUG_ON(*pos < 0); 400 401 tsk = get_proc_task(file_inode(file)); 402 if (!tsk) 403 return -ESRCH; 404 ret = get_task_cmdline(tsk, buf, count, pos); 405 put_task_struct(tsk); 406 if (ret > 0) 407 *pos += ret; 408 return ret; 409} 410 411static const struct file_operations proc_pid_cmdline_ops = { 412 .read = proc_pid_cmdline_read, 413 .llseek = generic_file_llseek, 414}; 415 416#ifdef CONFIG_KALLSYMS 417/* 418 * Provides a wchan file via kallsyms in a proper one-value-per-file format. 419 * Returns the resolved symbol to user space. 420 */ 421static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns, 422 struct pid *pid, struct task_struct *task) 423{ 424 unsigned long wchan; 425 char symname[KSYM_NAME_LEN]; 426 427 if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) 428 goto print0; 429 430 wchan = get_wchan(task); 431 if (wchan && !lookup_symbol_name(wchan, symname)) { 432 seq_puts(m, symname); 433 return 0; 434 } 435 436print0: 437 seq_putc(m, '0'); 438 return 0; 439} 440#endif /* CONFIG_KALLSYMS */ 441 442static int lock_trace(struct task_struct *task) 443{ 444 int err = down_read_killable(&task->signal->exec_update_lock); 445 if (err) 446 return err; 447 if (!ptrace_may_access(task, PTRACE_MODE_ATTACH_FSCREDS)) { 448 up_read(&task->signal->exec_update_lock); 449 return -EPERM; 450 } 451 return 0; 452} 453 454static void unlock_trace(struct task_struct *task) 455{ 456 up_read(&task->signal->exec_update_lock); 457} 458 459#ifdef CONFIG_STACKTRACE 460 461#define MAX_STACK_TRACE_DEPTH 64 462 463static int proc_pid_stack(struct seq_file *m, struct pid_namespace *ns, 464 struct pid *pid, struct task_struct *task) 465{ 466 unsigned long *entries; 467 int err; 468 469 /* 470 * The ability to racily run the kernel stack unwinder on a running task 471 * and then observe the unwinder output is scary; while it is useful for 472 * debugging kernel issues, it can also allow an attacker to leak kernel 473 * stack contents. 474 * Doing this in a manner that is at least safe from races would require 475 * some work to ensure that the remote task can not be scheduled; and 476 * even then, this would still expose the unwinder as local attack 477 * surface. 478 * Therefore, this interface is restricted to root. 479 */ 480 if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN)) 481 return -EACCES; 482 483 entries = kmalloc_array(MAX_STACK_TRACE_DEPTH, sizeof(*entries), 484 GFP_KERNEL); 485 if (!entries) 486 return -ENOMEM; 487 488 err = lock_trace(task); 489 if (!err) { 490 unsigned int i, nr_entries; 491 492 nr_entries = stack_trace_save_tsk(task, entries, 493 MAX_STACK_TRACE_DEPTH, 0); 494 495 for (i = 0; i < nr_entries; i++) { 496 seq_printf(m, "[<0>] %pB\n", (void *)entries[i]); 497 } 498 499 unlock_trace(task); 500 } 501 kfree(entries); 502 503 return err; 504} 505#endif 506 507#ifdef CONFIG_SCHED_INFO 508/* 509 * Provides /proc/PID/schedstat 510 */ 511static int proc_pid_schedstat(struct seq_file *m, struct pid_namespace *ns, 512 struct pid *pid, struct task_struct *task) 513{ 514 if (unlikely(!sched_info_on())) 515 seq_puts(m, "0 0 0\n"); 516 else 517 seq_printf(m, "%llu %llu %lu\n", 518 (unsigned long long)task->se.sum_exec_runtime, 519 (unsigned long long)task->sched_info.run_delay, 520 task->sched_info.pcount); 521 522 return 0; 523} 524#endif 525 526#ifdef CONFIG_LATENCYTOP 527static int lstats_show_proc(struct seq_file *m, void *v) 528{ 529 int i; 530 struct inode *inode = m->private; 531 struct task_struct *task = get_proc_task(inode); 532 533 if (!task) 534 return -ESRCH; 535 seq_puts(m, "Latency Top version : v0.1\n"); 536 for (i = 0; i < LT_SAVECOUNT; i++) { 537 struct latency_record *lr = &task->latency_record[i]; 538 if (lr->backtrace[0]) { 539 int q; 540 seq_printf(m, "%i %li %li", 541 lr->count, lr->time, lr->max); 542 for (q = 0; q < LT_BACKTRACEDEPTH; q++) { 543 unsigned long bt = lr->backtrace[q]; 544 545 if (!bt) 546 break; 547 seq_printf(m, " %ps", (void *)bt); 548 } 549 seq_putc(m, '\n'); 550 } 551 552 } 553 put_task_struct(task); 554 return 0; 555} 556 557static int lstats_open(struct inode *inode, struct file *file) 558{ 559 return single_open(file, lstats_show_proc, inode); 560} 561 562static ssize_t lstats_write(struct file *file, const char __user *buf, 563 size_t count, loff_t *offs) 564{ 565 struct task_struct *task = get_proc_task(file_inode(file)); 566 567 if (!task) 568 return -ESRCH; 569 clear_tsk_latency_tracing(task); 570 put_task_struct(task); 571 572 return count; 573} 574 575static const struct file_operations proc_lstats_operations = { 576 .open = lstats_open, 577 .read = seq_read, 578 .write = lstats_write, 579 .llseek = seq_lseek, 580 .release = single_release, 581}; 582 583#endif 584 585static int proc_oom_score(struct seq_file *m, struct pid_namespace *ns, 586 struct pid *pid, struct task_struct *task) 587{ 588 unsigned long totalpages = totalram_pages() + total_swap_pages; 589 unsigned long points = 0; 590 long badness; 591 592 badness = oom_badness(task, totalpages); 593 /* 594 * Special case OOM_SCORE_ADJ_MIN for all others scale the 595 * badness value into [0, 2000] range which we have been 596 * exporting for a long time so userspace might depend on it. 597 */ 598 if (badness != LONG_MIN) 599 points = (1000 + badness * 1000 / (long)totalpages) * 2 / 3; 600 601 seq_printf(m, "%lu\n", points); 602 603 return 0; 604} 605 606struct limit_names { 607 const char *name; 608 const char *unit; 609}; 610 611static const struct limit_names lnames[RLIM_NLIMITS] = { 612 [RLIMIT_CPU] = {"Max cpu time", "seconds"}, 613 [RLIMIT_FSIZE] = {"Max file size", "bytes"}, 614 [RLIMIT_DATA] = {"Max data size", "bytes"}, 615 [RLIMIT_STACK] = {"Max stack size", "bytes"}, 616 [RLIMIT_CORE] = {"Max core file size", "bytes"}, 617 [RLIMIT_RSS] = {"Max resident set", "bytes"}, 618 [RLIMIT_NPROC] = {"Max processes", "processes"}, 619 [RLIMIT_NOFILE] = {"Max open files", "files"}, 620 [RLIMIT_MEMLOCK] = {"Max locked memory", "bytes"}, 621 [RLIMIT_AS] = {"Max address space", "bytes"}, 622 [RLIMIT_LOCKS] = {"Max file locks", "locks"}, 623 [RLIMIT_SIGPENDING] = {"Max pending signals", "signals"}, 624 [RLIMIT_MSGQUEUE] = {"Max msgqueue size", "bytes"}, 625 [RLIMIT_NICE] = {"Max nice priority", NULL}, 626 [RLIMIT_RTPRIO] = {"Max realtime priority", NULL}, 627 [RLIMIT_RTTIME] = {"Max realtime timeout", "us"}, 628}; 629 630/* Display limits for a process */ 631static int proc_pid_limits(struct seq_file *m, struct pid_namespace *ns, 632 struct pid *pid, struct task_struct *task) 633{ 634 unsigned int i; 635 unsigned long flags; 636 637 struct rlimit rlim[RLIM_NLIMITS]; 638 639 if (!lock_task_sighand(task, &flags)) 640 return 0; 641 memcpy(rlim, task->signal->rlim, sizeof(struct rlimit) * RLIM_NLIMITS); 642 unlock_task_sighand(task, &flags); 643 644 /* 645 * print the file header 646 */ 647 seq_puts(m, "Limit " 648 "Soft Limit " 649 "Hard Limit " 650 "Units \n"); 651 652 for (i = 0; i < RLIM_NLIMITS; i++) { 653 if (rlim[i].rlim_cur == RLIM_INFINITY) 654 seq_printf(m, "%-25s %-20s ", 655 lnames[i].name, "unlimited"); 656 else 657 seq_printf(m, "%-25s %-20lu ", 658 lnames[i].name, rlim[i].rlim_cur); 659 660 if (rlim[i].rlim_max == RLIM_INFINITY) 661 seq_printf(m, "%-20s ", "unlimited"); 662 else 663 seq_printf(m, "%-20lu ", rlim[i].rlim_max); 664 665 if (lnames[i].unit) 666 seq_printf(m, "%-10s\n", lnames[i].unit); 667 else 668 seq_putc(m, '\n'); 669 } 670 671 return 0; 672} 673 674#ifdef CONFIG_HAVE_ARCH_TRACEHOOK 675static int proc_pid_syscall(struct seq_file *m, struct pid_namespace *ns, 676 struct pid *pid, struct task_struct *task) 677{ 678 struct syscall_info info; 679 u64 *args = &info.data.args[0]; 680 int res; 681 682 res = lock_trace(task); 683 if (res) 684 return res; 685 686 if (task_current_syscall(task, &info)) 687 seq_puts(m, "running\n"); 688 else if (info.data.nr < 0) 689 seq_printf(m, "%d 0x%llx 0x%llx\n", 690 info.data.nr, info.sp, info.data.instruction_pointer); 691 else 692 seq_printf(m, 693 "%d 0x%llx 0x%llx 0x%llx 0x%llx 0x%llx 0x%llx 0x%llx 0x%llx\n", 694 info.data.nr, 695 args[0], args[1], args[2], args[3], args[4], args[5], 696 info.sp, info.data.instruction_pointer); 697 unlock_trace(task); 698 699 return 0; 700} 701#endif /* CONFIG_HAVE_ARCH_TRACEHOOK */ 702 703/************************************************************************/ 704/* Here the fs part begins */ 705/************************************************************************/ 706 707/* permission checks */ 708static bool proc_fd_access_allowed(struct inode *inode) 709{ 710 struct task_struct *task; 711 bool allowed = false; 712 /* Allow access to a task's file descriptors if it is us or we 713 * may use ptrace attach to the process and find out that 714 * information. 715 */ 716 task = get_proc_task(inode); 717 if (task) { 718 allowed = ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS); 719 put_task_struct(task); 720 } 721 return allowed; 722} 723 724int proc_setattr(struct mnt_idmap *idmap, struct dentry *dentry, 725 struct iattr *attr) 726{ 727 int error; 728 struct inode *inode = d_inode(dentry); 729 730 if (attr->ia_valid & ATTR_MODE) 731 return -EPERM; 732 733 error = setattr_prepare(&nop_mnt_idmap, dentry, attr); 734 if (error) 735 return error; 736 737 setattr_copy(&nop_mnt_idmap, inode, attr); 738 return 0; 739} 740 741/* 742 * May current process learn task's sched/cmdline info (for hide_pid_min=1) 743 * or euid/egid (for hide_pid_min=2)? 744 */ 745static bool has_pid_permissions(struct proc_fs_info *fs_info, 746 struct task_struct *task, 747 enum proc_hidepid hide_pid_min) 748{ 749 /* 750 * If 'hidpid' mount option is set force a ptrace check, 751 * we indicate that we are using a filesystem syscall 752 * by passing PTRACE_MODE_READ_FSCREDS 753 */ 754 if (fs_info->hide_pid == HIDEPID_NOT_PTRACEABLE) 755 return ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS); 756 757 if (fs_info->hide_pid < hide_pid_min) 758 return true; 759 if (in_group_p(fs_info->pid_gid)) 760 return true; 761 return ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS); 762} 763 764 765static int proc_pid_permission(struct mnt_idmap *idmap, 766 struct inode *inode, int mask) 767{ 768 struct proc_fs_info *fs_info = proc_sb_info(inode->i_sb); 769 struct task_struct *task; 770 bool has_perms; 771 772 task = get_proc_task(inode); 773 if (!task) 774 return -ESRCH; 775 has_perms = has_pid_permissions(fs_info, task, HIDEPID_NO_ACCESS); 776 put_task_struct(task); 777 778 if (!has_perms) { 779 if (fs_info->hide_pid == HIDEPID_INVISIBLE) { 780 /* 781 * Let's make getdents(), stat(), and open() 782 * consistent with each other. If a process 783 * may not stat() a file, it shouldn't be seen 784 * in procfs at all. 785 */ 786 return -ENOENT; 787 } 788 789 return -EPERM; 790 } 791 return generic_permission(&nop_mnt_idmap, inode, mask); 792} 793 794 795 796static const struct inode_operations proc_def_inode_operations = { 797 .setattr = proc_setattr, 798}; 799 800static int proc_single_show(struct seq_file *m, void *v) 801{ 802 struct inode *inode = m->private; 803 struct pid_namespace *ns = proc_pid_ns(inode->i_sb); 804 struct pid *pid = proc_pid(inode); 805 struct task_struct *task; 806 int ret; 807 808 task = get_pid_task(pid, PIDTYPE_PID); 809 if (!task) 810 return -ESRCH; 811 812 ret = PROC_I(inode)->op.proc_show(m, ns, pid, task); 813 814 put_task_struct(task); 815 return ret; 816} 817 818static int proc_single_open(struct inode *inode, struct file *filp) 819{ 820 return single_open(filp, proc_single_show, inode); 821} 822 823static const struct file_operations proc_single_file_operations = { 824 .open = proc_single_open, 825 .read = seq_read, 826 .llseek = seq_lseek, 827 .release = single_release, 828}; 829 830/* 831 * proc_mem_open() can return errno, NULL or mm_struct*. 832 * 833 * - Returns NULL if the task has no mm (PF_KTHREAD or PF_EXITING) 834 * - Returns mm_struct* on success 835 * - Returns error code on failure 836 */ 837struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode) 838{ 839 struct task_struct *task = get_proc_task(inode); 840 struct mm_struct *mm; 841 842 if (!task) 843 return ERR_PTR(-ESRCH); 844 845 mm = mm_access(task, mode | PTRACE_MODE_FSCREDS); 846 put_task_struct(task); 847 848 if (IS_ERR(mm)) 849 return mm == ERR_PTR(-ESRCH) ? NULL : mm; 850 851 /* ensure this mm_struct can't be freed */ 852 mmgrab(mm); 853 /* but do not pin its memory */ 854 mmput(mm); 855 856 return mm; 857} 858 859static int __mem_open(struct inode *inode, struct file *file, unsigned int mode) 860{ 861 struct mm_struct *mm = proc_mem_open(inode, mode); 862 863 if (IS_ERR_OR_NULL(mm)) 864 return mm ? PTR_ERR(mm) : -ESRCH; 865 866 file->private_data = mm; 867 return 0; 868} 869 870static int mem_open(struct inode *inode, struct file *file) 871{ 872 if (WARN_ON_ONCE(!(file->f_op->fop_flags & FOP_UNSIGNED_OFFSET))) 873 return -EINVAL; 874 return __mem_open(inode, file, PTRACE_MODE_ATTACH); 875} 876 877static bool proc_mem_foll_force(struct file *file, struct mm_struct *mm) 878{ 879 struct task_struct *task; 880 bool ptrace_active = false; 881 882 switch (proc_mem_force_override) { 883 case PROC_MEM_FORCE_NEVER: 884 return false; 885 case PROC_MEM_FORCE_PTRACE: 886 task = get_proc_task(file_inode(file)); 887 if (task) { 888 ptrace_active = READ_ONCE(task->ptrace) && 889 READ_ONCE(task->mm) == mm && 890 READ_ONCE(task->parent) == current; 891 put_task_struct(task); 892 } 893 return ptrace_active; 894 default: 895 return true; 896 } 897} 898 899static ssize_t mem_rw(struct file *file, char __user *buf, 900 size_t count, loff_t *ppos, int write) 901{ 902 struct mm_struct *mm = file->private_data; 903 unsigned long addr = *ppos; 904 ssize_t copied; 905 char *page; 906 unsigned int flags; 907 908 if (!mm) 909 return 0; 910 911 page = (char *)__get_free_page(GFP_KERNEL); 912 if (!page) 913 return -ENOMEM; 914 915 copied = 0; 916 if (!mmget_not_zero(mm)) 917 goto free; 918 919 flags = write ? FOLL_WRITE : 0; 920 if (proc_mem_foll_force(file, mm)) 921 flags |= FOLL_FORCE; 922 923 while (count > 0) { 924 size_t this_len = min_t(size_t, count, PAGE_SIZE); 925 926 if (write && copy_from_user(page, buf, this_len)) { 927 copied = -EFAULT; 928 break; 929 } 930 931 this_len = access_remote_vm(mm, addr, page, this_len, flags); 932 if (!this_len) { 933 if (!copied) 934 copied = -EIO; 935 break; 936 } 937 938 if (!write && copy_to_user(buf, page, this_len)) { 939 copied = -EFAULT; 940 break; 941 } 942 943 buf += this_len; 944 addr += this_len; 945 copied += this_len; 946 count -= this_len; 947 } 948 *ppos = addr; 949 950 mmput(mm); 951free: 952 free_page((unsigned long) page); 953 return copied; 954} 955 956static ssize_t mem_read(struct file *file, char __user *buf, 957 size_t count, loff_t *ppos) 958{ 959 return mem_rw(file, buf, count, ppos, 0); 960} 961 962static ssize_t mem_write(struct file *file, const char __user *buf, 963 size_t count, loff_t *ppos) 964{ 965 return mem_rw(file, (char __user*)buf, count, ppos, 1); 966} 967 968loff_t mem_lseek(struct file *file, loff_t offset, int orig) 969{ 970 switch (orig) { 971 case 0: 972 file->f_pos = offset; 973 break; 974 case 1: 975 file->f_pos += offset; 976 break; 977 default: 978 return -EINVAL; 979 } 980 force_successful_syscall_return(); 981 return file->f_pos; 982} 983 984static int mem_release(struct inode *inode, struct file *file) 985{ 986 struct mm_struct *mm = file->private_data; 987 if (mm) 988 mmdrop(mm); 989 return 0; 990} 991 992static const struct file_operations proc_mem_operations = { 993 .llseek = mem_lseek, 994 .read = mem_read, 995 .write = mem_write, 996 .open = mem_open, 997 .release = mem_release, 998 .fop_flags = FOP_UNSIGNED_OFFSET, 999}; 1000 1001static int environ_open(struct inode *inode, struct file *file) 1002{ 1003 return __mem_open(inode, file, PTRACE_MODE_READ); 1004} 1005 1006static ssize_t environ_read(struct file *file, char __user *buf, 1007 size_t count, loff_t *ppos) 1008{ 1009 char *page; 1010 unsigned long src = *ppos; 1011 int ret = 0; 1012 struct mm_struct *mm = file->private_data; 1013 unsigned long env_start, env_end; 1014 1015 /* Ensure the process spawned far enough to have an environment. */ 1016 if (!mm || !mm->env_end) 1017 return 0; 1018 1019 page = (char *)__get_free_page(GFP_KERNEL); 1020 if (!page) 1021 return -ENOMEM; 1022 1023 ret = 0; 1024 if (!mmget_not_zero(mm)) 1025 goto free; 1026 1027 spin_lock(&mm->arg_lock); 1028 env_start = mm->env_start; 1029 env_end = mm->env_end; 1030 spin_unlock(&mm->arg_lock); 1031 1032 while (count > 0) { 1033 size_t this_len, max_len; 1034 int retval; 1035 1036 if (src >= (env_end - env_start)) 1037 break; 1038 1039 this_len = env_end - (env_start + src); 1040 1041 max_len = min_t(size_t, PAGE_SIZE, count); 1042 this_len = min(max_len, this_len); 1043 1044 retval = access_remote_vm(mm, (env_start + src), page, this_len, FOLL_ANON); 1045 1046 if (retval <= 0) { 1047 ret = retval; 1048 break; 1049 } 1050 1051 if (copy_to_user(buf, page, retval)) { 1052 ret = -EFAULT; 1053 break; 1054 } 1055 1056 ret += retval; 1057 src += retval; 1058 buf += retval; 1059 count -= retval; 1060 } 1061 *ppos = src; 1062 mmput(mm); 1063 1064free: 1065 free_page((unsigned long) page); 1066 return ret; 1067} 1068 1069static const struct file_operations proc_environ_operations = { 1070 .open = environ_open, 1071 .read = environ_read, 1072 .llseek = generic_file_llseek, 1073 .release = mem_release, 1074}; 1075 1076static int auxv_open(struct inode *inode, struct file *file) 1077{ 1078 return __mem_open(inode, file, PTRACE_MODE_READ_FSCREDS); 1079} 1080 1081static ssize_t auxv_read(struct file *file, char __user *buf, 1082 size_t count, loff_t *ppos) 1083{ 1084 struct mm_struct *mm = file->private_data; 1085 unsigned int nwords = 0; 1086 1087 if (!mm) 1088 return 0; 1089 do { 1090 nwords += 2; 1091 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */ 1092 return simple_read_from_buffer(buf, count, ppos, mm->saved_auxv, 1093 nwords * sizeof(mm->saved_auxv[0])); 1094} 1095 1096static const struct file_operations proc_auxv_operations = { 1097 .open = auxv_open, 1098 .read = auxv_read, 1099 .llseek = generic_file_llseek, 1100 .release = mem_release, 1101}; 1102 1103static ssize_t oom_adj_read(struct file *file, char __user *buf, size_t count, 1104 loff_t *ppos) 1105{ 1106 struct task_struct *task = get_proc_task(file_inode(file)); 1107 char buffer[PROC_NUMBUF]; 1108 int oom_adj = OOM_ADJUST_MIN; 1109 size_t len; 1110 1111 if (!task) 1112 return -ESRCH; 1113 if (task->signal->oom_score_adj == OOM_SCORE_ADJ_MAX) 1114 oom_adj = OOM_ADJUST_MAX; 1115 else 1116 oom_adj = (task->signal->oom_score_adj * -OOM_DISABLE) / 1117 OOM_SCORE_ADJ_MAX; 1118 put_task_struct(task); 1119 if (oom_adj > OOM_ADJUST_MAX) 1120 oom_adj = OOM_ADJUST_MAX; 1121 len = snprintf(buffer, sizeof(buffer), "%d\n", oom_adj); 1122 return simple_read_from_buffer(buf, count, ppos, buffer, len); 1123} 1124 1125static int __set_oom_adj(struct file *file, int oom_adj, bool legacy) 1126{ 1127 struct mm_struct *mm = NULL; 1128 struct task_struct *task; 1129 int err = 0; 1130 1131 task = get_proc_task(file_inode(file)); 1132 if (!task) 1133 return -ESRCH; 1134 1135 mutex_lock(&oom_adj_mutex); 1136 if (legacy) { 1137 if (oom_adj < task->signal->oom_score_adj && 1138 !capable(CAP_SYS_RESOURCE)) { 1139 err = -EACCES; 1140 goto err_unlock; 1141 } 1142 /* 1143 * /proc/pid/oom_adj is provided for legacy purposes, ask users to use 1144 * /proc/pid/oom_score_adj instead. 1145 */ 1146 pr_warn_once("%s (%d): /proc/%d/oom_adj is deprecated, please use /proc/%d/oom_score_adj instead.\n", 1147 current->comm, task_pid_nr(current), task_pid_nr(task), 1148 task_pid_nr(task)); 1149 } else { 1150 if ((short)oom_adj < task->signal->oom_score_adj_min && 1151 !capable(CAP_SYS_RESOURCE)) { 1152 err = -EACCES; 1153 goto err_unlock; 1154 } 1155 } 1156 1157 /* 1158 * Make sure we will check other processes sharing the mm if this is 1159 * not vfrok which wants its own oom_score_adj. 1160 * pin the mm so it doesn't go away and get reused after task_unlock 1161 */ 1162 if (!task->vfork_done) { 1163 struct task_struct *p = find_lock_task_mm(task); 1164 1165 if (p) { 1166 if (mm_flags_test(MMF_MULTIPROCESS, p->mm)) { 1167 mm = p->mm; 1168 mmgrab(mm); 1169 } 1170 task_unlock(p); 1171 } 1172 } 1173 1174 task->signal->oom_score_adj = oom_adj; 1175 if (!legacy && has_capability_noaudit(current, CAP_SYS_RESOURCE)) 1176 task->signal->oom_score_adj_min = (short)oom_adj; 1177 trace_oom_score_adj_update(task); 1178 1179 if (mm) { 1180 struct task_struct *p; 1181 1182 rcu_read_lock(); 1183 for_each_process(p) { 1184 if (same_thread_group(task, p)) 1185 continue; 1186 1187 /* do not touch kernel threads or the global init */ 1188 if (p->flags & PF_KTHREAD || is_global_init(p)) 1189 continue; 1190 1191 task_lock(p); 1192 if (!p->vfork_done && process_shares_mm(p, mm)) { 1193 p->signal->oom_score_adj = oom_adj; 1194 if (!legacy && has_capability_noaudit(current, CAP_SYS_RESOURCE)) 1195 p->signal->oom_score_adj_min = (short)oom_adj; 1196 } 1197 task_unlock(p); 1198 } 1199 rcu_read_unlock(); 1200 mmdrop(mm); 1201 } 1202err_unlock: 1203 mutex_unlock(&oom_adj_mutex); 1204 put_task_struct(task); 1205 return err; 1206} 1207 1208/* 1209 * /proc/pid/oom_adj exists solely for backwards compatibility with previous 1210 * kernels. The effective policy is defined by oom_score_adj, which has a 1211 * different scale: oom_adj grew exponentially and oom_score_adj grows linearly. 1212 * Values written to oom_adj are simply mapped linearly to oom_score_adj. 1213 * Processes that become oom disabled via oom_adj will still be oom disabled 1214 * with this implementation. 1215 * 1216 * oom_adj cannot be removed since existing userspace binaries use it. 1217 */ 1218static ssize_t oom_adj_write(struct file *file, const char __user *buf, 1219 size_t count, loff_t *ppos) 1220{ 1221 char buffer[PROC_NUMBUF] = {}; 1222 int oom_adj; 1223 int err; 1224 1225 if (count > sizeof(buffer) - 1) 1226 count = sizeof(buffer) - 1; 1227 if (copy_from_user(buffer, buf, count)) { 1228 err = -EFAULT; 1229 goto out; 1230 } 1231 1232 err = kstrtoint(strstrip(buffer), 0, &oom_adj); 1233 if (err) 1234 goto out; 1235 if ((oom_adj < OOM_ADJUST_MIN || oom_adj > OOM_ADJUST_MAX) && 1236 oom_adj != OOM_DISABLE) { 1237 err = -EINVAL; 1238 goto out; 1239 } 1240 1241 /* 1242 * Scale /proc/pid/oom_score_adj appropriately ensuring that a maximum 1243 * value is always attainable. 1244 */ 1245 if (oom_adj == OOM_ADJUST_MAX) 1246 oom_adj = OOM_SCORE_ADJ_MAX; 1247 else 1248 oom_adj = (oom_adj * OOM_SCORE_ADJ_MAX) / -OOM_DISABLE; 1249 1250 err = __set_oom_adj(file, oom_adj, true); 1251out: 1252 return err < 0 ? err : count; 1253} 1254 1255static const struct file_operations proc_oom_adj_operations = { 1256 .read = oom_adj_read, 1257 .write = oom_adj_write, 1258 .llseek = generic_file_llseek, 1259}; 1260 1261static ssize_t oom_score_adj_read(struct file *file, char __user *buf, 1262 size_t count, loff_t *ppos) 1263{ 1264 struct task_struct *task = get_proc_task(file_inode(file)); 1265 char buffer[PROC_NUMBUF]; 1266 short oom_score_adj = OOM_SCORE_ADJ_MIN; 1267 size_t len; 1268 1269 if (!task) 1270 return -ESRCH; 1271 oom_score_adj = task->signal->oom_score_adj; 1272 put_task_struct(task); 1273 len = snprintf(buffer, sizeof(buffer), "%hd\n", oom_score_adj); 1274 return simple_read_from_buffer(buf, count, ppos, buffer, len); 1275} 1276 1277static ssize_t oom_score_adj_write(struct file *file, const char __user *buf, 1278 size_t count, loff_t *ppos) 1279{ 1280 char buffer[PROC_NUMBUF] = {}; 1281 int oom_score_adj; 1282 int err; 1283 1284 if (count > sizeof(buffer) - 1) 1285 count = sizeof(buffer) - 1; 1286 if (copy_from_user(buffer, buf, count)) { 1287 err = -EFAULT; 1288 goto out; 1289 } 1290 1291 err = kstrtoint(strstrip(buffer), 0, &oom_score_adj); 1292 if (err) 1293 goto out; 1294 if (oom_score_adj < OOM_SCORE_ADJ_MIN || 1295 oom_score_adj > OOM_SCORE_ADJ_MAX) { 1296 err = -EINVAL; 1297 goto out; 1298 } 1299 1300 err = __set_oom_adj(file, oom_score_adj, false); 1301out: 1302 return err < 0 ? err : count; 1303} 1304 1305static const struct file_operations proc_oom_score_adj_operations = { 1306 .read = oom_score_adj_read, 1307 .write = oom_score_adj_write, 1308 .llseek = default_llseek, 1309}; 1310 1311#ifdef CONFIG_AUDIT 1312#define TMPBUFLEN 11 1313static ssize_t proc_loginuid_read(struct file * file, char __user * buf, 1314 size_t count, loff_t *ppos) 1315{ 1316 struct inode * inode = file_inode(file); 1317 struct task_struct *task = get_proc_task(inode); 1318 ssize_t length; 1319 char tmpbuf[TMPBUFLEN]; 1320 1321 if (!task) 1322 return -ESRCH; 1323 length = scnprintf(tmpbuf, TMPBUFLEN, "%u", 1324 from_kuid(file->f_cred->user_ns, 1325 audit_get_loginuid(task))); 1326 put_task_struct(task); 1327 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); 1328} 1329 1330static ssize_t proc_loginuid_write(struct file * file, const char __user * buf, 1331 size_t count, loff_t *ppos) 1332{ 1333 struct inode * inode = file_inode(file); 1334 uid_t loginuid; 1335 kuid_t kloginuid; 1336 int rv; 1337 1338 /* Don't let kthreads write their own loginuid */ 1339 if (current->flags & PF_KTHREAD) 1340 return -EPERM; 1341 1342 rcu_read_lock(); 1343 if (current != pid_task(proc_pid(inode), PIDTYPE_PID)) { 1344 rcu_read_unlock(); 1345 return -EPERM; 1346 } 1347 rcu_read_unlock(); 1348 1349 if (*ppos != 0) { 1350 /* No partial writes. */ 1351 return -EINVAL; 1352 } 1353 1354 rv = kstrtou32_from_user(buf, count, 10, &loginuid); 1355 if (rv < 0) 1356 return rv; 1357 1358 /* is userspace tring to explicitly UNSET the loginuid? */ 1359 if (loginuid == AUDIT_UID_UNSET) { 1360 kloginuid = INVALID_UID; 1361 } else { 1362 kloginuid = make_kuid(file->f_cred->user_ns, loginuid); 1363 if (!uid_valid(kloginuid)) 1364 return -EINVAL; 1365 } 1366 1367 rv = audit_set_loginuid(kloginuid); 1368 if (rv < 0) 1369 return rv; 1370 return count; 1371} 1372 1373static const struct file_operations proc_loginuid_operations = { 1374 .read = proc_loginuid_read, 1375 .write = proc_loginuid_write, 1376 .llseek = generic_file_llseek, 1377}; 1378 1379static ssize_t proc_sessionid_read(struct file * file, char __user * buf, 1380 size_t count, loff_t *ppos) 1381{ 1382 struct inode * inode = file_inode(file); 1383 struct task_struct *task = get_proc_task(inode); 1384 ssize_t length; 1385 char tmpbuf[TMPBUFLEN]; 1386 1387 if (!task) 1388 return -ESRCH; 1389 length = scnprintf(tmpbuf, TMPBUFLEN, "%u", 1390 audit_get_sessionid(task)); 1391 put_task_struct(task); 1392 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); 1393} 1394 1395static const struct file_operations proc_sessionid_operations = { 1396 .read = proc_sessionid_read, 1397 .llseek = generic_file_llseek, 1398}; 1399#endif 1400 1401#ifdef CONFIG_FAULT_INJECTION 1402static ssize_t proc_fault_inject_read(struct file * file, char __user * buf, 1403 size_t count, loff_t *ppos) 1404{ 1405 struct task_struct *task = get_proc_task(file_inode(file)); 1406 char buffer[PROC_NUMBUF]; 1407 size_t len; 1408 int make_it_fail; 1409 1410 if (!task) 1411 return -ESRCH; 1412 make_it_fail = task->make_it_fail; 1413 put_task_struct(task); 1414 1415 len = snprintf(buffer, sizeof(buffer), "%i\n", make_it_fail); 1416 1417 return simple_read_from_buffer(buf, count, ppos, buffer, len); 1418} 1419 1420static ssize_t proc_fault_inject_write(struct file * file, 1421 const char __user * buf, size_t count, loff_t *ppos) 1422{ 1423 struct task_struct *task; 1424 char buffer[PROC_NUMBUF] = {}; 1425 int make_it_fail; 1426 int rv; 1427 1428 if (!capable(CAP_SYS_RESOURCE)) 1429 return -EPERM; 1430 1431 if (count > sizeof(buffer) - 1) 1432 count = sizeof(buffer) - 1; 1433 if (copy_from_user(buffer, buf, count)) 1434 return -EFAULT; 1435 rv = kstrtoint(strstrip(buffer), 0, &make_it_fail); 1436 if (rv < 0) 1437 return rv; 1438 if (make_it_fail < 0 || make_it_fail > 1) 1439 return -EINVAL; 1440 1441 task = get_proc_task(file_inode(file)); 1442 if (!task) 1443 return -ESRCH; 1444 task->make_it_fail = make_it_fail; 1445 put_task_struct(task); 1446 1447 return count; 1448} 1449 1450static const struct file_operations proc_fault_inject_operations = { 1451 .read = proc_fault_inject_read, 1452 .write = proc_fault_inject_write, 1453 .llseek = generic_file_llseek, 1454}; 1455 1456static ssize_t proc_fail_nth_write(struct file *file, const char __user *buf, 1457 size_t count, loff_t *ppos) 1458{ 1459 struct task_struct *task; 1460 int err; 1461 unsigned int n; 1462 1463 err = kstrtouint_from_user(buf, count, 0, &n); 1464 if (err) 1465 return err; 1466 1467 task = get_proc_task(file_inode(file)); 1468 if (!task) 1469 return -ESRCH; 1470 task->fail_nth = n; 1471 put_task_struct(task); 1472 1473 return count; 1474} 1475 1476static ssize_t proc_fail_nth_read(struct file *file, char __user *buf, 1477 size_t count, loff_t *ppos) 1478{ 1479 struct task_struct *task; 1480 char numbuf[PROC_NUMBUF]; 1481 ssize_t len; 1482 1483 task = get_proc_task(file_inode(file)); 1484 if (!task) 1485 return -ESRCH; 1486 len = snprintf(numbuf, sizeof(numbuf), "%u\n", task->fail_nth); 1487 put_task_struct(task); 1488 return simple_read_from_buffer(buf, count, ppos, numbuf, len); 1489} 1490 1491static const struct file_operations proc_fail_nth_operations = { 1492 .read = proc_fail_nth_read, 1493 .write = proc_fail_nth_write, 1494}; 1495#endif 1496 1497 1498/* 1499 * Print out various scheduling related per-task fields: 1500 */ 1501static int sched_show(struct seq_file *m, void *v) 1502{ 1503 struct inode *inode = m->private; 1504 struct pid_namespace *ns = proc_pid_ns(inode->i_sb); 1505 struct task_struct *p; 1506 1507 p = get_proc_task(inode); 1508 if (!p) 1509 return -ESRCH; 1510 proc_sched_show_task(p, ns, m); 1511 1512 put_task_struct(p); 1513 1514 return 0; 1515} 1516 1517static ssize_t 1518sched_write(struct file *file, const char __user *buf, 1519 size_t count, loff_t *offset) 1520{ 1521 struct inode *inode = file_inode(file); 1522 struct task_struct *p; 1523 1524 p = get_proc_task(inode); 1525 if (!p) 1526 return -ESRCH; 1527 proc_sched_set_task(p); 1528 1529 put_task_struct(p); 1530 1531 return count; 1532} 1533 1534static int sched_open(struct inode *inode, struct file *filp) 1535{ 1536 return single_open(filp, sched_show, inode); 1537} 1538 1539static const struct file_operations proc_pid_sched_operations = { 1540 .open = sched_open, 1541 .read = seq_read, 1542 .write = sched_write, 1543 .llseek = seq_lseek, 1544 .release = single_release, 1545}; 1546 1547#ifdef CONFIG_SCHED_AUTOGROUP 1548/* 1549 * Print out autogroup related information: 1550 */ 1551static int sched_autogroup_show(struct seq_file *m, void *v) 1552{ 1553 struct inode *inode = m->private; 1554 struct task_struct *p; 1555 1556 p = get_proc_task(inode); 1557 if (!p) 1558 return -ESRCH; 1559 proc_sched_autogroup_show_task(p, m); 1560 1561 put_task_struct(p); 1562 1563 return 0; 1564} 1565 1566static ssize_t 1567sched_autogroup_write(struct file *file, const char __user *buf, 1568 size_t count, loff_t *offset) 1569{ 1570 struct inode *inode = file_inode(file); 1571 struct task_struct *p; 1572 char buffer[PROC_NUMBUF] = {}; 1573 int nice; 1574 int err; 1575 1576 if (count > sizeof(buffer) - 1) 1577 count = sizeof(buffer) - 1; 1578 if (copy_from_user(buffer, buf, count)) 1579 return -EFAULT; 1580 1581 err = kstrtoint(strstrip(buffer), 0, &nice); 1582 if (err < 0) 1583 return err; 1584 1585 p = get_proc_task(inode); 1586 if (!p) 1587 return -ESRCH; 1588 1589 err = proc_sched_autogroup_set_nice(p, nice); 1590 if (err) 1591 count = err; 1592 1593 put_task_struct(p); 1594 1595 return count; 1596} 1597 1598static int sched_autogroup_open(struct inode *inode, struct file *filp) 1599{ 1600 int ret; 1601 1602 ret = single_open(filp, sched_autogroup_show, NULL); 1603 if (!ret) { 1604 struct seq_file *m = filp->private_data; 1605 1606 m->private = inode; 1607 } 1608 return ret; 1609} 1610 1611static const struct file_operations proc_pid_sched_autogroup_operations = { 1612 .open = sched_autogroup_open, 1613 .read = seq_read, 1614 .write = sched_autogroup_write, 1615 .llseek = seq_lseek, 1616 .release = single_release, 1617}; 1618 1619#endif /* CONFIG_SCHED_AUTOGROUP */ 1620 1621#ifdef CONFIG_TIME_NS 1622static int timens_offsets_show(struct seq_file *m, void *v) 1623{ 1624 struct task_struct *p; 1625 1626 p = get_proc_task(file_inode(m->file)); 1627 if (!p) 1628 return -ESRCH; 1629 proc_timens_show_offsets(p, m); 1630 1631 put_task_struct(p); 1632 1633 return 0; 1634} 1635 1636static ssize_t timens_offsets_write(struct file *file, const char __user *buf, 1637 size_t count, loff_t *ppos) 1638{ 1639 struct inode *inode = file_inode(file); 1640 struct proc_timens_offset offsets[2]; 1641 char *kbuf = NULL, *pos, *next_line; 1642 struct task_struct *p; 1643 int ret, noffsets; 1644 1645 /* Only allow < page size writes at the beginning of the file */ 1646 if ((*ppos != 0) || (count >= PAGE_SIZE)) 1647 return -EINVAL; 1648 1649 /* Slurp in the user data */ 1650 kbuf = memdup_user_nul(buf, count); 1651 if (IS_ERR(kbuf)) 1652 return PTR_ERR(kbuf); 1653 1654 /* Parse the user data */ 1655 ret = -EINVAL; 1656 noffsets = 0; 1657 for (pos = kbuf; pos; pos = next_line) { 1658 struct proc_timens_offset *off = &offsets[noffsets]; 1659 char clock[10]; 1660 int err; 1661 1662 /* Find the end of line and ensure we don't look past it */ 1663 next_line = strchr(pos, '\n'); 1664 if (next_line) { 1665 *next_line = '\0'; 1666 next_line++; 1667 if (*next_line == '\0') 1668 next_line = NULL; 1669 } 1670 1671 err = sscanf(pos, "%9s %lld %lu", clock, 1672 &off->val.tv_sec, &off->val.tv_nsec); 1673 if (err != 3 || off->val.tv_nsec >= NSEC_PER_SEC) 1674 goto out; 1675 1676 clock[sizeof(clock) - 1] = 0; 1677 if (strcmp(clock, "monotonic") == 0 || 1678 strcmp(clock, __stringify(CLOCK_MONOTONIC)) == 0) 1679 off->clockid = CLOCK_MONOTONIC; 1680 else if (strcmp(clock, "boottime") == 0 || 1681 strcmp(clock, __stringify(CLOCK_BOOTTIME)) == 0) 1682 off->clockid = CLOCK_BOOTTIME; 1683 else 1684 goto out; 1685 1686 noffsets++; 1687 if (noffsets == ARRAY_SIZE(offsets)) { 1688 if (next_line) 1689 count = next_line - kbuf; 1690 break; 1691 } 1692 } 1693 1694 ret = -ESRCH; 1695 p = get_proc_task(inode); 1696 if (!p) 1697 goto out; 1698 ret = proc_timens_set_offset(file, p, offsets, noffsets); 1699 put_task_struct(p); 1700 if (ret) 1701 goto out; 1702 1703 ret = count; 1704out: 1705 kfree(kbuf); 1706 return ret; 1707} 1708 1709static int timens_offsets_open(struct inode *inode, struct file *filp) 1710{ 1711 return single_open(filp, timens_offsets_show, inode); 1712} 1713 1714static const struct file_operations proc_timens_offsets_operations = { 1715 .open = timens_offsets_open, 1716 .read = seq_read, 1717 .write = timens_offsets_write, 1718 .llseek = seq_lseek, 1719 .release = single_release, 1720}; 1721#endif /* CONFIG_TIME_NS */ 1722 1723static ssize_t comm_write(struct file *file, const char __user *buf, 1724 size_t count, loff_t *offset) 1725{ 1726 struct inode *inode = file_inode(file); 1727 struct task_struct *p; 1728 char buffer[TASK_COMM_LEN] = {}; 1729 const size_t maxlen = sizeof(buffer) - 1; 1730 1731 if (copy_from_user(buffer, buf, count > maxlen ? maxlen : count)) 1732 return -EFAULT; 1733 1734 p = get_proc_task(inode); 1735 if (!p) 1736 return -ESRCH; 1737 1738 if (same_thread_group(current, p)) { 1739 set_task_comm(p, buffer); 1740 proc_comm_connector(p); 1741 } 1742 else 1743 count = -EINVAL; 1744 1745 put_task_struct(p); 1746 1747 return count; 1748} 1749 1750static int comm_show(struct seq_file *m, void *v) 1751{ 1752 struct inode *inode = m->private; 1753 struct task_struct *p; 1754 1755 p = get_proc_task(inode); 1756 if (!p) 1757 return -ESRCH; 1758 1759 proc_task_name(m, p, false); 1760 seq_putc(m, '\n'); 1761 1762 put_task_struct(p); 1763 1764 return 0; 1765} 1766 1767static int comm_open(struct inode *inode, struct file *filp) 1768{ 1769 return single_open(filp, comm_show, inode); 1770} 1771 1772static const struct file_operations proc_pid_set_comm_operations = { 1773 .open = comm_open, 1774 .read = seq_read, 1775 .write = comm_write, 1776 .llseek = seq_lseek, 1777 .release = single_release, 1778}; 1779 1780static int proc_exe_link(struct dentry *dentry, struct path *exe_path) 1781{ 1782 struct task_struct *task; 1783 struct file *exe_file; 1784 1785 task = get_proc_task(d_inode(dentry)); 1786 if (!task) 1787 return -ENOENT; 1788 exe_file = get_task_exe_file(task); 1789 put_task_struct(task); 1790 if (exe_file) { 1791 *exe_path = exe_file->f_path; 1792 path_get(&exe_file->f_path); 1793 fput(exe_file); 1794 return 0; 1795 } else 1796 return -ENOENT; 1797} 1798 1799static const char *proc_pid_get_link(struct dentry *dentry, 1800 struct inode *inode, 1801 struct delayed_call *done) 1802{ 1803 struct path path; 1804 int error = -EACCES; 1805 1806 if (!dentry) 1807 return ERR_PTR(-ECHILD); 1808 1809 /* Are we allowed to snoop on the tasks file descriptors? */ 1810 if (!proc_fd_access_allowed(inode)) 1811 goto out; 1812 1813 error = PROC_I(inode)->op.proc_get_link(dentry, &path); 1814 if (error) 1815 goto out; 1816 1817 error = nd_jump_link(&path); 1818out: 1819 return ERR_PTR(error); 1820} 1821 1822static int do_proc_readlink(const struct path *path, char __user *buffer, int buflen) 1823{ 1824 char *tmp = kmalloc(PATH_MAX, GFP_KERNEL); 1825 char *pathname; 1826 int len; 1827 1828 if (!tmp) 1829 return -ENOMEM; 1830 1831 pathname = d_path(path, tmp, PATH_MAX); 1832 len = PTR_ERR(pathname); 1833 if (IS_ERR(pathname)) 1834 goto out; 1835 len = tmp + PATH_MAX - 1 - pathname; 1836 1837 if (len > buflen) 1838 len = buflen; 1839 if (copy_to_user(buffer, pathname, len)) 1840 len = -EFAULT; 1841 out: 1842 kfree(tmp); 1843 return len; 1844} 1845 1846static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int buflen) 1847{ 1848 int error = -EACCES; 1849 struct inode *inode = d_inode(dentry); 1850 struct path path; 1851 1852 /* Are we allowed to snoop on the tasks file descriptors? */ 1853 if (!proc_fd_access_allowed(inode)) 1854 goto out; 1855 1856 error = PROC_I(inode)->op.proc_get_link(dentry, &path); 1857 if (error) 1858 goto out; 1859 1860 error = do_proc_readlink(&path, buffer, buflen); 1861 path_put(&path); 1862out: 1863 return error; 1864} 1865 1866const struct inode_operations proc_pid_link_inode_operations = { 1867 .readlink = proc_pid_readlink, 1868 .get_link = proc_pid_get_link, 1869 .setattr = proc_setattr, 1870}; 1871 1872 1873/* building an inode */ 1874 1875void task_dump_owner(struct task_struct *task, umode_t mode, 1876 kuid_t *ruid, kgid_t *rgid) 1877{ 1878 /* Depending on the state of dumpable compute who should own a 1879 * proc file for a task. 1880 */ 1881 const struct cred *cred; 1882 kuid_t uid; 1883 kgid_t gid; 1884 1885 if (unlikely(task->flags & PF_KTHREAD)) { 1886 *ruid = GLOBAL_ROOT_UID; 1887 *rgid = GLOBAL_ROOT_GID; 1888 return; 1889 } 1890 1891 /* Default to the tasks effective ownership */ 1892 rcu_read_lock(); 1893 cred = __task_cred(task); 1894 uid = cred->euid; 1895 gid = cred->egid; 1896 rcu_read_unlock(); 1897 1898 /* 1899 * Before the /proc/pid/status file was created the only way to read 1900 * the effective uid of a /process was to stat /proc/pid. Reading 1901 * /proc/pid/status is slow enough that procps and other packages 1902 * kept stating /proc/pid. To keep the rules in /proc simple I have 1903 * made this apply to all per process world readable and executable 1904 * directories. 1905 */ 1906 if (mode != (S_IFDIR|S_IRUGO|S_IXUGO)) { 1907 struct mm_struct *mm; 1908 task_lock(task); 1909 mm = task->mm; 1910 /* Make non-dumpable tasks owned by some root */ 1911 if (mm) { 1912 if (get_dumpable(mm) != SUID_DUMP_USER) { 1913 struct user_namespace *user_ns = mm->user_ns; 1914 1915 uid = make_kuid(user_ns, 0); 1916 if (!uid_valid(uid)) 1917 uid = GLOBAL_ROOT_UID; 1918 1919 gid = make_kgid(user_ns, 0); 1920 if (!gid_valid(gid)) 1921 gid = GLOBAL_ROOT_GID; 1922 } 1923 } else { 1924 uid = GLOBAL_ROOT_UID; 1925 gid = GLOBAL_ROOT_GID; 1926 } 1927 task_unlock(task); 1928 } 1929 *ruid = uid; 1930 *rgid = gid; 1931} 1932 1933void proc_pid_evict_inode(struct proc_inode *ei) 1934{ 1935 struct pid *pid = ei->pid; 1936 1937 if (S_ISDIR(ei->vfs_inode.i_mode)) { 1938 spin_lock(&pid->lock); 1939 hlist_del_init_rcu(&ei->sibling_inodes); 1940 spin_unlock(&pid->lock); 1941 } 1942} 1943 1944struct inode *proc_pid_make_inode(struct super_block *sb, 1945 struct task_struct *task, umode_t mode) 1946{ 1947 struct inode * inode; 1948 struct proc_inode *ei; 1949 struct pid *pid; 1950 1951 /* We need a new inode */ 1952 1953 inode = new_inode(sb); 1954 if (!inode) 1955 goto out; 1956 1957 /* Common stuff */ 1958 ei = PROC_I(inode); 1959 inode->i_mode = mode; 1960 inode->i_ino = get_next_ino(); 1961 simple_inode_init_ts(inode); 1962 inode->i_op = &proc_def_inode_operations; 1963 1964 /* 1965 * grab the reference to task. 1966 */ 1967 pid = get_task_pid(task, PIDTYPE_PID); 1968 if (!pid) 1969 goto out_unlock; 1970 1971 /* Let the pid remember us for quick removal */ 1972 ei->pid = pid; 1973 1974 task_dump_owner(task, 0, &inode->i_uid, &inode->i_gid); 1975 security_task_to_inode(task, inode); 1976 1977out: 1978 return inode; 1979 1980out_unlock: 1981 iput(inode); 1982 return NULL; 1983} 1984 1985/* 1986 * Generating an inode and adding it into @pid->inodes, so that task will 1987 * invalidate inode's dentry before being released. 1988 * 1989 * This helper is used for creating dir-type entries under '/proc' and 1990 * '/proc/<tgid>/task'. Other entries(eg. fd, stat) under '/proc/<tgid>' 1991 * can be released by invalidating '/proc/<tgid>' dentry. 1992 * In theory, dentries under '/proc/<tgid>/task' can also be released by 1993 * invalidating '/proc/<tgid>' dentry, we reserve it to handle single 1994 * thread exiting situation: Any one of threads should invalidate its 1995 * '/proc/<tgid>/task/<pid>' dentry before released. 1996 */ 1997static struct inode *proc_pid_make_base_inode(struct super_block *sb, 1998 struct task_struct *task, umode_t mode) 1999{ 2000 struct inode *inode; 2001 struct proc_inode *ei; 2002 struct pid *pid; 2003 2004 inode = proc_pid_make_inode(sb, task, mode); 2005 if (!inode) 2006 return NULL; 2007 2008 /* Let proc_flush_pid find this directory inode */ 2009 ei = PROC_I(inode); 2010 pid = ei->pid; 2011 spin_lock(&pid->lock); 2012 hlist_add_head_rcu(&ei->sibling_inodes, &pid->inodes); 2013 spin_unlock(&pid->lock); 2014 2015 return inode; 2016} 2017 2018int pid_getattr(struct mnt_idmap *idmap, const struct path *path, 2019 struct kstat *stat, u32 request_mask, unsigned int query_flags) 2020{ 2021 struct inode *inode = d_inode(path->dentry); 2022 struct proc_fs_info *fs_info = proc_sb_info(inode->i_sb); 2023 struct task_struct *task; 2024 2025 generic_fillattr(&nop_mnt_idmap, request_mask, inode, stat); 2026 2027 stat->uid = GLOBAL_ROOT_UID; 2028 stat->gid = GLOBAL_ROOT_GID; 2029 rcu_read_lock(); 2030 task = pid_task(proc_pid(inode), PIDTYPE_PID); 2031 if (task) { 2032 if (!has_pid_permissions(fs_info, task, HIDEPID_INVISIBLE)) { 2033 rcu_read_unlock(); 2034 /* 2035 * This doesn't prevent learning whether PID exists, 2036 * it only makes getattr() consistent with readdir(). 2037 */ 2038 return -ENOENT; 2039 } 2040 task_dump_owner(task, inode->i_mode, &stat->uid, &stat->gid); 2041 } 2042 rcu_read_unlock(); 2043 return 0; 2044} 2045 2046/* dentry stuff */ 2047 2048/* 2049 * Set <pid>/... inode ownership (can change due to setuid(), etc.) 2050 */ 2051void pid_update_inode(struct task_struct *task, struct inode *inode) 2052{ 2053 task_dump_owner(task, inode->i_mode, &inode->i_uid, &inode->i_gid); 2054 2055 inode->i_mode &= ~(S_ISUID | S_ISGID); 2056 security_task_to_inode(task, inode); 2057} 2058 2059/* 2060 * Rewrite the inode's ownerships here because the owning task may have 2061 * performed a setuid(), etc. 2062 * 2063 */ 2064static int pid_revalidate(struct inode *dir, const struct qstr *name, 2065 struct dentry *dentry, unsigned int flags) 2066{ 2067 struct inode *inode; 2068 struct task_struct *task; 2069 int ret = 0; 2070 2071 rcu_read_lock(); 2072 inode = d_inode_rcu(dentry); 2073 if (!inode) 2074 goto out; 2075 task = pid_task(proc_pid(inode), PIDTYPE_PID); 2076 2077 if (task) { 2078 pid_update_inode(task, inode); 2079 ret = 1; 2080 } 2081out: 2082 rcu_read_unlock(); 2083 return ret; 2084} 2085 2086static inline bool proc_inode_is_dead(struct inode *inode) 2087{ 2088 return !proc_pid(inode)->tasks[PIDTYPE_PID].first; 2089} 2090 2091int pid_delete_dentry(const struct dentry *dentry) 2092{ 2093 /* Is the task we represent dead? 2094 * If so, then don't put the dentry on the lru list, 2095 * kill it immediately. 2096 */ 2097 return proc_inode_is_dead(d_inode(dentry)); 2098} 2099 2100const struct dentry_operations pid_dentry_operations = 2101{ 2102 .d_revalidate = pid_revalidate, 2103 .d_delete = pid_delete_dentry, 2104}; 2105 2106/* Lookups */ 2107 2108/* 2109 * Fill a directory entry. 2110 * 2111 * If possible create the dcache entry and derive our inode number and 2112 * file type from dcache entry. 2113 * 2114 * Since all of the proc inode numbers are dynamically generated, the inode 2115 * numbers do not exist until the inode is cache. This means creating 2116 * the dcache entry in readdir is necessary to keep the inode numbers 2117 * reported by readdir in sync with the inode numbers reported 2118 * by stat. 2119 */ 2120bool proc_fill_cache(struct file *file, struct dir_context *ctx, 2121 const char *name, unsigned int len, 2122 instantiate_t instantiate, struct task_struct *task, const void *ptr) 2123{ 2124 struct dentry *child, *dir = file->f_path.dentry; 2125 struct qstr qname = QSTR_INIT(name, len); 2126 struct inode *inode; 2127 unsigned type = DT_UNKNOWN; 2128 ino_t ino = 1; 2129 2130 child = try_lookup_noperm(&qname, dir); 2131 if (IS_ERR(child)) 2132 goto end_instantiate; 2133 2134 if (!child) { 2135 DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq); 2136 child = d_alloc_parallel(dir, &qname, &wq); 2137 if (IS_ERR(child)) 2138 goto end_instantiate; 2139 if (d_in_lookup(child)) { 2140 struct dentry *res; 2141 res = instantiate(child, task, ptr); 2142 d_lookup_done(child); 2143 if (unlikely(res)) { 2144 dput(child); 2145 child = res; 2146 if (IS_ERR(child)) 2147 goto end_instantiate; 2148 } 2149 } 2150 } 2151 inode = d_inode(child); 2152 ino = inode->i_ino; 2153 type = inode->i_mode >> 12; 2154 dput(child); 2155end_instantiate: 2156 return dir_emit(ctx, name, len, ino, type); 2157} 2158 2159/* 2160 * dname_to_vma_addr - maps a dentry name into two unsigned longs 2161 * which represent vma start and end addresses. 2162 */ 2163static int dname_to_vma_addr(struct dentry *dentry, 2164 unsigned long *start, unsigned long *end) 2165{ 2166 const char *str = dentry->d_name.name; 2167 unsigned long long sval, eval; 2168 unsigned int len; 2169 2170 if (str[0] == '0' && str[1] != '-') 2171 return -EINVAL; 2172 len = _parse_integer(str, 16, &sval); 2173 if (len & KSTRTOX_OVERFLOW) 2174 return -EINVAL; 2175 if (sval != (unsigned long)sval) 2176 return -EINVAL; 2177 str += len; 2178 2179 if (*str != '-') 2180 return -EINVAL; 2181 str++; 2182 2183 if (str[0] == '0' && str[1]) 2184 return -EINVAL; 2185 len = _parse_integer(str, 16, &eval); 2186 if (len & KSTRTOX_OVERFLOW) 2187 return -EINVAL; 2188 if (eval != (unsigned long)eval) 2189 return -EINVAL; 2190 str += len; 2191 2192 if (*str != '\0') 2193 return -EINVAL; 2194 2195 *start = sval; 2196 *end = eval; 2197 2198 return 0; 2199} 2200 2201static int map_files_d_revalidate(struct inode *dir, const struct qstr *name, 2202 struct dentry *dentry, unsigned int flags) 2203{ 2204 unsigned long vm_start, vm_end; 2205 bool exact_vma_exists = false; 2206 struct mm_struct *mm = NULL; 2207 struct task_struct *task; 2208 struct inode *inode; 2209 int status = 0; 2210 2211 if (flags & LOOKUP_RCU) 2212 return -ECHILD; 2213 2214 inode = d_inode(dentry); 2215 task = get_proc_task(inode); 2216 if (!task) 2217 goto out_notask; 2218 2219 mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); 2220 if (IS_ERR(mm)) 2221 goto out; 2222 2223 if (!dname_to_vma_addr(dentry, &vm_start, &vm_end)) { 2224 status = mmap_read_lock_killable(mm); 2225 if (!status) { 2226 exact_vma_exists = !!find_exact_vma(mm, vm_start, 2227 vm_end); 2228 mmap_read_unlock(mm); 2229 } 2230 } 2231 2232 mmput(mm); 2233 2234 if (exact_vma_exists) { 2235 task_dump_owner(task, 0, &inode->i_uid, &inode->i_gid); 2236 2237 security_task_to_inode(task, inode); 2238 status = 1; 2239 } 2240 2241out: 2242 put_task_struct(task); 2243 2244out_notask: 2245 return status; 2246} 2247 2248static const struct dentry_operations tid_map_files_dentry_operations = { 2249 .d_revalidate = map_files_d_revalidate, 2250 .d_delete = pid_delete_dentry, 2251}; 2252 2253static int map_files_get_link(struct dentry *dentry, struct path *path) 2254{ 2255 unsigned long vm_start, vm_end; 2256 struct vm_area_struct *vma; 2257 struct task_struct *task; 2258 struct mm_struct *mm; 2259 int rc; 2260 2261 rc = -ENOENT; 2262 task = get_proc_task(d_inode(dentry)); 2263 if (!task) 2264 goto out; 2265 2266 mm = get_task_mm(task); 2267 put_task_struct(task); 2268 if (!mm) 2269 goto out; 2270 2271 rc = dname_to_vma_addr(dentry, &vm_start, &vm_end); 2272 if (rc) 2273 goto out_mmput; 2274 2275 rc = mmap_read_lock_killable(mm); 2276 if (rc) 2277 goto out_mmput; 2278 2279 rc = -ENOENT; 2280 vma = find_exact_vma(mm, vm_start, vm_end); 2281 if (vma && vma->vm_file) { 2282 *path = *file_user_path(vma->vm_file); 2283 path_get(path); 2284 rc = 0; 2285 } 2286 mmap_read_unlock(mm); 2287 2288out_mmput: 2289 mmput(mm); 2290out: 2291 return rc; 2292} 2293 2294struct map_files_info { 2295 unsigned long start; 2296 unsigned long end; 2297 fmode_t mode; 2298}; 2299 2300/* 2301 * Only allow CAP_SYS_ADMIN and CAP_CHECKPOINT_RESTORE to follow the links, due 2302 * to concerns about how the symlinks may be used to bypass permissions on 2303 * ancestor directories in the path to the file in question. 2304 */ 2305static const char * 2306proc_map_files_get_link(struct dentry *dentry, 2307 struct inode *inode, 2308 struct delayed_call *done) 2309{ 2310 if (!checkpoint_restore_ns_capable(&init_user_ns)) 2311 return ERR_PTR(-EPERM); 2312 2313 return proc_pid_get_link(dentry, inode, done); 2314} 2315 2316/* 2317 * Identical to proc_pid_link_inode_operations except for get_link() 2318 */ 2319static const struct inode_operations proc_map_files_link_inode_operations = { 2320 .readlink = proc_pid_readlink, 2321 .get_link = proc_map_files_get_link, 2322 .setattr = proc_setattr, 2323}; 2324 2325static struct dentry * 2326proc_map_files_instantiate(struct dentry *dentry, 2327 struct task_struct *task, const void *ptr) 2328{ 2329 fmode_t mode = (fmode_t)(unsigned long)ptr; 2330 struct proc_inode *ei; 2331 struct inode *inode; 2332 2333 inode = proc_pid_make_inode(dentry->d_sb, task, S_IFLNK | 2334 ((mode & FMODE_READ ) ? S_IRUSR : 0) | 2335 ((mode & FMODE_WRITE) ? S_IWUSR : 0)); 2336 if (!inode) 2337 return ERR_PTR(-ENOENT); 2338 2339 ei = PROC_I(inode); 2340 ei->op.proc_get_link = map_files_get_link; 2341 2342 inode->i_op = &proc_map_files_link_inode_operations; 2343 inode->i_size = 64; 2344 2345 return proc_splice_unmountable(inode, dentry, 2346 &tid_map_files_dentry_operations); 2347} 2348 2349static struct dentry *proc_map_files_lookup(struct inode *dir, 2350 struct dentry *dentry, unsigned int flags) 2351{ 2352 unsigned long vm_start, vm_end; 2353 struct vm_area_struct *vma; 2354 struct task_struct *task; 2355 struct dentry *result; 2356 struct mm_struct *mm; 2357 2358 result = ERR_PTR(-ENOENT); 2359 task = get_proc_task(dir); 2360 if (!task) 2361 goto out; 2362 2363 result = ERR_PTR(-EACCES); 2364 if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) 2365 goto out_put_task; 2366 2367 result = ERR_PTR(-ENOENT); 2368 if (dname_to_vma_addr(dentry, &vm_start, &vm_end)) 2369 goto out_put_task; 2370 2371 mm = get_task_mm(task); 2372 if (!mm) 2373 goto out_put_task; 2374 2375 result = ERR_PTR(-EINTR); 2376 if (mmap_read_lock_killable(mm)) 2377 goto out_put_mm; 2378 2379 result = ERR_PTR(-ENOENT); 2380 vma = find_exact_vma(mm, vm_start, vm_end); 2381 if (!vma) 2382 goto out_no_vma; 2383 2384 if (vma->vm_file) 2385 result = proc_map_files_instantiate(dentry, task, 2386 (void *)(unsigned long)vma->vm_file->f_mode); 2387 2388out_no_vma: 2389 mmap_read_unlock(mm); 2390out_put_mm: 2391 mmput(mm); 2392out_put_task: 2393 put_task_struct(task); 2394out: 2395 return result; 2396} 2397 2398static const struct inode_operations proc_map_files_inode_operations = { 2399 .lookup = proc_map_files_lookup, 2400 .permission = proc_fd_permission, 2401 .setattr = proc_setattr, 2402}; 2403 2404static int 2405proc_map_files_readdir(struct file *file, struct dir_context *ctx) 2406{ 2407 struct vm_area_struct *vma; 2408 struct task_struct *task; 2409 struct mm_struct *mm; 2410 unsigned long nr_files, pos, i; 2411 GENRADIX(struct map_files_info) fa; 2412 struct map_files_info *p; 2413 int ret; 2414 struct vma_iterator vmi; 2415 2416 genradix_init(&fa); 2417 2418 ret = -ENOENT; 2419 task = get_proc_task(file_inode(file)); 2420 if (!task) 2421 goto out; 2422 2423 ret = -EACCES; 2424 if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) 2425 goto out_put_task; 2426 2427 ret = 0; 2428 if (!dir_emit_dots(file, ctx)) 2429 goto out_put_task; 2430 2431 mm = get_task_mm(task); 2432 if (!mm) 2433 goto out_put_task; 2434 2435 ret = mmap_read_lock_killable(mm); 2436 if (ret) { 2437 mmput(mm); 2438 goto out_put_task; 2439 } 2440 2441 nr_files = 0; 2442 2443 /* 2444 * We need two passes here: 2445 * 2446 * 1) Collect vmas of mapped files with mmap_lock taken 2447 * 2) Release mmap_lock and instantiate entries 2448 * 2449 * otherwise we get lockdep complained, since filldir() 2450 * routine might require mmap_lock taken in might_fault(). 2451 */ 2452 2453 pos = 2; 2454 vma_iter_init(&vmi, mm, 0); 2455 for_each_vma(vmi, vma) { 2456 if (!vma->vm_file) 2457 continue; 2458 if (++pos <= ctx->pos) 2459 continue; 2460 2461 p = genradix_ptr_alloc(&fa, nr_files++, GFP_KERNEL); 2462 if (!p) { 2463 ret = -ENOMEM; 2464 mmap_read_unlock(mm); 2465 mmput(mm); 2466 goto out_put_task; 2467 } 2468 2469 p->start = vma->vm_start; 2470 p->end = vma->vm_end; 2471 p->mode = vma->vm_file->f_mode; 2472 } 2473 mmap_read_unlock(mm); 2474 mmput(mm); 2475 2476 for (i = 0; i < nr_files; i++) { 2477 char buf[4 * sizeof(long) + 2]; /* max: %lx-%lx\0 */ 2478 unsigned int len; 2479 2480 p = genradix_ptr(&fa, i); 2481 len = snprintf(buf, sizeof(buf), "%lx-%lx", p->start, p->end); 2482 if (!proc_fill_cache(file, ctx, 2483 buf, len, 2484 proc_map_files_instantiate, 2485 task, 2486 (void *)(unsigned long)p->mode)) 2487 break; 2488 ctx->pos++; 2489 } 2490 2491out_put_task: 2492 put_task_struct(task); 2493out: 2494 genradix_free(&fa); 2495 return ret; 2496} 2497 2498static const struct file_operations proc_map_files_operations = { 2499 .read = generic_read_dir, 2500 .iterate_shared = proc_map_files_readdir, 2501 .llseek = generic_file_llseek, 2502}; 2503 2504#if defined(CONFIG_CHECKPOINT_RESTORE) && defined(CONFIG_POSIX_TIMERS) 2505struct timers_private { 2506 struct pid *pid; 2507 struct task_struct *task; 2508 struct pid_namespace *ns; 2509}; 2510 2511static void *timers_start(struct seq_file *m, loff_t *pos) 2512{ 2513 struct timers_private *tp = m->private; 2514 2515 tp->task = get_pid_task(tp->pid, PIDTYPE_PID); 2516 if (!tp->task) 2517 return ERR_PTR(-ESRCH); 2518 2519 rcu_read_lock(); 2520 return seq_hlist_start_rcu(&tp->task->signal->posix_timers, *pos); 2521} 2522 2523static void *timers_next(struct seq_file *m, void *v, loff_t *pos) 2524{ 2525 struct timers_private *tp = m->private; 2526 2527 return seq_hlist_next_rcu(v, &tp->task->signal->posix_timers, pos); 2528} 2529 2530static void timers_stop(struct seq_file *m, void *v) 2531{ 2532 struct timers_private *tp = m->private; 2533 2534 if (tp->task) { 2535 put_task_struct(tp->task); 2536 tp->task = NULL; 2537 rcu_read_unlock(); 2538 } 2539} 2540 2541static int show_timer(struct seq_file *m, void *v) 2542{ 2543 static const char * const nstr[] = { 2544 [SIGEV_SIGNAL] = "signal", 2545 [SIGEV_NONE] = "none", 2546 [SIGEV_THREAD] = "thread", 2547 }; 2548 2549 struct k_itimer *timer = hlist_entry((struct hlist_node *)v, struct k_itimer, list); 2550 struct timers_private *tp = m->private; 2551 int notify = timer->it_sigev_notify; 2552 2553 guard(spinlock_irq)(&timer->it_lock); 2554 if (!posixtimer_valid(timer)) 2555 return 0; 2556 2557 seq_printf(m, "ID: %d\n", timer->it_id); 2558 seq_printf(m, "signal: %d/%px\n", timer->sigq.info.si_signo, 2559 timer->sigq.info.si_value.sival_ptr); 2560 seq_printf(m, "notify: %s/%s.%d\n", nstr[notify & ~SIGEV_THREAD_ID], 2561 (notify & SIGEV_THREAD_ID) ? "tid" : "pid", 2562 pid_nr_ns(timer->it_pid, tp->ns)); 2563 seq_printf(m, "ClockID: %d\n", timer->it_clock); 2564 2565 return 0; 2566} 2567 2568static const struct seq_operations proc_timers_seq_ops = { 2569 .start = timers_start, 2570 .next = timers_next, 2571 .stop = timers_stop, 2572 .show = show_timer, 2573}; 2574 2575static int proc_timers_open(struct inode *inode, struct file *file) 2576{ 2577 struct timers_private *tp; 2578 2579 tp = __seq_open_private(file, &proc_timers_seq_ops, 2580 sizeof(struct timers_private)); 2581 if (!tp) 2582 return -ENOMEM; 2583 2584 tp->pid = proc_pid(inode); 2585 tp->ns = proc_pid_ns(inode->i_sb); 2586 return 0; 2587} 2588 2589static const struct file_operations proc_timers_operations = { 2590 .open = proc_timers_open, 2591 .read = seq_read, 2592 .llseek = seq_lseek, 2593 .release = seq_release_private, 2594}; 2595#endif 2596 2597static ssize_t timerslack_ns_write(struct file *file, const char __user *buf, 2598 size_t count, loff_t *offset) 2599{ 2600 struct inode *inode = file_inode(file); 2601 struct task_struct *p; 2602 u64 slack_ns; 2603 int err; 2604 2605 err = kstrtoull_from_user(buf, count, 10, &slack_ns); 2606 if (err < 0) 2607 return err; 2608 2609 p = get_proc_task(inode); 2610 if (!p) 2611 return -ESRCH; 2612 2613 if (p != current) { 2614 rcu_read_lock(); 2615 if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) { 2616 rcu_read_unlock(); 2617 count = -EPERM; 2618 goto out; 2619 } 2620 rcu_read_unlock(); 2621 2622 err = security_task_setscheduler(p); 2623 if (err) { 2624 count = err; 2625 goto out; 2626 } 2627 } 2628 2629 task_lock(p); 2630 if (rt_or_dl_task_policy(p)) 2631 slack_ns = 0; 2632 else if (slack_ns == 0) 2633 slack_ns = p->default_timer_slack_ns; 2634 p->timer_slack_ns = slack_ns; 2635 task_unlock(p); 2636 2637out: 2638 put_task_struct(p); 2639 2640 return count; 2641} 2642 2643static int timerslack_ns_show(struct seq_file *m, void *v) 2644{ 2645 struct inode *inode = m->private; 2646 struct task_struct *p; 2647 int err = 0; 2648 2649 p = get_proc_task(inode); 2650 if (!p) 2651 return -ESRCH; 2652 2653 if (p != current) { 2654 rcu_read_lock(); 2655 if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) { 2656 rcu_read_unlock(); 2657 err = -EPERM; 2658 goto out; 2659 } 2660 rcu_read_unlock(); 2661 2662 err = security_task_getscheduler(p); 2663 if (err) 2664 goto out; 2665 } 2666 2667 task_lock(p); 2668 seq_printf(m, "%llu\n", p->timer_slack_ns); 2669 task_unlock(p); 2670 2671out: 2672 put_task_struct(p); 2673 2674 return err; 2675} 2676 2677static int timerslack_ns_open(struct inode *inode, struct file *filp) 2678{ 2679 return single_open(filp, timerslack_ns_show, inode); 2680} 2681 2682static const struct file_operations proc_pid_set_timerslack_ns_operations = { 2683 .open = timerslack_ns_open, 2684 .read = seq_read, 2685 .write = timerslack_ns_write, 2686 .llseek = seq_lseek, 2687 .release = single_release, 2688}; 2689 2690static struct dentry *proc_pident_instantiate(struct dentry *dentry, 2691 struct task_struct *task, const void *ptr) 2692{ 2693 const struct pid_entry *p = ptr; 2694 struct inode *inode; 2695 struct proc_inode *ei; 2696 2697 inode = proc_pid_make_inode(dentry->d_sb, task, p->mode); 2698 if (!inode) 2699 return ERR_PTR(-ENOENT); 2700 2701 ei = PROC_I(inode); 2702 if (S_ISDIR(inode->i_mode)) 2703 set_nlink(inode, 2); /* Use getattr to fix if necessary */ 2704 if (p->iop) 2705 inode->i_op = p->iop; 2706 if (p->fop) 2707 inode->i_fop = p->fop; 2708 ei->op = p->op; 2709 pid_update_inode(task, inode); 2710 return d_splice_alias_ops(inode, dentry, &pid_dentry_operations); 2711} 2712 2713static struct dentry *proc_pident_lookup(struct inode *dir, 2714 struct dentry *dentry, 2715 const struct pid_entry *p, 2716 const struct pid_entry *end) 2717{ 2718 struct task_struct *task = get_proc_task(dir); 2719 struct dentry *res = ERR_PTR(-ENOENT); 2720 2721 if (!task) 2722 goto out_no_task; 2723 2724 /* 2725 * Yes, it does not scale. And it should not. Don't add 2726 * new entries into /proc/<tgid>/ without very good reasons. 2727 */ 2728 for (; p < end; p++) { 2729 if (p->len != dentry->d_name.len) 2730 continue; 2731 if (!memcmp(dentry->d_name.name, p->name, p->len)) { 2732 res = proc_pident_instantiate(dentry, task, p); 2733 break; 2734 } 2735 } 2736 put_task_struct(task); 2737out_no_task: 2738 return res; 2739} 2740 2741static int proc_pident_readdir(struct file *file, struct dir_context *ctx, 2742 const struct pid_entry *ents, unsigned int nents) 2743{ 2744 struct task_struct *task = get_proc_task(file_inode(file)); 2745 const struct pid_entry *p; 2746 2747 if (!task) 2748 return -ENOENT; 2749 2750 if (!dir_emit_dots(file, ctx)) 2751 goto out; 2752 2753 if (ctx->pos >= nents + 2) 2754 goto out; 2755 2756 for (p = ents + (ctx->pos - 2); p < ents + nents; p++) { 2757 if (!proc_fill_cache(file, ctx, p->name, p->len, 2758 proc_pident_instantiate, task, p)) 2759 break; 2760 ctx->pos++; 2761 } 2762out: 2763 put_task_struct(task); 2764 return 0; 2765} 2766 2767#ifdef CONFIG_SECURITY 2768static int proc_pid_attr_open(struct inode *inode, struct file *file) 2769{ 2770 file->private_data = NULL; 2771 __mem_open(inode, file, PTRACE_MODE_READ_FSCREDS); 2772 return 0; 2773} 2774 2775static ssize_t proc_pid_attr_read(struct file * file, char __user * buf, 2776 size_t count, loff_t *ppos) 2777{ 2778 struct inode * inode = file_inode(file); 2779 char *p = NULL; 2780 ssize_t length; 2781 struct task_struct *task = get_proc_task(inode); 2782 2783 if (!task) 2784 return -ESRCH; 2785 2786 length = security_getprocattr(task, PROC_I(inode)->op.lsmid, 2787 file->f_path.dentry->d_name.name, 2788 &p); 2789 put_task_struct(task); 2790 if (length > 0) 2791 length = simple_read_from_buffer(buf, count, ppos, p, length); 2792 kfree(p); 2793 return length; 2794} 2795 2796static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf, 2797 size_t count, loff_t *ppos) 2798{ 2799 struct inode * inode = file_inode(file); 2800 struct task_struct *task; 2801 void *page; 2802 int rv; 2803 2804 /* A task may only write when it was the opener. */ 2805 if (file->private_data != current->mm) 2806 return -EPERM; 2807 2808 rcu_read_lock(); 2809 task = pid_task(proc_pid(inode), PIDTYPE_PID); 2810 if (!task) { 2811 rcu_read_unlock(); 2812 return -ESRCH; 2813 } 2814 /* A task may only write its own attributes. */ 2815 if (current != task) { 2816 rcu_read_unlock(); 2817 return -EACCES; 2818 } 2819 /* Prevent changes to overridden credentials. */ 2820 if (current_cred() != current_real_cred()) { 2821 rcu_read_unlock(); 2822 return -EBUSY; 2823 } 2824 rcu_read_unlock(); 2825 2826 if (count > PAGE_SIZE) 2827 count = PAGE_SIZE; 2828 2829 /* No partial writes. */ 2830 if (*ppos != 0) 2831 return -EINVAL; 2832 2833 page = memdup_user(buf, count); 2834 if (IS_ERR(page)) { 2835 rv = PTR_ERR(page); 2836 goto out; 2837 } 2838 2839 /* Guard against adverse ptrace interaction */ 2840 rv = mutex_lock_interruptible(¤t->signal->cred_guard_mutex); 2841 if (rv < 0) 2842 goto out_free; 2843 2844 rv = security_setprocattr(PROC_I(inode)->op.lsmid, 2845 file->f_path.dentry->d_name.name, page, 2846 count); 2847 mutex_unlock(¤t->signal->cred_guard_mutex); 2848out_free: 2849 kfree(page); 2850out: 2851 return rv; 2852} 2853 2854static const struct file_operations proc_pid_attr_operations = { 2855 .open = proc_pid_attr_open, 2856 .read = proc_pid_attr_read, 2857 .write = proc_pid_attr_write, 2858 .llseek = generic_file_llseek, 2859 .release = mem_release, 2860}; 2861 2862#define LSM_DIR_OPS(LSM) \ 2863static int proc_##LSM##_attr_dir_iterate(struct file *filp, \ 2864 struct dir_context *ctx) \ 2865{ \ 2866 return proc_pident_readdir(filp, ctx, \ 2867 LSM##_attr_dir_stuff, \ 2868 ARRAY_SIZE(LSM##_attr_dir_stuff)); \ 2869} \ 2870\ 2871static const struct file_operations proc_##LSM##_attr_dir_ops = { \ 2872 .read = generic_read_dir, \ 2873 .iterate_shared = proc_##LSM##_attr_dir_iterate, \ 2874 .llseek = default_llseek, \ 2875}; \ 2876\ 2877static struct dentry *proc_##LSM##_attr_dir_lookup(struct inode *dir, \ 2878 struct dentry *dentry, unsigned int flags) \ 2879{ \ 2880 return proc_pident_lookup(dir, dentry, \ 2881 LSM##_attr_dir_stuff, \ 2882 LSM##_attr_dir_stuff + ARRAY_SIZE(LSM##_attr_dir_stuff)); \ 2883} \ 2884\ 2885static const struct inode_operations proc_##LSM##_attr_dir_inode_ops = { \ 2886 .lookup = proc_##LSM##_attr_dir_lookup, \ 2887 .getattr = pid_getattr, \ 2888 .setattr = proc_setattr, \ 2889} 2890 2891#ifdef CONFIG_SECURITY_SMACK 2892static const struct pid_entry smack_attr_dir_stuff[] = { 2893 ATTR(LSM_ID_SMACK, "current", 0666), 2894}; 2895LSM_DIR_OPS(smack); 2896#endif 2897 2898#ifdef CONFIG_SECURITY_APPARMOR 2899static const struct pid_entry apparmor_attr_dir_stuff[] = { 2900 ATTR(LSM_ID_APPARMOR, "current", 0666), 2901 ATTR(LSM_ID_APPARMOR, "prev", 0444), 2902 ATTR(LSM_ID_APPARMOR, "exec", 0666), 2903}; 2904LSM_DIR_OPS(apparmor); 2905#endif 2906 2907static const struct pid_entry attr_dir_stuff[] = { 2908 ATTR(LSM_ID_UNDEF, "current", 0666), 2909 ATTR(LSM_ID_UNDEF, "prev", 0444), 2910 ATTR(LSM_ID_UNDEF, "exec", 0666), 2911 ATTR(LSM_ID_UNDEF, "fscreate", 0666), 2912 ATTR(LSM_ID_UNDEF, "keycreate", 0666), 2913 ATTR(LSM_ID_UNDEF, "sockcreate", 0666), 2914#ifdef CONFIG_SECURITY_SMACK 2915 DIR("smack", 0555, 2916 proc_smack_attr_dir_inode_ops, proc_smack_attr_dir_ops), 2917#endif 2918#ifdef CONFIG_SECURITY_APPARMOR 2919 DIR("apparmor", 0555, 2920 proc_apparmor_attr_dir_inode_ops, proc_apparmor_attr_dir_ops), 2921#endif 2922}; 2923 2924static int proc_attr_dir_readdir(struct file *file, struct dir_context *ctx) 2925{ 2926 return proc_pident_readdir(file, ctx, 2927 attr_dir_stuff, ARRAY_SIZE(attr_dir_stuff)); 2928} 2929 2930static const struct file_operations proc_attr_dir_operations = { 2931 .read = generic_read_dir, 2932 .iterate_shared = proc_attr_dir_readdir, 2933 .llseek = generic_file_llseek, 2934}; 2935 2936static struct dentry *proc_attr_dir_lookup(struct inode *dir, 2937 struct dentry *dentry, unsigned int flags) 2938{ 2939 return proc_pident_lookup(dir, dentry, 2940 attr_dir_stuff, 2941 attr_dir_stuff + ARRAY_SIZE(attr_dir_stuff)); 2942} 2943 2944static const struct inode_operations proc_attr_dir_inode_operations = { 2945 .lookup = proc_attr_dir_lookup, 2946 .getattr = pid_getattr, 2947 .setattr = proc_setattr, 2948}; 2949 2950#endif 2951 2952#ifdef CONFIG_ELF_CORE 2953static ssize_t proc_coredump_filter_read(struct file *file, char __user *buf, 2954 size_t count, loff_t *ppos) 2955{ 2956 struct task_struct *task = get_proc_task(file_inode(file)); 2957 struct mm_struct *mm; 2958 char buffer[PROC_NUMBUF]; 2959 size_t len; 2960 int ret; 2961 2962 if (!task) 2963 return -ESRCH; 2964 2965 ret = 0; 2966 mm = get_task_mm(task); 2967 if (mm) { 2968 unsigned long flags = __mm_flags_get_dumpable(mm); 2969 2970 len = snprintf(buffer, sizeof(buffer), "%08lx\n", 2971 ((flags & MMF_DUMP_FILTER_MASK) >> 2972 MMF_DUMP_FILTER_SHIFT)); 2973 mmput(mm); 2974 ret = simple_read_from_buffer(buf, count, ppos, buffer, len); 2975 } 2976 2977 put_task_struct(task); 2978 2979 return ret; 2980} 2981 2982static ssize_t proc_coredump_filter_write(struct file *file, 2983 const char __user *buf, 2984 size_t count, 2985 loff_t *ppos) 2986{ 2987 struct task_struct *task; 2988 struct mm_struct *mm; 2989 unsigned int val; 2990 int ret; 2991 int i; 2992 unsigned long mask; 2993 2994 ret = kstrtouint_from_user(buf, count, 0, &val); 2995 if (ret < 0) 2996 return ret; 2997 2998 ret = -ESRCH; 2999 task = get_proc_task(file_inode(file)); 3000 if (!task) 3001 goto out_no_task; 3002 3003 mm = get_task_mm(task); 3004 if (!mm) 3005 goto out_no_mm; 3006 ret = 0; 3007 3008 for (i = 0, mask = 1; i < MMF_DUMP_FILTER_BITS; i++, mask <<= 1) { 3009 if (val & mask) 3010 mm_flags_set(i + MMF_DUMP_FILTER_SHIFT, mm); 3011 else 3012 mm_flags_clear(i + MMF_DUMP_FILTER_SHIFT, mm); 3013 } 3014 3015 mmput(mm); 3016 out_no_mm: 3017 put_task_struct(task); 3018 out_no_task: 3019 if (ret < 0) 3020 return ret; 3021 return count; 3022} 3023 3024static const struct file_operations proc_coredump_filter_operations = { 3025 .read = proc_coredump_filter_read, 3026 .write = proc_coredump_filter_write, 3027 .llseek = generic_file_llseek, 3028}; 3029#endif 3030 3031#ifdef CONFIG_TASK_IO_ACCOUNTING 3032static int do_io_accounting(struct task_struct *task, struct seq_file *m, int whole) 3033{ 3034 struct task_io_accounting acct; 3035 int result; 3036 3037 result = down_read_killable(&task->signal->exec_update_lock); 3038 if (result) 3039 return result; 3040 3041 if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) { 3042 result = -EACCES; 3043 goto out_unlock; 3044 } 3045 3046 if (whole) { 3047 struct signal_struct *sig = task->signal; 3048 struct task_struct *t; 3049 3050 guard(rcu)(); 3051 scoped_seqlock_read (&sig->stats_lock, ss_lock_irqsave) { 3052 acct = sig->ioac; 3053 __for_each_thread(sig, t) 3054 task_io_accounting_add(&acct, &t->ioac); 3055 3056 } 3057 } else { 3058 acct = task->ioac; 3059 } 3060 3061 seq_printf(m, 3062 "rchar: %llu\n" 3063 "wchar: %llu\n" 3064 "syscr: %llu\n" 3065 "syscw: %llu\n" 3066 "read_bytes: %llu\n" 3067 "write_bytes: %llu\n" 3068 "cancelled_write_bytes: %llu\n", 3069 (unsigned long long)acct.rchar, 3070 (unsigned long long)acct.wchar, 3071 (unsigned long long)acct.syscr, 3072 (unsigned long long)acct.syscw, 3073 (unsigned long long)acct.read_bytes, 3074 (unsigned long long)acct.write_bytes, 3075 (unsigned long long)acct.cancelled_write_bytes); 3076 result = 0; 3077 3078out_unlock: 3079 up_read(&task->signal->exec_update_lock); 3080 return result; 3081} 3082 3083static int proc_tid_io_accounting(struct seq_file *m, struct pid_namespace *ns, 3084 struct pid *pid, struct task_struct *task) 3085{ 3086 return do_io_accounting(task, m, 0); 3087} 3088 3089static int proc_tgid_io_accounting(struct seq_file *m, struct pid_namespace *ns, 3090 struct pid *pid, struct task_struct *task) 3091{ 3092 return do_io_accounting(task, m, 1); 3093} 3094#endif /* CONFIG_TASK_IO_ACCOUNTING */ 3095 3096#ifdef CONFIG_USER_NS 3097static int proc_id_map_open(struct inode *inode, struct file *file, 3098 const struct seq_operations *seq_ops) 3099{ 3100 struct user_namespace *ns = NULL; 3101 struct task_struct *task; 3102 struct seq_file *seq; 3103 int ret = -EINVAL; 3104 3105 task = get_proc_task(inode); 3106 if (task) { 3107 rcu_read_lock(); 3108 ns = get_user_ns(task_cred_xxx(task, user_ns)); 3109 rcu_read_unlock(); 3110 put_task_struct(task); 3111 } 3112 if (!ns) 3113 goto err; 3114 3115 ret = seq_open(file, seq_ops); 3116 if (ret) 3117 goto err_put_ns; 3118 3119 seq = file->private_data; 3120 seq->private = ns; 3121 3122 return 0; 3123err_put_ns: 3124 put_user_ns(ns); 3125err: 3126 return ret; 3127} 3128 3129static int proc_id_map_release(struct inode *inode, struct file *file) 3130{ 3131 struct seq_file *seq = file->private_data; 3132 struct user_namespace *ns = seq->private; 3133 put_user_ns(ns); 3134 return seq_release(inode, file); 3135} 3136 3137static int proc_uid_map_open(struct inode *inode, struct file *file) 3138{ 3139 return proc_id_map_open(inode, file, &proc_uid_seq_operations); 3140} 3141 3142static int proc_gid_map_open(struct inode *inode, struct file *file) 3143{ 3144 return proc_id_map_open(inode, file, &proc_gid_seq_operations); 3145} 3146 3147static int proc_projid_map_open(struct inode *inode, struct file *file) 3148{ 3149 return proc_id_map_open(inode, file, &proc_projid_seq_operations); 3150} 3151 3152static const struct file_operations proc_uid_map_operations = { 3153 .open = proc_uid_map_open, 3154 .write = proc_uid_map_write, 3155 .read = seq_read, 3156 .llseek = seq_lseek, 3157 .release = proc_id_map_release, 3158}; 3159 3160static const struct file_operations proc_gid_map_operations = { 3161 .open = proc_gid_map_open, 3162 .write = proc_gid_map_write, 3163 .read = seq_read, 3164 .llseek = seq_lseek, 3165 .release = proc_id_map_release, 3166}; 3167 3168static const struct file_operations proc_projid_map_operations = { 3169 .open = proc_projid_map_open, 3170 .write = proc_projid_map_write, 3171 .read = seq_read, 3172 .llseek = seq_lseek, 3173 .release = proc_id_map_release, 3174}; 3175 3176static int proc_setgroups_open(struct inode *inode, struct file *file) 3177{ 3178 struct user_namespace *ns = NULL; 3179 struct task_struct *task; 3180 int ret; 3181 3182 ret = -ESRCH; 3183 task = get_proc_task(inode); 3184 if (task) { 3185 rcu_read_lock(); 3186 ns = get_user_ns(task_cred_xxx(task, user_ns)); 3187 rcu_read_unlock(); 3188 put_task_struct(task); 3189 } 3190 if (!ns) 3191 goto err; 3192 3193 if (file->f_mode & FMODE_WRITE) { 3194 ret = -EACCES; 3195 if (!ns_capable(ns, CAP_SYS_ADMIN)) 3196 goto err_put_ns; 3197 } 3198 3199 ret = single_open(file, &proc_setgroups_show, ns); 3200 if (ret) 3201 goto err_put_ns; 3202 3203 return 0; 3204err_put_ns: 3205 put_user_ns(ns); 3206err: 3207 return ret; 3208} 3209 3210static int proc_setgroups_release(struct inode *inode, struct file *file) 3211{ 3212 struct seq_file *seq = file->private_data; 3213 struct user_namespace *ns = seq->private; 3214 int ret = single_release(inode, file); 3215 put_user_ns(ns); 3216 return ret; 3217} 3218 3219static const struct file_operations proc_setgroups_operations = { 3220 .open = proc_setgroups_open, 3221 .write = proc_setgroups_write, 3222 .read = seq_read, 3223 .llseek = seq_lseek, 3224 .release = proc_setgroups_release, 3225}; 3226#endif /* CONFIG_USER_NS */ 3227 3228static int proc_pid_personality(struct seq_file *m, struct pid_namespace *ns, 3229 struct pid *pid, struct task_struct *task) 3230{ 3231 int err = lock_trace(task); 3232 if (!err) { 3233 seq_printf(m, "%08x\n", task->personality); 3234 unlock_trace(task); 3235 } 3236 return err; 3237} 3238 3239#ifdef CONFIG_LIVEPATCH 3240static int proc_pid_patch_state(struct seq_file *m, struct pid_namespace *ns, 3241 struct pid *pid, struct task_struct *task) 3242{ 3243 seq_printf(m, "%d\n", task->patch_state); 3244 return 0; 3245} 3246#endif /* CONFIG_LIVEPATCH */ 3247 3248#ifdef CONFIG_KSM 3249static int proc_pid_ksm_merging_pages(struct seq_file *m, struct pid_namespace *ns, 3250 struct pid *pid, struct task_struct *task) 3251{ 3252 struct mm_struct *mm; 3253 3254 mm = get_task_mm(task); 3255 if (mm) { 3256 seq_printf(m, "%lu\n", mm->ksm_merging_pages); 3257 mmput(mm); 3258 } 3259 3260 return 0; 3261} 3262static int proc_pid_ksm_stat(struct seq_file *m, struct pid_namespace *ns, 3263 struct pid *pid, struct task_struct *task) 3264{ 3265 struct mm_struct *mm; 3266 int ret = 0; 3267 3268 mm = get_task_mm(task); 3269 if (mm) { 3270 seq_printf(m, "ksm_rmap_items %lu\n", mm->ksm_rmap_items); 3271 seq_printf(m, "ksm_zero_pages %ld\n", mm_ksm_zero_pages(mm)); 3272 seq_printf(m, "ksm_merging_pages %lu\n", mm->ksm_merging_pages); 3273 seq_printf(m, "ksm_process_profit %ld\n", ksm_process_profit(mm)); 3274 seq_printf(m, "ksm_merge_any: %s\n", 3275 mm_flags_test(MMF_VM_MERGE_ANY, mm) ? "yes" : "no"); 3276 ret = mmap_read_lock_killable(mm); 3277 if (ret) { 3278 mmput(mm); 3279 return ret; 3280 } 3281 seq_printf(m, "ksm_mergeable: %s\n", 3282 ksm_process_mergeable(mm) ? "yes" : "no"); 3283 mmap_read_unlock(mm); 3284 mmput(mm); 3285 } 3286 3287 return 0; 3288} 3289#endif /* CONFIG_KSM */ 3290 3291#ifdef CONFIG_KSTACK_ERASE_METRICS 3292static int proc_stack_depth(struct seq_file *m, struct pid_namespace *ns, 3293 struct pid *pid, struct task_struct *task) 3294{ 3295 unsigned long prev_depth = THREAD_SIZE - 3296 (task->prev_lowest_stack & (THREAD_SIZE - 1)); 3297 unsigned long depth = THREAD_SIZE - 3298 (task->lowest_stack & (THREAD_SIZE - 1)); 3299 3300 seq_printf(m, "previous stack depth: %lu\nstack depth: %lu\n", 3301 prev_depth, depth); 3302 return 0; 3303} 3304#endif /* CONFIG_KSTACK_ERASE_METRICS */ 3305 3306/* 3307 * Thread groups 3308 */ 3309static const struct file_operations proc_task_operations; 3310static const struct inode_operations proc_task_inode_operations; 3311 3312static const struct pid_entry tgid_base_stuff[] = { 3313 DIR("task", S_IRUGO|S_IXUGO, proc_task_inode_operations, proc_task_operations), 3314 DIR("fd", S_IRUSR|S_IXUSR, proc_fd_inode_operations, proc_fd_operations), 3315 DIR("map_files", S_IRUSR|S_IXUSR, proc_map_files_inode_operations, proc_map_files_operations), 3316 DIR("fdinfo", S_IRUGO|S_IXUGO, proc_fdinfo_inode_operations, proc_fdinfo_operations), 3317 DIR("ns", S_IRUSR|S_IXUGO, proc_ns_dir_inode_operations, proc_ns_dir_operations), 3318#ifdef CONFIG_NET 3319 DIR("net", S_IRUGO|S_IXUGO, proc_net_inode_operations, proc_net_operations), 3320#endif 3321 REG("environ", S_IRUSR, proc_environ_operations), 3322 REG("auxv", S_IRUSR, proc_auxv_operations), 3323 ONE("status", S_IRUGO, proc_pid_status), 3324 ONE("personality", S_IRUSR, proc_pid_personality), 3325 ONE("limits", S_IRUGO, proc_pid_limits), 3326 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations), 3327#ifdef CONFIG_SCHED_AUTOGROUP 3328 REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations), 3329#endif 3330#ifdef CONFIG_TIME_NS 3331 REG("timens_offsets", S_IRUGO|S_IWUSR, proc_timens_offsets_operations), 3332#endif 3333 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations), 3334#ifdef CONFIG_HAVE_ARCH_TRACEHOOK 3335 ONE("syscall", S_IRUSR, proc_pid_syscall), 3336#endif 3337 REG("cmdline", S_IRUGO, proc_pid_cmdline_ops), 3338 ONE("stat", S_IRUGO, proc_tgid_stat), 3339 ONE("statm", S_IRUGO, proc_pid_statm), 3340 REG("maps", S_IRUGO, proc_pid_maps_operations), 3341#ifdef CONFIG_NUMA 3342 REG("numa_maps", S_IRUGO, proc_pid_numa_maps_operations), 3343#endif 3344 REG("mem", S_IRUSR|S_IWUSR, proc_mem_operations), 3345 LNK("cwd", proc_cwd_link), 3346 LNK("root", proc_root_link), 3347 LNK("exe", proc_exe_link), 3348 REG("mounts", S_IRUGO, proc_mounts_operations), 3349 REG("mountinfo", S_IRUGO, proc_mountinfo_operations), 3350 REG("mountstats", S_IRUSR, proc_mountstats_operations), 3351#ifdef CONFIG_PROC_PAGE_MONITOR 3352 REG("clear_refs", S_IWUSR, proc_clear_refs_operations), 3353 REG("smaps", S_IRUGO, proc_pid_smaps_operations), 3354 REG("smaps_rollup", S_IRUGO, proc_pid_smaps_rollup_operations), 3355 REG("pagemap", S_IRUSR, proc_pagemap_operations), 3356#endif 3357#ifdef CONFIG_SECURITY 3358 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations), 3359#endif 3360#ifdef CONFIG_KALLSYMS 3361 ONE("wchan", S_IRUGO, proc_pid_wchan), 3362#endif 3363#ifdef CONFIG_STACKTRACE 3364 ONE("stack", S_IRUSR, proc_pid_stack), 3365#endif 3366#ifdef CONFIG_SCHED_INFO 3367 ONE("schedstat", S_IRUGO, proc_pid_schedstat), 3368#endif 3369#ifdef CONFIG_LATENCYTOP 3370 REG("latency", S_IRUGO, proc_lstats_operations), 3371#endif 3372#ifdef CONFIG_PROC_PID_CPUSET 3373 ONE("cpuset", S_IRUGO, proc_cpuset_show), 3374#endif 3375#ifdef CONFIG_CGROUPS 3376 ONE("cgroup", S_IRUGO, proc_cgroup_show), 3377#endif 3378#ifdef CONFIG_PROC_CPU_RESCTRL 3379 ONE("cpu_resctrl_groups", S_IRUGO, proc_resctrl_show), 3380#endif 3381 ONE("oom_score", S_IRUGO, proc_oom_score), 3382 REG("oom_adj", S_IRUGO|S_IWUSR, proc_oom_adj_operations), 3383 REG("oom_score_adj", S_IRUGO|S_IWUSR, proc_oom_score_adj_operations), 3384#ifdef CONFIG_AUDIT 3385 REG("loginuid", S_IWUSR|S_IRUGO, proc_loginuid_operations), 3386 REG("sessionid", S_IRUGO, proc_sessionid_operations), 3387#endif 3388#ifdef CONFIG_FAULT_INJECTION 3389 REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations), 3390 REG("fail-nth", 0644, proc_fail_nth_operations), 3391#endif 3392#ifdef CONFIG_ELF_CORE 3393 REG("coredump_filter", S_IRUGO|S_IWUSR, proc_coredump_filter_operations), 3394#endif 3395#ifdef CONFIG_TASK_IO_ACCOUNTING 3396 ONE("io", S_IRUSR, proc_tgid_io_accounting), 3397#endif 3398#ifdef CONFIG_USER_NS 3399 REG("uid_map", S_IRUGO|S_IWUSR, proc_uid_map_operations), 3400 REG("gid_map", S_IRUGO|S_IWUSR, proc_gid_map_operations), 3401 REG("projid_map", S_IRUGO|S_IWUSR, proc_projid_map_operations), 3402 REG("setgroups", S_IRUGO|S_IWUSR, proc_setgroups_operations), 3403#endif 3404#if defined(CONFIG_CHECKPOINT_RESTORE) && defined(CONFIG_POSIX_TIMERS) 3405 REG("timers", S_IRUGO, proc_timers_operations), 3406#endif 3407 REG("timerslack_ns", S_IRUGO|S_IWUGO, proc_pid_set_timerslack_ns_operations), 3408#ifdef CONFIG_LIVEPATCH 3409 ONE("patch_state", S_IRUSR, proc_pid_patch_state), 3410#endif 3411#ifdef CONFIG_KSTACK_ERASE_METRICS 3412 ONE("stack_depth", S_IRUGO, proc_stack_depth), 3413#endif 3414#ifdef CONFIG_PROC_PID_ARCH_STATUS 3415 ONE("arch_status", S_IRUGO, proc_pid_arch_status), 3416#endif 3417#ifdef CONFIG_SECCOMP_CACHE_DEBUG 3418 ONE("seccomp_cache", S_IRUSR, proc_pid_seccomp_cache), 3419#endif 3420#ifdef CONFIG_KSM 3421 ONE("ksm_merging_pages", S_IRUSR, proc_pid_ksm_merging_pages), 3422 ONE("ksm_stat", S_IRUSR, proc_pid_ksm_stat), 3423#endif 3424}; 3425 3426static int proc_tgid_base_readdir(struct file *file, struct dir_context *ctx) 3427{ 3428 return proc_pident_readdir(file, ctx, 3429 tgid_base_stuff, ARRAY_SIZE(tgid_base_stuff)); 3430} 3431 3432static const struct file_operations proc_tgid_base_operations = { 3433 .read = generic_read_dir, 3434 .iterate_shared = proc_tgid_base_readdir, 3435 .llseek = generic_file_llseek, 3436}; 3437 3438struct pid *tgid_pidfd_to_pid(const struct file *file) 3439{ 3440 if (file->f_op != &proc_tgid_base_operations) 3441 return ERR_PTR(-EBADF); 3442 3443 return proc_pid(file_inode(file)); 3444} 3445 3446static struct dentry *proc_tgid_base_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags) 3447{ 3448 return proc_pident_lookup(dir, dentry, 3449 tgid_base_stuff, 3450 tgid_base_stuff + ARRAY_SIZE(tgid_base_stuff)); 3451} 3452 3453static const struct inode_operations proc_tgid_base_inode_operations = { 3454 .lookup = proc_tgid_base_lookup, 3455 .getattr = pid_getattr, 3456 .setattr = proc_setattr, 3457 .permission = proc_pid_permission, 3458}; 3459 3460/** 3461 * proc_flush_pid - Remove dcache entries for @pid from the /proc dcache. 3462 * @pid: pid that should be flushed. 3463 * 3464 * This function walks a list of inodes (that belong to any proc 3465 * filesystem) that are attached to the pid and flushes them from 3466 * the dentry cache. 3467 * 3468 * It is safe and reasonable to cache /proc entries for a task until 3469 * that task exits. After that they just clog up the dcache with 3470 * useless entries, possibly causing useful dcache entries to be 3471 * flushed instead. This routine is provided to flush those useless 3472 * dcache entries when a process is reaped. 3473 * 3474 * NOTE: This routine is just an optimization so it does not guarantee 3475 * that no dcache entries will exist after a process is reaped 3476 * it just makes it very unlikely that any will persist. 3477 */ 3478 3479void proc_flush_pid(struct pid *pid) 3480{ 3481 proc_invalidate_siblings_dcache(&pid->inodes, &pid->lock); 3482} 3483 3484static struct dentry *proc_pid_instantiate(struct dentry * dentry, 3485 struct task_struct *task, const void *ptr) 3486{ 3487 struct inode *inode; 3488 3489 inode = proc_pid_make_base_inode(dentry->d_sb, task, 3490 S_IFDIR | S_IRUGO | S_IXUGO); 3491 if (!inode) 3492 return ERR_PTR(-ENOENT); 3493 3494 inode->i_op = &proc_tgid_base_inode_operations; 3495 inode->i_fop = &proc_tgid_base_operations; 3496 inode->i_flags|=S_IMMUTABLE; 3497 3498 set_nlink(inode, nlink_tgid); 3499 pid_update_inode(task, inode); 3500 3501 return d_splice_alias_ops(inode, dentry, &pid_dentry_operations); 3502} 3503 3504struct dentry *proc_pid_lookup(struct dentry *dentry, unsigned int flags) 3505{ 3506 struct task_struct *task; 3507 unsigned tgid; 3508 struct proc_fs_info *fs_info; 3509 struct pid_namespace *ns; 3510 struct dentry *result = ERR_PTR(-ENOENT); 3511 3512 tgid = name_to_int(&dentry->d_name); 3513 if (tgid == ~0U) 3514 goto out; 3515 3516 fs_info = proc_sb_info(dentry->d_sb); 3517 ns = fs_info->pid_ns; 3518 rcu_read_lock(); 3519 task = find_task_by_pid_ns(tgid, ns); 3520 if (task) 3521 get_task_struct(task); 3522 rcu_read_unlock(); 3523 if (!task) 3524 goto out; 3525 3526 /* Limit procfs to only ptraceable tasks */ 3527 if (fs_info->hide_pid == HIDEPID_NOT_PTRACEABLE) { 3528 if (!has_pid_permissions(fs_info, task, HIDEPID_NO_ACCESS)) 3529 goto out_put_task; 3530 } 3531 3532 result = proc_pid_instantiate(dentry, task, NULL); 3533out_put_task: 3534 put_task_struct(task); 3535out: 3536 return result; 3537} 3538 3539/* 3540 * Find the first task with tgid >= tgid 3541 * 3542 */ 3543struct tgid_iter { 3544 unsigned int tgid; 3545 struct task_struct *task; 3546}; 3547static struct tgid_iter next_tgid(struct pid_namespace *ns, struct tgid_iter iter) 3548{ 3549 struct pid *pid; 3550 3551 if (iter.task) 3552 put_task_struct(iter.task); 3553 rcu_read_lock(); 3554retry: 3555 iter.task = NULL; 3556 pid = find_ge_pid(iter.tgid, ns); 3557 if (pid) { 3558 iter.tgid = pid_nr_ns(pid, ns); 3559 iter.task = pid_task(pid, PIDTYPE_TGID); 3560 if (!iter.task) { 3561 iter.tgid += 1; 3562 goto retry; 3563 } 3564 get_task_struct(iter.task); 3565 } 3566 rcu_read_unlock(); 3567 return iter; 3568} 3569 3570#define TGID_OFFSET (FIRST_PROCESS_ENTRY + 2) 3571 3572/* for the /proc/ directory itself, after non-process stuff has been done */ 3573int proc_pid_readdir(struct file *file, struct dir_context *ctx) 3574{ 3575 struct tgid_iter iter; 3576 struct proc_fs_info *fs_info = proc_sb_info(file_inode(file)->i_sb); 3577 struct pid_namespace *ns = proc_pid_ns(file_inode(file)->i_sb); 3578 loff_t pos = ctx->pos; 3579 3580 if (pos >= PID_MAX_LIMIT + TGID_OFFSET) 3581 return 0; 3582 3583 if (pos == TGID_OFFSET - 2) { 3584 if (!dir_emit(ctx, "self", 4, self_inum, DT_LNK)) 3585 return 0; 3586 ctx->pos = pos = pos + 1; 3587 } 3588 if (pos == TGID_OFFSET - 1) { 3589 if (!dir_emit(ctx, "thread-self", 11, thread_self_inum, DT_LNK)) 3590 return 0; 3591 ctx->pos = pos = pos + 1; 3592 } 3593 iter.tgid = pos - TGID_OFFSET; 3594 iter.task = NULL; 3595 for (iter = next_tgid(ns, iter); 3596 iter.task; 3597 iter.tgid += 1, iter = next_tgid(ns, iter)) { 3598 char name[10 + 1]; 3599 unsigned int len; 3600 3601 cond_resched(); 3602 if (!has_pid_permissions(fs_info, iter.task, HIDEPID_INVISIBLE)) 3603 continue; 3604 3605 len = snprintf(name, sizeof(name), "%u", iter.tgid); 3606 ctx->pos = iter.tgid + TGID_OFFSET; 3607 if (!proc_fill_cache(file, ctx, name, len, 3608 proc_pid_instantiate, iter.task, NULL)) { 3609 put_task_struct(iter.task); 3610 return 0; 3611 } 3612 } 3613 ctx->pos = PID_MAX_LIMIT + TGID_OFFSET; 3614 return 0; 3615} 3616 3617/* 3618 * proc_tid_comm_permission is a special permission function exclusively 3619 * used for the node /proc/<pid>/task/<tid>/comm. 3620 * It bypasses generic permission checks in the case where a task of the same 3621 * task group attempts to access the node. 3622 * The rationale behind this is that glibc and bionic access this node for 3623 * cross thread naming (pthread_set/getname_np(!self)). However, if 3624 * PR_SET_DUMPABLE gets set to 0 this node among others becomes uid=0 gid=0, 3625 * which locks out the cross thread naming implementation. 3626 * This function makes sure that the node is always accessible for members of 3627 * same thread group. 3628 */ 3629static int proc_tid_comm_permission(struct mnt_idmap *idmap, 3630 struct inode *inode, int mask) 3631{ 3632 bool is_same_tgroup; 3633 struct task_struct *task; 3634 3635 task = get_proc_task(inode); 3636 if (!task) 3637 return -ESRCH; 3638 is_same_tgroup = same_thread_group(current, task); 3639 put_task_struct(task); 3640 3641 if (likely(is_same_tgroup && !(mask & MAY_EXEC))) { 3642 /* This file (/proc/<pid>/task/<tid>/comm) can always be 3643 * read or written by the members of the corresponding 3644 * thread group. 3645 */ 3646 return 0; 3647 } 3648 3649 return generic_permission(&nop_mnt_idmap, inode, mask); 3650} 3651 3652static const struct inode_operations proc_tid_comm_inode_operations = { 3653 .setattr = proc_setattr, 3654 .permission = proc_tid_comm_permission, 3655}; 3656 3657/* 3658 * Tasks 3659 */ 3660static const struct pid_entry tid_base_stuff[] = { 3661 DIR("fd", S_IRUSR|S_IXUSR, proc_fd_inode_operations, proc_fd_operations), 3662 DIR("fdinfo", S_IRUGO|S_IXUGO, proc_fdinfo_inode_operations, proc_fdinfo_operations), 3663 DIR("ns", S_IRUSR|S_IXUGO, proc_ns_dir_inode_operations, proc_ns_dir_operations), 3664#ifdef CONFIG_NET 3665 DIR("net", S_IRUGO|S_IXUGO, proc_net_inode_operations, proc_net_operations), 3666#endif 3667 REG("environ", S_IRUSR, proc_environ_operations), 3668 REG("auxv", S_IRUSR, proc_auxv_operations), 3669 ONE("status", S_IRUGO, proc_pid_status), 3670 ONE("personality", S_IRUSR, proc_pid_personality), 3671 ONE("limits", S_IRUGO, proc_pid_limits), 3672 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations), 3673 NOD("comm", S_IFREG|S_IRUGO|S_IWUSR, 3674 &proc_tid_comm_inode_operations, 3675 &proc_pid_set_comm_operations, {}), 3676#ifdef CONFIG_HAVE_ARCH_TRACEHOOK 3677 ONE("syscall", S_IRUSR, proc_pid_syscall), 3678#endif 3679 REG("cmdline", S_IRUGO, proc_pid_cmdline_ops), 3680 ONE("stat", S_IRUGO, proc_tid_stat), 3681 ONE("statm", S_IRUGO, proc_pid_statm), 3682 REG("maps", S_IRUGO, proc_pid_maps_operations), 3683#ifdef CONFIG_PROC_CHILDREN 3684 REG("children", S_IRUGO, proc_tid_children_operations), 3685#endif 3686#ifdef CONFIG_NUMA 3687 REG("numa_maps", S_IRUGO, proc_pid_numa_maps_operations), 3688#endif 3689 REG("mem", S_IRUSR|S_IWUSR, proc_mem_operations), 3690 LNK("cwd", proc_cwd_link), 3691 LNK("root", proc_root_link), 3692 LNK("exe", proc_exe_link), 3693 REG("mounts", S_IRUGO, proc_mounts_operations), 3694 REG("mountinfo", S_IRUGO, proc_mountinfo_operations), 3695#ifdef CONFIG_PROC_PAGE_MONITOR 3696 REG("clear_refs", S_IWUSR, proc_clear_refs_operations), 3697 REG("smaps", S_IRUGO, proc_pid_smaps_operations), 3698 REG("smaps_rollup", S_IRUGO, proc_pid_smaps_rollup_operations), 3699 REG("pagemap", S_IRUSR, proc_pagemap_operations), 3700#endif 3701#ifdef CONFIG_SECURITY 3702 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations), 3703#endif 3704#ifdef CONFIG_KALLSYMS 3705 ONE("wchan", S_IRUGO, proc_pid_wchan), 3706#endif 3707#ifdef CONFIG_STACKTRACE 3708 ONE("stack", S_IRUSR, proc_pid_stack), 3709#endif 3710#ifdef CONFIG_SCHED_INFO 3711 ONE("schedstat", S_IRUGO, proc_pid_schedstat), 3712#endif 3713#ifdef CONFIG_LATENCYTOP 3714 REG("latency", S_IRUGO, proc_lstats_operations), 3715#endif 3716#ifdef CONFIG_PROC_PID_CPUSET 3717 ONE("cpuset", S_IRUGO, proc_cpuset_show), 3718#endif 3719#ifdef CONFIG_CGROUPS 3720 ONE("cgroup", S_IRUGO, proc_cgroup_show), 3721#endif 3722#ifdef CONFIG_PROC_CPU_RESCTRL 3723 ONE("cpu_resctrl_groups", S_IRUGO, proc_resctrl_show), 3724#endif 3725 ONE("oom_score", S_IRUGO, proc_oom_score), 3726 REG("oom_adj", S_IRUGO|S_IWUSR, proc_oom_adj_operations), 3727 REG("oom_score_adj", S_IRUGO|S_IWUSR, proc_oom_score_adj_operations), 3728#ifdef CONFIG_AUDIT 3729 REG("loginuid", S_IWUSR|S_IRUGO, proc_loginuid_operations), 3730 REG("sessionid", S_IRUGO, proc_sessionid_operations), 3731#endif 3732#ifdef CONFIG_FAULT_INJECTION 3733 REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations), 3734 REG("fail-nth", 0644, proc_fail_nth_operations), 3735#endif 3736#ifdef CONFIG_TASK_IO_ACCOUNTING 3737 ONE("io", S_IRUSR, proc_tid_io_accounting), 3738#endif 3739#ifdef CONFIG_USER_NS 3740 REG("uid_map", S_IRUGO|S_IWUSR, proc_uid_map_operations), 3741 REG("gid_map", S_IRUGO|S_IWUSR, proc_gid_map_operations), 3742 REG("projid_map", S_IRUGO|S_IWUSR, proc_projid_map_operations), 3743 REG("setgroups", S_IRUGO|S_IWUSR, proc_setgroups_operations), 3744#endif 3745#ifdef CONFIG_LIVEPATCH 3746 ONE("patch_state", S_IRUSR, proc_pid_patch_state), 3747#endif 3748#ifdef CONFIG_PROC_PID_ARCH_STATUS 3749 ONE("arch_status", S_IRUGO, proc_pid_arch_status), 3750#endif 3751#ifdef CONFIG_SECCOMP_CACHE_DEBUG 3752 ONE("seccomp_cache", S_IRUSR, proc_pid_seccomp_cache), 3753#endif 3754#ifdef CONFIG_KSM 3755 ONE("ksm_merging_pages", S_IRUSR, proc_pid_ksm_merging_pages), 3756 ONE("ksm_stat", S_IRUSR, proc_pid_ksm_stat), 3757#endif 3758}; 3759 3760static int proc_tid_base_readdir(struct file *file, struct dir_context *ctx) 3761{ 3762 return proc_pident_readdir(file, ctx, 3763 tid_base_stuff, ARRAY_SIZE(tid_base_stuff)); 3764} 3765 3766static struct dentry *proc_tid_base_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags) 3767{ 3768 return proc_pident_lookup(dir, dentry, 3769 tid_base_stuff, 3770 tid_base_stuff + ARRAY_SIZE(tid_base_stuff)); 3771} 3772 3773static const struct file_operations proc_tid_base_operations = { 3774 .read = generic_read_dir, 3775 .iterate_shared = proc_tid_base_readdir, 3776 .llseek = generic_file_llseek, 3777}; 3778 3779static const struct inode_operations proc_tid_base_inode_operations = { 3780 .lookup = proc_tid_base_lookup, 3781 .getattr = pid_getattr, 3782 .setattr = proc_setattr, 3783}; 3784 3785static struct dentry *proc_task_instantiate(struct dentry *dentry, 3786 struct task_struct *task, const void *ptr) 3787{ 3788 struct inode *inode; 3789 inode = proc_pid_make_base_inode(dentry->d_sb, task, 3790 S_IFDIR | S_IRUGO | S_IXUGO); 3791 if (!inode) 3792 return ERR_PTR(-ENOENT); 3793 3794 inode->i_op = &proc_tid_base_inode_operations; 3795 inode->i_fop = &proc_tid_base_operations; 3796 inode->i_flags |= S_IMMUTABLE; 3797 3798 set_nlink(inode, nlink_tid); 3799 pid_update_inode(task, inode); 3800 3801 return d_splice_alias_ops(inode, dentry, &pid_dentry_operations); 3802} 3803 3804static struct dentry *proc_task_lookup(struct inode *dir, struct dentry * dentry, unsigned int flags) 3805{ 3806 struct task_struct *task; 3807 struct task_struct *leader = get_proc_task(dir); 3808 unsigned tid; 3809 struct proc_fs_info *fs_info; 3810 struct pid_namespace *ns; 3811 struct dentry *result = ERR_PTR(-ENOENT); 3812 3813 if (!leader) 3814 goto out_no_task; 3815 3816 tid = name_to_int(&dentry->d_name); 3817 if (tid == ~0U) 3818 goto out; 3819 3820 fs_info = proc_sb_info(dentry->d_sb); 3821 ns = fs_info->pid_ns; 3822 rcu_read_lock(); 3823 task = find_task_by_pid_ns(tid, ns); 3824 if (task) 3825 get_task_struct(task); 3826 rcu_read_unlock(); 3827 if (!task) 3828 goto out; 3829 if (!same_thread_group(leader, task)) 3830 goto out_drop_task; 3831 3832 result = proc_task_instantiate(dentry, task, NULL); 3833out_drop_task: 3834 put_task_struct(task); 3835out: 3836 put_task_struct(leader); 3837out_no_task: 3838 return result; 3839} 3840 3841/* 3842 * Find the first tid of a thread group to return to user space. 3843 * 3844 * Usually this is just the thread group leader, but if the users 3845 * buffer was too small or there was a seek into the middle of the 3846 * directory we have more work todo. 3847 * 3848 * In the case of a short read we start with find_task_by_pid. 3849 * 3850 * In the case of a seek we start with the leader and walk nr 3851 * threads past it. 3852 */ 3853static struct task_struct *first_tid(struct pid *pid, int tid, loff_t f_pos, 3854 struct pid_namespace *ns) 3855{ 3856 struct task_struct *pos, *task; 3857 unsigned long nr = f_pos; 3858 3859 if (nr != f_pos) /* 32bit overflow? */ 3860 return NULL; 3861 3862 rcu_read_lock(); 3863 task = pid_task(pid, PIDTYPE_PID); 3864 if (!task) 3865 goto fail; 3866 3867 /* Attempt to start with the tid of a thread */ 3868 if (tid && nr) { 3869 pos = find_task_by_pid_ns(tid, ns); 3870 if (pos && same_thread_group(pos, task)) 3871 goto found; 3872 } 3873 3874 /* If nr exceeds the number of threads there is nothing todo */ 3875 if (nr >= get_nr_threads(task)) 3876 goto fail; 3877 3878 /* If we haven't found our starting place yet start 3879 * with the leader and walk nr threads forward. 3880 */ 3881 for_each_thread(task, pos) { 3882 if (!nr--) 3883 goto found; 3884 } 3885fail: 3886 pos = NULL; 3887 goto out; 3888found: 3889 get_task_struct(pos); 3890out: 3891 rcu_read_unlock(); 3892 return pos; 3893} 3894 3895/* 3896 * Find the next thread in the thread list. 3897 * Return NULL if there is an error or no next thread. 3898 * 3899 * The reference to the input task_struct is released. 3900 */ 3901static struct task_struct *next_tid(struct task_struct *start) 3902{ 3903 struct task_struct *pos = NULL; 3904 rcu_read_lock(); 3905 if (pid_alive(start)) { 3906 pos = __next_thread(start); 3907 if (pos) 3908 get_task_struct(pos); 3909 } 3910 rcu_read_unlock(); 3911 put_task_struct(start); 3912 return pos; 3913} 3914 3915/* for the /proc/TGID/task/ directories */ 3916static int proc_task_readdir(struct file *file, struct dir_context *ctx) 3917{ 3918 struct inode *inode = file_inode(file); 3919 struct task_struct *task; 3920 struct pid_namespace *ns; 3921 int tid; 3922 3923 if (proc_inode_is_dead(inode)) 3924 return -ENOENT; 3925 3926 if (!dir_emit_dots(file, ctx)) 3927 return 0; 3928 3929 /* We cache the tgid value that the last readdir call couldn't 3930 * return and lseek resets it to 0. 3931 */ 3932 ns = proc_pid_ns(inode->i_sb); 3933 tid = (int)(intptr_t)file->private_data; 3934 file->private_data = NULL; 3935 for (task = first_tid(proc_pid(inode), tid, ctx->pos - 2, ns); 3936 task; 3937 task = next_tid(task), ctx->pos++) { 3938 char name[10 + 1]; 3939 unsigned int len; 3940 3941 tid = task_pid_nr_ns(task, ns); 3942 if (!tid) 3943 continue; /* The task has just exited. */ 3944 len = snprintf(name, sizeof(name), "%d", tid); 3945 if (!proc_fill_cache(file, ctx, name, len, 3946 proc_task_instantiate, task, NULL)) { 3947 /* returning this tgid failed, save it as the first 3948 * pid for the next readir call */ 3949 file->private_data = (void *)(intptr_t)tid; 3950 put_task_struct(task); 3951 break; 3952 } 3953 } 3954 3955 return 0; 3956} 3957 3958static int proc_task_getattr(struct mnt_idmap *idmap, 3959 const struct path *path, struct kstat *stat, 3960 u32 request_mask, unsigned int query_flags) 3961{ 3962 struct inode *inode = d_inode(path->dentry); 3963 struct task_struct *p = get_proc_task(inode); 3964 generic_fillattr(&nop_mnt_idmap, request_mask, inode, stat); 3965 3966 if (p) { 3967 stat->nlink += get_nr_threads(p); 3968 put_task_struct(p); 3969 } 3970 3971 return 0; 3972} 3973 3974/* 3975 * proc_task_readdir() set @file->private_data to a positive integer 3976 * value, so casting that to u64 is safe. generic_llseek_cookie() will 3977 * set @cookie to 0, so casting to an int is safe. The WARN_ON_ONCE() is 3978 * here to catch any unexpected change in behavior either in 3979 * proc_task_readdir() or generic_llseek_cookie(). 3980 */ 3981static loff_t proc_dir_llseek(struct file *file, loff_t offset, int whence) 3982{ 3983 u64 cookie = (u64)(intptr_t)file->private_data; 3984 loff_t off; 3985 3986 off = generic_llseek_cookie(file, offset, whence, &cookie); 3987 WARN_ON_ONCE(cookie > INT_MAX); 3988 file->private_data = (void *)(intptr_t)cookie; /* serialized by f_pos_lock */ 3989 return off; 3990} 3991 3992static const struct inode_operations proc_task_inode_operations = { 3993 .lookup = proc_task_lookup, 3994 .getattr = proc_task_getattr, 3995 .setattr = proc_setattr, 3996 .permission = proc_pid_permission, 3997}; 3998 3999static const struct file_operations proc_task_operations = { 4000 .read = generic_read_dir, 4001 .iterate_shared = proc_task_readdir, 4002 .llseek = proc_dir_llseek, 4003}; 4004 4005void __init set_proc_pid_nlink(void) 4006{ 4007 nlink_tid = pid_entry_nlink(tid_base_stuff, ARRAY_SIZE(tid_base_stuff)); 4008 nlink_tgid = pid_entry_nlink(tgid_base_stuff, ARRAY_SIZE(tgid_base_stuff)); 4009}
~/
Read-only file preview.