namespace.c

  1// SPDX-License-Identifier: GPL-2.0
  2/*
  3 * linux/ipc/namespace.c
  4 * Copyright (C) 2006 Pavel Emelyanov <xemul@openvz.org> OpenVZ, SWsoft Inc.
  5 */
  6
  7#include <linux/ipc.h>
  8#include <linux/msg.h>
  9#include <linux/ipc_namespace.h>
 10#include <linux/rcupdate.h>
 11#include <linux/nsproxy.h>
 12#include <linux/slab.h>
 13#include <linux/cred.h>
 14#include <linux/fs.h>
 15#include <linux/mount.h>
 16#include <linux/user_namespace.h>
 17#include <linux/proc_ns.h>
 18#include <linux/nstree.h>
 19#include <linux/sched/task.h>
 20
 21#include "util.h"
 22
 23/*
 24 * The work queue is used to avoid the cost of synchronize_rcu in kern_unmount.
 25 */
 26static void free_ipc(struct work_struct *unused);
 27static DECLARE_WORK(free_ipc_work, free_ipc);
 28
 29static struct ucounts *inc_ipc_namespaces(struct user_namespace *ns)
 30{
 31	return inc_ucount(ns, current_euid(), UCOUNT_IPC_NAMESPACES);
 32}
 33
 34static void dec_ipc_namespaces(struct ucounts *ucounts)
 35{
 36	dec_ucount(ucounts, UCOUNT_IPC_NAMESPACES);
 37}
 38
 39static struct ipc_namespace *create_ipc_ns(struct user_namespace *user_ns,
 40					   struct ipc_namespace *old_ns)
 41{
 42	struct ipc_namespace *ns;
 43	struct ucounts *ucounts;
 44	int err;
 45
 46	err = -ENOSPC;
 47 again:
 48	ucounts = inc_ipc_namespaces(user_ns);
 49	if (!ucounts) {
 50		/*
 51		 * IPC namespaces are freed asynchronously, by free_ipc_work.
 52		 * If frees were pending, flush_work will wait, and
 53		 * return true. Fail the allocation if no frees are pending.
 54		 */
 55		if (flush_work(&free_ipc_work))
 56			goto again;
 57		goto fail;
 58	}
 59
 60	err = -ENOMEM;
 61	ns = kzalloc(sizeof(struct ipc_namespace), GFP_KERNEL_ACCOUNT);
 62	if (ns == NULL)
 63		goto fail_dec;
 64
 65	err = ns_common_init(ns);
 66	if (err)
 67		goto fail_free;
 68
 69	ns_tree_gen_id(ns);
 70	ns->user_ns = get_user_ns(user_ns);
 71	ns->ucounts = ucounts;
 72
 73	err = mq_init_ns(ns);
 74	if (err)
 75		goto fail_put;
 76
 77	err = -ENOMEM;
 78	if (!setup_mq_sysctls(ns))
 79		goto fail_mq_mount;
 80
 81	if (!setup_ipc_sysctls(ns))
 82		goto fail_mq_sysctls;
 83
 84	err = msg_init_ns(ns);
 85	if (err)
 86		goto fail_ipc;
 87
 88	sem_init_ns(ns);
 89	shm_init_ns(ns);
 90	ns_tree_add_raw(ns);
 91
 92	return ns;
 93
 94fail_ipc:
 95	retire_ipc_sysctls(ns);
 96fail_mq_sysctls:
 97	retire_mq_sysctls(ns);
 98fail_mq_mount:
 99	mntput(ns->mq_mnt);
100fail_put:
101	put_user_ns(ns->user_ns);
102	ns_common_free(ns);
103fail_free:
104	kfree(ns);
105fail_dec:
106	dec_ipc_namespaces(ucounts);
107fail:
108	return ERR_PTR(err);
109}
110
111struct ipc_namespace *copy_ipcs(u64 flags,
112	struct user_namespace *user_ns, struct ipc_namespace *ns)
113{
114	if (!(flags & CLONE_NEWIPC))
115		return get_ipc_ns(ns);
116	return create_ipc_ns(user_ns, ns);
117}
118
119/*
120 * free_ipcs - free all ipcs of one type
121 * @ns:   the namespace to remove the ipcs from
122 * @ids:  the table of ipcs to free
123 * @free: the function called to free each individual ipc
124 *
125 * Called for each kind of ipc when an ipc_namespace exits.
126 */
127void free_ipcs(struct ipc_namespace *ns, struct ipc_ids *ids,
128	       void (*free)(struct ipc_namespace *, struct kern_ipc_perm *))
129{
130	struct kern_ipc_perm *perm;
131	int next_id;
132	int total, in_use;
133
134	down_write(&ids->rwsem);
135
136	in_use = ids->in_use;
137
138	for (total = 0, next_id = 0; total < in_use; next_id++) {
139		perm = idr_find(&ids->ipcs_idr, next_id);
140		if (perm == NULL)
141			continue;
142		rcu_read_lock();
143		ipc_lock_object(perm);
144		free(ns, perm);
145		total++;
146	}
147	up_write(&ids->rwsem);
148}
149
150static void free_ipc_ns(struct ipc_namespace *ns)
151{
152	/*
153	 * Caller needs to wait for an RCU grace period to have passed
154	 * after making the mount point inaccessible to new accesses.
155	 */
156	mntput(ns->mq_mnt);
157	sem_exit_ns(ns);
158	msg_exit_ns(ns);
159	shm_exit_ns(ns);
160
161	retire_mq_sysctls(ns);
162	retire_ipc_sysctls(ns);
163
164	dec_ipc_namespaces(ns->ucounts);
165	put_user_ns(ns->user_ns);
166	ns_common_free(ns);
167	kfree(ns);
168}
169
170static LLIST_HEAD(free_ipc_list);
171static void free_ipc(struct work_struct *unused)
172{
173	struct llist_node *node = llist_del_all(&free_ipc_list);
174	struct ipc_namespace *n, *t;
175
176	llist_for_each_entry_safe(n, t, node, mnt_llist)
177		mnt_make_shortterm(n->mq_mnt);
178
179	/* Wait for any last users to have gone away. */
180	synchronize_rcu();
181
182	llist_for_each_entry_safe(n, t, node, mnt_llist)
183		free_ipc_ns(n);
184}
185
186/*
187 * put_ipc_ns - drop a reference to an ipc namespace.
188 * @ns: the namespace to put
189 *
190 * If this is the last task in the namespace exiting, and
191 * it is dropping the refcount to 0, then it can race with
192 * a task in another ipc namespace but in a mounts namespace
193 * which has this ipcns's mqueuefs mounted, doing some action
194 * with one of the mqueuefs files.  That can raise the refcount.
195 * So dropping the refcount, and raising the refcount when
196 * accessing it through the VFS, are protected with mq_lock.
197 *
198 * (Clearly, a task raising the refcount on its own ipc_ns
199 * needn't take mq_lock since it can't race with the last task
200 * in the ipcns exiting).
201 */
202void put_ipc_ns(struct ipc_namespace *ns)
203{
204	if (ns_ref_put_and_lock(ns, &mq_lock)) {
205		mq_clear_sbinfo(ns);
206		spin_unlock(&mq_lock);
207
208		ns_tree_remove(ns);
209		if (llist_add(&ns->mnt_llist, &free_ipc_list))
210			schedule_work(&free_ipc_work);
211	}
212}
213
214static struct ns_common *ipcns_get(struct task_struct *task)
215{
216	struct ipc_namespace *ns = NULL;
217	struct nsproxy *nsproxy;
218
219	task_lock(task);
220	nsproxy = task->nsproxy;
221	if (nsproxy)
222		ns = get_ipc_ns(nsproxy->ipc_ns);
223	task_unlock(task);
224
225	return ns ? &ns->ns : NULL;
226}
227
228static void ipcns_put(struct ns_common *ns)
229{
230	return put_ipc_ns(to_ipc_ns(ns));
231}
232
233static int ipcns_install(struct nsset *nsset, struct ns_common *new)
234{
235	struct nsproxy *nsproxy = nsset->nsproxy;
236	struct ipc_namespace *ns = to_ipc_ns(new);
237	if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN) ||
238	    !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))
239		return -EPERM;
240
241	put_ipc_ns(nsproxy->ipc_ns);
242	nsproxy->ipc_ns = get_ipc_ns(ns);
243	return 0;
244}
245
246static struct user_namespace *ipcns_owner(struct ns_common *ns)
247{
248	return to_ipc_ns(ns)->user_ns;
249}
250
251const struct proc_ns_operations ipcns_operations = {
252	.name		= "ipc",
253	.get		= ipcns_get,
254	.put		= ipcns_put,
255	.install	= ipcns_install,
256	.owner		= ipcns_owner,
257};