1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/mount.h> 3 #include <linux/pseudo_fs.h> 4 #include <linux/file.h> 5 #include <linux/fs.h> 6 #include <linux/proc_fs.h> 7 #include <linux/proc_ns.h> 8 #include <linux/magic.h> 9 #include <linux/ktime.h> 10 #include <linux/seq_file.h> 11 #include <linux/user_namespace.h> 12 #include <linux/nsfs.h> 13 #include <linux/uaccess.h> 14 15 #include "internal.h" 16 17 static struct vfsmount *nsfs_mnt; 18 19 static long ns_ioctl(struct file *filp, unsigned int ioctl, 20 unsigned long arg); 21 static const struct file_operations ns_file_operations = { 22 .llseek = no_llseek, 23 .unlocked_ioctl = ns_ioctl, 24 }; 25 26 static char *ns_dname(struct dentry *dentry, char *buffer, int buflen) 27 { 28 struct inode *inode = d_inode(dentry); 29 const struct proc_ns_operations *ns_ops = dentry->d_fsdata; 30 31 return dynamic_dname(dentry, buffer, buflen, "%s:[%lu]", 32 ns_ops->name, inode->i_ino); 33 } 34 35 static void ns_prune_dentry(struct dentry *dentry) 36 { 37 struct inode *inode = d_inode(dentry); 38 if (inode) { 39 struct ns_common *ns = inode->i_private; 40 atomic_long_set(&ns->stashed, 0); 41 } 42 } 43 44 const struct dentry_operations ns_dentry_operations = 45 { 46 .d_prune = ns_prune_dentry, 47 .d_delete = always_delete_dentry, 48 .d_dname = ns_dname, 49 }; 50 51 static void nsfs_evict(struct inode *inode) 52 { 53 struct ns_common *ns = inode->i_private; 54 clear_inode(inode); 55 ns->ops->put(ns); 56 } 57 58 static void *__ns_get_path(struct path *path, struct ns_common *ns) 59 { 60 struct vfsmount *mnt = nsfs_mnt; 61 struct dentry *dentry; 62 struct inode *inode; 63 unsigned long d; 64 65 rcu_read_lock(); 66 d = atomic_long_read(&ns->stashed); 67 if (!d) 68 goto slow; 69 dentry = (struct dentry *)d; 70 if (!lockref_get_not_dead(&dentry->d_lockref)) 71 goto slow; 72 rcu_read_unlock(); 73 ns->ops->put(ns); 74 got_it: 75 path->mnt = mntget(mnt); 76 path->dentry = dentry; 77 return NULL; 78 slow: 79 rcu_read_unlock(); 80 inode = new_inode_pseudo(mnt->mnt_sb); 81 if (!inode) { 82 ns->ops->put(ns); 83 return ERR_PTR(-ENOMEM); 84 } 85 inode->i_ino = ns->inum; 86 inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode); 87 inode->i_flags |= S_IMMUTABLE; 88 inode->i_mode = S_IFREG | S_IRUGO; 89 inode->i_fop = &ns_file_operations; 90 inode->i_private = ns; 91 92 dentry = d_alloc_anon(mnt->mnt_sb); 93 if (!dentry) { 94 iput(inode); 95 return ERR_PTR(-ENOMEM); 96 } 97 d_instantiate(dentry, inode); 98 dentry->d_fsdata = (void *)ns->ops; 99 d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry); 100 if (d) { 101 d_delete(dentry); /* make sure ->d_prune() does nothing */ 102 dput(dentry); 103 cpu_relax(); 104 return ERR_PTR(-EAGAIN); 105 } 106 goto got_it; 107 } 108 109 void *ns_get_path_cb(struct path *path, ns_get_path_helper_t *ns_get_cb, 110 void *private_data) 111 { 112 void *ret; 113 114 do { 115 struct ns_common *ns = ns_get_cb(private_data); 116 if (!ns) 117 return ERR_PTR(-ENOENT); 118 119 ret = __ns_get_path(path, ns); 120 } while (ret == ERR_PTR(-EAGAIN)); 121 122 return ret; 123 } 124 125 struct ns_get_path_task_args { 126 const struct proc_ns_operations *ns_ops; 127 struct task_struct *task; 128 }; 129 130 static struct ns_common *ns_get_path_task(void *private_data) 131 { 132 struct ns_get_path_task_args *args = private_data; 133 134 return args->ns_ops->get(args->task); 135 } 136 137 void *ns_get_path(struct path *path, struct task_struct *task, 138 const struct proc_ns_operations *ns_ops) 139 { 140 struct ns_get_path_task_args args = { 141 .ns_ops = ns_ops, 142 .task = task, 143 }; 144 145 return ns_get_path_cb(path, ns_get_path_task, &args); 146 } 147 148 int open_related_ns(struct ns_common *ns, 149 struct ns_common *(*get_ns)(struct ns_common *ns)) 150 { 151 struct path path = {}; 152 struct file *f; 153 void *err; 154 int fd; 155 156 fd = get_unused_fd_flags(O_CLOEXEC); 157 if (fd < 0) 158 return fd; 159 160 do { 161 struct ns_common *relative; 162 163 relative = get_ns(ns); 164 if (IS_ERR(relative)) { 165 put_unused_fd(fd); 166 return PTR_ERR(relative); 167 } 168 169 err = __ns_get_path(&path, relative); 170 } while (err == ERR_PTR(-EAGAIN)); 171 172 if (IS_ERR(err)) { 173 put_unused_fd(fd); 174 return PTR_ERR(err); 175 } 176 177 f = dentry_open(&path, O_RDONLY, current_cred()); 178 path_put(&path); 179 if (IS_ERR(f)) { 180 put_unused_fd(fd); 181 fd = PTR_ERR(f); 182 } else 183 fd_install(fd, f); 184 185 return fd; 186 } 187 EXPORT_SYMBOL_GPL(open_related_ns); 188 189 static long ns_ioctl(struct file *filp, unsigned int ioctl, 190 unsigned long arg) 191 { 192 struct user_namespace *user_ns; 193 struct ns_common *ns = get_proc_ns(file_inode(filp)); 194 uid_t __user *argp; 195 uid_t uid; 196 197 switch (ioctl) { 198 case NS_GET_USERNS: 199 return open_related_ns(ns, ns_get_owner); 200 case NS_GET_PARENT: 201 if (!ns->ops->get_parent) 202 return -EINVAL; 203 return open_related_ns(ns, ns->ops->get_parent); 204 case NS_GET_NSTYPE: 205 return ns->ops->type; 206 case NS_GET_OWNER_UID: 207 if (ns->ops->type != CLONE_NEWUSER) 208 return -EINVAL; 209 user_ns = container_of(ns, struct user_namespace, ns); 210 argp = (uid_t __user *) arg; 211 uid = from_kuid_munged(current_user_ns(), user_ns->owner); 212 return put_user(uid, argp); 213 default: 214 return -ENOTTY; 215 } 216 } 217 218 int ns_get_name(char *buf, size_t size, struct task_struct *task, 219 const struct proc_ns_operations *ns_ops) 220 { 221 struct ns_common *ns; 222 int res = -ENOENT; 223 const char *name; 224 ns = ns_ops->get(task); 225 if (ns) { 226 name = ns_ops->real_ns_name ? : ns_ops->name; 227 res = snprintf(buf, size, "%s:[%u]", name, ns->inum); 228 ns_ops->put(ns); 229 } 230 return res; 231 } 232 233 struct file *proc_ns_fget(int fd) 234 { 235 struct file *file; 236 237 file = fget(fd); 238 if (!file) 239 return ERR_PTR(-EBADF); 240 241 if (file->f_op != &ns_file_operations) 242 goto out_invalid; 243 244 return file; 245 246 out_invalid: 247 fput(file); 248 return ERR_PTR(-EINVAL); 249 } 250 251 static int nsfs_show_path(struct seq_file *seq, struct dentry *dentry) 252 { 253 struct inode *inode = d_inode(dentry); 254 const struct proc_ns_operations *ns_ops = dentry->d_fsdata; 255 256 seq_printf(seq, "%s:[%lu]", ns_ops->name, inode->i_ino); 257 return 0; 258 } 259 260 static const struct super_operations nsfs_ops = { 261 .statfs = simple_statfs, 262 .evict_inode = nsfs_evict, 263 .show_path = nsfs_show_path, 264 }; 265 266 static int nsfs_init_fs_context(struct fs_context *fc) 267 { 268 struct pseudo_fs_context *ctx = init_pseudo(fc, NSFS_MAGIC); 269 if (!ctx) 270 return -ENOMEM; 271 ctx->ops = &nsfs_ops; 272 ctx->dops = &ns_dentry_operations; 273 return 0; 274 } 275 276 static struct file_system_type nsfs = { 277 .name = "nsfs", 278 .init_fs_context = nsfs_init_fs_context, 279 .kill_sb = kill_anon_super, 280 }; 281 282 void __init nsfs_init(void) 283 { 284 nsfs_mnt = kern_mount(&nsfs); 285 if (IS_ERR(nsfs_mnt)) 286 panic("can't set nsfs up\n"); 287 nsfs_mnt->mnt_sb->s_flags &= ~SB_NOUSER; 288 } 289